memory_collect_written asks for every page a submit collects whether it is
in the captured ranges, and take_capture's texture shadow asks the same of
the texture storage, each with a binary search. The collections give their
pages in address order (collect_in walks hos_gpu_guest_ranges' sorted
ranges), so RangeWalk keeps a cursor that only moves forward: one pass over
the ranges for the scan. An address below the last one searches again, so
its answers are the search's in any order.

From King Kuranes' CP25.

Assisted-by: Claude Opus 5.5

@@ -671,0 +670,4 @@
+namespace {
+/// (longshot) Whether addresses asked in ascending order fall in sorted, disjoint [lo, hi) ranges: a cursor that only
+/// moves forward, one pass over the ranges for a whole scan, where a binary search for every page cost log2(ranges)
+/// compares each (the collections give their pages in address order: host/rx_backend.c's collect_in walks

@@ -671,0 +677,4 @@
+    size_t next = 0;   // (the first range that starts past the last address asked)
+    uint64_t last = 0;
+    bool in(uint64_t a) {
+        if (a < last) next = (size_t)(std::upper_bound(r.begin(), r.end(), std::make_pair(a, ~uint64_t(0))) - r.begin());

@@ -1974,9 +1985,10 @@ bool take_capture(std::unique_ptr<Capture> c, uint64_t value, uint64_t completed
             static thread_local std::vector<CopyPair> pairs;   // (the copies, made together once the slots are known)
             pairs.clear();
             size_t i = 0;
+            RangeWalk in_tex{tex_merged};   // (c->copied in address order too: a subset of c->pages)

@@ -0,0 +13,4 @@
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[1]

@@ -0,0 +46,4 @@
+
+static Ranges ranges(std::mt19937_64& rng, int n) {   // (sorted, disjoint, page-aligned, gaps between)
+    Ranges r;
+    uint64_t at = (rng() % 64) << 12;

@@ -0,0 +102,4 @@
+        long a = 0, b = 0;
+        const auto t0 = std::chrono::steady_clock::now();
+        for (int k = 0; k < 50; k++)
+            for (uint64_t p : pages) a += searched(r, p);