docs: retire the 2026-09-21 STATE.md snapshot

- remove the superseded flat state page; current state lives in
  STATE-CURRENT.md and the docs tree
- update the historical-material note in docs/README and the STATE-CURRENT
  header/see-also references

3 files changed, 6 insertions, 108 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index 7fe0291..64824b3 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -5,8 +5,8 @@
 > maintained outside this repository; the public known-knowns/unknowns document
 > is authoritative here:
 > [`docs/04-implementation/01-known-knowns-and-unknowns.md`](docs/04-implementation/01-known-knowns-and-unknowns.md).
-> The 2026-09-21 snapshot remains in [`STATE.md`](STATE.md) as a historical
-> record.
+> The former 2026-09-21 snapshot (`STATE.md`) is retired; its content remains
+> in the git history.
 
 ## Mission
 
@@ -252,7 +252,6 @@ device.
 - [`docs/03-architecture/08-physical-gpu-integration.md`](docs/03-architecture/08-physical-gpu-integration.md) - chosen execution backend (module-owned GPU + real GSP session)
 - [`docs/03-architecture/09-full-system-picture.md`](docs/03-architecture/09-full-system-picture.md) - visual end-to-end system map with status tags
 - [`docs/03-architecture/10-interaction-and-scheduling.md`](docs/03-architecture/10-interaction-and-scheduling.md) - cross-component interaction, queues, interrupts, scheduling detail
-- [`STATE.md`](STATE.md) - 2026-09-21 historical snapshot
 
 ---
 
diff --git a/STATE.md b/STATE.md
deleted file mode 100644
index 9ba13fc..0000000
--- a/STATE.md
+++ /dev/null
@@ -1,102 +0,0 @@
-> **Status: superseded (2026-09-21).** For current state see docs/04-implementation/01-known-knowns-and-unknowns.md and the project handoff. Kept as a historical record.
-
-# Open-IOV Project State
-
-*Last updated: 2026-09-21 (PM)*
-
-## Mission
-
-Run **unmodified NVIDIA guest drivers** in VMs with full GPU functionality
-(CUDA, graphics, video, AI/ML) on consumer/datacenter GPUs, without
-proprietary GRID licenses — via host-side GSP emulation in
-`open-iov-vfio.ko`.
-
-## Current milestone
-
-| Phase | Status |
-|-------|--------|
-| GSP 570.144 firmware decompilation (132 files, 12 RPC types) | ✅ Complete |
-| Refactor 1: GSP emulation engine (per-mdev thread, doorbell, shared mem, MSI-X) | ✅ Complete |
-| Refactor 2: PCI config space + BAR + MSI-X emulation | ✅ Complete |
-| Refactor 3: All 12 RPC types with emulation fallbacks | ✅ Complete |
-| Refactor 4: Portable architecture (fw analyzer, dynamic dispatcher, arch/version layers, YAML configs) | ✅ Complete |
-| Refactor 5: Guest driver integration (mdev creation, VFIO registration) | ✅ Unblocked, in test |
-| Refactor 6-11: CUDA / graphics / benchmarks / migration / Windows / hardening | ⏳ Pending |
-
-**Right now**: the **guest-probe hang root cause is found and fixed** (VFIO
-mmap garbage PFN → KVM EPT livelock — see below) plus a sweep of correctness
-fixes (mdev remove leaks, eventfd wiring, GSP shadow binding, RPC livelock).
-Guest driver **570.144 stock runfile installed** in the VM. The fixed module
-is built and pushed; it loads after the next host reboot (a leaked
-`gsp_emu` kthread from the pre-fix remove path pins the old module — rmmod
-would oops). Post-reboot: guest `nvidia.ko` probe → `nvidia-smi` → teardown
-regression → unit test → CUDA validation (`docs/05-operations/02-debugging-and-maintenance-workflows.md`; the historical checklist is summarised there).
-
-## Recently solved bugs
-
-| Bug | Root cause | Fix |
-|-----|-----------|-----|
-| `available_instances` stuck at 0, mdev create fails `-EUSERS` | mdev core's shared `parent->available_instances` counter leaked on crashed removes | `mdev_driver.get_available` callback computes availability from the driver's own device list (kernel/main.c) |
-| Module unload hang (`open_iov_vfio` stuck "Unloading") | Legacy `nv_vgpu_gsp_init()` booting physical GSP firmware, conflicting with host nvidia.ko; unload blocked in `cancel_work_sync` | Skip legacy GSP boot, use `gsp_emu_init()`; thread-stop via completion with 5s timeout; `cancel_work_sync` before `destroy_workqueue` |
-| mdev remove kernel panic (`vfio_device_group_unregister+0xa`) | NULL deref on VFIO group unregister | Defensive cleanup ordering in `nv_vgpu_mdev_remove()` |
-| mdev creation `EINVAL` (-22) | Double IOMMU group handling conflicted with `vfio_register_emulated_iommu_dev()` | Let VFIO create its own group; IOMMUFD emulated callbacks wired |
-| `Unknown symbol nvidia_vgpu_vfio_probe` | NVIDIA OpenRM built without `KBUILD_EXTRA_SYMBOLS` | Build order automated in `stack_manager.sh` (kernel → nvidia → userspace) |
-| `vfio 1: No such file or directory` | VFIO device registration is NOT automatic for mdev | `vfio_register_emulated_iommu_dev()` in probe, unregister in remove (Intel kvmgt pattern) |
-| Guest-visible PCI config space wrong | BAR types/offsets, subsystem ID offsets, MSI-X table size | Config space rewritten to match physical TU104 (BAR0 16MB 32-bit non-prefetch, BAR1 256MB 64-bit prefetch VRAM, BAR3 32MB; 32 MSI-X vectors; subsystem IDs at 0x2C/0x2E) |
-| **Guest driver probe hard-hangs whole VM (580 & 570.144)** | VFIO `mmap` used `virt_to_phys()` on `vzalloc`'d BAR0 shadow + ioremap'd BAR2/3 → garbage PFN → KVM `make_spte` reserved-bit WARN → EPT-violation livelock (diagnosed via QEMU GDB stub: one vCPU frozen on a single MMIO instruction) | BAR0 mapped per-page via `vmalloc_to_pfn()`; BAR2/3/4/5 map `bars[N].gpa` directly; `nv_vgpu_mmap_virt_to_pfn()` helper |
-| **GSP emulation thread never saw guest RPCs** | Engine polled the *host physical* BAR0 doorbell + a local `dma_alloc_wc` buffer; guest writes land in the vzalloc `bar0_shadow` | `gsp_emu_init` binds exclusively to `bar0_shadow` (doorbell/mailbox/PBA aliases); also stopped PBA writes corrupting the host GPU's physical BAR0+0x3000 |
-| **Guest never received MSI-X completions** | `SET_IRQS DATA_EVENTFD` handler discarded eventfds (`TODO` + `kfree`); `msix_trigger[]` all NULL; inject used an init-time (stale) copy | Full eventfd wiring: `eventfd_ctx_fdget` per vector, `-1` clears, close releases refs; inject looks up `vgpu->irqs[0].trigger` live |
-| **BAR_TRAP/MIGRATE RPC livelock** | dispatch → `gsp_rpc_submit_raw` rings the same doorbell the thread polls → self-triggered infinite loop + 2–30 s stalls | emulation-mode guards return `-ENOTSUPP` with `pr_warn_ratelimited` |
-| **mdev remove leaked everything** | remove never `list_del`'d (available_instances stuck), never ran cleanup (leaked `gsp_emu` kthread), never unregistered VFIO (leaked `/dev/vfio/N` + iommu group), never put pdev/freed struct | kvmgt-style remove: wait fds → `vfio_unregister_group_dev` → cleanup work → `list_del` → `pci_dev_put` → `vfio_put_device` |
-| `dma_map_page` IOVA corruption | 64-bit `dma_addr_t` stored in `int ret` (truncates ≥4 GB IOVAs under IOMMU) | dedicated `dma_addr_t iova` in `gsp_rpc_alloc_emul` |
-| config-space write returned `-1` (`SIZE_MAX`) | `while(count--)` wrap + bogus return expression; function was dead code while the live path did unfiltered byte copies | return fixed; VFIO write handler now routes through the per-register filter (guest can't rewrite vendor ID/BARs) |
-| Misleading `MODULE_SOFTDEP("pre: nvidia")` | module has zero nvidia imports (it *exports* `nvidia_vgpu_vfio_*`) | removed; load order is open-iov-vfio **before** nvidia.ko |
-| Kernel unit tests didn't build | written against a removed struct-based RPC API | rewritten to drive `gsp_emu_process_rpc()` with crafted mailbox messages; `depends: open-iov-vfio` |
-
-## Known open bugs / limitations
-
-- Guest `nvidia.ko` end-to-end probe not yet validated (fixed module loads
-  post-reboot; checklist in `docs/05-operations/02-debugging-and-maintenance-workflows.md`)
-- **Memory-model gap**: guest VRAM (BAR1) maps directly to physical BAR1 gpa,
-  but `gsp_rpc_alloc_emul` services ALLOC with host system pages — the two
-  are not unified; must be resolved before CUDA/DMA-heavy workloads
-  (`docs/03-architecture/06-host-module-and-hybrid-model.md`)
-- BAR_TRAP / MIGRATE RPCs fail fast with `-ENOTSUPP` in emulation mode
-  (guest's normal BAR access is direct MMIO; real handlers TODO)
-- `gsp_emu_process_rpc()` doesn't bump stats counters (only the kthread
-  path does) — cosmetic
-- WPR callback registration lacks kernel eventfd support
-  (`TODO` in driver/wpr — legacy guest-driver tree)
-- Migration WPR state save/restore incomplete
-- BAR `force_access` path not fully wired (unused-function warning)
-- Kernel `SCHEDULE` emulation returns success without real work submission
-  (userspace emulation works)
-- Async `NOTIFY` events not emulated in kernel (no eventfd/poll yet)
-- Single GPU validated so far: TU104 (RTX 2080 SUPER Mobile), GSP 570.144,
-  kernel 6.8.0-139-generic
-- Live migration protocol implemented (4-phase) but not yet validated
-- Windows guest not yet validated (automation scaffolding present)
-- MSI-X emulation has dual stores (guest-visible `bar0_shadow` table vs
-  `bar_emul_ctx.msix_table[]` used by the currently-unused trap path) —
-  documented in `docs/03-architecture/06-host-module-and-hybrid-model.md`; harmless with the
-  direct-mmap design
-
-## Reproducibility notes
-
-- NVIDIA base: `open-gpu-kernel-modules` tag **610.57.04** + patch series
-  in `legacy-patches/nvidia/` (re-brands version string to 570.144 to match the
-  GSP firmware ABI; adds the vGPU VFIO interface headers + symbol exports).
-- GSP firmware: `nvidia/tu102/gsp/gsp-570.144.bin` from
-  [linux-firmware.git](https://github.com/NVIDIA/linux-firmware)
-  (pin `2237b99e`), `.fwimage` section extracted with `objcopy`,
-  MD5 `13ce12a392a31eeb79a2e6ebd3a4a93a`. `install.sh` does this.
-- Firmware blobs, decompiled output, NVIDIA tree, VM images, Ghidra DBs and
-  local VM wrappers are intentionally **not** tracked in git.
-- Fresh-system bring-up: `./install.sh` (see README.md).
-
-## Hardware/software reference environment
-
-- Host GPU: NVIDIA RTX 2080 SUPER Mobile (TU104, PCI `10de:1ed3`)
-- Host OS: Ubuntu, kernel 6.8.0-139-generic
-- Guest OS: Ubuntu 24.04.5 LTS (QEMU/KVM, q35, OVMF)
-- GSP firmware: 570.144 (RV64IMAC, base `0x04000000`)
diff --git a/docs/README.md b/docs/README.md
index 81f02c8..284ca76 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -193,9 +193,10 @@ The pre-reboot flat documents have been merged into this tree and removed
   [`04-implementation/02-practical-challenges-and-adversarial-interop.md`](04-implementation/02-practical-challenges-and-adversarial-interop.md)
   and [`06-portability/hardware-software-matrix.md`](06-portability/hardware-software-matrix.md).
 
-What remains historical is the pre-supersession wiki material, `old/ARCHITECTURE.md`,
-and [`../STATE.md`](../STATE.md) (a 2026-09-21 snapshot); their status banners
-name the canonical document.
+What remains historical is the pre-supersession wiki material and
+`old/ARCHITECTURE.md`; their status banners name the canonical document. (The
+former 2026-09-21 `STATE.md` snapshot is retired; its content lives on in the
+git history and its replacements above.)
 
 ## 5. What makes Open-IOV different?