STATE-CURRENT: full driver-API smoke test passes with payload 64/64

- milestone: cuCtxCreate through cuCtxDestroy with correct data roundtrip
- GMMU walk decode fixed (real entry encoding); DtoH copy-engine-on-compute
  allowed for trusted injected pushes
- ladder/diagrams/rails updated; next rung is real CUDA workloads

1 files changed, 30 insertions, 29 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index 237eba6..5481313 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -1,6 +1,6 @@
 # Open-IOV Current State
 
-> **Snapshot: 2026-09-30 06:45.** This is a dated public status page, not live
+> **Snapshot: 2026-09-30 08:58.** This is a dated public status page, not live
 > state; it is refreshed on every progress check. Live working notes are
 > maintained outside this repository; the public known-knowns/unknowns document
 > is authoritative here:
@@ -29,8 +29,8 @@ meant to execute on the physical GPU.
 | `nvidia-smi -L` enumerates the emulated TU104 | ✅ |
 | CUDA userspace: `cuInit`, `cuDeviceGetCount`, `cuDeviceGet` | ✅ |
 | `cuCtxCreate` returns | ✅ (the whole smoke test now completes) |
-| `cuMemAlloc` + `cuMemcpy` roundtrip (`ALL OK` in the smoke test) | 🟡 all calls succeed and the test prints `ALL OK`; the 64-byte data roundtrip is not yet correct |
-| Full `nvidia-smi` output | ❌ (faults on the CUDA path) |
+| `cuMemAlloc` + `cuMemcpy` roundtrip (`ALL OK` in the smoke test) | ✅ payload roundtrip verified 64/64 in the guest |
+| Full `nvidia-smi` output | ❌ next: run real CUDA workloads in the guest |
 | CUDA kernel execution (`vectorAdd`) | ❌ not started (forwarding layer absent) |
 | Graphics (3D), video | ❌ |
 | Faults, multi-version, Windows, migration, multi-tenancy, performance | ❌ |
@@ -43,20 +43,20 @@ chain succeeds.
 
 ## Right now (frontier)
 
-- **The smoke test now completes end-to-end**: `cuInit -> cuDeviceGet ->
-  cuCtxCreate -> cuMemAlloc -> cuMemcpyHtoD -> cuMemcpyDtoH -> cuMemFree ->
-  cuCtxDestroy` all succeed and the test prints `ALL OK`. The context-creation
-  error that stalled this for days is root-caused and fixed: the emulated GR
-  information table left the shader-pipe count and related clock fields zero,
-  which the client's clock-table validation rejected.
-- **The payload's host-to-device path is found**: the copy is a
-  compute-class inline-data DMA (the payload rides inside the push itself),
-  not a copy-engine transfer. The decoder now recognises the method set and
-  attempts the write. The remaining blocker is the destination's
-  GPU-virtual-address translation: the emulated page-table walk has never
-  resolved entries (every translation so far came from pins or the discovery
-  map), so the write cannot land yet. The live page-directory writes are
-  being audited to fix the walk.
+- **The full CUDA driver-API smoke test passes with correct data**: the client
+  completes `cuCtxCreate -> cuMemAlloc -> cuMemcpyHtoD -> cuMemcpyDtoH ->
+  cuMemFree -> cuCtxDestroy` and prints `ALL OK`, with the 64-byte payload
+  roundtripping exactly (64/64 verified in the guest).
+- **The last two walls**: the GPU page-table walk's address decode (child
+  pointers and leaves were 16x too low; fixed with the real entry encoding -
+  walks now succeed at scale) and the device-to-host copy (a copy-engine
+  class transfer bound on a compute channel whose work was denied by the
+  engine-type gate; trusted host-injected pushes may now execute copy-engine
+  work as well).
+- **Next: run a real CUDA workload in the guest** (`nvidia-smi`, a
+  `vectorAdd`-style kernel launch) and iterate on whatever the runtime path
+  asks for - this moves the frontier toward kernel execution, which still
+  requires the execution backend.
 - Recap of the fixes behind this point: all 20/20 compute-channel releases
   land (three decode paths routed to the exact counter slot); registration
   delivers the incrementing tracking release for every consumed submission;
@@ -64,9 +64,8 @@ chain succeeds.
   the copy-engine decoder consults pinned translations before the scanned
   map, so every push-data operation executes (`memset=19473`, `ringops=10551`
   live).
-- Active work: audit the live page-directory writes to fix the page-table
-  walk, so the inline write (and then the device-to-host copy) resolves
-  client device addresses; iterate with a fresh boot per run.
+- Active work: run a real CUDA workload in the guest (`nvidia-smi`, a kernel
+  launch) and iterate on the runtime path; iterate with a fresh boot per run.
 - Observability: a size-keyed copy watch, a VRAM shadow dump/search, and an
   operation log are now module parameters, and the test's output survives
   guest-agent stalls via the serial console.
@@ -119,18 +118,19 @@ Status tags: `[done]`, `[frontier]` (actively worked), `[partial]`,
         |                                                  GR + CE channels; push buffers
         |                                                  semaphore pool; completion counters
         v
- [partial] --------------------------------------------->  cuMemAlloc + cuMemcpy roundtrip
-        |                                                  (all calls succeed; payload data path pending)
- [not yet] --------------------------------------------->  full nvidia-smi output
+ [done] ------------------------------------------------>  cuMemAlloc + cuMemcpy roundtrip
+        |                                                  (passes end-to-end; payload 64/64 correct)
+ [not yet] --------------------------------------------->  full nvidia-smi output / kernel launch
 ```
 
 Work execution (host service vs client synchronization):
 
 ```
- [partial] host decodes guest pushes (method streams): memsets, copies, releases
-           - CE pushes execute at scale (memset=19473, ringops=10551; misses at zero)
-           - the 64-byte test payload's HtoD path is not decoded yet
- [partial] GPU VA -> guest PA translation and pinning; server-owned page tables in progress
+ [done] host decodes guest pushes (method streams): memsets, copies, releases
+           - CE pushes execute at scale; the compute-class inline-DMA HtoD and
+             the copy-engine-on-compute DtoH both execute; payload 64/64
+ [partial] GPU VA -> guest PA translation: page-table walk fixed and succeeding;
+           server-owned page-table population still in progress
  [not yet] real work forwarded to the physical GPU (host-RM proxy or direct submission)
  [not yet] correct results (vectorAdd)
 ```
@@ -153,8 +153,9 @@ Recent chain of walls removed (2026-09-28 to 2026-09-30):
    -> deterministic chain solved -> pin-drop and release-push fixes
    -> copy-engine data path executes -> compute-window pinning
    -> registration release delivery -> 20/20 counter slots -> GR-info clock fix
-   -> cuCtxCreate OK and the full smoke test ALL OK; payload data path remains
-   -> payload found (compute-class inline DMA) -> page-table walk audit
+   -> cuCtxCreate OK; payload found (compute-class inline DMA)
+   -> GMMU walk decode fixed (child/leaf encoding) -> inline HtoD lands
+   -> DtoH copy-engine-on-compute allowed -> payload roundtrip 64/64
 ```
 
 ## Tools, code paths and fixes behind this progress