wiki: 2026-11-10 afternoon refresh - first real GPU readback; direct-GL/window walls

Refresh STATE-CURRENT, the Main Page and the status/frontier pages: the DDX
3D replay executes and a guest pbuffer glClear+glReadPixels returns a red
pixel (ff0000ff); the RM write-lock holder (Xorg in the DDX scrub wait) is
fixed in df6e71bb. The direct-GL client channel still emits only setup/notify
kicks (ops_runs=0), a window draw wedges X, and X startup/RM stability plus
the DDX 4 GB sysmem allocation remain. Published to open-iov.org.

14 files changed, 230 insertions, 200 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index 79154d3..7c43dea 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -1,5 +1,45 @@
 # Open-IOV Current State
 
+> **Snapshot: 2026-11-10 ~16:45 (SESSION 156 continued; HEAD `df6e71bb`,
+> tree has in-flight kernel/tool work; supersedes the 06:10 entry below).**
+> The **first real GPU readback** landed: a guest
+> `glClear(red)+glFinish+glReadPixels` pbuffer probe returned
+> `rc=0 err=0x0 pixel=ff0000ff` (r1734), with the host logging
+> `section captured` plus `GR LAUNCH submitted` on the DDX channel
+> `0x1000014`. That proves the emulated path can render and read back through
+> the unmodified guest driver. The RM write-lock holder was identified as
+> Xorg in the DDX vidheap scrub wait (NVOS32 `ALLOC_SIZE` 0xa0000, spinning
+> on `vmap+0x6c004`); `df6e71bb` authors the all-ones release pair for a
+> scanner-registered scrub buffer with no USERD GP_PUT, which released the
+> lock and made the readback work.
+>
+> Still open: the direct-GL client channel `0xbfef0002` opens a C597 section
+> but emits only 32/64-byte setup/notify kicks (`ops_runs=0`, `section
+> captured`/`GR LAUNCH` 0) - the GL draws never reach the host. A synchronous
+> window draw wedges X (`xwd -root` writes 0 bytes) while the pbuffer probe
+> works, so screen capture must use the ivshmem frame path. X startup remains
+> a lottery (`Failed to initialize DMA` / push-buffer `0x51` / occasional
+> vmalloc 96 GB) and X can die after forward activity. No non-black screen
+> pixels yet. Milestone position: between M-GL1 and M-GL2; the readback pixel
+> is execution proof, not a screen frame.
+>
+> Walls ranked: (1) direct-GL draw submission/capture on `0xbfef0002`;
+> (2) window/screen present and X stability; (3) X startup/RM degradation
+> (`0x51`); (4) the DDX 4 GB sysmem allocation/OOM (12 GB guest); (5)
+> non-black screen frames and sustained rate.
+>
+> CUDA front unchanged (backgrounded while graphics holds the device; its
+> 10-30 status stands): `41343c63` green (`victory_mail` `VADD bad=0` +
+> `STATUS OK`; `vecadd_loop` 100 launches PASS); the fresh-boot battery's
+> red class is D2H-stage with release-discipline fixes staged; the SESSION
+> 143 Vulkan fence regression is not re-measured.
+>
+> Live at check (read-only): host up ~42 h (fresh boot 2026-11-08 22:29);
+> `vgsp` loaded + live cycle (QEMU 128357, mdev
+> `c949938a-0391-4aa0-8d49-1679878fe5cd`); `tree` has the campaign's in-flight
+> kernel/tool work (HEAD `df6e71bb`); pstore empty; no reboot during the
+> check.
+>
 > **Snapshot: 2026-11-10 ~06:10 (SESSION 156 continued; HEAD `bb802909`,
 > tree has in-flight kernel work from the campaign; supersedes the 05:30
 > entry below).**
diff --git a/tools/site/pages/Main-Page.wiki b/tools/site/pages/Main-Page.wiki
index c29e5c1..f3fb52a 100644
--- a/tools/site/pages/Main-Page.wiki
+++ b/tools/site/pages/Main-Page.wiki
@@ -36,7 +36,7 @@ The only new component is one host kernel module (<code>vgsp.ko</code>), which i
 |-
 | Display and KMS (nvidia-modeset/NvKms, /dev/dri, X) || Working — the emulated display engine serves the modeset push buffers and notifier completion; NvKms registers, X settles and glxinfo reports OpenGL 4.6.0 with direct rendering
 |-
-| 3D graphics: Xorg + OpenGL, Vulkan || In progress — the display/KMS and GL stacks run, the direct GL client's GR/CE channels submit and retire, the GSP event-IRQ fix completes swaps, X is reliable, and the guest's real GL draws now forward and execute on the physical GPU; the 2D path is green. The draw still writes 0 pixels: the beef GR ring resolution, the fixed-CB image's zero MVP block and the render-target bind are the current frontier — see [[Graphics Execution]], [[OpenGL]], [[Vulkan]]
+| 3D graphics: Xorg + OpenGL, Vulkan || In progress — the display/KMS and GL stacks run, the 2D path is green, the DDX 3D replay executes, and the first real GPU readback is proven (pbuffer red pixel). The direct-GL client channel still emits only setup/notify kicks and a window draw wedges X, so direct-GL draw capture and the window/screen present are the current frontier — see [[Graphics Execution]], [[OpenGL]], [[Vulkan]]
 |-
 | Windows guests, multi-tenancy, migration, performance || Not yet — multiple mediated devices (different emulated VRAM sizes) and multiple guests already coexist; per-guest execution isolation is in progress
 |}
diff --git a/wiki/.publish-manifest.json b/wiki/.publish-manifest.json
index 7d7d30c..74759ce 100644
--- a/wiki/.publish-manifest.json
+++ b/wiki/.publish-manifest.json
@@ -64,11 +64,11 @@
  },
  "FAQ": {
   "file": "FAQ.wiki",
-  "new_revid": 24085,
-  "old_revid": 24073,
-  "source_sha": "a3695d0713019777",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:38Z",
+  "new_revid": 24097,
+  "old_revid": 24085,
+  "source_sha": "a249bba8af80cd8e",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:55Z",
   "title": "FAQ"
  },
  "GMMU Multi-Tenant Protection": {
@@ -127,11 +127,11 @@
  },
  "Graphics Execution": {
   "file": "Graphics-Execution.wiki",
-  "new_revid": 24086,
-  "old_revid": 24074,
-  "source_sha": "d10808a904df291e",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:38Z",
+  "new_revid": 24098,
+  "old_revid": 24086,
+  "source_sha": "a6bc3db0939616d9",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:56Z",
   "title": "Graphics Execution"
  },
  "Guest Driver Lifecycle: A Field Guide": {
@@ -190,11 +190,11 @@
  },
  "Main Page": {
   "file": "Main-Page.wiki",
-  "new_revid": 24094,
-  "old_revid": 24082,
-  "source_sha": "da191925550b19fa",
-  "summary": "2026-11-10 morning refresh: X reliable, GL draws execute on the physical GPU; beef-ring/CB/render-target are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:46Z",
+  "new_revid": 24106,
+  "old_revid": 24094,
+  "source_sha": "255b09c45c397709",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback; direct-GL draw capture and window/screen present are the frontier",
+  "timestamp": "2026-11-10T21:41:07Z",
   "title": "Main Page"
  },
  "MediaWiki:Sidebar": {
@@ -226,11 +226,11 @@
  },
  "OpenGL": {
   "file": "OpenGL.wiki",
-  "new_revid": 24088,
-  "old_revid": 24076,
-  "source_sha": "1439d7e61bb4afde",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:39Z",
+  "new_revid": 24100,
+  "old_revid": 24088,
+  "source_sha": "4c5dbee20ce762fe",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:57Z",
   "title": "OpenGL"
  },
  "Performance": {
@@ -244,38 +244,38 @@
  },
  "Physical GPU Backend and Guest Wiring": {
   "file": "Physical-GPU-Backend.wiki",
-  "new_revid": 24089,
-  "old_revid": 24077,
-  "source_sha": "104da451cf4a4654",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:40Z",
+  "new_revid": 24101,
+  "old_revid": 24089,
+  "source_sha": "f366ffcfd0513e04",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:58Z",
   "title": "Physical GPU Backend and Guest Wiring"
  },
  "Project Goals": {
   "file": "Project-Goals.wiki",
-  "new_revid": 24090,
-  "old_revid": 24078,
-  "source_sha": "245994b5a1df60aa",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:41Z",
+  "new_revid": 24102,
+  "old_revid": 24090,
+  "source_sha": "62e47d7d23cb7cc3",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:58Z",
   "title": "Project Goals"
  },
  "Project Plan": {
   "file": "Project-Plan.wiki",
-  "new_revid": 24091,
-  "old_revid": 24079,
-  "source_sha": "4a9d126b6cb4e391",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:41Z",
+  "new_revid": 24103,
+  "old_revid": 24091,
+  "source_sha": "f771eb3323903178",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:59Z",
   "title": "Project Plan"
  },
  "Project Status": {
   "file": "Project-Status.wiki",
-  "new_revid": 24092,
-  "old_revid": 24080,
-  "source_sha": "098085f72e17533f",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:42Z",
+  "new_revid": 24104,
+  "old_revid": 24092,
+  "source_sha": "ec76c4f58530952c",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:59Z",
   "title": "Project Status"
  },
  "RPC Message Format": {
@@ -289,11 +289,11 @@
  },
  "System Overview": {
   "file": "System-Overview.wiki",
-  "new_revid": 24093,
-  "old_revid": 24081,
-  "source_sha": "e0e0596d01be29f2",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:42Z",
+  "new_revid": 24105,
+  "old_revid": 24093,
+  "source_sha": "3317be0a59ba72cd",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:41:00Z",
   "title": "System Overview"
  },
  "Template:About message": {
@@ -325,11 +325,11 @@
  },
  "The Execution Frontier": {
   "file": "Execution-Frontier.wiki",
-  "new_revid": 24083,
-  "old_revid": 24071,
-  "source_sha": "0c7c530a98d2500a",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:37Z",
+  "new_revid": 24095,
+  "old_revid": 24083,
+  "source_sha": "b66f76919923080a",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:54Z",
   "title": "The Execution Frontier"
  },
  "The Guest Stack and CUDASW": {
@@ -343,20 +343,20 @@
  },
  "The Host Module (vgsp.ko)": {
   "file": "Host-Module.wiki",
-  "new_revid": 24087,
-  "old_revid": 24075,
-  "source_sha": "4fd9d5ce2f854c52",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:39Z",
+  "new_revid": 24099,
+  "old_revid": 24087,
+  "source_sha": "24e5342d41ff772c",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:56Z",
   "title": "The Host Module (vgsp.ko)"
  },
  "The vGSP Execution Plane (vEP)": {
   "file": "Execution-Plane.wiki",
-  "new_revid": 24084,
-  "old_revid": 24072,
-  "source_sha": "3a5417132a0616d9",
-  "summary": "2026-11-10 morning refresh: X reliable on attempt 1, GR backend timeout=0; beef-ring resolution, fixed-CB MVP and render-target bind are the 0-pixel walls",
-  "timestamp": "2026-11-10T11:03:37Z",
+  "new_revid": 24096,
+  "old_revid": 24084,
+  "source_sha": "27898c25eb230b57",
+  "summary": "2026-11-10 afternoon refresh: first real GPU readback (pbuffer red pixel); direct-GL draw capture and window/screen present are the walls",
+  "timestamp": "2026-11-10T21:40:55Z",
   "title": "The vGSP Execution Plane (vEP)"
  },
  "UVM in the Guest": {
diff --git a/wiki/Execution-Frontier.md b/wiki/Execution-Frontier.md
index d90fdd7..2dd70ae 100644
--- a/wiki/Execution-Frontier.md
+++ b/wiki/Execution-Frontier.md
@@ -14,7 +14,7 @@
 > [`../docs/04-implementation/03-execution-frontier.md`](../docs/04-implementation/03-execution-frontier.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`.
+Status: 2026-11-09, tree `master @ df6e71bb`.
 Tags: `[live]` observed; `[wip]` partial; `[wall]` current blocker; theories
 are labelled as such.
 
@@ -103,11 +103,11 @@ OpenGL 4.6.0 with direct rendering, and the X DDX waits are fixed
 release applied); the direct GL client's GR and CE channels submit and retire,
 and the X DDX kick channel is decoded. GZDoom reached `MAP01` once the DDX
 push-buffer loop was unblocked, but on Mesa llvmpipe — not the emulated vGPU.
-What is missing is **rendered pixels through the NVIDIA path**: the GSP
-event-IRQ fix completes swaps, the 2D path is green end-to-end, X is reliable,
-and the guest's real GL draws forward and execute on the physical GPU, but the
-draw writes 0 pages. The beef GR ring resolution race, the fixed-CB image's
-zero `0x80` MVP block and the render-target bind are the named walls. The
+What is missing is **screen pixels through the NVIDIA path**: the 2D path is
+green, the DDX 3D replay executes, and the first real GPU readback landed
+(pbuffer `pixel=ff0000ff`), but the direct-GL client still emits only
+setup/notify kicks (`ops_runs=0`) and a synchronous window draw wedges X. The
+direct-GL draw capture and the window/screen present are the named walls. The
 guest Vulkan pipeline's inline-to-memory upload arm is its gap. The full
 picture lives on [`Graphics-Execution.md`](Graphics-Execution.md).
 
@@ -166,13 +166,12 @@ different emulated VRAM sizes and multiple guests coexist at the device level
 CUDA guests is in progress.
 
 **Issue D — the graphics pixel frontier.** The display/KMS stack and the GL
-client now run end to end (NvKms registers, X settles, GL 4.6, direct-GL
-channels submit and retire, the X DDX waits are fixed, X is reliable, and the
-guest's real GL draws forward and execute on the physical GPU); but the draw
-writes 0 pages and no rendered (non-black) frame has been produced yet. The
-beef GR ring resolution, the fixed-CB image's zero MVP block and the
-render-target bind are the named blockers
-([`Graphics-Execution.md`](Graphics-Execution.md)).
+client now run end to end (NvKms registers, X settles, GL 4.6, the DDX 3D
+replay executes, and the first real GPU readback returns a red pbuffer
+pixel); but the direct-GL client still emits only setup/notify kicks
+(`ops_runs=0`), a window draw wedges X, and no non-black screen frame has
+been produced. The direct-GL draw capture and the window/screen present are
+the named blockers ([`Graphics-Execution.md`](Graphics-Execution.md)).
 
 ## 6. Lines of investigation (live)
 
diff --git a/wiki/Execution-Plane.md b/wiki/Execution-Plane.md
index a48af30..03a739a 100644
--- a/wiki/Execution-Plane.md
+++ b/wiki/Execution-Plane.md
@@ -8,7 +8,7 @@
 > when the two disagree, the docs tree wins. Front door:
 > [`../docs/README.md`](../docs/README.md).
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` proven with the
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented, default-off or parameter-gated;
 `[wip]` partial; `[wall]` current blocker; `[target]` named success latch;
 `[planned]` designed, not built.
@@ -149,11 +149,13 @@ guest: push + QMD + GPFIFO entry + doorbell (BAR0 0x88704)
   buffers plus the notifier/`UPDATE` completion, class-aware arm), so NvKms
   registers, X settles and GL 4.6 is live, the X DDX waits are fixed, and
   the guest's real GL draws now forward and execute on the physical GPU
-  (`backend_ok=5-7`, `backend_timeout=0`); X is reliable and the 2D path is
-  green. No rendered (non-black) frame has been produced through the NVIDIA
-  path yet: the beef GR ring resolution race, the fixed-CB image's zero MVP
-  block and the render-target bind are the named blockers. The lanes and the
-  ladder are on [`Graphics-Execution.md`](Graphics-Execution.md).
+  (`backend_ok=5-7`, `backend_timeout=0`); the DDX 3D replay executes, the 2D
+  path is green, and the first real GPU readback landed (pbuffer red pixel).
+  No non-black **screen** frame has been produced through the NVIDIA path
+  yet: the direct-GL client emits only setup/notify kicks and a window draw
+  wedges X, so the direct-GL draw capture and the window/screen present are
+  the named blockers. The lanes and the ladder are on
+  [`Graphics-Execution.md`](Graphics-Execution.md).
 
 ## 6. Portability
 
diff --git a/wiki/FAQ.md b/wiki/FAQ.md
index 57782e7..e4361a6 100644
--- a/wiki/FAQ.md
+++ b/wiki/FAQ.md
@@ -5,7 +5,7 @@
 > [`../docs/09-reference/glossary-and-faq.md`](../docs/09-reference/glossary-and-faq.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`.
+Status: 2026-11-09, tree `master @ df6e71bb`.
 
 ## Project and positioning
 
@@ -40,17 +40,16 @@ progress). This is the project's known status, not a misconfiguration — see
 Partially, and it is an active frontier. The display/KMS stack and the X
 server now run on the emulated vGPU with the stock driver: nvidia-modeset/NvKms
 registers (`/dev/dri`), `glxinfo` reports OpenGL 4.6.0 with direct rendering,
-the direct GL client's GR and CE channels submit and retire, and the GSP
-event-IRQ fix completes swaps. X is green on attempt 1, the guest's **real GL
-draws forward and execute on the physical GPU** (`work_gr backend_ok=5-7`,
-`backend_timeout=0`), and the 2D path is green end-to-end, but the frames are
-black: the replayed draw writes 0 pages because the beef GR ring does not
-resolve deterministically, the fixed-CB image's `0x80` MVP block is zero, and
-the render-target bind is unconfirmed. The guest Vulkan pipeline runs end to
-end (device → command buffer → fence → readback, frames black). These three
-plus the DDX's 4 GB sysmem allocation (12 GB guest workaround) are the
-current gates — see [`OpenGL.md`](OpenGL.md), [`Vulkan.md`](Vulkan.md) and
-[`Graphics-Execution.md`](Graphics-Execution.md).
+the 2D path is green and the DDX 3D replay executes; the **first real GPU
+readback** landed (a pbuffer `glClear(red)+glReadPixels` probe returns
+`pixel=ff0000ff`). The RM write-lock holder (Xorg in the DDX vidheap scrub
+wait) was identified and fixed (`df6e71bb`). The guest Vulkan pipeline runs
+end to end (device → command buffer → fence → readback, frames black). Screen
+pixels are still the wall: the direct-GL client channel `0xbfef0002` emits
+only setup/notify kicks (`ops_runs=0`), a synchronous window draw wedges X,
+and X startup/RM degradation (`0x51`) plus the DDX's 4 GB sysmem allocation
+(12 GB guest workaround) remain — see [`OpenGL.md`](OpenGL.md),
+[`Vulkan.md`](Vulkan.md) and [`Graphics-Execution.md`](Graphics-Execution.md).
 
 **How fast is it?**
 No published numbers yet. Kernel launches execute on the physical engine;
diff --git a/wiki/Graphics-Execution.md b/wiki/Graphics-Execution.md
index ca04b8f..1cdb15f 100644
--- a/wiki/Graphics-Execution.md
+++ b/wiki/Graphics-Execution.md
@@ -12,7 +12,7 @@
 > [`../docs/04-implementation/04-real-render-walls.md`](../docs/04-implementation/04-real-render-walls.md)
 > (the measured walls); the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` observed end to
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` observed end to
 end; `[wip]` partially built; `[wall]` current blocker; `[target]` defined
 success state; `[planned]` designed, not built.
 
@@ -82,20 +82,15 @@ fidelity:
    faults across repeated launches. This proved engine-side dispatch before
    the verbatim lane existed. The program itself is still a development
    stand-in at this rung — execution proof, not pixels.
-3. **Forwarding the client's own pushes** `[wip]`. The GL client's own
-   channels now register, submit and retire: the direct-GL GR channel
-   (`0xbeef0100`) and its CE siblings (`0xbeef0101`/`0xbeef0102`) are
-   discovered, their rings and releases are decoded, and the X server's DDX
-   kick channel (`0xbfef0002`) is decoded from its ring head with its
-   class-2D notification authored. The X DDX waits are fixed (class-aware
-   display arm, `0x8000 -> 0` notification completion, decoded GL release
-   applied), forcing GLX selects `libnvidia-glcore`, and the event-IRQ fix
-   (`a478f0b4`) lets the guest service the completion, so glxgears completes
-   swaps and the guest's real GL draws now forward and execute on the
-   physical GPU (`work_gr backend_ok=5-7`, `backend_timeout=0`) and X is
-   reliable, but the draw still writes 0 pages. What remains is the beef GR
-   ring resolution race, the fixed-CB image's zero MVP block, and the
-   render-target bind (§6).
+3. **Forwarding the client's own pushes** `[wip]`. The X DDX channel
+   `0x1000014` executes its 3D replay (12 launches per cycle), the 2D path is
+   green, and a guest pbuffer `glClear(red)+glFinish+glReadPixels` probe
+   returns a real pixel (`pixel=ff0000ff`): the replay and readback machinery
+   works. The direct-GL client's own channel (`0xbfef0002` this cycle) opens
+   a C597 section but emits only 32/64-byte setup/notify kicks
+   (`ops_runs=0`), so its draws never reach the host; a synchronous window
+   draw also wedges X. That draw submission and the window/screen present are
+   what remains (§6).
 
 ## 4. The channel and object picture
 
@@ -146,10 +141,11 @@ DDX's reserve loop. For a windowed GL client the present is a kick; the GSP
 event-IRQ fix now sets the RISC-V SWGEN0 IRQSTAT/IRQMASK/IRQDEST and latches
 the CPU-tree leaf, so the guest services the event and glxgears completes
 swaps, and the GR backend no longer times out (the pair-close/pair-safe
-replay fixes are default ON; draws retire in 3-2400 ms). The next completion
-step is the beef GR ring (so the fixed-CB scan runs on every cycle) and the
-CB image (its `0x80` MVP block is zero even when the scan runs), then the
-render-target bind.
+replay fixes are default ON; draws retire in 3-2400 ms). The DDX 3D replay
+now renders and reads back a pbuffer pixel (`pixel=ff0000ff`), and the
+RM write-lock holder (Xorg in the DDX vidheap scrub wait) is fixed. The next
+step is the direct-GL client's draw submission/capture and the window/screen
+present path.
 
 During bring-up the module also carries a **diagnostics-only mirror** for apps
 that spin on a shared progress word; it exists so a run can proceed while the
@@ -158,33 +154,27 @@ requires it switched off, along with any external poke.
 
 ## 6. Where the frontier is (ranked walls)
 
-1. **Beef GR ring resolution** `[wall]`. `0xbeef0100` (the GL client GR
-   channel) registers with `vas=0` before its CE siblings publish
-   `0xbeef0300`; the shared VAS is then registered UNVERIFIED by the 1 ms
-   age-out, so the ring at `0x4020000` stays `ring_pa=0` and the fixed-CB scan
-   (gated to the `0xbeef0000` family) never runs. The next fix is to gate the
-   candidate promote on *verified* rather than *known* and retry every pump
-   turn.
-2. **The fixed-CB image MVP block** `[wall]`. Even on a cycle where the scan
-   runs (`r1687`), it decodes 1492 `0x3800` offsets plus 1497 `0x39c8` data
-   runs (1092 words) but the image's `0x80` MVP block is zero. Identified
-   parser bugs (subchannel bits 15:13, `0x238c` ONE_INC inline data, selector
-   B/C swap) are not yet applied; the MVP may live at an offset >= `0x1000` or
-   a selector B/C binding. With a zero MVP every vertex collapses to the
-   origin, so there are no fragments.
-3. **The render-target bind** `[wall]`. Confirm that the replayed draw's
-   render target is the page `bounce copy-out` compares
-   (`svc_surf_prelude_capture` currently picks the last trusted bind
-   globally).
+1. **Direct-GL draw submission/capture** `[wall]`. The GL client channel
+   `0xbfef0002` opens a C597 section but emits only 32/64-byte setup/notify
+   kicks (`ops_runs=0`; `section captured` and `GR LAUNCH` are 0). The DDX
+   channel `0x1000014` works (12 launches/cycle), so the gap is the
+   direct-GL client's submit path, not the replay machinery.
+2. **Window/screen present and X stability** `[wall]`. A synchronous window
+   GL draw wedges X (`xwd -root` writes 0 bytes; `XGetImage` never
+   completes), while the pbuffer probe works. Screen capture must use the
+   ivshmem frame path, and the X must survive the draw.
+3. **X startup / RM degradation** `[wall]`. X startup is a lottery
+   (`Failed to initialize DMA`, push-buffer `0x51`, occasional vmalloc
+   96 GB), and X can die after forward activity; a fresh cycle clears it.
 4. **The X DDX footprint** `[wall]`. The DDX allocates 4 GB of system pages at
    startup; an 8 GB guest has no headroom once GZDoom's own footprint lands
    and both are OOM-killed. Current runs use a 12 GB guest; the allocation is
    a suspected emulation gap (a 512 MiB emulated VRAM falling back to a 4 GB
    sysmem allocation) to fix.
-5. **Non-black frames and sustained rate** `[wall]`/`[target]`. Once the beef
-   ring, the CB image and the render-target bind land, the capture must show
-   motion, then 60 fps in one VM with no forcing, then two VMs on two mediated
-   devices with non-black frames in both.
+5. **Non-black screen frames and sustained rate** `[wall]`/`[target]`. Once
+   the direct-GL draw capture and the window/screen present land, the capture
+   must show motion, then 60 fps in one VM with no forcing, then two VMs on
+   two mediated devices with non-black frames in both.
 
 ## 7. What is proven today
 
@@ -199,27 +189,27 @@ requires it switched off, along with any external poke.
 | 2D path end-to-end: accelerated X fills read back via `xwd` | `[live]` |
 | Guest's real GL draws forward and execute on the physical GPU (`work_gr backend_ok=5-7`) | `[live]` |
 | GR backend timeouts fixed (`backend_timeout=0`; draws retire in 3-2400 ms) | `[live]` |
-| CB-DIAG decodes the draw's fixed-CB stream (1492 `0x3800` offsets, 1092 words) | `[live]` |
-| Beef GR channel `0xbeef0100` captures real GL draw sections | `[live]` |
+| DDX 3D replay executes (`section captured` + `GR LAUNCH` on `0x1000014`, 12 launches/cycle) | `[live]` |
+| First real GPU readback: pbuffer `glClear(red)+glReadPixels` -> `pixel=ff0000ff` | `[live]` |
+| RM write-lock holder identified (Xorg in the DDX vidheap scrub wait) and fixed (`df6e71bb`) | `[live]` |
 | GL section capture: the X channel's `0xC597` stream decoded | `[live]` |
 | Verbatim 3D method-stream replay retired by the engine (no MMU fault) | `[live]` |
 | Synthesized launch executes real `sm_75` SASS; Turing `V3` program header accepted | `[live]` |
 | X server survives the run on a 12 GB guest (the DDX's 4 GB sysmem allocation forces the size) | `[live]` |
-| Beef GR ring resolves deterministically; fixed-CB scan runs every cycle | `[wall]` |
-| Fixed-CB image's `0x80` MVP block becomes non-zero | `[wall]` |
-| Render-target bind matches the copy-out page | `[wall]` |
+| Direct-GL channel `0xbfef0002` submits a captured draw (`ops_runs>0`) | `[wall]` |
+| Window/screen present completes without wedging X (ivshmem frame path) | `[wall]` |
+| X startup/RM stability (`0x51`, vmalloc 96 GB) | `[wall]` |
 | NVIDIA Vulkan ICD creates a device | `[wall]` |
-| Non-black pixels from the emulated vGPU's 3D pipeline | `[wall]` |
+| Non-black screen pixels from the emulated vGPU's 3D pipeline | `[wall]` |
 | Windows/DirectX guests | `[planned]` |
 
 ## 8. What is not claimed
 
 * No non-black pixel has been produced by the emulated vGPU's 3D pipeline yet.
 * Display/KMS bring-up (NvKms, `/dev/dri`, X, a real GL context) is not a
-  rendered-frame claim; the guest's GL draws now execute on the physical GPU,
-  X is reliable and glxgears completes swaps, but the frames are black. The
-  beef GR ring resolution, the fixed-CB image's zero MVP block and the
-  render-target bind are the current walls.
+  rendered-frame claim. The first readback pixel is a pbuffer probe, not a
+  window/screen frame; the direct-GL client still emits only setup/notify
+  kicks, and a window draw wedges X. Those are the current walls.
 * No frame-rate or latency numbers: the scheduled measurement is defined
   (60 fps over 60 s, no forcing) but not yet met.
 * The `virgl`-based demo videos are a different, labelled path — not this one.
diff --git a/wiki/Host-Module.md b/wiki/Host-Module.md
index 7099beb..b1fd6a1 100644
--- a/wiki/Host-Module.md
+++ b/wiki/Host-Module.md
@@ -6,7 +6,7 @@
 > source: [`../docs/03-architecture/06-host-module-and-hybrid-model.md`](../docs/03-architecture/06-host-module-and-hybrid-model.md);
 > the docs tree wins on disagreement with this page.
 >
-> Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` observed with
+> Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` observed with
 > the stock guest driver; `[wip]` demonstrated live, being productized;
 > `[gated]` implemented default-off behind supervised gates; `[wall]` known
 > blocking limit; `[target]` designed, not built; `[planned]` roadmap.
@@ -109,8 +109,8 @@ plane. CE copies, release and fault relay are implemented default-off and
 verified live [gated]; forwarded guest CUDA launches execute on the engine
 with engine-authored completions relayed to the guest; the guest's real GL
 draws now forward and execute on the physical GR engine (`work_gr
-backend_ok=5-7`, `backend_timeout=0`), and graphics method streams execute in
-three shapes,
+backend_ok=5-7`, `backend_timeout=0`), the DDX 3D replay reads back a real
+pixel, and graphics method streams execute in three shapes,
 including the direct GL client's own GR/CE channels
 ([`Execution-Frontier.md`](Execution-Frontier.md),
 [`Graphics-Execution.md`](Graphics-Execution.md)).
@@ -125,11 +125,11 @@ nvidia-modeset/NvKms register (`/dev/dri`), X settle and GLX clients obtain a
 real GL context. The display-capability seam is parameterised. For the DDX's
 own 2D push buffers the remaining host levers are publishing/advancing the
 GPU-written engine get word and recycling the notifier to `0xffff` after
-completion. For a windowed GL client the GSP event-IRQ path raises the
-RISC-V SWGEN0 interrupt and latches the CPU-tree leaf so the guest services
-the event and completes swaps; the remaining GL gap is the beef GR ring
-resolution (so the fixed-CB scan runs), the fixed-CB image's zero MVP block
-and the render-target bind (the draw writes 0 pages).
+completion. The DDX 3D replay now renders and reads back a pbuffer pixel
+(`pixel=ff0000ff`), and the RM write-lock holder (Xorg in the DDX vidheap
+scrub wait) is fixed (`df6e71bb`). The remaining GL gap is the direct-GL
+client's draw submission/capture (`0xbfef0002` still emits only setup/notify
+kicks) and the window/screen present path, which currently wedges X.
 
 ## 6. Debug parameters
 
diff --git a/wiki/OpenGL.md b/wiki/OpenGL.md
index c499967..7445d12 100644
--- a/wiki/OpenGL.md
+++ b/wiki/OpenGL.md
@@ -12,7 +12,7 @@
 > [`../docs/03-architecture/02-guest-stack-and-cudasw.md`](../docs/03-architecture/02-guest-stack-and-cudasw.md)
 > (the guest stack). The docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` observed with the
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` observed with the
 stock guest driver; `[wip]` partial; `[wall]` current blocker; `[target]`
 defined success state.
 
@@ -80,17 +80,17 @@ Rated honestly, against the milestone ladder in the plan:
 | 2D path end-to-end: accelerated X fills read back via `xwd` | `[live]` |
 | Guest's real GL draws forward and execute on the physical GPU (`work_gr backend_ok=5-7`) | `[live]` |
 | GR backend timeouts fixed (`backend_timeout=0`; draws retire in 3-2400 ms) | `[live]` |
-| CB-DIAG decodes the draw's fixed-CB stream (1492 `0x3800` offsets, 1092 words) | `[live]` |
-| Beef GR channel `0xbeef0100` captures real GL draw sections | `[live]` |
+| DDX 3D replay executes (`section captured` + `GR LAUNCH` on `0x1000014`, 12 launches/cycle) | `[live]` |
+| First real GPU readback: pbuffer `glClear(red)+glReadPixels` -> `pixel=ff0000ff` | `[live]` |
+| RM write-lock holder identified (Xorg in the DDX vidheap scrub wait) and fixed (`df6e71bb`) | `[live]` |
 | Engine executes a launch built from the captured section (real `sm_75` SASS retired) | `[live]` |
 | Verbatim 3D method-stream replay retired by the engine, no MMU fault | `[live]` |
-| Direct GL client submits and retires its per-frame draws (GR `0xbeef0100`, CE `0xbeef0101`/`0xbeef0102`); DDX kick channel decoded | `[live]` |
 | X server survives the run on a 12 GB guest (the DDX's 4 GB sysmem allocation forces the size) | `[live]` |
-| Beef GR ring resolves deterministically; fixed-CB scan runs every cycle | `[wall]` |
-| Fixed-CB image's `0x80` MVP block becomes non-zero | `[wall]` |
-| Render-target bind matches the copy-out page | `[wall]` |
+| Direct-GL channel `0xbfef0002` submits a captured draw (`ops_runs>0`) | `[wall]` |
+| Window/screen present completes without wedging X (ivshmem frame path) | `[wall]` |
+| X startup/RM stability (`0x51`, vmalloc 96 GB) | `[wall]` |
 | NVIDIA Vulkan ICD creates a device | `[wall]` |
-| Non-black rendered frames through the emulated vGPU | `[wall]` |
+| Non-black screen rendered frames through the emulated vGPU | `[wall]` |
 | 60 fps sustained, no forcing (M-GL4) | `[target]` |
 
 ## 4. How OpenGL runs are verified
@@ -112,18 +112,18 @@ non-black through the mdev), M-GL4 (60 fps, no forcing), M-GL5 (two VMs, two
 mdevs), M-GL6 (split-screen video). The project sits **between M-GL1 and
 M-GL2**: the interface and execution work is done — the display/KMS stack
 registers, X settles, the client submits and retires its GR/CE channels, and
-the guest's GL draws forward and execute on the physical GPU and X is
-reliable. The remaining gates are the beef GR ring resolution, the fixed-CB
-image's zero MVP block, and the render-target bind before the first rendered
-frame.
+the first real GPU readback is proven (pbuffer `pixel=ff0000ff`). The
+remaining gates are the direct-GL client's draw submission/capture on
+`0xbfef0002` and the window/screen present path (a window draw currently
+wedges X) before the first rendered screen frame.
 
 ## 6. What is not claimed
 
 * No OpenGL frame from the emulated vGPU has produced real rendered pixels
-  yet; every capture so far is black. glxgears completes swaps and its GL
-  draws execute on the physical GPU, but the replayed draw still writes 0
-  pages: the beef ring, the fixed-CB image's zero MVP block and the
-  render-target bind are unresolved.
+  yet; every screen capture so far is black. The pbuffer probe renders and
+  reads back a red pixel, but the direct-GL client still emits only
+  setup/notify kicks, and a synchronous window draw wedges X. Those are the
+  current walls.
 * No frame-rate or latency numbers.
 * The published two-VM GZDoom demo videos used the labelled `virtio-gpu`/
   `virgl` path, not the emulated vGPU.
diff --git a/wiki/Physical-GPU-Backend.md b/wiki/Physical-GPU-Backend.md
index 240e8fe..181afa2 100644
--- a/wiki/Physical-GPU-Backend.md
+++ b/wiki/Physical-GPU-Backend.md
@@ -5,7 +5,7 @@
 > guest-facing emulation. Canonical sources: [`../docs/03-architecture/08-physical-gpu-integration.md`](../docs/03-architecture/08-physical-gpu-integration.md)
 > and [`../docs/03-architecture/11-physical-backend-guest-wiring.md`](../docs/03-architecture/11-physical-backend-guest-wiring.md); the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` proven with the
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented default-off; `[wip]` partially
 built; `[wall]` current blocker; `[target]` planned end state.
 
@@ -123,10 +123,10 @@ same machinery in three shapes (a verbatim 3D method-stream replay,
 synthesized launches, and the direct GL client's own GR/CE channels); the
 captured and synthesized streams execute on the engine, and the direct GL
 client's channels submit. The display/KMS stack registers, the X DDX waits are
-fixed, X is reliable and the guest's real GL draws forward and execute on the
-physical GPU, so the remaining graphics gates are the beef GR ring
-resolution, the fixed-CB image's zero MVP block and the render-target bind
-before rendered pixels. The remaining compute work is the staged-transfer
+fixed, X is reliable, the DDX 3D replay executes and the first real GPU
+readback is proven (pbuffer red pixel), so the remaining graphics gates are
+the direct-GL draw submission/capture and the window/screen present before
+non-black screen pixels. The remaining compute work is the staged-transfer
 class (under repair), the every-boot acceptance campaign, and per-guest
 execution isolation — see
 [`Execution-Frontier.md`](Execution-Frontier.md) and
diff --git a/wiki/Project-Goals.md b/wiki/Project-Goals.md
index 5842046..812ef3a 100644
--- a/wiki/Project-Goals.md
+++ b/wiki/Project-Goals.md
@@ -10,7 +10,7 @@
 > [`Execution-Frontier.md`](Execution-Frontier.md) and
 > [`Graphics-Execution.md`](Graphics-Execution.md).
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` working with the
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` working with the
 stock guest driver; `[wip]` in progress; `[planned]` designed, not built;
 `[target]` bring-up ahead; `[non-goal]` explicitly out of scope.
 
@@ -51,7 +51,7 @@ drivers, no license.**
 | Stock guest driver initialisation | The unmodified driver probes, initialises and enumerates as on bare metal (`nvidia-smi`) | `[live]` — TU104 reference platform |
 | Full CUDA driver-API surface | Context creation, allocation, copies, free, destroy complete with correct results | `[live]` — the driver-API smoke prints `ALL OK`; the 64-byte payload round-trips |
 | CUDA kernel execution on real hardware | Verified guest kernels execute on the physical GPU, with engine-authored completions waking the guest | `[live]` — vector-add, matrix-multiply and transformer clients green on fresh boots; the staged-transfer class, the every-boot acceptance campaign and per-guest isolation are in progress ([`Execution-Frontier.md`](Execution-Frontier.md)) |
-| OpenGL (3D graphics) | Stock guest GL applications render real pixels through the emulated vGPU | `[wip]` — the display/KMS stack and X run (NvKms registers, `glxinfo` OpenGL 4.6.0 direct), the direct GL client's GR/CE channels submit and retire, X is reliable, and the guest's real GL draws now forward and execute on the physical GPU (`backend_ok=5-7`); the 2D path is green, but the draw writes 0 pixels. The beef GR ring resolution, the fixed-CB image's zero MVP block and the render-target bind are the frontier ([`OpenGL.md`](OpenGL.md)) |
+| OpenGL (3D graphics) | Stock guest GL applications render real pixels through the emulated vGPU | `[wip]` — the display/KMS stack and X run (NvKms registers, `glxinfo` OpenGL 4.6.0 direct), the 2D path is green, the DDX 3D replay executes and the first real GPU readback is proven (pbuffer red pixel). Screen pixels remain the frontier: the direct-GL client channel `0xbfef0002` emits only setup/notify kicks, a window draw wedges X, and X startup/RM stability is not deterministic ([`OpenGL.md`](OpenGL.md)) |
 | Vulkan | Stock guest Vulkan applications render real pixels | `[wip]` — the pipeline runs end to end (device → command buffer → fence → readback); frames are black — program delivery and program-VA mapping are the frontier ([`Vulkan.md`](Vulkan.md)) |
 | Windows guests (DirectX, CUDA) | A stock WDDM driver and stock D3D/CUDA applications run in Windows guests | `[target]` — not started; same emulation target ([`DirectX.md`](DirectX.md)) |
 | Video (NVENC/NVDEC) | Encode/decode through the emulated device | `[planned]` |
diff --git a/wiki/Project-Plan.md b/wiki/Project-Plan.md
index 0361ed6..5694a77 100644
--- a/wiki/Project-Plan.md
+++ b/wiki/Project-Plan.md
@@ -15,7 +15,7 @@
 > [`../docs/06-portability/03-device-validation-and-porting-sequence.md`](../docs/06-portability/03-device-validation-and-porting-sequence.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[done]`, `[active]`,
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[done]`, `[active]`,
 `[ahead]` — the plan's own state vocabulary, distinct from the goal tags.
 
 ## 1. How the plan works
@@ -44,7 +44,7 @@ itself:
 |---|---|---|---|
 | **P0 — Platform** | Emulated vGPU device, GSP boot and GSP-RM emulation, stock guest driver initialisation | Driver-API smoke green (`ALL OK`) = evaluation rung 2 | `[done]` |
 | **P1 — First execution (compute)** | Guest CUDA kernels executing on the physical GPU, with engine-authored completions; then hardening | Verified clients + engine-authored completion = rung 3 core; hardening: staged-transfer class, every-boot acceptance, per-guest isolation | `[active]` — execution green; hardening in progress |
-| **P2 — Graphics execution** | OpenGL/Vulkan draw commands executed by the physical 3D pipeline and delivered as readable pixels | The graphics ladder: M-GL1 client context-init executes; M-GL2 `glxgears` non-black; M-GL3 GZDoom GL non-black through the mdev | `[active]` — between M-GL1 and M-GL2; the display/KMS and direct-GL channel work is live, X is reliable, and the guest's GL draws execute on the physical GPU; the beef GR ring resolution, the fixed-CB image's zero MVP block and the render-target bind are the walls |
+| **P2 — Graphics execution** | OpenGL/Vulkan draw commands executed by the physical 3D pipeline and delivered as readable pixels | The graphics ladder: M-GL1 client context-init executes; M-GL2 `glxgears` non-black; M-GL3 GZDoom GL non-black through the mdev | `[active]` — between M-GL1 and M-GL2; the display/KMS and DDX replay machinery work and the first real GPU readback is proven (pbuffer red pixel); the direct-GL draw capture, the window/screen present and X stability are the walls |
 | **P3 — Sustained and multi-tenant** | Frame rates without assistance; multiple VMs sharing the GPU with measured fairness; soak-stable operation | Graphics M-GL4 (60 fps, no forcing) and M-GL5 (two VMs, two mdevs); CUDA battery + soak; per-guest execution isolation = rungs 4/5 | `[ahead]` |
 | **P4 — Breadth** | Video (NVENC/NVDEC), Windows/DirectX guests, live migration, non-KVM hypervisor transports | Per-case bring-up gates plus the matrix's evidence expectations | `[ahead]` |
 | **P5 — Scale and portability** | New GPU generations and driver families carried forward; published performance programme | A profile + measured delta per version, validated on hardware; A/B numbers published per the measurement contract | `[ahead]` |
@@ -58,12 +58,12 @@ available (P5 runs across the whole plan).
 Ranked, in dependency order:
 
 1. **Graphics pixels (P2).** The client and display stacks execute, the
-   guest's GL draws forward and execute on the physical GPU, X is reliable,
-   and the 2D path is green; the named walls are the beef GR ring resolution
-   (the fixed-CB scan only runs when `0xbeef0100`'s ring resolves
-   deterministically), the fixed-CB image's zero `0x80` MVP block (parser
-   bugs identified), the render-target bind, and the DDX's 4 GB sysmem
-   allocation (12 GB guest workaround), then non-black frames. Full detail:
+   DDX 3D replay runs, and the first real GPU readback is proven (pbuffer
+   red pixel); the named walls are the direct-GL client's draw
+   submission/capture on `0xbfef0002` (setup/notify only, `ops_runs=0`), the
+   window/screen present path (a window draw wedges X), X startup/RM
+   stability (`0x51`), and the DDX's 4 GB sysmem allocation (12 GB guest
+   workaround), then non-black screen frames. Full detail:
    [`Graphics-Execution.md`](Graphics-Execution.md) §6.
 2. **Compute hardening (P1).** The staged-transfer class (failure modes proven,
    fixes in flight); the every-boot acceptance campaign; per-guest execution
@@ -81,10 +81,10 @@ bring-up (NvKms registers, X settles, GL 4.6); the UVM channel-pool tracker;
 the direct-GL GR release and CE ring discovery; the X DDX kick-channel decode
 and its three wait fixes (class-aware display arm, `0x8000 -> 0` notification
 completion, decoded GL release applied); the GSP event-IRQ fix that completes
-swaps; the X DMA-init fix (`ebf3130f`) that makes X green on attempt 1; the
-GR backend timeout fix (`backend_timeout=0`); the 2D path end-to-end; the
-guest's real GL draws forwarding and executing on the physical GPU
-(`backend_ok=5-7`); and the guest Vulkan pipeline running end to end.
+swaps; the X DMA-init fix (`ebf3130f`); the GR backend timeout fix
+(`backend_timeout=0`); the 2D path end-to-end; the DDX 3D replay and the
+first real GPU readback (pbuffer `pixel=ff0000ff`); the RM write-lock holder
+fix (`df6e71bb`); and the guest Vulkan pipeline running end to end.
 
 ## 4. The gates
 
diff --git a/wiki/Project-Status.md b/wiki/Project-Status.md
index 5115706..f153bb9 100644
--- a/wiki/Project-Status.md
+++ b/wiki/Project-Status.md
@@ -10,7 +10,7 @@
 > (the execution frontier). When this page and the docs disagree, the docs tree
 > wins.
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` proven with the
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented, default-off or behind supervised
 gates; `[wip]` partially implemented; `[wall]` current blocker; `[target]`
 named success state; `[planned]` designed, not built.
@@ -28,7 +28,7 @@ named success state; `[planned]` designed, not built.
 | Physical backend on real hardware (module-owned GPU running its real GSP-RM) | `[live]` boot, RPC session, object creation, copy-engine work and GR execution proven — the verified guest CUDA kernel clients execute through this backend, and graphics method streams execute on the engine ([`Graphics-Execution.md`](Graphics-Execution.md)) |
 | Display and KMS on the emulated vGPU (nvidia-modeset/NvKms, `/dev/dri`, X) | `[live]` in the campaign configuration — the emulated display engine serves the guest's display push-buffer channels (notifier plus `UPDATE -> FINISHED`), nvidia-modeset/NvKms registers (`/dev/dri/card0`, `renderD128`, `fb0`), `nvidia-smi -L` enumerates and X settles; the display-capability seam is parameterised ([`Graphics-Execution.md`](Graphics-Execution.md)) |
 | Multi-tenant isolation (mdev per VM, per-context page directories) | `[wip]` device-level coexistence works — multiple mediated devices with different emulated VRAM sizes and multiple guests coexist (two guests demonstrated); per-guest execution isolation for simultaneous CUDA guests is in progress |
-| OpenGL (3D graphics) | `[wip]` — the display/KMS stack registers, X settles and `glxinfo` reports OpenGL 4.6.0 with direct rendering; the GSP event-IRQ fix completes swaps, the 2D path is green end-to-end, and the guest's **real GL draws forward and execute on the physical GPU** (`work_gr backend_ok=5-7`, `backend_timeout=0`); the X DMA-init path is fixed (`ebf3130f`) so X is green on attempt 1 in three consecutive cycles. **No rendered pixels through the emulated vGPU yet:** the replayed draw writes 0 pages; the walls are the beef GR ring resolution race (the fixed-CB scan only runs on `0xbeef0100`, whose ring at `0x4020000` is unresolved), the fixed-CB image's `0x80` MVP block being zero (1092 words decoded; parser bugs identified), and the render-target bind matching the copy-out; the DDX's 4 GB sysmem allocation (12 GB guest) remains ([`OpenGL.md`](OpenGL.md)) |
+| OpenGL (3D graphics) | `[wip]` — the display/KMS stack registers, X settles and `glxinfo` reports OpenGL 4.6.0 with direct rendering; the 2D path is green, the DDX 3D replay executes on `0x1000014`, and the **first real GPU readback** landed: a guest `glClear(red)+glFinish+glReadPixels` pbuffer probe returned `pixel=ff0000ff`. The RM write-lock holder (Xorg in the DDX vidheap scrub wait) was identified and fixed (`df6e71bb`). **No non-black screen pixels yet:** the direct-GL client channel `0xbfef0002` still emits only 32/64-byte setup/notify kicks (`ops_runs=0`, no captured draw), a synchronous window draw wedges X, and X startup/RM degradation (`0x51`) plus the DDX's 4 GB sysmem allocation (12 GB guest) remain ([`OpenGL.md`](OpenGL.md)) |
 | Vulkan (3D/compute) | `[wip]` — the guest Vulkan pipeline runs end to end on the emulated vGPU (device, allocation, pipeline, command buffer, fence, queue submit, readback) and the engine executes translated launches; frames are still black — program delivery and program-VA mapping are the frontier ([`Vulkan.md`](Vulkan.md)) |
 | DirectX / Windows guests | `[planned]` (target) — no Windows guest booted yet; the architecture is the same emulation target ([`DirectX.md`](DirectX.md)) |
 | Video (NVENC/NVDEC) | `[planned]` |
@@ -66,7 +66,7 @@ The project's definition of done for CUDA requires all of the following
 Until every gate holds, the honest formulation is: **initialization, the
 driver-API path and kernel execution on the physical GPU work and verify;
 the staged-transfer class, per-guest isolation and the graphics
-beef-ring/CB/first-frame frontier remain.**
+direct-GL/present/first-frame frontier remain.**
 
 ## 3. How to see it yourself
 
@@ -76,10 +76,10 @@ outcome is exactly the ladder above — driver probe, `nvidia-smi`, the full
 driver-API smoke, and guest CUDA kernels executing and verifying on the
 physical GPU. On the graphics side the same setup brings up the display/KMS
 stack and the X server on the emulated vGPU (`glxinfo` reports OpenGL 4.6.0
-with direct rendering); X is green on attempt 1, the guest's GL draws retire
-and execute on the physical GPU, and the 2D path is green, but the draw still
-writes 0 pages because the beef-ring/CB/render-target chain does not resolve
-([`OpenGL.md`](OpenGL.md)). The
+with direct rendering); the first GPU readback is proven (a pbuffer probe
+returns a red pixel) and the DDX 3D replay executes, but the direct-GL client
+still emits only setup/notify kicks and a window draw wedges X, so screen
+capture is the frontier ([`OpenGL.md`](OpenGL.md)). The
 risc-v-gsp-rm-debugger workbench
 ([`Riscv-GSP-RM-Debugger.md`](Riscv-GSP-RM-Debugger.md)) is the host-side
 tooling used to study the firmware side of that frontier.
diff --git a/wiki/System-Overview.md b/wiki/System-Overview.md
index cf586cc..9ad17e0 100644
--- a/wiki/System-Overview.md
+++ b/wiki/System-Overview.md
@@ -7,7 +7,7 @@
 > and [`../docs/03-architecture/10-interaction-and-scheduling.md`](../docs/03-architecture/10-interaction-and-scheduling.md)
 > for the full picture); the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` proven with the
+Status: 2026-11-09, tree `master @ df6e71bb`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented default-off; `[wip]` partial;
 `[wall]` current blocker; `[target]` designed end state.
 
@@ -142,12 +142,12 @@ RPC from the guest to "firmware":
    buffers and the display notifier/completion (class-aware arm), so
    nvidia-modeset/NvKms registers (`/dev/dri`), X settles and `glxinfo`
    reports OpenGL 4.6.0 with direct rendering; the direct GL client's
-   channels submit, the X DDX waits are fixed, X is reliable, the guest's
-   real GL draws forward and execute on the physical GPU, the 2D path is
-   green, and the guest Vulkan pipeline runs end to end. The draw still
-   writes 0 pixels, so the remaining gate is the beef GR ring resolution, the
-   fixed-CB image's zero MVP block and the render-target bind before the first
-   rendered (non-black) frame ([`OpenGL.md`](OpenGL.md),
+   channels submit, the X DDX waits are fixed, the DDX 3D replay executes,
+   the 2D path is green, the first real GPU readback is proven (pbuffer red
+   pixel), and the guest Vulkan pipeline runs end to end. The direct-GL client
+   still emits only setup/notify kicks and a window draw wedges X, so the
+   remaining gate is the direct-GL draw capture and the window/screen present
+   before the first non-black screen frame ([`OpenGL.md`](OpenGL.md),
    [`Vulkan.md`](Vulkan.md)).
 
 ## 6. Where the detail lives