STATE-CURRENT: payload roundtrip 64/64 restored by the page-table publication capture

- the device-to-host destination now resolves; baseline green again in live runs
- frontier/active-work notes updated: land the capture fix, then the runtime
  vectorAdd client

1 files changed, 10 insertions, 13 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index fe2cd0f..0959c39 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -1,6 +1,6 @@
 # Open-IOV Current State
 
-> **Snapshot: 2026-09-30 11:43.** This is a dated public status page, not live
+> **Snapshot: 2026-09-30 12:42.** This is a dated public status page, not live
 > state; it is refreshed on every progress check. Live working notes are
 > maintained outside this repository; the public known-knowns/unknowns document
 > is authoritative here:
@@ -53,15 +53,12 @@ chain succeeds.
   class transfer bound on a compute channel whose work was denied by the
   engine-type gate; trusted host-injected pushes may now execute copy-engine
   work as well).
-- **Runtime bring-up, with a baseline regression to clear first**: the
-  harness now runs `nvidia-smi` and a static-runtime `vectorAdd` client. The
-  runtime client currently fails at its first call - registration release
-  delivery lands seconds after an ~18 s deadline. Separately, the previously
-  verified copy baseline regressed: the device-to-host push is decoded and
-  executes, but its **destination** (a host staging address) has no
-  translation, so the copy fails with a missing-entry error. The operand
-  resolver now has a targeted allocation fallback and per-side miss tracing,
-  and a push whose operand is still under a scan is held and retried.
+- **The baseline is restored (payload roundtrip 64/64 again)**: with the
+  page-table publication capture in the running module, the device-to-host
+  copy's destination resolves and the roundtrip matches exactly (verified
+  live at 12:41). The regression was the guest's live page-directory entries
+  not reaching the emulated shadow; capturing and promoting them fixes the
+  walk for client system-memory addresses.
 - Recap of the fixes behind this point: all 20/20 compute-channel releases
   land (three decode paths routed to the exact counter slot); registration
   delivers the incrementing tracking release for every consumed submission;
@@ -69,9 +66,9 @@ chain succeeds.
   the copy-engine decoder consults pinned translations before the scanned
   map, so every push-data operation executes (`memset=19473`, `ringops=10551`
   live).
-- Active work: validate the targeted fallback resolves the device-to-host
-  destination (latest run still misses it), restore the verified 64/64
-  baseline, then re-run the runtime client.
+- Active work: land and document the page-table capture fix, then re-run the
+  static-runtime `vectorAdd` client and chase its remaining delivery/deadline
+  wall.
 - Observability: a size-keyed copy watch, a VRAM shadow dump/search, and an
   operation log are now module parameters, and the test's output survives
   guest-agent stalls via the serial console.