STATE-CURRENT: baseline regression (DtoH destination translation) and the targeted-fallback/retry work

1 files changed, 13 insertions, 10 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index 64824b3..fe2cd0f 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -1,6 +1,6 @@
 # Open-IOV Current State
 
-> **Snapshot: 2026-09-30 10:01.** This is a dated public status page, not live
+> **Snapshot: 2026-09-30 11:43.** This is a dated public status page, not live
 > state; it is refreshed on every progress check. Live working notes are
 > maintained outside this repository; the public known-knowns/unknowns document
 > is authoritative here:
@@ -53,12 +53,15 @@ chain succeeds.
   class transfer bound on a compute channel whose work was denied by the
   engine-type gate; trusted host-injected pushes may now execute copy-engine
   work as well).
-- **Runtime bring-up has started**: the harness now runs `nvidia-smi` and a
-  static-runtime `vectorAdd`-style client. The page-table walk resolves at
-  scale (thousands of successful walks per run), but the runtime's larger
-  buffers currently fail translation - host-side copies of 1 MB and smaller
-  report a missing-entry error on those virtual addresses. That translation
-  class is the new wall.
+- **Runtime bring-up, with a baseline regression to clear first**: the
+  harness now runs `nvidia-smi` and a static-runtime `vectorAdd` client. The
+  runtime client currently fails at its first call - registration release
+  delivery lands seconds after an ~18 s deadline. Separately, the previously
+  verified copy baseline regressed: the device-to-host push is decoded and
+  executes, but its **destination** (a host staging address) has no
+  translation, so the copy fails with a missing-entry error. The operand
+  resolver now has a targeted allocation fallback and per-side miss tracing,
+  and a push whose operand is still under a scan is held and retried.
 - Recap of the fixes behind this point: all 20/20 compute-channel releases
   land (three decode paths routed to the exact counter slot); registration
   delivers the incrementing tracking release for every consumed submission;
@@ -66,9 +69,9 @@ chain succeeds.
   the copy-engine decoder consults pinned translations before the scanned
   map, so every push-data operation executes (`memset=19473`, `ringops=10551`
   live).
-- Active work: chase the runtime buffers' translations (the kernel-VA class),
-  with a CPU monitor now flagging kernel-VA translation failures; iterate on
-  the runtime path with one fresh boot per run.
+- Active work: validate the targeted fallback resolves the device-to-host
+  destination (latest run still misses it), restore the verified 64/64
+  baseline, then re-run the runtime client.
 - Observability: a size-keyed copy watch, a VRAM shadow dump/search, and an
   operation log are now module parameters, and the test's output survives
   guest-agent stalls via the serial console.