STATE-CURRENT: payload path found (compute-class inline DMA); page-table walk is the wall

- smoke test ends ALL OK; data roundtrip pending the GPU-VA walk
- HtoD identified as a GRCE inline-data DMA and decoded; destination
  translation is the remaining blocker
- frontier/rail refreshed

1 files changed, 13 insertions, 11 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index 8d597aa..237eba6 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -1,6 +1,6 @@
 # Open-IOV Current State
 
-> **Snapshot: 2026-09-30 05:54.** This is a dated public status page, not live
+> **Snapshot: 2026-09-30 06:45.** This is a dated public status page, not live
 > state; it is refreshed on every progress check. Live working notes are
 > maintained outside this repository; the public known-knowns/unknowns document
 > is authoritative here:
@@ -49,13 +49,14 @@ chain succeeds.
   error that stalled this for days is root-caused and fixed: the emulated GR
   information table left the shader-pipe count and related clock fields zero,
   which the client's clock-table validation rejected.
-- **The remaining wall is the user payload**: the memory roundtrip returns
-  zeros - the 64-byte payload does not reach the emulated VRAM through the
-  path this allocation uses. The copies the host observes carry UVM
-  bookkeeping, not the payload; a full scan of the pinned copy-engine push
-  buffer and of the 256 MB VRAM shadow finds no trace of it. The next suspect
-  is the external-allocation path the client uses (RM-allocated memory mapped
-  into UVM), including a possible windowed CPU copy.
+- **The payload's host-to-device path is found**: the copy is a
+  compute-class inline-data DMA (the payload rides inside the push itself),
+  not a copy-engine transfer. The decoder now recognises the method set and
+  attempts the write. The remaining blocker is the destination's
+  GPU-virtual-address translation: the emulated page-table walk has never
+  resolved entries (every translation so far came from pins or the discovery
+  map), so the write cannot land yet. The live page-directory writes are
+  being audited to fix the walk.
 - Recap of the fixes behind this point: all 20/20 compute-channel releases
   land (three decode paths routed to the exact counter slot); registration
   delivers the incrementing tracking release for every consumed submission;
@@ -63,9 +64,9 @@ chain succeeds.
   the copy-engine decoder consults pinned translations before the scanned
   map, so every push-data operation executes (`memset=19473`, `ringops=10551`
   live).
-- Active work: find the payload's host-to-device path for the external
-  allocation - pattern-match the copy's source, audit the RM
-  allocation/descriptor path, and check where windowed writes land.
+- Active work: audit the live page-directory writes to fix the page-table
+  walk, so the inline write (and then the device-to-host copy) resolves
+  client device addresses; iterate with a fresh boot per run.
 - Observability: a size-keyed copy watch, a VRAM shadow dump/search, and an
   operation log are now module parameters, and the test's output survives
   guest-agent stalls via the serial console.
@@ -153,6 +154,7 @@ Recent chain of walls removed (2026-09-28 to 2026-09-30):
    -> copy-engine data path executes -> compute-window pinning
    -> registration release delivery -> 20/20 counter slots -> GR-info clock fix
    -> cuCtxCreate OK and the full smoke test ALL OK; payload data path remains
+   -> payload found (compute-class inline DMA) -> page-table walk audit
 ```
 
 ## Tools, code paths and fixes behind this progress