wiki: 2026-11-10 morning refresh - X reliable, GR timeouts fixed; beef-ring/CB/RT walls

Refresh STATE-CURRENT, the Main Page and the status/frontier pages:
ebf3130f fixes the X DMA-init path and flips the GR pair-close/pair-safe
replay fixes default ON (X green on attempt 1 in three consecutive cycles,
backend_timeout=0, draws retire in 3-2400 ms); bb802909 is committed. The
replayed draw still writes 0 pages; the beef GR ring resolution, the
fixed-CB image's zero 0x80 MVP block and the render-target bind are the
named walls. Published to open-iov.org.

1 files changed, 50 insertions, 0 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index 608c238..79154d3 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -1,5 +1,55 @@
 # Open-IOV Current State
 
+> **Snapshot: 2026-11-10 ~06:10 (SESSION 156 continued; HEAD `bb802909`,
+> tree has in-flight kernel work from the campaign; supersedes the 05:30
+> entry below).**
+> The X and GR reliability work landed. `ebf3130f` fixes the X DMA-init path
+> (the pristine-FB USERD scan now runs when the ring is present but unusable,
+> the foreign-FB claim is offset-correct, the parked VAS candidate is
+> content-validated at the pump turn, and the owner-VAS fallback covers
+> `hVASpace==0`) and flips the GR pair-close/pair-safe replay fixes to default
+> ON. Result: **X direct rendering green on attempt 1 in three consecutive
+> cycles (r1687/1688/1689)**, `backend_timeout=0` (was 6), `backend_ok=5-7`,
+> and draws retire in 3-2400 ms. `bb802909` (WIP beef-ring promote +
+> draw-channel CB scan) is committed; the campaign has uncommitted kernel work
+> in flight.
+>
+> The remaining wall is still the **replayed draw writes 0 pages** (render
+> target unchanged; `bounce copy-out` reports 0 changed). It is now precise:
+> (1) the beef GR ring resolution race - `0xbeef0100` registers with `vas=0`
+> before its CE siblings publish `0xbeef0300`; the VAS is then registered
+> UNVERIFIED by the 1 ms age-out, so the ring at `0x4020000` stays
+> `ring_pa=0` and the fixed-CB scan (gated to the `0xbeef0000` family) never
+> runs. The fix is to gate the candidate promote on *verified* rather than
+> *known* and retry every pump turn. (2) Even when the scan runs (`r1687`), it
+> decodes 1492 `0x3800` offsets plus 1497 `0x39c8` data runs (1092 words) but
+> the image's `0x80` MVP block is zero; identified parser bugs (subchannel
+> bits 15:13, `0x238c` ONE_INC inline data, selector B/C swap) are not yet
+> applied, and the MVP may live at an offset >= `0x1000` or a selector B/C
+> binding. (3) The render-target bind (`svc_surf_prelude_capture`,
+> last-trusted-bind-wins) must be confirmed to match the page the copy-out
+> compares.
+>
+> The 2D path is green end-to-end, the guest's real GL draws forward and
+> execute on the physical GPU, and X is reliable; no rendered pixel through
+> the emulated vGPU yet. Milestone position: between M-GL1 and M-GL2.
+> Estimate (subjective): first non-black frame hours-to-days if the beef-ring
+> and CB decode behave like their predecessors; the two-VM GPU-accelerated
+> video after that.
+>
+> CUDA front unchanged (backgrounded while graphics holds the device; its
+> 10-30 status stands): `41343c63` green (`victory_mail` `VADD bad=0` +
+> `STATUS OK`; `vecadd_loop` 100 launches PASS); the fresh-boot battery's
+> red class is D2H-stage with release-discipline fixes staged; the SESSION
+> 143 Vulkan fence regression is not re-measured.
+>
+> Live at check (read-only): r1691 VM up (QEMU 80456, mdev
+> `eba5a4f0-ef85-4ea5-9fb4-4ef1a6b04a3b`), X green on attempt 1, glxgears
+> 300x300 black, `work_gr backend_ok=5 timeout=0`, `bounce copy-out 0
+> changed`, beef ring unresolved; `vgsp` loaded (HEAD `bb802909` plus the
+> campaign's in-flight kernel work), `guest_ram active=1`; pstore empty; no
+> reboot during the check.
+>
 > **Snapshot: 2026-11-10 ~05:30 (SESSION 156 continued; HEAD `cb8e822b`,
 > tree clean, `vgpu/master` in sync; supersedes the 19:15 entry below).**
 > The execution chain came alive overnight. The guest's **real GL draws now