wall-2 session-78: post-device wait identified as the NvOgl (GL ucode) engine init (A8 retry loop work item named NvOgl_m0; D6 submit ORs 0x200000 into the pending word) and the push windows become READABLE via the resolver6 window-record/memdesc recipe (0x4480000 -> 0x120cfb000, 0x4ca0000 -> 0x12e51e000; the service decodes the GR init streams where sessions 73-74 saw unread) - remaining gate: have_rel=0 (CE-shaped matcher) and the GR forward not engaging (forwarded=0 gr_nocap=4 drain held=4)

1 files changed, 30 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index cf2450e..282b3a0 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -73,3 +73,33 @@
   nvidiactl mapping (pagemap; run in the guest as root).
 * `nudge.sh` — host-side loop: poll guest_words.sh and write 1 to any
   zero word (multi-page variant; prefer the single-word recipe).
+
+## ADDENDUM (r685, session 78) — POST-DEVICE WAIT IDENTIFIED: the NvOgl (GL ucode) engine init; push windows now READABLE (resolver6)
+
+* The post-device spin is the **GL module bring-up**: the main thread's
+  A8-layer retry loop (eglcore 0xa85d24) works on a work item whose
+  embedded name is ASCII **"NvOgl_m0"** (+0xf04: "NvOgl_m40"); the D6
+  submit layer (0xd624e0) ORs **0x200000** into its pending word (the
+  same engine-pending bit SESSION 75/76 watched on E+0x150), then the
+  A8 loop yields via the B284B0 spin helper (sched_yield) waiting for
+  the GL ucode init to complete on the GR engine.
+* **The push windows ARE now readable** (first time): the resolver6
+  recipe (window-record pair {push_va,0x20000}+{ring_va,0x40000} ->
+  same-page 0x20000 memdesc PA -> `sema_map_add`) injected
+  `0x4480000 -> 0x120cfb000` (content `2001c00d 70000000 2001c00d
+  68000000` = the 2-method semaphore-like push) and `0x4ca0000 ->
+  0x12e51e000` (the 1432-byte GR init stream: SET_OBJECT 0xc5c0/0xc5b5,
+  `0x200121ed`, `0x200120a9`, bulk methods, tail `2001c00d
+  70/68`). The service now decodes the streams (`sema-push ... tail=0dc0
+  012000000070...`) where SESSION 73-74 saw "unread".
+  CAUTION: the resolver injects every candidate; a zero-page candidate
+  injected last replaces the good mapping for that VA (re-inject the
+  good page after the scan).
+* **Remaining gate**: the service still reports `have_rel=0` for every
+  GR push (the CE-shaped release matcher) and — decisively — the
+  GR-forward machinery is NOT engaging: `drain held=4 starved=149
+  forwarded=0 ... gr_nocap=4`. The GL ucode init work is never
+  forwarded/executed, so the completion (and the 0x200000 bit clear)
+  never arrives. Next: the GR forward/capture path for these channels
+  (operand capture + release decode for the GR shape), then the client
+  proceeds to VKFRAME.