docs: ANALYSIS-egl-engine-selection - entry trace narrows the wall to glsi+0x33b80's state machine

Batch-gdb entry trace (r543 boot): engine-init -> 1aba0 -> 22f30 (device
lookup, miss=0xee00002) / 2c360 (object lookup, miss=0xee00003) / 33b80
(device flags + state machine) -> 301b0 (state, 3a6f0 x7, 2ac10 x2) ->
EGL_BAD_ALLOC. All three lookups were entered, so the failure lands inside
33b80's state machine; the busy path (30ef2 in 30b20) sets bit 0x20 on the
per-engine state record and returns 0xee00001 once, and eglcore rejects the
engine without retry. 22f30 is called ~1300x (enumeration), so it is not a
lookup miss. Also records the inconclusive Xorg DMA/push-buffer test on a
boot that had a stalled client.

1 files changed, 45 insertions, 4 deletions

diff --git a/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md b/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md
index 9c7ed67..48e9f35 100644
--- a/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md
+++ b/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md
@@ -77,11 +77,52 @@ is what fails.
 * **Not ASLR-dependent.** All offsets above are stable under gdb
   (`set disable-randomization on`).
 
-## 4. Next steps (for the successor)
+## 4. Entry-trace update (2026-10-23, r543 boot)
 
-1. Trace `glsi +0x301b0`'s internal calls (returns of `+0x3a6f0`,
-   `+0x2ac10`, `+0x2fbe0`, `+0x29760`, `+0x32110`, `+0x2dc70`) to find the
-   first non-zero return; that call is the true failing layer.
+A batch-gdb entry trace (breakpoints on the glsi engine-init entry and its
+inner functions, breakpoint set after `eglInitialize` so the vendor libraries
+are mapped; ASLR disabled reproduces glsi base `0x7ffff7e2a000`) captured the
+failing call order:
+
+```
+glsi+0x5f480 (engine-init)
+  glsi+0x1aba0 (first inner call)
+    glsi+0x22f30   device lookup by GPU id   (miss -> 0xee00002)
+    glsi+0x2c360   object lookup             (miss -> 0xee00003)
+    glsi+0x33b80   device-flags + state      <-- the failing layer
+      glsi+0x301b0 (state machine, entered twice)
+        glsi+0x3a6f0  (entered ~7x)
+        glsi+0x2ac10  (entered twice)
+  -> EGL_CURRENT_FAIL err=0x3003 (eglcore rejects the engine)
+```
+
+`+0x5f480` returns as soon as `+0x1aba0` reports non-zero; `+0x1aba0`
+propagates the first failure of `+0x22f30` / `+0x2c360` / `+0x33b80`. In the
+trace all three were entered, and the failure lands inside `+0x33b80`'s
+state-machine call. `+0x33b80` reads the device flags word at `+0xb84`; on a
+state-machine failure with the retry bit set it marks the device busy
+(`or 0x20` into the state record at `device + idx*0xdc8 + 0x291b4`) and
+returns `0xee00001` once (`glsi+0x30ef2` inside its callee `+0x30b20`);
+the higher layer reads `+0xb84` bit 0x20 and rejects the engine for this
+attempt without retry. `+0x22f30` is called ~1300 times during the probe
+(per-device/per-engine enumeration) - the failure is not a lookup miss.
+
+The state machine (`+0x301b0`) consumes per-engine context records; its
+inputs are the fields the caller passes in (`+0x95` mode byte, `+0x38`
+record array, `+0x74` id, `+0x98` index) plus the device flags. The next
+step is a return-value trace of `+0x3a6f0`/`+0x2ac10` (their failure
+conditions) or a differential state dump against a physical-GPU run.
+
+Note (same day): a control experiment was attempted - Xorg (GLX path) on
+the same boot died in `Failed to initialize DMA` / `Failed to allocate push
+buffer`, but that boot had a stalled CUDA client holding the device, so the
+result is inconclusive; retry on a clean boot.
+
+## 5. Next steps (for the successor)
+
+1. Return-value trace of `glsi +0x33b80`'s callees (`+0x301b0`'s
+   `+0x3a6f0` / `+0x2ac10` results): the first non-zero return there is the
+   true failing layer.
 2. Compare the glsi device-engine state with the same probe on a physical
    Turing GPU (the host's own 570 driver runs the identical userspace; a
    host-side `egl_frame` run with the real GPU succeeds, so a differential