wiki: 2026-11-10 morning refresh - X reliable, GR timeouts fixed; beef-ring/CB/RT walls

Refresh STATE-CURRENT, the Main Page and the status/frontier pages:
ebf3130f fixes the X DMA-init path and flips the GR pair-close/pair-safe
replay fixes default ON (X green on attempt 1 in three consecutive cycles,
backend_timeout=0, draws retire in 3-2400 ms); bb802909 is committed. The
replayed draw still writes 0 pages; the beef GR ring resolution, the
fixed-CB image's zero 0x80 MVP block and the render-target bind are the
named walls. Published to open-iov.org.

1 files changed, 43 insertions, 40 deletions

diff --git a/wiki/Graphics-Execution.md b/wiki/Graphics-Execution.md
index 7771d6a..ca04b8f 100644
--- a/wiki/Graphics-Execution.md
+++ b/wiki/Graphics-Execution.md
@@ -12,7 +12,7 @@
 > [`../docs/04-implementation/04-real-render-walls.md`](../docs/04-implementation/04-real-render-walls.md)
 > (the measured walls); the docs tree wins on disagreement.
 
-Status: 2026-11-09, tree `master @ cb8e822b`. Tags: `[live]` observed end to
+Status: 2026-11-09, tree `master @ bb802909`. Tags: `[live]` observed end to
 end; `[wip]` partially built; `[wall]` current blocker; `[target]` defined
 success state; `[planned]` designed, not built.
 
@@ -92,9 +92,10 @@ fidelity:
    applied), forcing GLX selects `libnvidia-glcore`, and the event-IRQ fix
    (`a478f0b4`) lets the guest service the completion, so glxgears completes
    swaps and the guest's real GL draws now forward and execute on the
-   physical GPU (`work_gr backend_ok=9`). What remains is the constant-buffer
-   (MVP) content, the MME front-end defer and GR stale-wedge, and the DDX
-   get-word/notifier completion (§6).
+   physical GPU (`work_gr backend_ok=5-7`, `backend_timeout=0`) and X is
+   reliable, but the draw still writes 0 pages. What remains is the beef GR
+   ring resolution race, the fixed-CB image's zero MVP block, and the
+   render-target bind (§6).
 
 ## 4. The channel and object picture
 
@@ -144,9 +145,11 @@ host-side levers now, and a diagnostic write of the get word released the
 DDX's reserve loop. For a windowed GL client the present is a kick; the GSP
 event-IRQ fix now sets the RISC-V SWGEN0 IRQSTAT/IRQMASK/IRQDEST and latches
 the CPU-tree leaf, so the guest services the event and glxgears completes
-swaps. The next completion step is the constant buffer: the draw's CB page
-must be resolved and copied into the seed page so the engine produces
-fragments.
+swaps, and the GR backend no longer times out (the pair-close/pair-safe
+replay fixes are default ON; draws retire in 3-2400 ms). The next completion
+step is the beef GR ring (so the fixed-CB scan runs on every cycle) and the
+CB image (its `0x80` MVP block is zero even when the scan runs), then the
+render-target bind.
 
 During bring-up the module also carries a **diagnostics-only mirror** for apps
 that spin on a shared progress word; it exists so a run can proceed while the
@@ -155,35 +158,33 @@ requires it switched off, along with any external poke.
 
 ## 6. Where the frontier is (ranked walls)
 
-1. **The constant buffer (MVP) content** `[wall]`. The guest's GL draws now
-   execute on the physical GPU, but the engine writes 0 pages. The draw's
-   constant-buffer source is forced to the seed page because
-   `cb-copy src=0x0cd70000 ... first8=00000000 ... src=synthetic-id` reads all
-   zeros; a guest-RAM scan found no MVP matrix and the `0x3f800000` vidmem
-   hits are shader microcode immediates. With a zero MVP every vertex
-   collapses to the origin, so there are no fragments. Decode the CB-bind
-   method on the beef channel, resolve that VA through the channel VAS, and
-   copy the real page into the seed page.
-2. **Execution stability** `[wall]`. The MME front-end is busy/deferred
-   (`MME-FE-DEFER` then forced loads) and the GR channel stale-wedges
-   (`GR-STALL-stale-wedge`, recovered), so the pipeline restarts mid-frame.
-   Fixing the CB page may unstick the MME; the wedge recovery needs a durable
-   fix.
-3. **The X DDX push-buffer completion** `[wall]`. The DDX's 2D reserve loop
-   exits only when the GPU-written engine get word advances (`get <= put`) and
-   the kick requires the notifier to be recycled to `0xffff` after completion.
-   `sema_vas_cand_ms=1` makes X green on attempt 1, but X can still die after a
-   few forward frames into the RM-degraded state.
+1. **Beef GR ring resolution** `[wall]`. `0xbeef0100` (the GL client GR
+   channel) registers with `vas=0` before its CE siblings publish
+   `0xbeef0300`; the shared VAS is then registered UNVERIFIED by the 1 ms
+   age-out, so the ring at `0x4020000` stays `ring_pa=0` and the fixed-CB scan
+   (gated to the `0xbeef0000` family) never runs. The next fix is to gate the
+   candidate promote on *verified* rather than *known* and retry every pump
+   turn.
+2. **The fixed-CB image MVP block** `[wall]`. Even on a cycle where the scan
+   runs (`r1687`), it decodes 1492 `0x3800` offsets plus 1497 `0x39c8` data
+   runs (1092 words) but the image's `0x80` MVP block is zero. Identified
+   parser bugs (subchannel bits 15:13, `0x238c` ONE_INC inline data, selector
+   B/C swap) are not yet applied; the MVP may live at an offset >= `0x1000` or
+   a selector B/C binding. With a zero MVP every vertex collapses to the
+   origin, so there are no fragments.
+3. **The render-target bind** `[wall]`. Confirm that the replayed draw's
+   render target is the page `bounce copy-out` compares
+   (`svc_surf_prelude_capture` currently picks the last trusted bind
+   globally).
 4. **The X DDX footprint** `[wall]`. The DDX allocates 4 GB of system pages at
    startup; an 8 GB guest has no headroom once GZDoom's own footprint lands
    and both are OOM-killed. Current runs use a 12 GB guest; the allocation is
    a suspected emulation gap (a 512 MiB emulated VRAM falling back to a 4 GB
    sysmem allocation) to fix.
-5. **Non-black frames and sustained rate** `[wall]`/`[target]`. Once the
-   constant buffer, the MME/wedge stability and the DDX get-word/notifier
-   completion land, the capture must show motion, then 60 fps in one VM with
-   no forcing, then two VMs on two mediated devices with non-black frames in
-   both.
+5. **Non-black frames and sustained rate** `[wall]`/`[target]`. Once the beef
+   ring, the CB image and the render-target bind land, the capture must show
+   motion, then 60 fps in one VM with no forcing, then two VMs on two mediated
+   devices with non-black frames in both.
 
 ## 7. What is proven today
 
@@ -193,18 +194,20 @@ requires it switched off, along with any external poke.
 | Display engine serves the modeset push buffers; notifier plus `UPDATE -> FINISHED` | `[live]` (campaign configuration) |
 | nvidia-modeset/NvKms registers (`/dev/dri/card0`, `renderD128`, `fb0`); `nvidia-smi -L` enumerates | `[live]` |
 | `glxinfo` reports the emulated GPU with the NVIDIA renderer (OpenGL 4.6.0, direct rendering) | `[live]` |
-| X server green with `sema_vas_cand_ms=1`; glxinfo 4.6.0 direct | `[live]` |
+| X green on attempt 1 in three consecutive cycles (`ebf3130f`) | `[live]` |
 | GSP event-IRQ fix wakes the guest poll; glxgears completes swaps | `[live]` |
 | 2D path end-to-end: accelerated X fills read back via `xwd` | `[live]` |
-| Guest's real GL draws forward and execute on the physical GPU (`work_gr backend_ok=9`) | `[live]` |
+| Guest's real GL draws forward and execute on the physical GPU (`work_gr backend_ok=5-7`) | `[live]` |
+| GR backend timeouts fixed (`backend_timeout=0`; draws retire in 3-2400 ms) | `[live]` |
+| CB-DIAG decodes the draw's fixed-CB stream (1492 `0x3800` offsets, 1092 words) | `[live]` |
 | Beef GR channel `0xbeef0100` captures real GL draw sections | `[live]` |
 | GL section capture: the X channel's `0xC597` stream decoded | `[live]` |
 | Verbatim 3D method-stream replay retired by the engine (no MMU fault) | `[live]` |
 | Synthesized launch executes real `sm_75` SASS; Turing `V3` program header accepted | `[live]` |
 | X server survives the run on a 12 GB guest (the DDX's 4 GB sysmem allocation forces the size) | `[live]` |
-| Constant-buffer (MVP) page resolves and the draw writes render-target pixels | `[wall]` |
-| MME front-end defer / GR stale-wedge stability | `[wall]` |
-| DDX push-buffer get-word publish and notifier recycle | `[wall]` |
+| Beef GR ring resolves deterministically; fixed-CB scan runs every cycle | `[wall]` |
+| Fixed-CB image's `0x80` MVP block becomes non-zero | `[wall]` |
+| Render-target bind matches the copy-out page | `[wall]` |
 | NVIDIA Vulkan ICD creates a device | `[wall]` |
 | Non-black pixels from the emulated vGPU's 3D pipeline | `[wall]` |
 | Windows/DirectX guests | `[planned]` |
@@ -213,10 +216,10 @@ requires it switched off, along with any external poke.
 
 * No non-black pixel has been produced by the emulated vGPU's 3D pipeline yet.
 * Display/KMS bring-up (NvKms, `/dev/dri`, X, a real GL context) is not a
-  rendered-frame claim; the guest's GL draws now execute on the physical GPU
-  and glxgears completes swaps, but the frames are black. The constant-buffer
-  (MVP) content, the MME/wedge stability and the DDX get-word/notifier
-  completion are the current walls.
+  rendered-frame claim; the guest's GL draws now execute on the physical GPU,
+  X is reliable and glxgears completes swaps, but the frames are black. The
+  beef GR ring resolution, the fixed-CB image's zero MVP block and the
+  render-target bind are the current walls.
 * No frame-rate or latency numbers: the scheduled measurement is defined
   (60 fps over 60 s, no forcing) but not yet met.
 * The `virgl`-based demo videos are a different, labelled path — not this one.