docs(wiki): 2026-11-15 evening status refresh - held-window release carrier deterministic (c772), slot-34/SA[34] settled (0x265), call order is the blocker; eng64 chains the release behind the pack carrier; STATE-CURRENT snapshot

12 files changed, 266 insertions, 151 deletions

diff --git a/wiki/.publish-manifest.json b/wiki/.publish-manifest.json
index 284637d..d135731 100644
--- a/wiki/.publish-manifest.json
+++ b/wiki/.publish-manifest.json
@@ -64,11 +64,11 @@
  },
  "FAQ": {
   "file": "FAQ.wiki",
-  "new_revid": 24157,
-  "old_revid": 24149,
-  "source_sha": "d3693204ba2e2047",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:13Z",
+  "new_revid": 24179,
+  "old_revid": 24168,
+  "source_sha": "a60d299efe4e8e8a",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:18Z",
   "title": "FAQ"
  },
  "GMMU Multi-Tenant Protection": {
@@ -127,11 +127,11 @@
  },
  "Graphics Execution": {
   "file": "Graphics-Execution.wiki",
-  "new_revid": 24158,
-  "old_revid": 24145,
-  "source_sha": "0bec237d98b7f442",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:13Z",
+  "new_revid": 24180,
+  "old_revid": 24169,
+  "source_sha": "69252ee5880d2ea0",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:19Z",
   "title": "Graphics Execution"
  },
  "Guest Driver Lifecycle: A Field Guide": {
@@ -226,11 +226,11 @@
  },
  "OpenGL": {
   "file": "OpenGL.wiki",
-  "new_revid": 24160,
-  "old_revid": 24146,
-  "source_sha": "08c583681fea9d54",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:14Z",
+  "new_revid": 24182,
+  "old_revid": 24171,
+  "source_sha": "18669a2422764d3b",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:20Z",
   "title": "OpenGL"
  },
  "Performance": {
@@ -244,38 +244,38 @@
  },
  "Physical GPU Backend and Guest Wiring": {
   "file": "Physical-GPU-Backend.wiki",
-  "new_revid": 24161,
-  "old_revid": 24151,
-  "source_sha": "2fd146b3a6c7a2e2",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:15Z",
+  "new_revid": 24183,
+  "old_revid": 24172,
+  "source_sha": "28b0f988043208dc",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:20Z",
   "title": "Physical GPU Backend and Guest Wiring"
  },
  "Project Goals": {
   "file": "Project-Goals.wiki",
-  "new_revid": 24162,
-  "old_revid": 24152,
-  "source_sha": "33b028e78eeec590",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:15Z",
+  "new_revid": 24184,
+  "old_revid": 24173,
+  "source_sha": "1bc4bffa2ee75b07",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:21Z",
   "title": "Project Goals"
  },
  "Project Plan": {
   "file": "Project-Plan.wiki",
-  "new_revid": 24163,
-  "old_revid": 24153,
-  "source_sha": "49a3a98f1b8de158",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:16Z",
+  "new_revid": 24185,
+  "old_revid": 24174,
+  "source_sha": "8e662457fd35a307",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:21Z",
   "title": "Project Plan"
  },
  "Project Status": {
   "file": "Project-Status.wiki",
-  "new_revid": 24164,
-  "old_revid": 24144,
-  "source_sha": "ed9bb8b3c0d564f5",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:16Z",
+  "new_revid": 24186,
+  "old_revid": 24175,
+  "source_sha": "ed8adbf6185d4dc6",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:21Z",
   "title": "Project Status"
  },
  "RPC Message Format": {
@@ -289,11 +289,11 @@
  },
  "System Overview": {
   "file": "System-Overview.wiki",
-  "new_revid": 24165,
-  "old_revid": 24154,
-  "source_sha": "3fa9fc93813ae23a",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:17Z",
+  "new_revid": 24187,
+  "old_revid": 24176,
+  "source_sha": "8a03ffc5fd543d7f",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:22Z",
   "title": "System Overview"
  },
  "Template:About message": {
@@ -325,11 +325,11 @@
  },
  "The Execution Frontier": {
   "file": "Execution-Frontier.wiki",
-  "new_revid": 24155,
-  "old_revid": 24147,
-  "source_sha": "1376a274a45b302c",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:11Z",
+  "new_revid": 24177,
+  "old_revid": 24166,
+  "source_sha": "694c4ae09c4cccec",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:17Z",
   "title": "The Execution Frontier"
  },
  "The Guest Stack and CUDASW": {
@@ -343,20 +343,20 @@
  },
  "The Host Module (vgsp.ko)": {
   "file": "Host-Module.wiki",
-  "new_revid": 24159,
-  "old_revid": 24150,
-  "source_sha": "cc9ef114a2cdcf4c",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:14Z",
+  "new_revid": 24181,
+  "old_revid": 24170,
+  "source_sha": "fde89d5868b93ea0",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:19Z",
   "title": "The Host Module (vgsp.ko)"
  },
  "The vGSP Execution Plane (vEP)": {
   "file": "Execution-Plane.wiki",
-  "new_revid": 24156,
-  "old_revid": 24148,
-  "source_sha": "4303167a355bf82f",
-  "summary": "2026-11-15 status refresh: DS stage image authored+live (st0=st1=020a0481; DS 0x86040626->0x84000420, two boots); draw-issue mac=0x22 and stores remain; X start lottery limits the run rate",
-  "timestamp": "2026-11-15T19:09:12Z",
+  "new_revid": 24178,
+  "old_revid": 24167,
+  "source_sha": "4a78097d559d84dd",
+  "summary": "2026-11-15 evening refresh (HEAD 6aeb20c7): release path host-deterministic (c772), slot-34/SA[34] settled (0x265), reorder landed; blocker is call order; eng64 chains the release behind the pack carrier; DS 0x84000420/stores remain",
+  "timestamp": "2026-11-15T21:37:18Z",
   "title": "The vGSP Execution Plane (vEP)"
  },
  "UVM in the Guest": {
diff --git a/wiki/Execution-Frontier.md b/wiki/Execution-Frontier.md
index 1425aaf..15396c6 100644
--- a/wiki/Execution-Frontier.md
+++ b/wiki/Execution-Frontier.md
@@ -14,7 +14,7 @@
 > [`../docs/04-implementation/03-execution-frontier.md`](../docs/04-implementation/03-execution-frontier.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`.
+Status: 2026-11-15, tree `master @ 6aeb20c7`.
 Tags: `[live]` observed; `[wip]` partial; `[wall]` current blocker; theories
 are labelled as such.
 
@@ -123,11 +123,25 @@ is aliased, and `DRAW_IAB` (`mac=0x22`) runs with the SPH-BIND prelude intact
 authored and live**: a VTG SPH at `family+0x900` (`SPH-AUTHOR`, first word
 `020a0481`) is what both vertex slots fetch (`DS-IMAGE st0=st1=020a0481
 code=ff007321`), the window's own later slot-1 bind is rewritten to it, and
-the DS value fell `0x86040626 -> 0x84000420` (reproduced on two boots). What
-is missing is **window/screen pixels through the NVIDIA path**: the remaining
-DS bits are stage type/context (SPH5/SPH10/SPH18), the 728-B draw window's
-released macros (`0x33/0x39/0x1/0x0`) do not include `DRAW_IAB` (`mac=0x22`),
-so the draw still does not store (`wrote=0`, `px0=0`); the window/screen
+the DS value fell `0x86040626 -> 0x84000420` (reproduced on two boots). The
+release path is now host-deterministic when the pack completes: the
+saved-window release carrier snapshots the held window and re-submits it with
+the calls released once the pack is resident (c772 end to end: save 240/68 ->
+fire -> synthetic `GR LAUNCH 0x6d6d6500` -> `MME-PACK-REARM` -> DS
+`0x84000420`), and the held-CALL census plus the SA[34] golden fill prove the
+`DRAW_IAB` call and its target are present (`MME-CALL-TARGET slot=34
+method=0x3910 client=0x265 golden=0x265 used=0x265`). What is missing is
+**window/screen pixels through the NVIDIA path**: the blocker is **call
+order** — the saved 728-B state window places the slot-34 run after the
+`0x33/0x39` setup, so the last `0x39` latches DS `0x84000420` and the MFE
+never reaches CALL(34) (c780), while the 324-B DRAW window places it first
+and ran `mac=0x22` (c716). A release-window reorder (`a03a68ea`) is landed
+but unexercised, and pack completion is still a per-boot lottery (poisoned
+pack-part; no pump pass after the carry arm; carry-armed-never-fired);
+`6aeb20c7` (eng64) chains the release behind a successful pack carrier and
+names a stalled carrier's gate, validation pending. The
+DS still carries the stage type/context bits (SPH5/SPH10/SPH18), so the draw
+does not store (`wrote=0`, `px0=0`); the window/screen
 present path is unproven, glxgears' window is black, and a synchronous window
 draw wedges X on some boots. The per-boot binding and X first-generation
 start lottery are now the dominant throughput limiter. The guest Vulkan
@@ -203,10 +217,19 @@ first `MME-PACK-REARM` fires, the fixed-CB region is aliased, and `DRAW_IAB`
 (`mac=0x22`) runs with the SPH-BIND prelude intact and the DS stage VAs
 populated. The **DS stage-0/1 image is now authored and live** (a VTG SPH at
 `family+0x900`, fetched by both vertex slots as `st0=st1=020a0481`; DS fell
-`0x86040626 -> 0x84000420`, reproduced on two boots); the remaining bits are
-stage type/context (SPH5/SPH10/SPH18), and the 728-B window's released macros
-(`0x33/0x39/0x1/0x0`) do not include the `DRAW_IAB` call, so the draws still
-do not store. glxgears' window is black, a window draw wedges X on some
+`0x86040626 -> 0x84000420`, reproduced on two boots). The release is
+host-deterministic when the pack completes: the saved-window release carrier
+re-submits the held window with the calls released (c772), and the held-CALL
+census plus SA[34] golden fill prove the slot-34 `DRAW_IAB` address
+(`client=golden=used=0x265`). The remaining blocker is call order: the 728-B
+state window places the slot-34 run after the `0x33/0x39` setup, so the `0x39`
+DS latch pre-empts it (c780), while the 324-B DRAW window places it first and
+ran `mac=0x22` (c716); the reorder `a03a68ea` is landed but unexercised, and
+pack completion is still a per-boot lottery (`6aeb20c7`, eng64, chains the
+release behind a successful pack carrier; validation pending). The DS stage
+type/context bits (SPH5/SPH10/SPH18) remain after the call, so the draws
+still do not store.
+glxgears' window is black, a window draw wedges X on some
 boots, and the per-boot binding plus X first-generation start lottery is the
 dominant throughput limiter
 ([`Graphics-Execution.md`](Graphics-Execution.md)).
@@ -224,11 +247,13 @@ dominant throughput limiter
    transformer kernel; each entry is accepted only on its own verification
    output (`bad=0` + `STATUS OK`).
 5. **The graphics pixel frontier** — the DS stage image is authored and live
-   for both vertex slots; next get the draw-issue `DRAW_IAB` (`mac=0x22`) call
-   into the window so it stores (`wrote>0`) at the bound render target, then
-   make the window/screen present land, and reduce the per-boot binding/X
-   start lottery so the proven off-screen frames become window pixels; the
-   lanes, the walls and the milestone ladder are on
+   for both vertex slots, and the saved-window release carrier now replays the
+   held window deterministically when the pack completes; next exercise the
+   release-window reorder so the slot-34 `DRAW_IAB` call runs before the setup
+   calls and stores (`wrote>0`) at the bound render target, then clear the DS
+   stage type/context bits, make the window/screen present land, and reduce
+   the per-boot binding/X start lottery so the proven off-screen frames become
+   window pixels; the lanes, the walls and the milestone ladder are on
    [`Graphics-Execution.md`](Graphics-Execution.md).
 
 ## 7. Theories, resolved
diff --git a/wiki/Execution-Plane.md b/wiki/Execution-Plane.md
index 567f41c..4a84457 100644
--- a/wiki/Execution-Plane.md
+++ b/wiki/Execution-Plane.md
@@ -8,7 +8,7 @@
 > when the two disagree, the docs tree wins. Front door:
 > [`../docs/README.md`](../docs/README.md).
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` proven with the
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented, default-off or parameter-gated;
 `[wip]` partial; `[wall]` current blocker; `[target]` named success latch;
 `[planned]` designed, not built.
@@ -169,13 +169,19 @@ guest: push + QMD + GPFIFO entry + doorbell (BAR0 0x88704)
   stage-0/1 image is now authored and live: a VTG SPH at `family+0x900`
   (first word `020a0481`) is fetched by both vertex slots
   (`DS-IMAGE st0=st1=020a0481`; DS fell `0x86040626 -> 0x84000420`,
-  reproduced on two boots). No non-black **window/screen** frame has been
-  produced through the NVIDIA path yet: the remaining DS bits are stage
-  type/context (SPH5/SPH10/SPH18), the 728-B draw window's released macros
-  (`0x33/0x39/0x1/0x0`) do not include the `DRAW_IAB` call, so the draw never
-  stores (`wrote=0`, `px0=0`); the window/screen present is unproven, and the
-  per-boot binding plus X first-generation lottery is the throughput limiter.
-  Those are the
+  reproduced on two boots). The release path is now host-deterministic when
+  the pack completes: the saved-window release carrier snapshots the held
+  window and re-submits it with the calls released once the pack is resident
+  (c772), and the held-CALL census plus the SA[34] golden fill prove the
+  slot-34 `DRAW_IAB` target (`client=golden=used=0x265`). No non-black
+  **window/screen** frame has been produced through the NVIDIA path yet: the
+  blocker is call order (the 728-B window places slot-34 after the `0x33/0x39`
+  setup, so the DS latch `0x84000420` pre-empts it; the 324-B window places it
+  first and ran `mac=0x22`), the reorder `a03a68ea` is landed but unexercised,
+  pack completion is still a per-boot lottery, the DS stage type/context bits
+  (SPH5/SPH10/SPH18) remain, and the draw does not store (`wrote=0`,
+  `px0=0`); the window/screen present is unproven, and the per-boot binding
+  plus X first-generation lottery is the throughput limiter. Those are the
   named blockers. The lanes and the ladder are on
   [`Graphics-Execution.md`](Graphics-Execution.md).
 
diff --git a/wiki/FAQ.md b/wiki/FAQ.md
index 1035c5f..b527ce2 100644
--- a/wiki/FAQ.md
+++ b/wiki/FAQ.md
@@ -5,7 +5,7 @@
 > [`../docs/09-reference/glossary-and-faq.md`](../docs/09-reference/glossary-and-faq.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`.
+Status: 2026-11-15, tree `master @ 6aeb20c7`.
 
 ## Project and positioning
 
@@ -59,11 +59,18 @@ first `MME-PACK-REARM` fires, the fixed-CB region is aliased, and `DRAW_IAB`
 populated. The DS stage-0/1 image is now authored and live: a VTG SPH at
 `family+0x900` (first word `020a0481`) is fetched by both vertex slots
 (`st0=st1=020a0481`), and the DS value fell `0x86040626 -> 0x84000420`
-(reproduced on two boots). Window and screen pixels are still the wall: the
-remaining DS bits are stage type/context (SPH5/SPH10/SPH18), the 728-B draw
-window's released macros (`0x33/0x39/0x1/0x0`) do not include the `DRAW_IAB`
-call, so the draw never stores, glxgears' window is black, and the per-boot
-binding plus X first-generation start lottery is the throughput limiter. The
+(reproduced on two boots). The release path is now host-deterministic when
+the pack completes (the saved-window release carrier replays the held window
+with the calls released; the held-CALL census plus the SA[34] golden fill
+prove `client=golden=used=0x265`). Window and screen pixels are still the
+wall: the blocker is call order (the 728-B window places the slot-34
+`DRAW_IAB` call after the `0x33/0x39` setup, so the `0x39` DS latch
+`0x84000420` pre-empts it; the 324-B window places it first and ran
+`mac=0x22`), the reorder `a03a68ea` is landed but unexercised, pack
+completion is still a per-boot lottery, the DS stage type/context bits
+(SPH5/SPH10/SPH18) remain, so the draw never stores, glxgears' window is
+black, and the per-boot binding plus X first-generation start lottery is the
+throughput limiter. The
 guest Vulkan pipeline runs end to end (device
 → command buffer → fence → readback) but frames are black. See
 [`OpenGL.md`](OpenGL.md), [`Vulkan.md`](Vulkan.md) and
diff --git a/wiki/Graphics-Execution.md b/wiki/Graphics-Execution.md
index 31ad576..0b5d97c 100644
--- a/wiki/Graphics-Execution.md
+++ b/wiki/Graphics-Execution.md
@@ -12,7 +12,7 @@
 > [`../docs/04-implementation/04-real-render-walls.md`](../docs/04-implementation/04-real-render-walls.md)
 > (the measured walls); the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` observed end to
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` observed end to
 end; `[wip]` partially built; `[wall]` current blocker; `[target]` defined
 success state; `[planned]` designed, not built.
 
@@ -129,13 +129,30 @@ fidelity:
    `0x2054` slot-1 bind to the authored page (`SPH-SLOT1-REWRITE`), and the DS
    latch reads the authored image for both vertex slots (`DS-IMAGE
    st0=st1=020a0481 code=ff007321`; the DS value fell
-   `0x86040626 -> 0x84000420`), reproduced on two boots. The remaining DS bits
-   are stage type/context (SPH5/SPH10/SPH18); the `DRAW_IAB` (`mac=0x22`) call
-   does not run in the 728-B draw window, whose released macros are
-   `0x33/0x39/0x1/0x0`, so stores still miss (`wrote=0`, `px0=0`). The
-   window/screen present is still the frontier (§6), and the per-boot binding
-   lottery (the GL client usually rides the X channel in indirect mode, and X
-   start keeps a first-generation lottery) is the throughput limiter.
+   `0x86040626 -> 0x84000420`), reproduced on two boots. The release path is
+   now host-deterministic when the pack completes: a saved-window release
+   carrier snapshots the held window at `MME-CALL-HOLD` and re-submits it with
+   the calls released once the pack is resident (c772: `MME-CARRY-SAVE
+   win=240 held=68` -> `MME-CARRY-FIRE mode=release` -> synthetic `GR LAUNCH
+   push=0x6d6d6500` -> `MME-PACK-REARM` gen=5 -> DS `0x84000420` ->
+   `MME-CARRY-COMPLETE`), and the held-CALL census plus the SA[34] golden fill
+   prove the `DRAW_IAB` call and its target are present
+   (`MME-CALL-TARGET slot=34 method=0x3910 client=0x265 golden=0x265
+   used=0x265`; `MME-GOLDEN sa-fill slot=34 entry=0x265`). The remaining
+   blocker is **call order**: the saved 728-B state window places the slot-34
+   run at `off=0x340` after the `0x33/0x39` setup, so the last `0x39` latches
+   DS `0x84000420` and the MFE never reaches CALL(34) (c780 released
+   `0x33/0x39/0x0`); the 324-B DRAW window places it first (off `0x1c0`) and
+   ran `mac=0x22` (c716). A release-window reorder (`a03a68ea`:
+   `[head binds][slot-34 run][rest]`) is landed but not yet exercised, and
+   pack completion is still a per-boot lottery (poisoned pack-part; no pump
+   pass after the carry arm; carry-armed-never-fired); `6aeb20c7` (eng64)
+   chains the release behind a successful pack carrier and names a stalled
+   carrier's gate (`MME-CARRY-WAIT reason=...`), validation pending. The
+   remaining DS bits
+   are stage type/context (SPH5/SPH10/SPH18); stores still miss (`wrote=0`,
+   `px0=0`). The window/screen present is still the frontier (§6), and the
+   per-boot binding/X-first-generation lottery is the throughput limiter.
 
 ## 4. The channel and object picture
 
@@ -196,8 +213,8 @@ swaps, and the GR backend no longer times out (the pair-close/pair-safe
    DDX/ScreenInit stability walls are closed, and the direct-GL ring/USERD
    machinery is hardened. The MME pack completes and the draw macro runs, and
    the authored DS stage image is live for both vertex slots; the next step is
-   the draw-issue macro (`mac=0x22`) and the stores, then the window/screen
-   present path.
+   the release call order (slot-34 `DRAW_IAB` before the setup calls) so the
+   draw issues and stores, then the window/screen present path.
 
 During bring-up the module also carries a **diagnostics-only mirror** for apps
 that spin on a shared progress word; it exists so a run can proceed while the
@@ -223,10 +240,25 @@ requires it switched off, along with any external poke.
    (`SPH-AUTHOR`, first word `020a0481`) and the window's own `0x2054` slot-1
    bind is rewritten to it (`SPH-SLOT1-REWRITE`), so the DS latch reads
    `st0=st1=020a0481 code=ff007321` and the DS value falls
-   `0x86040626 -> 0x84000420` (reproduced on two boots). The remaining gates
-   are the stage type/context bits (SPH5/SPH10/SPH18) and the draw-issue call:
-   the 728-B draw window's released macros are `0x33/0x39/0x1/0x0`, the
-   `DRAW_IAB` (`mac=0x22`) call does not run, and stores still miss
+   `0x86040626 -> 0x84000420` (reproduced on two boots). The release is
+   host-deterministic when the pack completes: the saved-window release
+   carrier snapshots the held window and re-submits it with calls released
+   once the pack is resident (c772: `MME-CARRY-SAVE win=240 held=68` ->
+   `MME-CARRY-FIRE mode=release` -> synthetic `GR LAUNCH push=0x6d6d6500` ->
+   `MME-PACK-REARM` gen=5 -> DS `0x84000420` -> `MME-CARRY-COMPLETE`); the
+   held-CALL census and SA[34] golden fill settle the call and its address
+   (`MME-CALL-TARGET slot=34 method=0x3910 client=0x265 golden=0x265
+   used=0x265`; `MME-GOLDEN sa-fill slot=34 entry=0x265`). The remaining
+   blocker is **call order**: the 728-B state window places the slot-34 run
+   at `off=0x340` after the `0x33/0x39` setup, so the last `0x39` latches DS
+   `0x84000420` and the MFE never reaches CALL(34) (c780 released
+   `0x33/0x39/0x0`); the 324-B DRAW window places it first (off `0x1c0`) and
+   ran `mac=0x22` (c716). The reorder `a03a68ea` (`[head binds][slot-34
+   run][rest]`) is landed but unexercised (the c781/c782 boots never completed
+   the pack), and pack completion is still a per-boot lottery (`6aeb20c7`,
+   eng64, chains the release behind a successful pack carrier and names the
+   stalled gate; validation pending). The remaining
+   DS bits are stage type/context (SPH5/SPH10/SPH18); stores still miss
    (`wrote=0`, `px0=0`). Closed on the way: the QMD-carrier theory
    (refuted: no QMD bit in the entry format, no QMD magic in 256 MiB BAR1)
    and RT routing (the clear targets RT0 while the window binds RT1; RT0 bind
@@ -300,7 +332,11 @@ requires it switched off, along with any external poke.
 | First `MME-PACK-REARM` captured (engine-global completion plus keep-done-across-recycle); fixed-CB region aliased; released calls run macros | `[live]` |
 | `DRAW_IAB` (`mac=0x22`) executes on the 324-B window class after a cross-lane `MME-PACK-REARM`; SPH-BIND prelude emits 84 words; DS stage VAs populate | `[live]` |
 | DS stage-0/1 image: a VTG SPH is authored at `family+0x900` and the window's own slot-1 bind rewritten to it; the DS latch reads `st0=st1=020a0481` (`0x86040626 -> 0x84000420`, two boots) | `[live]` |
-| Remaining DS bits (stage type/context: SPH5/SPH10/SPH18); the 728-B draw window's released macros (`0x33/0x39/0x1/0x0`) do not include `DRAW_IAB` (`mac=0x22`); stores `wrote=0` | `[wall]` |
+| Saved-window release carrier: the held window is snapshotted at `MME-CALL-HOLD` and re-submitted with calls released once the pack is resident (c772: save 240/68 -> fire -> synthetic `GR LAUNCH 0x6d6d6500` -> REARM -> DS `0x84000420`) | `[live]` |
+| Held-CALL census + SA[34] golden fill: the slot-34 `DRAW_IAB` call is present in the saved 728-B window; `client=golden=used=0x265` (`MME-GOLDEN sa-fill slot=34 entry=0x265`) | `[live]` |
+| Call order: the 728-B window places slot-34 at `off=0x340` after the `0x33/0x39` setup, so the `0x39` DS latch pre-empts CALL(34) (c780: `mac=0x33/0x39/0x0`); the reorder `a03a68ea` is landed but unexercised | `[wall]` |
+| Pack-completion lottery (poisoned pack-part; no pump pass after the carry arm; carry-armed-never-fired) gates the deterministic release | `[wall]` |
+| DS `0x84000420` (SPH5/SPH10/SPH18 stage type/context) after the draw-issue call; stores `wrote=0` | `[wall]` |
 | Window/screen present produces non-black window pixels | `[wall]` |
 | X screen-init first-generation lottery (`modeNum` parity; only an immediately-post-boot X passes DDX DMA init; dominant throughput limiter) | `[wip]` |
 | Non-black screen pixels from the emulated vGPU's 3D pipeline | `[wall]` |
@@ -318,8 +354,9 @@ requires it switched off, along with any external poke.
   client's GL init and the direct-GL GR lane, not the game loop or a
   presented frame; the client's draw-state push reaches the engine, the MME
   program completes and the draw macro executes, and the authored DS stage
-  image is fetched by both vertex slots, but the 728-B window's draw-issue
-  call and the stores are still missing, so the window stays black.
+  image is fetched by both vertex slots, but the 728-B window places the
+  slot-34 draw-issue call after the setup calls (so the DS latch pre-empts it)
+  and the stores are still missing, so the window stays black.
 * The engine-zero-write (NOWRITE) campaign is not a rendering result: it and
   the draw census together proved the submission is macro-driven (no
   method-grammar draw header exists), that RT routing is not the cause, and
diff --git a/wiki/Host-Module.md b/wiki/Host-Module.md
index fa0b5a9..de68e5c 100644
--- a/wiki/Host-Module.md
+++ b/wiki/Host-Module.md
@@ -6,7 +6,7 @@
 > source: [`../docs/03-architecture/06-host-module-and-hybrid-model.md`](../docs/03-architecture/06-host-module-and-hybrid-model.md);
 > the docs tree wins on disagreement with this page.
 >
-> Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` observed with
+> Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` observed with
 > the stock guest driver; `[wip]` demonstrated live, being productized;
 > `[gated]` implemented default-off behind supervised gates; `[wall]` known
 > blocking limit; `[target]` designed, not built; `[planned]` roadmap.
@@ -144,11 +144,17 @@ the first `MME-PACK-REARM` fires, the fixed-CB region is aliased, and
 VAs populated. The DS stage-0/1 image is now authored and live: a VTG SPH at
 `family+0x900` (`SPH-AUTHOR`, first word `020a0481`) is fetched by both vertex
 slots, with the window's own slot-1 bind rewritten to it
-(`SPH-SLOT1-REWRITE`; DS `0x86040626 -> 0x84000420`, two boots). The remaining
-GL gap is the stage type/context bits (SPH5/SPH10/SPH18) plus the 728-B
-window's draw-issue call (`mac=0x22` is not among its released macros), so the
-draws still do not store, and the window/screen present path, which currently
-stays black or wedges X.
+(`SPH-SLOT1-REWRITE`; DS `0x86040626 -> 0x84000420`, two boots). The release
+path is now host-deterministic when the pack completes: the saved-window
+release carrier snapshots the held window and re-submits it with the calls
+released once the pack is resident (c772), and the held-CALL census plus the
+SA[34] golden fill prove the slot-34 `DRAW_IAB` target
+(`client=golden=used=0x265`). The remaining GL gap is call order (the 728-B
+window places slot-34 after the `0x33/0x39` setup, so the DS latch pre-empts
+it; the 324-B window places it first and ran `mac=0x22`), the reorder
+`a03a68ea` (landed, unexercised), the pack-completion lottery, the DS stage
+type/context bits (SPH5/SPH10/SPH18), the stores, and the window/screen
+present path, which currently stays black or wedges X.
 
 ## 6. Debug parameters
 
diff --git a/wiki/OpenGL.md b/wiki/OpenGL.md
index f07765f..8a5e256 100644
--- a/wiki/OpenGL.md
+++ b/wiki/OpenGL.md
@@ -12,7 +12,7 @@
 > [`../docs/03-architecture/02-guest-stack-and-cudasw.md`](../docs/03-architecture/02-guest-stack-and-cudasw.md)
 > (the guest stack). The docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` observed with the
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` observed with the
 stock guest driver; `[wip]` partial; `[wall]` current blocker; `[target]`
 defined success state.
 
@@ -104,7 +104,11 @@ Rated honestly, against the milestone ladder in the plan:
 | First `MME-PACK-REARM` captured (engine-global completion plus keep-done-across-recycle); fixed-CB region aliased; released calls run macros | `[live]` |
 | `DRAW_IAB` (`mac=0x22`) executes on the 324-B window class after a cross-lane `MME-PACK-REARM`; SPH-BIND prelude emits 84 words; DS stage VAs populate | `[live]` |
 | DS stage-0/1 image: a VTG SPH is authored at `family+0x900` and the window's own slot-1 bind rewritten to it; the DS latch reads `st0=st1=020a0481` (`0x86040626 -> 0x84000420`, two boots) | `[live]` |
-| Remaining DS bits (stage type/context: SPH5/SPH10/SPH18); the 728-B draw window's released macros (`0x33/0x39/0x1/0x0`) do not include `DRAW_IAB` (`mac=0x22`); stores `wrote=0` | `[wall]` |
+| Saved-window release carrier: the held window is snapshotted at `MME-CALL-HOLD` and re-submitted with calls released once the pack is resident (c772: save 240/68 -> fire -> synthetic `GR LAUNCH 0x6d6d6500` -> REARM -> DS `0x84000420`) | `[live]` |
+| Held-CALL census + SA[34] golden fill: the slot-34 `DRAW_IAB` call is present in the saved 728-B window; `client=golden=used=0x265` (`MME-GOLDEN sa-fill slot=34 entry=0x265`) | `[live]` |
+| Call order: the 728-B window places slot-34 at `off=0x340` after the `0x33/0x39` setup, so the `0x39` DS latch pre-empts CALL(34) (c780: `mac=0x33/0x39/0x0`); the reorder `a03a68ea` is landed but unexercised | `[wall]` |
+| Pack-completion lottery (poisoned pack-part; no pump pass after the carry arm; carry-armed-never-fired) gates the deterministic release | `[wall]` |
+| DS `0x84000420` (SPH5/SPH10/SPH18 stage type/context) after the draw-issue call; stores `wrote=0` | `[wall]` |
 | Window/screen present produces non-black screen pixels | `[wall]` |
 | X screen-init first-generation lottery (`modeNum` parity; only an immediately-post-boot X passes DDX DMA init; dominant throughput limiter) | `[wip]` |
 | 60 fps sustained, no forcing (M-GL4) | `[target]` |
@@ -143,12 +147,24 @@ prelude intact (84 words) and the DS stage VAs populated. The **DS stage-0/1
 image is now authored and live** (a VTG SPH at `family+0x900`, first word
 `020a0481`, with the window's own slot-1 bind rewritten to it): the DS latch
 reads `st0=st1=020a0481 code=ff007321` and the DS value falls
-`0x86040626 -> 0x84000420`, reproduced on two boots. The remaining gates are
-the stage type/context bits (SPH5/SPH10/SPH18), the draw-issue call (the
-728-B window's released macros are `0x33/0x39/0x1/0x0`, not `DRAW_IAB`), so
-the draw still does not store, the window/screen present path (glxgears'
-window is black and a window draw can wedge X), and the per-boot binding/X
-first-generation start lottery — then the first rendered screen frame.
+`0x86040626 -> 0x84000420`, reproduced on two boots. The release path is now
+host-deterministic when the pack completes: the saved-window release carrier
+snapshots the held window and re-submits it with the calls released once the
+pack is resident (c772 end to end), and the held-CALL census plus the SA[34]
+golden fill prove the slot-34 `DRAW_IAB` call and its target are present
+(`MME-CALL-TARGET slot=34 method=0x3910 client=0x265 golden=0x265
+used=0x265`). The remaining blocker is **call order**: the saved 728-B state
+window places the slot-34 run after the `0x33/0x39` setup, so the last `0x39`
+latches DS `0x84000420` and the MFE never reaches CALL(34) (c780); the 324-B
+DRAW window places it first and ran `mac=0x22` (c716). A release-window
+reorder (`a03a68ea`) is landed but not yet exercised, and pack completion is
+still a per-boot lottery (`6aeb20c7`, eng64, chains the release behind a
+successful pack carrier and names the stalled gate; validation pending).
+After that come the remaining DS stage type/context
+bits (SPH5/SPH10/SPH18), the stores, the window/screen present path
+(glxgears' window is black and a window draw can wedge X), and the per-boot
+binding/X first-generation start lottery — then the first rendered screen
+frame.
 
 ## 6. What is not claimed
 
@@ -158,9 +174,12 @@ first-generation start lottery — then the first rendered screen frame.
   sysmem -> kvmfr ivshmem -> host reader), not from a windowed X screen
   capture. The client's draw-state push reaches the engine, the MME program
   completes and the draw macro executes, and the authored DS stage image is
-  fetched by both vertex slots; but the 728-B window's draw-issue call and the
-  stores are still missing, a synchronous window draw can wedge X, and X start
-  retains a per-boot first-generation lottery. Those are the current walls.
+  fetched by both vertex slots; the release carrier can now replay the held
+  window deterministically when the pack completes, but the 728-B window
+  places the slot-34 draw-issue call after the setup calls (so the DS latch
+  pre-empts it) and the stores are still missing, a synchronous window draw
+  can wedge X, and X start retains a per-boot first-generation lottery. Those
+  are the current walls.
 * GZDoom reaching `V_Init: allocate screen` is not a rendered-frame claim; it
   proves the client's GL init and the direct-GL GR lane, not the game loop or
   a presented frame.
diff --git a/wiki/Physical-GPU-Backend.md b/wiki/Physical-GPU-Backend.md
index f050b1d..ef2dcd3 100644
--- a/wiki/Physical-GPU-Backend.md
+++ b/wiki/Physical-GPU-Backend.md
@@ -5,7 +5,7 @@
 > guest-facing emulation. Canonical sources: [`../docs/03-architecture/08-physical-gpu-integration.md`](../docs/03-architecture/08-physical-gpu-integration.md)
 > and [`../docs/03-architecture/11-physical-backend-guest-wiring.md`](../docs/03-architecture/11-physical-backend-guest-wiring.md); the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` proven with the
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented default-off; `[wip]` partially
 built; `[wall]` current blocker; `[target]` planned end state.
 
@@ -109,7 +109,7 @@ FAIL  a failed mutating operation parks the device in a locked fail-safe;
 | Host RM client and first real engine work (static config, real objects, 4 KiB CE copy) | done `[live]` |
 | Guest-copy forwarding, deferred release, hardware-primary copies, engine-authored relay, fault relay | verified live (seams parameterised and fail-open); the staged-transfer class is under repair `[live]` |
 | CUDA kernel execution (`vectorAdd` and further clients) | done `[live]` — stock guest CUDA clients (vector-add, matrix-multiply, transformer) execute on the physical engine with verified results and engine-authored completions relayed to the guest |
-| Graphics method-stream execution (verbatim 3D replay, synthesized launches, direct-GL client channels) | `[wip]` — the engine retires real graphics streams, the display/KMS stack registers and X + stock GLX are green (the DDX/ScreenInit stability walls are closed, X green >10 minutes), captured GL sections execute, the direct-GL submission is fully decoded (macro-driven, no classic draw header), the client's draw-state push reaches the engine, the MME pack completes, the `DRAW_IAB` macro executes, and the DS stage image is authored and live for both vertex slots (`st0=st1=020a0481`), and the first non-black GPU-rendered frames are captured off-screen; the remaining draw-issue `mac=0x22`/stores and the window/screen present are the frontier ([`Graphics-Execution.md`](Graphics-Execution.md)) |
+| Graphics method-stream execution (verbatim 3D replay, synthesized launches, direct-GL client channels) | `[wip]` — the engine retires real graphics streams, the display/KMS stack registers and X + stock GLX are green (the DDX/ScreenInit stability walls are closed, X green >10 minutes), captured GL sections execute, the direct-GL submission is fully decoded (macro-driven, no classic draw header), the client's draw-state push reaches the engine, the MME pack completes, the `DRAW_IAB` macro executes, the DS stage image is authored and live for both vertex slots (`st0=st1=020a0481`), the saved-window release carrier replays the held window deterministically once the pack is resident, and the first non-black GPU-rendered frames are captured off-screen; the remaining release call order (`a03a68ea`), the pack-completion lottery, the stores and the window/screen present are the frontier ([`Graphics-Execution.md`](Graphics-Execution.md)) |
 
 ## 7. The execution frontier
 
@@ -130,12 +130,15 @@ the DDX 3D replay executes, captured GL sections execute on the engine, and
 the first non-black GPU-rendered frames are proven (500/500 off-screen frames
 per run plus captured videos); the direct-GL submission is fully decoded
 (macro-driven) and its draw-state push reaches the engine, the MME pack
-completes, the `DRAW_IAB` macro executes, and the DS stage image is authored
-and live for both vertex slots (`st0=st1=020a0481`; DS `0x86040626 ->
-0x84000420`, two boots), so the remaining graphics gates are the stage
-type/context bits plus the draw-issue call and stores, the window/screen
-present, and the per-boot binding/X first-generation start lottery before
-non-black window pixels. The remaining
+completes, the `DRAW_IAB` macro executes, the DS stage image is authored and
+live for both vertex slots (`st0=st1=020a0481`; DS `0x86040626 ->
+0x84000420`, two boots), and the saved-window release carrier replays the
+held window deterministically once the pack is resident (c772; the slot-34
+census plus the SA[34] golden fill prove `client=golden=used=0x265`), so the
+remaining graphics gates are the release call order (`a03a68ea`, landed but
+unexercised), the pack-completion lottery, the DS stage type/context bits,
+the stores, the window/screen present, and the per-boot binding/X
+first-generation start lottery before non-black window pixels. The remaining
 compute work is the staged-transfer class (under repair), the every-boot
 acceptance campaign, and per-guest execution isolation — see
 [`Execution-Frontier.md`](Execution-Frontier.md) and
diff --git a/wiki/Project-Goals.md b/wiki/Project-Goals.md
index f041aa1..c45d9cc 100644
--- a/wiki/Project-Goals.md
+++ b/wiki/Project-Goals.md
@@ -10,7 +10,7 @@
 > [`Execution-Frontier.md`](Execution-Frontier.md) and
 > [`Graphics-Execution.md`](Graphics-Execution.md).
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` working with the
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` working with the
 stock guest driver; `[wip]` in progress; `[planned]` designed, not built;
 `[target]` bring-up ahead; `[non-goal]` explicitly out of scope.
 
@@ -51,7 +51,7 @@ drivers, no license.**
 | Stock guest driver initialisation | The unmodified driver probes, initialises and enumerates as on bare metal (`nvidia-smi`) | `[live]` — TU104 reference platform |
 | Full CUDA driver-API surface | Context creation, allocation, copies, free, destroy complete with correct results | `[live]` — the driver-API smoke prints `ALL OK`; the 64-byte payload round-trips |
 | CUDA kernel execution on real hardware | Verified guest kernels execute on the physical GPU, with engine-authored completions waking the guest | `[live]` — vector-add, matrix-multiply and transformer clients green on fresh boots; the staged-transfer class, the every-boot acceptance campaign and per-guest isolation are in progress ([`Execution-Frontier.md`](Execution-Frontier.md)) |
-| OpenGL (3D graphics) | Stock guest GL applications render real pixels through the emulated vGPU | `[wip]` — the display/KMS stack and X run, the stock NVIDIA GLX path is fully green (`glxinfo -B` rc 0, OpenGL 4.6.0 direct, `glxgears` ~520 FPS), the 2D path is green, the DDX 3D replay executes, the X DDX/ScreenInit stability walls are closed (X green >10 minutes), captured GL sections execute on the engine, the direct-GL submission is fully decoded (macro-driven, no classic draw header), the client's draw-state push reaches the engine, the MME pack completes, the `DRAW_IAB` macro executes, the DS stage image is authored and live for both vertex slots (`st0=st1=020a0481`), and the first non-black GPU-rendered frames plus captured videos (45.4 s and 50 s) are proven off-screen; GZDoom reaches `V_Init`. Window/screen pixels remain the frontier: the remaining DS stage type/context bits and the draw-issue `mac=0x22`/stores are the last named gates before window pixels, the window/screen present is unproven, and the per-boot binding/X first-generation lottery is the throughput limiter ([`OpenGL.md`](OpenGL.md)) |
+| OpenGL (3D graphics) | Stock guest GL applications render real pixels through the emulated vGPU | `[wip]` — the display/KMS stack and X run, the stock NVIDIA GLX path is fully green (`glxinfo -B` rc 0, OpenGL 4.6.0 direct, `glxgears` ~520 FPS), the 2D path is green, the DDX 3D replay executes, the X DDX/ScreenInit stability walls are closed (X green >10 minutes), captured GL sections execute on the engine, the direct-GL submission is fully decoded (macro-driven, no classic draw header), the client's draw-state push reaches the engine, the MME pack completes, the `DRAW_IAB` macro executes, the DS stage image is authored and live for both vertex slots (`st0=st1=020a0481`), the saved-window release carrier replays the held window deterministically once the pack is resident (slot-34 census plus SA[34] golden fill prove `client=golden=used=0x265`), and the first non-black GPU-rendered frames plus captured videos (45.4 s and 50 s) are proven off-screen; GZDoom reaches `V_Init`. Window/screen pixels remain the frontier: the release call order (`a03a68ea`, landed but unexercised), the pack-completion lottery, the remaining DS stage type/context bits and the stores are the last named gates before window pixels, the window/screen present is unproven, and the per-boot binding/X first-generation lottery is the throughput limiter ([`OpenGL.md`](OpenGL.md)) |
 | Vulkan | Stock guest Vulkan applications render real pixels | `[wip]` — the pipeline runs end to end (device → command buffer → fence → readback); frames are black — program delivery and program-VA mapping are the frontier ([`Vulkan.md`](Vulkan.md)) |
 | Windows guests (DirectX, CUDA) | A stock WDDM driver and stock D3D/CUDA applications run in Windows guests | `[target]` — not started; same emulation target ([`DirectX.md`](DirectX.md)) |
 | Video (NVENC/NVDEC) | Encode/decode through the emulated device | `[planned]` |
diff --git a/wiki/Project-Plan.md b/wiki/Project-Plan.md
index 9f8b55d..2594282 100644
--- a/wiki/Project-Plan.md
+++ b/wiki/Project-Plan.md
@@ -15,7 +15,7 @@
 > [`../docs/06-portability/03-device-validation-and-porting-sequence.md`](../docs/06-portability/03-device-validation-and-porting-sequence.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[done]`, `[active]`,
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[done]`, `[active]`,
 `[ahead]` — the plan's own state vocabulary, distinct from the goal tags.
 
 ## 1. How the plan works
@@ -44,7 +44,7 @@ itself:
 |---|---|---|---|
 | **P0 — Platform** | Emulated vGPU device, GSP boot and GSP-RM emulation, stock guest driver initialisation | Driver-API smoke green (`ALL OK`) = evaluation rung 2 | `[done]` |
 | **P1 — First execution (compute)** | Guest CUDA kernels executing on the physical GPU, with engine-authored completions; then hardening | Verified clients + engine-authored completion = rung 3 core; hardening: staged-transfer class, every-boot acceptance, per-guest isolation | `[active]` — execution green; hardening in progress |
-| **P2 — Graphics execution** | OpenGL/Vulkan draw commands executed by the physical 3D pipeline and delivered as readable pixels | The graphics ladder: M-GL1 client context-init executes; M-GL2 `glxgears` non-black; M-GL3 GZDoom GL non-black through the mdev | `[active]` — between M-GL1 and M-GL2 with M-GL2's off-screen half proven: the display/KMS and DDX replay machinery work, X + stock GLX are green, the first non-black GPU-rendered frames and videos are captured, the X DDX/ScreenInit stability walls are closed, captured GL sections execute on the engine, the direct-GL submission is fully decoded (macro-driven, no classic draw header), the client's draw-state push reaches the engine, the MME pack completes, the `DRAW_IAB` macro executes, the DS stage image is authored and live for both vertex slots (`st0=st1=020a0481`); the remaining walls are the remaining DS stage type/context bits, the draw-issue `mac=0x22`/stores, the window/screen present, and the per-boot binding/X first-generation start lottery |
+| **P2 — Graphics execution** | OpenGL/Vulkan draw commands executed by the physical 3D pipeline and delivered as readable pixels | The graphics ladder: M-GL1 client context-init executes; M-GL2 `glxgears` non-black; M-GL3 GZDoom GL non-black through the mdev | `[active]` — between M-GL1 and M-GL2 with M-GL2's off-screen half proven: the display/KMS and DDX replay machinery work, X + stock GLX are green, the first non-black GPU-rendered frames and videos are captured, the X DDX/ScreenInit stability walls are closed, captured GL sections execute on the engine, the direct-GL submission is fully decoded (macro-driven, no classic draw header), the client's draw-state push reaches the engine, the MME pack completes, the `DRAW_IAB` macro executes, the DS stage image is authored and live for both vertex slots (`st0=st1=020a0481`), and the saved-window release carrier deterministically replays the held window once the pack is resident; the remaining walls are the release call order (`a03a68ea`, landed but unexercised), the pack-completion lottery, the remaining DS stage type/context bits and the stores, the window/screen present, and the per-boot binding/X first-generation start lottery |
 | **P3 — Sustained and multi-tenant** | Frame rates without assistance; multiple VMs sharing the GPU with measured fairness; soak-stable operation | Graphics M-GL4 (60 fps, no forcing) and M-GL5 (two VMs, two mdevs); CUDA battery + soak; per-guest execution isolation = rungs 4/5 | `[ahead]` |
 | **P4 — Breadth** | Video (NVENC/NVDEC), Windows/DirectX guests, live migration, non-KVM hypervisor transports | Per-case bring-up gates plus the matrix's evidence expectations | `[ahead]` |
 | **P5 — Scale and portability** | New GPU generations and driver families carried forward; published performance programme | A profile + measured delta per version, validated on hardware; A/B numbers published per the measurement contract | `[ahead]` |
@@ -68,13 +68,18 @@ Ranked, in dependency order:
    executes with the SPH-BIND prelude intact and the DS stage VAs populated.
    The **DS stage-0/1 image is now authored and live** (a VTG SPH at
    `family+0x900`, first word `020a0481`; the window's own slot-1 bind is
-   rewritten to it; DS `0x86040626 -> 0x84000420`, two boots). The named walls
-   are the remaining DS stage type/context bits (SPH5/SPH10/SPH18) plus the
-   draw-issue call (the 728-B window's released macros are `0x33/0x39/0x1/0x0`,
-   not `DRAW_IAB`), the window/screen present path (glxgears' window is black
-   and a window draw wedges X), the per-boot binding/X first-generation start
-   lottery (even `modeNum` required; now the dominant throughput limiter), and
-   then non-black window frames.
+   rewritten to it; DS `0x86040626 -> 0x84000420`, two boots). The release
+   path is now host-deterministic when the pack completes: the saved-window
+   release carrier replays the held window with the calls released, and the
+   slot-34 census plus the SA[34] golden fill prove
+   `client=golden=used=0x265`. The named walls are the release call order
+   (the 728-B window places slot-34 after the `0x33/0x39` setup, so the DS
+   latch pre-empts it; the reorder `a03a68ea` is landed but unexercised), the
+   pack-completion lottery, the remaining DS stage type/context bits
+   (SPH5/SPH10/SPH18) and the stores, the window/screen present path
+   (glxgears' window is black and a window draw wedges X), the per-boot
+   binding/X first-generation start lottery (even `modeNum` required; now the
+   dominant throughput limiter), and then non-black window frames.
    Full detail:
    [`Graphics-Execution.md`](Graphics-Execution.md) §6.
 2. **Compute hardening (P1).** The staged-transfer class (failure modes proven,
diff --git a/wiki/Project-Status.md b/wiki/Project-Status.md
index b63d6aa..6b1438a 100644
--- a/wiki/Project-Status.md
+++ b/wiki/Project-Status.md
@@ -10,7 +10,7 @@
 > (the execution frontier). When this page and the docs disagree, the docs tree
 > wins.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` proven with the
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented, default-off or behind supervised
 gates; `[wip]` partially implemented; `[wall]` current blocker; `[target]`
 named success state; `[planned]` designed, not built.
@@ -28,7 +28,7 @@ named success state; `[planned]` designed, not built.
 | Physical backend on real hardware (module-owned GPU running its real GSP-RM) | `[live]` boot, RPC session, object creation, copy-engine work and GR execution proven — the verified guest CUDA kernel clients execute through this backend, and graphics method streams execute on the engine ([`Graphics-Execution.md`](Graphics-Execution.md)) |
 | Display and KMS on the emulated vGPU (nvidia-modeset/NvKms, `/dev/dri`, X) | `[live]` in the campaign configuration — the emulated display engine serves the guest's display push-buffer channels (notifier plus `UPDATE -> FINISHED`), nvidia-modeset/NvKms registers (`/dev/dri/card0`, `renderD128`, `fb0`), `nvidia-smi -L` enumerates and X settles. The X DDX idle-DMA/ScreenInit, USERD-latch lifetime, re-probe-thrash, Xorg kernel-mode-spin and flip-event walls were closed (X green for >10 minutes in a validated window); what remains is the per-boot **first-generation X start lottery**, which by 11-13/11-14 was the dominant throughput limiter for the graphics A/B runs (only an X started immediately after boot passes DDX DMA init; long stretches of dead starts, one green first-start boot). The display-capability seam is parameterised ([`Graphics-Execution.md`](Graphics-Execution.md)) |
 | Multi-tenant isolation (mdev per VM, per-context page directories) | `[wip]` device-level coexistence works — multiple mediated devices with different emulated VRAM sizes and multiple guests coexist (two guests demonstrated); per-guest execution isolation for simultaneous CUDA guests is in progress |
-| OpenGL (3D graphics) | `[wip]` — the display/KMS stack registers, X and the stock NVIDIA GLX path are fully green (`glxinfo -B` returns 0 with OpenGL 4.6.0 and direct rendering; `glxgears` renders ~520 FPS with the emulated GPU's NVIDIA renderer), and the **first non-black GPU-rendered output** is proven: the pbuffer frame path produced 500/500 non-black 640x480 frames per run and captured videos (45.4 s on 2026-11-11; a 50 s 640x480 h264 capture on 2026-11-12). GZDoom reaches `V_Init: allocate screen` with its GL 4.6.0 context whenever the shared nvClip `modeNum` is even. **The direct-GL submission is now fully decoded:** no client push carries a method-grammar draw header — the channel's 9 NV906F entries tile one contiguous buffer and its per-frame work is carried as rewritten data-block blobs plus small state pushes (324/476/728 B) that invoke MME macros (the QMD-carrier hypothesis was tested and refuted). A content-gated FB-shadow rescue and a LOW-band rescue recover the recycled pushes: the client's draw-state push now opens a C597 section, is captured and marked for the verbatim 3D lane (the first direct-GL stream3d marks), and reaches the engine (`GR LAUNCH submitted`/`OK`, golden MME overlay accepted). **The MME chain now completes and executes the draw macro.** The multi-part keep-window mechanism won multi-frame windows; the part-launch poison was eliminated (the real fault was the client's own `SET_REPORT_SEMAPHORE`/`SET_NOTIFY` writes to client VAs that the host scratch page-table pool remaps — redirected to a mapped scratch slot; 49 cycles with zero poison and zero MMU faults); the 2799-word pack completes (2799/2799); engine-global completion plus keep-done-across-recycle produced the first `MME-PACK-REARM`; the fixed-CB region is aliased; and the released calls run macros through to **`DRAW_IAB` (`mac=0x22`)**. Two synthesized-prelude defects were then fixed: the SPH-BIND prelude self-destructed because an auto-dropped run broke its kept/final count (`444ae2c1`), and the stage block was silently skipped by a double-counted budget; with both fixed the prelude emits 84 words and the DS stage VAs populate (one validated boot carried the full post-REARM chain, `mac=0x22` and `DS 86040624`). **The DS stage-0/1 image is now authored and live**: a VTG SPH is written at `family+0x900` (`SPH-AUTHOR`, first word `020a0481`), the window's own later `0x2054` slot-1 bind is rewritten to the authored page (`SPH-SLOT1-REWRITE`), and the DS latch reads the authored image for both vertex slots (`DS-IMAGE st0=st1=020a0481 code=ff007321`; the DS value fell `0x86040626 -> 0x84000420`), reproduced on two boots. The remaining DS bits are stage type/context (SPH5/SPH10/SPH18), and the **`DRAW_IAB` (`mac=0x22`)** call does not run in the 728-B draw window (its released macros are `0x33/0x39/0x1/0x0`), so stores still miss (`wrote=0`, `px0=0`); the window/screen present path is unproven; and the per-boot binding lottery (the GL client usually rides the X channel in indirect mode, and X start keeps a first-generation lottery) is the throughput limiter ([`OpenGL.md`](OpenGL.md)) |
+| OpenGL (3D graphics) | `[wip]` — the display/KMS stack registers, X and the stock NVIDIA GLX path are fully green (`glxinfo -B` returns 0 with OpenGL 4.6.0 and direct rendering; `glxgears` renders ~520 FPS with the emulated GPU's NVIDIA renderer), and the **first non-black GPU-rendered output** is proven: the pbuffer frame path produced 500/500 non-black 640x480 frames per run and captured videos (45.4 s on 2026-11-11; a 50 s 640x480 h264 capture on 2026-11-12). GZDoom reaches `V_Init: allocate screen` with its GL 4.6.0 context whenever the shared nvClip `modeNum` is even. **The direct-GL submission is now fully decoded:** no client push carries a method-grammar draw header — the channel's 9 NV906F entries tile one contiguous buffer and its per-frame work is carried as rewritten data-block blobs plus small state pushes (324/476/728 B) that invoke MME macros (the QMD-carrier hypothesis was tested and refuted). A content-gated FB-shadow rescue and a LOW-band rescue recover the recycled pushes: the client's draw-state push now opens a C597 section, is captured and marked for the verbatim 3D lane (the first direct-GL stream3d marks), and reaches the engine (`GR LAUNCH submitted`/`OK`, golden MME overlay accepted). **The MME chain now completes and executes the draw macro.** The multi-part keep-window mechanism won multi-frame windows; the part-launch poison was eliminated (the real fault was the client's own `SET_REPORT_SEMAPHORE`/`SET_NOTIFY` writes to client VAs that the host scratch page-table pool remaps — redirected to a mapped scratch slot; 49 cycles with zero poison and zero MMU faults); the 2799-word pack completes (2799/2799); engine-global completion plus keep-done-across-recycle produced the first `MME-PACK-REARM`; the fixed-CB region is aliased; and the released calls run macros through to **`DRAW_IAB` (`mac=0x22`)**. Two synthesized-prelude defects were then fixed: the SPH-BIND prelude self-destructed because an auto-dropped run broke its kept/final count (`444ae2c1`), and the stage block was silently skipped by a double-counted budget; with both fixed the prelude emits 84 words and the DS stage VAs populate (one validated boot carried the full post-REARM chain, `mac=0x22` and `DS 86040624`). **The DS stage-0/1 image is now authored and live**: a VTG SPH is written at `family+0x900` (`SPH-AUTHOR`, first word `020a0481`), the window's own later `0x2054` slot-1 bind is rewritten to the authored page (`SPH-SLOT1-REWRITE`), and the DS latch reads the authored image for both vertex slots (`DS-IMAGE st0=st1=020a0481 code=ff007321`; the DS value fell `0x86040626 -> 0x84000420`), reproduced on two boots. The release path is now host-deterministic when the pack completes (the saved-window release carrier replays the held window with the calls released; the slot-34 census and SA[34] golden fill prove `client=golden=used=0x265`). The blocker is **call order**: the 728-B window places the slot-34 `DRAW_IAB` run after the `0x33/0x39` setup, so the `0x39` DS latch (`0x84000420`) pre-empts it; the 324-B window places it first and ran `mac=0x22`. A release-window reorder (`a03a68ea`) is landed but unexercised, pack completion is still a per-boot lottery (`6aeb20c7`, eng64, chains the release behind a successful pack carrier and names the stalled gate; validation pending), and the remaining DS stage type/context bits (SPH5/SPH10/SPH18) leave the stores missing (`wrote=0`, `px0=0`); the window/screen present path is unproven; and the per-boot binding lottery (the GL client usually rides the X channel in indirect mode, and X start keeps a first-generation lottery) is the throughput limiter ([`OpenGL.md`](OpenGL.md)) |
 | Vulkan (3D/compute) | `[wip]` — the guest Vulkan pipeline runs end to end on the emulated vGPU (device, allocation, pipeline, command buffer, fence, queue submit, readback) and the engine executes translated launches; frames are still black — program delivery and program-VA mapping are the frontier ([`Vulkan.md`](Vulkan.md)) |
 | DirectX / Windows guests | `[planned]` (target) — no Windows guest booted yet; the architecture is the same emulation target ([`DirectX.md`](DirectX.md)) |
 | Video (NVENC/NVDEC) | `[planned]` |
@@ -82,9 +82,11 @@ GPU-rendered frames are proven off-screen (the pbuffer path produced a
 GZDoom reaches its screen-allocation stage with GL 4.6.0 on an even modeNum.
 The direct-GL submission is fully decoded, the MME multi-part program now
 completes and the draw macro executes, and the DS stage image is authored and
-live for both vertex slots; but windowed/screen pixels remain the frontier
-(the draw-issue `mac=0x22` and the stores are the next named gates, and X
-start keeps a first-generation lottery) — see [`OpenGL.md`](OpenGL.md). The
+live for both vertex slots; the saved-window release carrier now replays the
+held window deterministically when the pack completes, but windowed/screen
+pixels remain the frontier (the release call order, the pack-completion
+lottery and the stores are the next named gates, and X start keeps a
+first-generation lottery) — see [`OpenGL.md`](OpenGL.md). The
 risc-v-gsp-rm-debugger workbench
 ([`Riscv-GSP-RM-Debugger.md`](Riscv-GSP-RM-Debugger.md)) is the host-side
 tooling used to study the firmware side of that frontier.
diff --git a/wiki/System-Overview.md b/wiki/System-Overview.md
index 8d85b10..87732ca 100644
--- a/wiki/System-Overview.md
+++ b/wiki/System-Overview.md
@@ -7,7 +7,7 @@
 > and [`../docs/03-architecture/10-interaction-and-scheduling.md`](../docs/03-architecture/10-interaction-and-scheduling.md)
 > for the full picture); the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`. Tags: `[live]` proven with the
+Status: 2026-11-15, tree `master @ 6aeb20c7`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented default-off; `[wip]` partial;
 `[wall]` current blocker; `[target]` designed end state.
 
@@ -159,14 +159,19 @@ RPC from the guest to "firmware":
    SPH-BIND prelude intact and the DS stage VAs populated. The DS stage-0/1
    image is now authored and live: a VTG SPH at `family+0x900` (first word
    `020a0481`) is fetched by both vertex slots (`st0=st1=020a0481`; DS
-   `0x86040626 -> 0x84000420`, two boots). The remaining gates are the stage
-   type/context bits (SPH5/SPH10/SPH18) plus the draw-issue call (the 728-B
-   window's released macros are `0x33/0x39/0x1/0x0`, not `DRAW_IAB`), so the
-   draw still does not store (`wrote=0`, `px0=0`); the window/screen present
-   is unproven (a window draw can wedge X and glxgears' window is black), and
-   the per-boot binding plus X first-generation start lottery is the dominant
-   throughput limiter, so the remaining gates are the draw-issue/store and
-   the window/screen present before the first non-black window frame
+   `0x86040626 -> 0x84000420`, two boots). The release path is now
+   host-deterministic when the pack completes (the saved-window release
+   carrier replays the held window with calls released; the slot-34 census
+   plus SA[34] golden fill prove `client=golden=used=0x265`). The remaining
+   gates are the release call order (the 728-B window places slot-34 after
+   the `0x33/0x39` setup, so the DS latch pre-empts it; the 324-B window ran
+   `mac=0x22`; the reorder `a03a68ea` is landed but unexercised), the
+   pack-completion lottery, the DS stage type/context bits (SPH5/SPH10/SPH18),
+   the stores (`wrote=0`, `px0=0`), and the window/screen present (a window
+   draw can wedge X and glxgears' window is black); the per-boot binding plus
+   X first-generation start lottery is the dominant throughput limiter, so the
+   remaining gates are the call-order/store and the window/screen present
+   before the first non-black window frame
    ([`OpenGL.md`](OpenGL.md), [`Vulkan.md`](Vulkan.md)).
 
 ## 6. Where the detail lives