1 files changed, 57 insertions, 0 deletions
diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index 0099306..3119b75 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -1097,3 +1097,60 @@ unresolved in r1496), so a single hard-coded source VA is not sufficient. The
 DS continues to latch SPH stage errors on some windows. The next work is to
 source the active vertex/index page from the sysmem backing (or to make the
 vidmem upload deterministic) and to make the CB source discoverable per boot.
+
+## Session 154e (r1497-r1499, 2026-11-05): real-FB fetch delivery, per-boot CB, DS post-clear
+
+Three changes closed the "engine fetches zeros for the active draw" wall and
+moved the measured state to "the engine clears the target but draws no
+geometry".
+
+1. **Empty-shadow FB fetch pages are delivered from the real frame buffer.**
+   The active indexed draw's vertex/index buffers are mapped by the client's
+   own page tables with the vidmem aperture, but no emulated path ever
+   populated the BAR1 shadow copy of those pages (the upload did not pass
+   through an inline write, a decoded CE copy or a CPU aperture write), so
+   the engine fetched zeros. Two delivery paths now cover the page:
+   * when every byte of the shadow page is zero, a launch fetch page (a QMD
+     pointer, not the data-fill surface) is mapped with a VID-aperture leaf
+     to the real frame-buffer offset the guest page table names
+     (`FETCH-VID-MAP va=... fb=... qmd=...`);
+   * a vertex-stream page uses the same rule inside the contiguous fetch
+     line (`MME-VSTREAM-LINE ... vid=N fb0=...`);
+   * if the same VA also has a sysmem mapping with nonzero bytes, those
+     bytes are copied into the shadow page (`FETCH-SYSBACK`), which covers
+     boots where the client keeps a CPU-visible staging copy.
+   A page whose shadow already has content is never touched, so the working
+   sysmem streams, the fixed-CB seed and every engine-written page keep
+   their identity. Render-target/surface pages (QMD word NONE) are
+   deliberately excluded: their stores must land in the emulated page so the
+   copy-out can ship them back to the guest.
+
+2. **The fixed CB is discovered per boot.** When the client's
+   `SET_MME_SHADOW_SCRATCH(0x18)` write reaches a decoded push it is used as
+   the fixed-CB base; when that capture is absent the historically observed
+   base is tried as a candidate and the matrix gate decides. In r1499 the
+   candidate resolved through the VAS walk to the client's real page
+   (`first8=3ff35a31 be800000 be9e377b 3f737870 ...`, the client's MVP), and
+   42 of 96 copies used the real page with the rest served from the
+   remembered validated page.
+
+3. **The DS HWW ESR latch is cleared after each replayed window as well as
+   before it.** The latch is W1C; the pre-clear made each window's validation
+   set readable, the post-clear keeps a failed window's pending report from
+   poisoning the next window's entry state. The poison count stayed at 0-1
+   per run with the mask knob enabled.
+
+**Measured state (r1499).** The active draw's streams now read the client's
+real vertex floats (`MME-VSTREAM-LINE base=0x44fea00 first8=3f800000 00000000
+bf000000 bf800000 ...` and `base=0x44ff000 first8=4069999a ...`), and the
+engine executes without a fetch fault. It writes an opaque-black clear
+(`0xff000000`) into the render-target shadow page at FB offset `0x200000`
+and into the forced RT seed page at `0x504000` (`dump_vidmem` readback), the
+bounce copy-out ships the changed seed pages, and the guest's window capture
+is uniformly black (`xwd -id`, 800x600, non-black pixels 0, bbox 0,0,0,0).
+The clear reaching the target proves the RT0 bind and the color-store path;
+no gear fragments are produced. The next wall is geometry coverage: the
+index-buffer bind, the vertex-shader position output and the viewport/clip
+transform must be checked against the client's own draw arguments (the
+active index page currently reads as vertex floats at its bound VA, so the
+index/vertex role or the index count is also a candidate).