1 files changed, 46 insertions, 0 deletions
diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index b080732..0099306 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -1051,3 +1051,49 @@ shadow is re-copied from the guest page. The next work is to deliver the
 captured vertex image into the guest page for every window and to calibrate
 the viewport against the client's own CALL(33) arguments or a synthetic
 full-screen control draw.
+
+## Session 154d (r1494-r1496): fixed-CB stability and contiguous VTG streams
+
+Two delivery defects on the path from the client's constants and vertex buffers
+to the engine were isolated and fixed; neither alone produces fragments yet.
+
+1. **The fixed constant buffer must be re-delivered every draw.** The MME
+   constant-buffer base is forced to a page inside the client's screen
+   allocation and the engine reads it through the launch's bounce alias. That
+   page is ordinary guest memory: the client (and the guest console) can
+   overwrite it between launches. The previous fallback wrote an identity
+   matrix whenever the source VA failed to resolve, which wiped an already
+   validated real CB (`cb-copy ... src=synthetic-id`). The copy now remembers
+   the last page that resolved through a SYS (engine-visible) source and passed
+   the matrix gate, and reuses it for the rest of the boot when a later
+   resolution misses. The synthetic identity is used only when no real CB was
+   ever resolved. The copy is not skipped on an unchanged hash, because the
+   seed page can have been rewritten by the guest since the previous launch
+   (receipts: `src=vaswalk` -> `src=cached-real` with the client's MVP in
+   `m[0x80..0xbc]`, and a guest-witness readback of the real matrix words).
+
+2. **A VTG stream must be one contiguous engine-visible range.** The vertex
+   stream macro payload is `[stream, end_hi, end_lo, base_hi, base_lo]`, where
+   `end - base` is the stream length. Relocating `end` and `base` as two
+   independent single-page operands put a page-crossing stream's ends in
+   unrelated shadow windows: the computed length went negative and the fetch
+   past the base page read an invalid PTE (the `miss=1` poison seen once the
+   real vertex shader started executing). The payload pair is now mapped into
+   one fresh contiguous fetch line (up to 16 x 4 KB) and both words are
+   rewritten from that line; unresolvable pages map the module zero page so a
+   read is a degenerate vertex, never a fault. The receipt
+   (`MME-VSTREAM-LINE ... pages=N dummy=... line=... first8=...`) reads the
+   client's real vertex floats back through the mapped page.
+
+**Remaining wall (measured, r1496).** The active indexed draw's vertex and
+index buffers are vidmem (BAR1-aperture) allocations: the launch page set
+resolves them to FB page `0xb9f000`, but the emulated vidmem shadow for that
+page is all zero (`dump_vidmem` proof), while the same vertex/index data is
+present in guest system memory as the client's staging/backing copy. The
+engine therefore fetches zeros for the active draw even though the stream
+mapping is correct, and the copy-out still reports `0/900` changed pages. The
+fixed-CB source VA also moves between boots (resolved in r1492/r1493/r1495,
+unresolved in r1496), so a single hard-coded source VA is not sufficient. The
+DS continues to latch SPH stage errors on some windows. The next work is to
+source the active vertex/index page from the sysmem backing (or to make the
+vidmem upload deterministic) and to make the CB source discoverable per boot.