1 files changed, 40 insertions, 15 deletions
diff --git a/wiki/Execution-Frontier.md b/wiki/Execution-Frontier.md
index 1425aaf..15396c6 100644
--- a/wiki/Execution-Frontier.md
+++ b/wiki/Execution-Frontier.md
@@ -14,7 +14,7 @@
 > [`../docs/04-implementation/03-execution-frontier.md`](../docs/04-implementation/03-execution-frontier.md);
 > the docs tree wins on disagreement.
 
-Status: 2026-11-15, tree `master @ 692a7eb0`.
+Status: 2026-11-15, tree `master @ 6aeb20c7`.
 Tags: `[live]` observed; `[wip]` partial; `[wall]` current blocker; theories
 are labelled as such.
 
@@ -123,11 +123,25 @@ is aliased, and `DRAW_IAB` (`mac=0x22`) runs with the SPH-BIND prelude intact
 authored and live**: a VTG SPH at `family+0x900` (`SPH-AUTHOR`, first word
 `020a0481`) is what both vertex slots fetch (`DS-IMAGE st0=st1=020a0481
 code=ff007321`), the window's own later slot-1 bind is rewritten to it, and
-the DS value fell `0x86040626 -> 0x84000420` (reproduced on two boots). What
-is missing is **window/screen pixels through the NVIDIA path**: the remaining
-DS bits are stage type/context (SPH5/SPH10/SPH18), the 728-B draw window's
-released macros (`0x33/0x39/0x1/0x0`) do not include `DRAW_IAB` (`mac=0x22`),
-so the draw still does not store (`wrote=0`, `px0=0`); the window/screen
+the DS value fell `0x86040626 -> 0x84000420` (reproduced on two boots). The
+release path is now host-deterministic when the pack completes: the
+saved-window release carrier snapshots the held window and re-submits it with
+the calls released once the pack is resident (c772 end to end: save 240/68 ->
+fire -> synthetic `GR LAUNCH 0x6d6d6500` -> `MME-PACK-REARM` -> DS
+`0x84000420`), and the held-CALL census plus the SA[34] golden fill prove the
+`DRAW_IAB` call and its target are present (`MME-CALL-TARGET slot=34
+method=0x3910 client=0x265 golden=0x265 used=0x265`). What is missing is
+**window/screen pixels through the NVIDIA path**: the blocker is **call
+order** — the saved 728-B state window places the slot-34 run after the
+`0x33/0x39` setup, so the last `0x39` latches DS `0x84000420` and the MFE
+never reaches CALL(34) (c780), while the 324-B DRAW window places it first
+and ran `mac=0x22` (c716). A release-window reorder (`a03a68ea`) is landed
+but unexercised, and pack completion is still a per-boot lottery (poisoned
+pack-part; no pump pass after the carry arm; carry-armed-never-fired);
+`6aeb20c7` (eng64) chains the release behind a successful pack carrier and
+names a stalled carrier's gate, validation pending. The
+DS still carries the stage type/context bits (SPH5/SPH10/SPH18), so the draw
+does not store (`wrote=0`, `px0=0`); the window/screen
 present path is unproven, glxgears' window is black, and a synchronous window
 draw wedges X on some boots. The per-boot binding and X first-generation
 start lottery are now the dominant throughput limiter. The guest Vulkan
@@ -203,10 +217,19 @@ first `MME-PACK-REARM` fires, the fixed-CB region is aliased, and `DRAW_IAB`
 (`mac=0x22`) runs with the SPH-BIND prelude intact and the DS stage VAs
 populated. The **DS stage-0/1 image is now authored and live** (a VTG SPH at
 `family+0x900`, fetched by both vertex slots as `st0=st1=020a0481`; DS fell
-`0x86040626 -> 0x84000420`, reproduced on two boots); the remaining bits are
-stage type/context (SPH5/SPH10/SPH18), and the 728-B window's released macros
-(`0x33/0x39/0x1/0x0`) do not include the `DRAW_IAB` call, so the draws still
-do not store. glxgears' window is black, a window draw wedges X on some
+`0x86040626 -> 0x84000420`, reproduced on two boots). The release is
+host-deterministic when the pack completes: the saved-window release carrier
+re-submits the held window with the calls released (c772), and the held-CALL
+census plus SA[34] golden fill prove the slot-34 `DRAW_IAB` address
+(`client=golden=used=0x265`). The remaining blocker is call order: the 728-B
+state window places the slot-34 run after the `0x33/0x39` setup, so the `0x39`
+DS latch pre-empts it (c780), while the 324-B DRAW window places it first and
+ran `mac=0x22` (c716); the reorder `a03a68ea` is landed but unexercised, and
+pack completion is still a per-boot lottery (`6aeb20c7`, eng64, chains the
+release behind a successful pack carrier; validation pending). The DS stage
+type/context bits (SPH5/SPH10/SPH18) remain after the call, so the draws
+still do not store.
+glxgears' window is black, a window draw wedges X on some
 boots, and the per-boot binding plus X first-generation start lottery is the
 dominant throughput limiter
 ([`Graphics-Execution.md`](Graphics-Execution.md)).
@@ -224,11 +247,13 @@ dominant throughput limiter
    transformer kernel; each entry is accepted only on its own verification
    output (`bad=0` + `STATUS OK`).
 5. **The graphics pixel frontier** — the DS stage image is authored and live
-   for both vertex slots; next get the draw-issue `DRAW_IAB` (`mac=0x22`) call
-   into the window so it stores (`wrote>0`) at the bound render target, then
-   make the window/screen present land, and reduce the per-boot binding/X
-   start lottery so the proven off-screen frames become window pixels; the
-   lanes, the walls and the milestone ladder are on
+   for both vertex slots, and the saved-window release carrier now replays the
+   held window deterministically when the pack completes; next exercise the
+   release-window reorder so the slot-34 `DRAW_IAB` call runs before the setup
+   calls and stores (`wrote>0`) at the bound render target, then clear the DS
+   stage type/context bits, make the window/screen present land, and reduce
+   the per-boot binding/X start lottery so the proven off-screen frames become
+   window pixels; the lanes, the walls and the milestone ladder are on
    [`Graphics-Execution.md`](Graphics-Execution.md).
 
 ## 7. Theories, resolved