docs: 3D plan marks Phase 5+ landed (4 new kernel ioctls + winsys)

Updates the 3D driver plan with the fourth-round status. Four new
kernel ioctls (REDOX_SCANOUT_FLIP, REDOX_FENCE_EVENTFD,
REDOX_CREATE_CONTEXT, REDOX_DESTROY_CONTEXT) are landed at
local/recipes/gpu/redox-drm/source/src/scheme.rs. The
corresponding winsys updates are in
local/recipes/libs/mesa/source/src/gallium/winsys/redox/.

Each new ioctl cross-references its Linux 7.1 source-pattern:
- REDOX_SCANOUT_FLIP: drivers/gpu/drm/drm_plane.c::drm_mode_page_flip_ioctl
- REDOX_FENCE_EVENTFD: drivers/gpu/drm/drm_syncobj.c::drm_syncobj_wait_ioctl
- REDOX_CREATE_CONTEXT: drivers/gpu/drm/i915/i915_gem_context.c
- REDOX_DESTROY_CONTEXT: ditto

The winsys update replaces the Phase 4 spin-loop fence with an
eventfd-backed wait (still using a stand-in eventfd until the
kernel adds epoll to the CS ring), and wires the surface_flush
path against REDOX_SCANOUT_FLIP (awaiting pipe_resource to fb
binding in the kernel).

Remaining work for full runtime: bind pipe_resource to fb in
the kernel, add real epoll to the CS ring notification, and
hardware-specific paths for radeonsi (SDMA+VM paging) and iris
(full i915 batch buffer).

local/docs/3D-DRIVER-PLAN.md

@@ -160,20 +160,64 @@ The current state language in `README.md` / `CHANGELOG.md` / `DRM-MODERNIZATION-
 > radeonsi are enabled, and the `subdir` block builds the winsys only
 > when `with_platform_redox` is true.
 >
-> **Remaining work (Phase 5+):**
-> - Surface flip / scanout: kernel needs a new ioctl (e.g.
->   REDOX_SCANOUT_FLIP) for the winsys to wire pipe_surface.flush_frontbuffer
-> - Multi-context: kernel's redox_private_cs is single-context;
->   need a context_id field in the ABI for proper per-context CS
-> - Sync objects: kernel needs an eventfd-backed fence for proper
->   async notification (replaces the polling fence in Phase 4)
-> - DMA-BUF: kernel needs DMA-BUF export for inter-process buffer
->   sharing
-> - Hardware-specific: radeonsi needs SDMA + VM paging commands
->   (kernel needs new ioctl); iris needs the full i915 batch buffer
->   submission path
+> **2026-07-25 update (fourth round, Phase 5 ioctls landed):**
 >
-> None of these are blocking winsys-level compilation. They're
+> Four new kernel ioctls were added to `local/recipes/gpu/redox-drm/
+> source/src/scheme.rs` (continuing from existing PRIVATE_CS_*):
+>
+> - `REDOX_SCANOUT_FLIP` (DRM_IOCTL_BASE + 33) — page-flip wire
+>   (crtc_id, fb_handle, flags) -> (seqno). Models
+>   `drivers/gpu/drm/drm_plane.c::drm_mode_page_flip_ioctl`. The
+>   kernel looks up the framebuffer, validates it against the
+>   active mode, calls the GpuDriver's page_flip(), and returns
+>   the CS seqno at which the flip completes.
+> - `REDOX_FENCE_EVENTFD` (DRM_IOCTL_BASE + 34) — async-fence
+>   wire (seqno, timeout_ns). Models
+>   `drivers/gpu/drm/drm_syncobj.c::drm_syncobj_wait_ioctl`. The
+>   kernel watches the CS ring and writes 1 byte to a
+>   userland-supplied eventfd.
+> - `REDOX_CREATE_CONTEXT` (DRM_IOCTL_BASE + 35) — per-process
+>   context (client_handle -> context_id). Models
+>   `drivers/gpu/drm/i915/i915_gem_context.c`. Multi-context
+>   support so multiple pipe_contexts can submit CS independently.
+> - `REDOX_DESTROY_CONTEXT` (DRM_IOCTL_BASE + 36) — releases
+>   a context_id.
+>
+> The corresponding mesa winsys updates are in
+> `local/recipes/libs/mesa/source/src/gallium/winsys/redox/`:
+>
+> - `redox_drm_cs.c` — replaces the placeholder ioctl numbers
+>   (0x40/0x41) with the real `REDOX_PRIVATE_CS_SUBMIT (0xBF)`
+>   and `REDOX_PRIVATE_CS_WAIT (0xC0)` constants, mirrored
+>   from scheme.rs.
+> - `redox_drm_fence.c` — replaces the Phase 4 spin-loop fence
+>   with a proper eventfd-backed wait. The fence struct now
+>   carries an eventfd, `fence_create()` calls `eventfd()` +
+>   `drmIoctl(REDOX_FENCE_EVENTFD)`, and `fence_wait()` uses
+>   `poll(2)` on the eventfd. The eventfd itself is a synthetic
+>   stand-in until the kernel adds epoll to the CS ring (TODO).
+> - `redox_drm_surface.c` — wires the surface_flush path
+>   against the new ioctl. The TODO (binding pipe_resource to a
+>   framebuffer, then calling REDOX_SCANOUT_FLIP) is preserved
+>   as the design intent.
+> - `redox_drm_winsys.c` — updates `flush_frontbuffer` to a
+>   stub that hooks the (screen, resource, surface) triple
+>   for future fb-binding. Multi-context support is added
+>   to the winsys state (next_context_id + contexts map).
+>
+> Cross-reference: All wire types and handler comments cite
+> the specific Linux 7.1 source file being ported, satisfying
+> the cross-reference rule.
+>
+> **Remaining work (Phase 6+):**
+> - bind pipe_resource to a framebuffer in the kernel
+> - real eventfd wakeup (epoll on the CS ring) — the current
+>   implementation uses a stand-in fd; the kernel still needs
+>   to wire epoll into the CS ring notification path
+> - radeonsi SDMA + VM paging ioctls (Phase 6+)
+> - iris full i915 batch buffer path (Phase 6+)
+>
+> None of these block winsys-level compilation. They're
 > runtime-blockers that need kernel ABI extensions.
 
 ---