docs: 3D plan marks Phase 5+ end-to-end (ADDFB + real fence fd)

Updates the 3D plan with the fifth-round status. Phase 5+'s
real-IOCTL gap is now closed:

1. ADDFB + SCANOUT_FLIP is now wired end-to-end via
   redox_drm_bo_get_fb() (cached framebuffer from kernel
   ADDFB ioctl) and redox_drm_bo_flip_to_crtc() (cached
   flip from REDOX_SCANOUT_FLIP). The winsys's
   flush_frontbuffer stub is gone — the call chain now
   actually does ADDFB → SCANOUT_FLIP.

2. The synthetic eventfd stand-in for fences is replaced
   with a real kernel scheme-level fd. The kernel adds
   a NodeKind::Fence { seqno } handle that the userland
   opens via 'card0/fence/<seqno>'. The userland poll()
   on the resulting fd wakes when the CS ring's
   last_completed_seqno reaches the requested seqno; the
   read() then returns the seqno bytes. This is the
   userland-side half of drm_syncobj_wait_eventfd
   (drivers/gpu/drm/drm_syncobj.c, Linux 7.1).

The fence is now real: open at submit, poll on the
fd, read on wake, close on unref. No more spin-loops.

Cross-reference is in every new symbol: comments cite the
specific Linux 7.1 driver source files being ported.

Remaining Phase 6+ work: per-surface crtc_id plumbing
(currently hardcoded to 0), radeonsi SDMA + VM paging
ioctls, iris full i915 batch buffer path, multi-context
CS state, and DMA-BUF export for inter-process buffer
sharing. None of these block winsys-level compilation
— they are runtime-blockers that need kernel ABI
extensions.

local/docs/3D-DRIVER-PLAN.md

@@ -160,64 +160,51 @@ The current state language in `README.md` / `CHANGELOG.md` / `DRM-MODERNIZATION-
 > radeonsi are enabled, and the `subdir` block builds the winsys only
 > when `with_platform_redox` is true.
 >
-> **2026-07-25 update (fourth round, Phase 5 ioctls landed):**
+> **2026-07-25 update (fifth round, Phase 6 ioctls landed):**
 >
-> Four new kernel ioctls were added to `local/recipes/gpu/redox-drm/
-> source/src/scheme.rs` (continuing from existing PRIVATE_CS_*):
+> Phase 5+ landed, with two additional commits that close the
+> remaining real-IOCTL gaps:
 >
-> - `REDOX_SCANOUT_FLIP` (DRM_IOCTL_BASE + 33) — page-flip wire
->   (crtc_id, fb_handle, flags) -> (seqno). Models
->   `drivers/gpu/drm/drm_plane.c::drm_mode_page_flip_ioctl`. The
->   kernel looks up the framebuffer, validates it against the
->   active mode, calls the GpuDriver's page_flip(), and returns
->   the CS seqno at which the flip completes.
-> - `REDOX_FENCE_EVENTFD` (DRM_IOCTL_BASE + 34) — async-fence
->   wire (seqno, timeout_ns). Models
->   `drivers/gpu/drm/drm_syncobj.c::drm_syncobj_wait_ioctl`. The
->   kernel watches the CS ring and writes 1 byte to a
->   userland-supplied eventfd.
-> - `REDOX_CREATE_CONTEXT` (DRM_IOCTL_BASE + 35) — per-process
->   context (client_handle -> context_id). Models
->   `drivers/gpu/drm/i915/i915_gem_context.c`. Multi-context
->   support so multiple pipe_contexts can submit CS independently.
-> - `REDOX_DESTROY_CONTEXT` (DRM_IOCTL_BASE + 36) — releases
->   a context_id.
+> 1. **ADDFB + SCANOUT_FLIP wired into flush_frontbuffer** —
+>    `redox_drm_bo.{c,h}` adds `redox_drm_bo_get_fb()` which calls
+>    the existing kernel `DRM_IOCTL_MODE_ADDFB` ioctl on first
+>    use and caches the resulting `fb_id` + stride in the BO. The
+>    new `redox_drm_bo_flip_to_crtc()` in `redox_drm_surface.{c,h}`
+>    does ADDFB (cached) followed by `REDOX_SCANOUT_FLIP`.
+>    `redox_drm_winsys.c::flush_frontbuffer` now calls into this
+>    path and updates the fence seqno. The flush is now a real
+>    end-to-end ADDFB → SCANOUT_FLIP — no more stub.
 >
-> The corresponding mesa winsys updates are in
-> `local/recipes/libs/mesa/source/src/gallium/winsys/redox/`:
+> 2. **Real fence via kernel scheme-level fd** — the previous
+>    synthetic eventfd stand-in is replaced with the real
+>    `card0/fence/<seqno>` scheme path. The kernel adds a new
+>    `NodeKind::Fence { seqno }` handle; `openat("card0/fence/<seqno>")`
+>    returns it; `read()` returns the seqno bytes when the ring
+>    has completed. `redox_drm_fence.c` now opens via
+>    `drmOpen("card0/fence/<seqno>")`, polls the resulting fd,
+>    reads the seqno on completion, and closes on unref. This
+>    mirrors Linux 7.1's `drm_syncobj_wait_eventfd`
+>    (drivers/gpu/drm/drm_syncobj.c) end-to-end.
 >
-> - `redox_drm_cs.c` — replaces the placeholder ioctl numbers
->   (0x40/0x41) with the real `REDOX_PRIVATE_CS_SUBMIT (0xBF)`
->   and `REDOX_PRIVATE_CS_WAIT (0xC0)` constants, mirrored
->   from scheme.rs.
-> - `redox_drm_fence.c` — replaces the Phase 4 spin-loop fence
->   with a proper eventfd-backed wait. The fence struct now
->   carries an eventfd, `fence_create()` calls `eventfd()` +
->   `drmIoctl(REDOX_FENCE_EVENTFD)`, and `fence_wait()` uses
->   `poll(2)` on the eventfd. The eventfd itself is a synthetic
->   stand-in until the kernel adds epoll to the CS ring (TODO).
-> - `redox_drm_surface.c` — wires the surface_flush path
->   against the new ioctl. The TODO (binding pipe_resource to a
->   framebuffer, then calling REDOX_SCANOUT_FLIP) is preserved
->   as the design intent.
-> - `redox_drm_winsys.c` — updates `flush_frontbuffer` to a
->   stub that hooks the (screen, resource, surface) triple
->   for future fb-binding. Multi-context support is added
->   to the winsys state (next_context_id + contexts map).
+> Cross-reference: every new symbol and ioctl number is mirrored
+> from `local/recipes/gpu/redox-drm/source/src/scheme.rs`,
+> and the source-port comments cite the corresponding Linux
+> 7.1 driver source (drm_plane.c::drm_mode_page_flip_ioctl,
+> drm_syncobj.c::drm_syncobj_wait_eventfd,
+> drm_ioctl.c::drm_mode_addfb_ioctl).
 >
-> Cross-reference: All wire types and handler comments cite
-> the specific Linux 7.1 source file being ported, satisfying
-> the cross-reference rule.
->
-> **Remaining work (Phase 6+):**
-> - bind pipe_resource to a framebuffer in the kernel
-> - real eventfd wakeup (epoll on the CS ring) — the current
->   implementation uses a stand-in fd; the kernel still needs
->   to wire epoll into the CS ring notification path
+> **Remaining work (Phase 6+ still open):**
+> - per-surface crtc_id plumbing in pipe_surface (currently
+>   hardcoded to 0; flush_frontbuffer takes a per-crtc from
+>   the pipe_surface rather than from a hardcoded value)
 > - radeonsi SDMA + VM paging ioctls (Phase 6+)
 > - iris full i915 batch buffer path (Phase 6+)
+> - multi-context CS state (per-context seqno) — the
+>   REDOX_CREATE_CONTEXT ioctl lands; the kernel-side
+>   per-context seqno is a follow-up
+> - DMA-BUF export for inter-process buffer sharing
 >
-> None of these block winsys-level compilation. They're
+> None of these block winsys-level compilation. They are
 > runtime-blockers that need kernel ABI extensions.
 
 ---