Round 13: green = pre-video crash; U-Boot init checkpoint bands

RESEARCH.md

@@ -583,3 +583,28 @@ Payload flashed, cmp + on-device vbutil verify OK.
 | green screen + backlight | wrapper ran; U-Boot crashed before video probe |
 | dark, no backlight | wrapper never executed — handoff/boot-path problem with THIS image |
 | U-Boot banner | everything works (banner replaces the green) |
+
+## Round 13 — green screen: U-Boot crashes pre-video-probe; init checkpoints
+
+Reboot with `9955943c…`: **full-screen green, stable** — the wrapper ran
+and U-Boot proper died between entry and the video probe (the video
+uclass would have `video_clear`ed to black for the banner). The crash
+window is wide: PIE fixup, relocation, DM scan, and notably
+`initr_env`/`initr_mmc` run BEFORE `stdio_add_devices` in board_r.c.
+
+### Checkpoint flash (payload `fc48d83b…`)
+
+U-Boot itself now paints checkpoints into the live scanout from board
+code (`mt8183.c`, TEMPORARY, gated on `CONFIG_BOARD_EARLY_INIT_F/R`,
+`dcache_status()`-guarded with `mmu_map_region`+flush for the
+post-relocation one):
+
+| band | checkpoint | position |
+|---|---|---|
+| full green | wrapper | before U-Boot (Round 12) |
+| orange top | `board_early_init_f` | after initf_dm, before get_clocks/timer/serial/dram_init |
+| blue bottom | `dram_init_banksize` | after dram_init, right before relocation |
+| red top | `board_early_init_r` | post-relocation, before dm/mmc/env/console/video |
+
+Read: last paint reached = code survived through that checkpoint; the
+crash/hang is in the next window. Success = banner on black.