RESEARCH.md: Round 10 — pipeline validated end to end

red -> yellow -> green -> blue held, with payload adbea06f. Documents
the four gotchas that cost nine rounds and the working configuration.

RESEARCH.md

@@ -429,6 +429,27 @@ confirmed by the kernel's own coreboot driver, sysfs tags, and
 Payload `adbea06f…` flashed (cmp + vbutil OK). host_test and qemu_test
 pass.
 
+## Round 10 — SUCCESS: full pipeline validated
+
+Payload `adbea06f…`: **red → yellow → green → blue, blue held.** The
+depthcharge → custom-payload → display pipeline works end to end:
+
+1. depthcharge boots the dev-signed FIT from `mmcblk0p1` and hands off
+   (x0 = FDT buffer, x1-x3 = 0, MMU off);
+2. stage0 re-enables OVL (+0x000C / +0x100C) and backlight (GPIO dout
+   0x10005114 / 0x10005154);
+3. the LBIO table at the fixed 0xffed9000 parses (record: pa handled via
+   OVL_L0_ADDR substitution = 0xFD536000);
+4. fills at the live scanout are visible.
+
+Effective gotchas that cost nine rounds, all [REVERSED] or resolved:
+OVL_EN offset (0x0F00→0x000C), GPIO dout offset (0x140→0x100), LBIO pa=0
+legitimacy (cbgfx rejects it; scanout comes from OVL_L0_ADDR), and the
+empty x0 FDT buffer (bypassed with the fixed table address; root cause
+still open and RELEVANT FOR U-BOOT).
+
+Next phase: U-Boot as the FIT kernel payload (see Round 11 planning).
+
 Recovery: power-cycle, boot USB (unchanged), `dd if=mmcblk0p1-pmos-backup.img
 of=/dev/mmcblk0p1 bs=4M conv=fsync`.