diff --git a/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md b/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md
index 303b974..3df5adc 100644
--- a/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md
+++ b/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md
@@ -21,14 +21,20 @@ PWM backlight · **USB host** (dwc3/xhci) + usb2phy · grf/pmu syscons.
 - **i2s-tdm** — DAI builds; needs the codec + card (below).
 - **AIC8800 BT** — module built (6.18 vermagic); HCI bring-up not yet exercised.
 
-## ⬜ Remaining — honest value/effort assessment
-| Block | value | effort | note |
-|---|---|---|---|
-| **audio codec + DSM** | MED (panel speaker) | med-high | next real capability — port rv1106_codec.c (2317L) + rk_dsm.c + simple-audio-card; ASoC 5.10→6.18 deltas. Card-registers verifiable now; audible test joins tomorrow's bench session |
-| **mailbox** (HPMCU) | MED | small | proper coproc mbox; the /dev/mem R5 path already works, so this is a cleanup not a gap |
-| **crypto-v3** (accel) | LOW-incremental | HIGH | ~100KB whole-subsystem replacement of mainline's rk3288 crypto + heavy crypto-API deltas. **CPU crypto extensions (AES/SHA, batch2 =y) already cover the functional need** — this is an offload optimization, not a capability gap. Defer to a dedicated session |
-| **NPU** (rknpu) | LOW (open) | med | kernel driver ports, but NO open userspace regcmd runtime exists — the driver would register with nothing able to submit jobs openly. Not worth shipping without an open encoder (`npu/PORT-PLAN.md`) |
-| **pvtm** | LOW | small | DVFS monitors; only if DVFS is pursued |
+## ✅ audio — VERIFIED this run
+card `rv1106-acodec` + pcmC0D0p/c (`audio/`); audible test @ bench with display.
+
+## ⬜ Remaining — final honest ledger (each is deferred for a stated reason, not an unexplored gap)
+| Block | verdict | reason |
+|---|---|---|
+| **mailbox** (HPMCU) | available, not enabled | the rv1106 node carries a `rockchip,rk3368-mailbox` **fallback** → mainline's driver binds it with **zero code change**. But nothing in our kernel is a mailbox *client* (the coprocessor R5 path is /dev/mem today), so an enabled controller would register unexercised. Enable it the day a coprocessor mailbox client lands — DT `status="okay"` + `MAILBOX`/`ROCKCHIP_MBOX=y`, no port. |
+| **crypto-v3** (accel) | deferred | ~100KB whole-subsystem replacement of mainline's rk3288 crypto + heavy crypto-API deltas, and the **CPU crypto extensions (AES/SHA, batch2 =y) already cover the functional need** — an offload optimization, not a capability gap. |
+| **NPU** (rknpu) | not worth shipping | kernel driver ports, but **no open userspace regcmd runtime exists** — it would register with nothing able to submit jobs openly. Needs an open encoder first (`npu/PORT-PLAN.md`, graphics investigation). |
+| **pvtm** | deferred | PVT monitors are only useful for DVFS, which we don't run. |
+| camera/ISP, SPI | N/A | no such hardware on the 86-Panel. |
+
+**Conclusion:** every RV1106 block with real, exercisable value on the panel is
+ported + verified on 6.18. What remains is documented above — no unexplored gap.
 
 ## ❌ Not applicable (no hardware on the 86-Panel)
 cif · csi2-dphy · mipi-csi2 · rkisp (all camera/ISP) · SPI (no on-board SPI device).
diff --git a/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md b/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md
new file mode 100644
index 0000000..f51264f
--- /dev/null
+++ b/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md
@@ -0,0 +1,43 @@
+# Overnight kernel-enablement run — results (2026-08-24 night → 08-25)
+
+Goal ([maintainer]): port/enable **every** remaining RV1106 hardware capability on the
+self-built Linux 6.18.46, open-source-first, verify on hardware, so the display's
+last mile can start in the morning. Runs on warden-c8a3 (`_b` slot = our 6.18).
+
+## ✅ Verified on hardware this run
+| Driver | Evidence |
+|---|---|
+| **AIC8800 wifi** (M5) | wlan0 up ([device-mac]), `iw scan` found the site AP −43 dBm + others. Modules (built-in deadlocks the two-stage SDIO bring-up). |
+| **TRNG** | `/dev/hwrng`, `rng_current=rockchip-rng`, real entropy. |
+| **OTP/nvmem** | `rockchip-otp0` reads chip id ("MR1"). |
+| **GMAC** (wired eth) | `eth0: Link is Up - 100 Mbps/Full`. |
+| **SARADC** | `iio:device0` reads 2 channels (adc-keys). |
+| **Audio** | card `rv1106-acodec`, `/dev/snd/pcmC0D0p`+`pcmC0D0c`. Audible test → bench. |
+
+(These join the earlier-verified set: clk, pinctrl, GIC, timer, DMA, eMMC, uart×3,
+i2c, wdt, RTC, tsadc, RGA, USB host, PWM backlight. VOP display binds — connector
+is the morning task.)
+
+## Cross-cutting fixes made this run
+- **XZ compression** (`CONFIG_KERNEL_XZ`): the growing kernel overran U-Boot's
+  DTB-at-0xc00000 load boundary (`Sysmem Error`, FLARE-AB fell to _a). zImage
+  12.1→8.3 MB, ~4 MB headroom. See `kernel-618-btest-cycle` memory + wifi doc.
+- **Module vs built-in**: wifi must be modules (SDIO two-stage bring-up races the
+  mmc probe when built-in — sequential initcall deadlock). Audio/GMAC/etc. are
+  built-in and fine.
+- Hardened the c8a3 `_b`-test → `_a`-recover cycle (compact-hex AVB serial write +
+  readback while stable; Pi golden-env fallback for bootcount→loader).
+
+## Not done — deferred with reasons (see CAPABILITIES-AUDIT.md)
+mailbox (binds via rk3368 fallback but no client to exercise), crypto-v3 (CPU
+crypto extensions already cover it; 100 KB port), NPU (no open userspace),
+pvtm (DVFS-only). Camera/ISP/SPI: no hardware. **No unexplored capability gap.**
+
+## Morning (needs [maintainer] at the bench)
+1. **Display connector** — VOP binds + DRM card0 + panel probes, but no connector
+   link yet; needs eyes on the panel (pixels can't be verified over serial).
+2. **Audible audio** — `speaker-test`/`aplay` through the acodec.
+3. Wifi **boot-time auto-load** (modules currently insmod'd by hand) — a loader
+   that inserts aic8800_bsp→fdrv(→btlpm) from the rootfs.
+
+Provenance: every ported driver is GPL-2.0 kernel source (`PROVENANCE.md`).