diff --git a/README.md b/README.md
index a75164d..22114d0 100644
--- a/README.md
+++ b/README.md
@@ -116,20 +116,32 @@ and is unit-tested on its own — including the case a screenshot can't
 easily catch, dragging an object parented under a non-uniformly-scaled
 parent.
 
-**M4 in progress.** `engine.physics` wraps Box3D and `engine.audio` wraps
-miniaudio, both through a deliberately narrow C shim — neither library's
-own config structs (large, with function pointers and, for Box3D, at
-least one type that "cannot be directly copied") cross the P/Invoke
-boundary, only plain scalars and handles do. `samples/PhysicsDemo` ties
-physics, audio, input, and rendering together in one running project with
-`engine.editor` deliberately left out of its `project.json` — the
-shippable configuration, not the dev one. `.github/workflows/build.yml`
-builds and tests both native shims and the full solution on real
-`ubuntu-latest` and `windows-latest` runners, since nothing on a single
-Linux dev machine can otherwise verify the Windows half of M4's own "done
-when." Still open: the build pipeline hasn't actually run on GitHub yet
-(pending a `workflow` OAuth scope grant), and M4's "one small game"
-target is the physics demo so far, not yet a scored 20-minute one.
+**M4 in progress — the "done when" is met.** `engine.physics` wraps Box3D
+and `engine.audio` wraps miniaudio, both through a deliberately narrow C
+shim — neither library's own config structs (large, with function
+pointers and, for Box3D, at least one type that "cannot be directly
+copied") cross the P/Invoke boundary, only plain scalars and handles do.
+`samples/PhysicsDemo` ties physics, audio, input, and rendering together
+in one running project with `engine.editor` deliberately left out of its
+`project.json` — the shippable configuration, not the dev one.
+`.github/workflows/build.yml` builds both native shims from source, runs
+the full test suite, and headless-verifies real physics end to end, on
+real `ubuntu-latest` and `windows-latest` runners — the only way to check
+the Windows half at all from a single Linux dev machine. **Both platforms
+are green.** The first real run caught two things no amount of local
+testing could have: the linux-x64 `.so` committed for local dev
+convenience, built against this dev machine's own newer glibc, didn't
+load on `ubuntu-latest`'s (CI now rebuilds it fresh every run instead of
+trusting a locally-built binary); and `--headless` doesn't stop a loaded
+`engine.windowing`/`engine.render` from creating a real GL context
+regardless, which fails outright on a GPU-less runner (CI's verification
+step now stages a separate, `engine.physics`-only build with no window
+plugin at all — `engine.render`'s own correctness is proven by real
+screenshots on a real desktop instead, not something a headless runner
+could check anyway).
+
+Still open for M4: the "one small game" target is the physics demo so
+far, not yet a scored 20-minute one.
 
 See the build order (M0–M4) in
 [`docs/kernel-contract.md`](docs/kernel-contract.md) for the rest.
diff --git a/docs/kernel-contract.md b/docs/kernel-contract.md
index f223532..0f5df7a 100644
--- a/docs/kernel-contract.md
+++ b/docs/kernel-contract.md
@@ -436,7 +436,7 @@ cost of changing course is still zero.
 | **M1** | **Window, input, a triangle.** Three separate plugins over Silk.NET. First real-load test of the data channel. | The triangle's color changes by editing system code, with no app restart. |
 | **M2** | **Assets and scenes.** Hot-reloading asset plugin, scene format, `World` serialization. | Swapping a texture on disk changes the picture with nothing stopped; a scene loads and saves. |
 | **M3** | **Editor as plugins — done.** Shell (`engine.editor`, ImGui over the live scene, see §5 and the new `Stage.Present`), reflection-based inspector and hierarchy, Play/Stop on snapshots, a real 3D translate gizmo driven by the actual camera. | Entering Play takes under 100 ms — the original complaint about Unity is closed. Proven twice: `WorldSnapshotTests` (kernel, 300 `GameObject`s) and a real editor run against `samples/WindowDemo` (13ms, logged by `PlayModeController`). |
-| **M4** | **One small game, end to end — in progress.** `engine.physics` (Box3D) and `engine.audio` (miniaudio) done, both over a narrow, scalars-only P/Invoke shim; `samples/PhysicsDemo` ties physics/audio/input/render together with `engine.editor` deliberately excluded from its `project.json`; `.github/workflows/build.yml` builds and tests on real `ubuntu-latest`/`windows-latest` runners. Not yet: the workflow has actually run on GitHub (blocked on an OAuth `workflow` scope grant), and the demo is a physics sandbox, not yet a scored 20-minute game. | The build runs on both platforms with no editor plugins in the shipped binary. |
+| **M4** | **One small game, end to end — done when met, game itself in progress.** `engine.physics` (Box3D) and `engine.audio` (miniaudio) done, both over a narrow, scalars-only P/Invoke shim; `samples/PhysicsDemo` ties physics/audio/input/render together with `engine.editor` deliberately excluded from its `project.json`. `.github/workflows/build.yml` builds both native shims from source, tests, and headless-verifies on real `ubuntu-latest`/`windows-latest` runners — both green on the first real run, which itself caught two real cross-platform bugs no local testing could have (a locally-built `.so` too new for `ubuntu-latest`'s glibc; `--headless` not stopping a loaded `engine.render` from demanding a real GL context on a GPU-less Windows runner — see README's Status section). Not yet: the demo is a physics sandbox, not yet a scored 20-minute game. | The build runs on both platforms with no editor plugins in the shipped binary. |
 
 ---