diff --git a/phase0_findings_iter6.md b/phase0_findings_iter6.md
index 27d1966..a1b69fc 100644
--- a/phase0_findings_iter6.md
+++ b/phase0_findings_iter6.md
@@ -126,6 +126,60 @@ If iter6 should specifically MATCH the difficulty of iter5b-β (medium): **G or
 
 If iter6 should specifically EXPAND on iter5b-β's architectural cleanup work: **J** (auto-detect harden) is the architectural fit; small backend change, removes a long-standing fragility.
 
-## Phase 1 lock pending
+## Locked research question (iteration 6, 2026-05-12)
 
-This document does NOT lock Phase 1. The user picks the iter6 research question from candidates F-J (or proposes K). After that pick, this doc becomes "iter6 Phase 0 final" and feeds Phase 1 lock.
+User pick: **Candidate G — Bug 6 VP8 partial output.**
+
+> *"Identify and fix the cause of VP8 libva producing 74.8%-zero output with traces of real content (hash `bcc57ed5…`) rather than the byte-identical kdirect output (`136ce5cb…`). After fix: `libva_vp8.yuv == kdirect_vp8.yuv == sw_vp8.yuv` for `bbb_720p10s_vp8.webm` 3-frame test. No regression on VP9, MPEG-2, H.264 keyframe-partial state, or HEVC."*
+
+### Pass/fail (boolean)
+
+1. **VP8 libva == kdirect**: `cmp -s libva_vp8.yuv kdirect_vp8.yuv` returns 0 on the standard 3-frame sweep. Both equal `136ce5cb…` (the iter5b-β kdirect anchor).
+2. **VP9 unchanged**: `libva_vp9.yuv == kdirect_vp9.yuv == 4f1565e8…` (iter5b-β's PASS preserved).
+3. **MPEG-2 unchanged**: `libva_mpeg2.yuv == kdirect_mpeg2.yuv == 19eefbf4…` (iter5b-β's maintained state preserved).
+4. **H.264 keyframe-partial unchanged**: `libva_h264.yuv == 71ac099b…` (Bug 4 still deferred to a future iteration; no new H.264 regression introduced).
+5. **HEVC unchanged**: `libva_hevc.yuv == 06b2c5a0…` all-zero (Bug 5 still deferred; no new HEVC regression).
+6. **Control-payload anchors hold**: `VIDIOC_S_EXT_CTRLS` payloads on the 5-codec sweep byte-match the iter5 Phase 3 anchors. iter6 changes shouldn't touch control submission.
+
+Clean iter6 close = all six criteria green. Bug 6 is the only NEW behavior; the other four codecs must hold their iter5b-β state.
+
+### Scope locks
+
+**In scope**:
+- `src/vp8.c` — VP8 backend control assembly + slice submission.
+- `src/picture.c` — VP8 dispatch in `codec_set_controls`, VP8 buffer-type cases, BeginPicture/EndPicture flow.
+- `src/surface.c` — `surface_bind_slot` (slot-to-surface binding for CAPTURE).
+- `src/cap_pool.c` / `request_pool.c` — slot lifecycle for VP8 path.
+- `surface.h` `params.vp8` union.
+- Any shared infrastructure that VP8 touches (request_fd lifecycle, DPB binding).
+
+**Out of scope**:
+- VP9 / H.264 / HEVC / MPEG-2 code paths (read-only for regression-verify).
+- Kernel patches (this is a backend-side bug per the empirical evidence: kernel succeeded the DQBUF, decode happened, output diverges).
+- Performance metrics.
+- Bug 4, Bug 5, all other backlog items.
+
+### Phase 2 source-read targets
+
+For the upcoming Phase 2 situation analysis:
+
+- `src/vp8.c` — full file. iter3 wrote this; ~300 LOC.
+- `src/picture.c::codec_set_controls` — VP8 dispatch site.
+- `src/picture.c::codec_store_buffer` — VP8 buffer-type cases (Picture, Slice, IQMatrix, ProbabilityData).
+- `src/surface.c::surface_bind_slot` — destination_data fill.
+- `src/cap_pool.c::cap_pool_acquire` — slot selection logic.
+- Kernel UAPI `<linux/v4l2-controls.h>` — `V4L2_CID_STATELESS_VP8_FRAME` + `struct v4l2_ctrl_vp8_frame`.
+- FFmpeg `libavcodec/v4l2_request_vp8.c` (Kwiboo's downstream) — kernel-direct VP8 reference.
+- Phase 3 baseline strace at `iter5_phase3_baseline.tgz/anchors_vp8/` — control-payload anchor.
+
+### Phase 3 baseline (re-acquire if needed)
+
+iter5 Phase 3 baseline already captured VP8 anchors. iter6 Phase 3 will re-verify on the current β backend + add: byte-level comparison of `libva_vp8.yuv` vs `kdirect_vp8.yuv` to identify where the divergence is (which frames? which planes? which spatial regions?).
+
+### Predicted iter6 difficulty
+
+Small. The decode is already running through the kernel cleanly (no DQBUF ERROR like HEVC). The divergence is in cap_pool slot rotation or partial fill — most likely a 5-50 LOC fix once root-caused. Phase 2 + Phase 3 may take more time than Phase 6 implementation.
+
+### Phase 1 → Phase 2 handoff
+
+iter6 Phase 1 is locked above. iter6 Phase 2 reads VP8 source and produces a situation analysis.