diff --git a/docs/rewrite/DEVIANT_FIXES.md b/docs/rewrite/DEVIANT_FIXES.md
index 17c4506..1541087 100644
--- a/docs/rewrite/DEVIANT_FIXES.md
+++ b/docs/rewrite/DEVIANT_FIXES.md
@@ -59,7 +59,7 @@ when this file was written.
 | 31 | GTK: `+new-window` D-Bus arguments | `apprt/gtk/ipc/new_window.zig:49-53` (`Bytes.new(ptr, len + 1)` + `Variant.newFromBytes(..., trusted = true)`) | Arguments are passed as trusted GVariant strings without validation; invalid UTF-8 or an interior NUL makes GIO abort the process while serializing (input-triggered crash). | `arguments_variant` validates first and returns `Error::IpcFailed` (message on stderr, no D-Bus call); valid arguments are byte-identical to Zig. | `65dd9d5` fix-deviant(gtk) | `ipc::new_window::tests::invalid_dbus_strings_are_rejected_without_abort` (`ghostty-apprt-gtk`) |
 | 32 | OS: URL opener child reaping | `os/open.zig` (`try collectOutput(...)` before `wait()`) | When collecting the opener's output fails (e.g. more than 50 KiB on a stream), the error returns before `wait()`, leaving the child as a zombie. | The child is always reaped; the collection error is still logged. | `4a55abf` fix-deviant(os) | `ghostty-os` open tests |
 | 33 | OS: maximum-length `NOTIFY_SOCKET` | `os/systemd.zig:100-116` (`socket_address.path.len < socket_path.len`, then `path[socket_path.len] = 0`) | A 108-byte path (the size of `sockaddr_un.path`) passes the length check, and the terminating NUL is written at `path[108]`, one byte past the array (out-of-bounds write). Separate from row 13 (the abstract-socket `@` handling). | The address is built with rustix's `SocketAddrUnix::new`, which takes the 108 bytes without a terminator (valid for Linux `AF_UNIX`) and rejects longer paths; no out-of-bounds write. Verified in code. | f8c5ce0 (`git log -S` on `ghostty-os/src/systemd.rs`: the only commit touching it, besides formatting/macOS changes) | `notify_maximum_length_socket_path_is_rejected_safely` (`ghostty-os/src/systemd.rs`) |
-| 34 | Renderer (Metal): buffer reallocation size | `renderer/metal/buffer.zig:89` (`Buffer.sync`) and `:146` (`syncFromArrayLists`) | `size = req_bytes * 2` is already in bytes, then `size * @sizeOf(T)` is passed to `newBufferWithLength:options:`, so the new buffer is `sizeof(T)` times larger than intended (GPU-memory over-allocation). | The new buffer is exactly `2 * req_bytes` (`metal_layout::grown_buffer_bytes`); the element count is `2 * total_len`. | bab49ee (`git log -S"over-allocating"` on `ghostty-renderer/src/metal/buffer.rs`; the file's first commit) | `metal_layout::tests::grown_buffer_bytes_is_double_the_required_bytes_not_scaled_by_size_of_t` (runs on any host; the Metal buffer itself is compile-checked only) |
+| 34 | Renderer (Metal): buffer reallocation size | `renderer/metal/buffer.zig:89` (`Buffer.sync`) and `:146` (`syncFromArrayLists`) | `size = req_bytes * 2` is already in bytes, then `size * @sizeOf(T)` is passed to `newBufferWithLength:options:`, so the new buffer is `sizeof(T)` times larger than intended (GPU-memory over-allocation). | The new buffer is exactly `2 * req_bytes` (`metal_layout::grown_buffer_bytes`); the element count is `2 * total_len`. | bab49ee; registered + test in `2040677` fix-deviant(renderer) | `metal_layout::tests::grown_buffer_bytes_is_double_the_required_bytes_not_scaled_by_size_of_t` (runs on any host; the Metal buffer itself is compile-checked only) |
 
 ## Upstream quirks deliberately kept (not fixed)
 
diff --git a/docs/rewrite/STATUS.md b/docs/rewrite/STATUS.md
index 7322244..2eec65a 100644
--- a/docs/rewrite/STATUS.md
+++ b/docs/rewrite/STATUS.md
@@ -95,7 +95,8 @@ Legend: ⬜ todo · 🟨 in progress · ✅ done (gate passed, committed) · ⚠
 | RV16 | final Codex verification (clean HEAD) | codex astra | ✅ | all RV15 resolved; 1 P3 (freetype-only backend) + 4 register omissions → Z19 |
 | Z19 | freetype-only font backend feature + register omissions | sonnet | ✅ | 3577 tests |
 | RV17 | confirmation Codex verification (clean HEAD) | codex astra | ✅ | RV16 resolved; 6 P3 (Apple freetype, test defect, 3 inspector, Metal alloc register) → Z20 |
-| Z20 | RV17 P3 items | sonnet | 🟨 | |
+| Z20 | RV17 P3 items | sonnet | ✅ | 3582 tests; fix-deviant(renderer) |
+| RV18 | confirmation Codex verification (clean HEAD) | codex astra | 🟨 | |
 | DEV | DEVIANT_FIXES.md register of all intentional deviations (with commits) | sonnet | ✅ | 30 fixed bugs, 11 kept quirks, 18 other |
 | RV10 | final Codex verification (RV9 rows + full sweep) | codex astra | ✅ | all prior rows resolved; 8 gaps (1 P1 C buffer len regression) → Z13 |
 | Z13 | RV10 gaps incl. P1 C action len/alloc mismatch | sonnet | ✅ | |
@@ -147,3 +148,4 @@ Legend: ⬜ todo · 🟨 in progress · ✅ done (gate passed, committed) · ⚠
 - 2026-10-12: Z18 committed (parity + fix-deviant(gtk) + fix-deviant(os)); gate green; RV16 running.
 - 2026-10-12: Z19 committed (feat(font) + fix-deviant(os)). RV17 running.
 - 2026-10-12: RV17 (Codex needed defensive framing after a false-positive cyber flag) → Z20.
+- 2026-10-12: Z20 committed (parity + fix-deviant(renderer)). RV18 running.