diff --git a/STATUS.md b/STATUS.md
index 8a63ee4..290d553 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -72,14 +72,18 @@ which runs correctly under MAME (apple2gs).
   native object format) for round-tripping with classic dev tools.
 - `runtime/build.sh` builds crt0, libc, soft-float, soft-double,
   libgcc into linkable objects.
-- `scripts/smokeTest.sh` runs 102 end-to-end checks (scalar ops,
+- `scripts/smokeTest.sh` runs 107 end-to-end checks (scalar ops,
   control flow, calling conventions, MAME execution, regressions,
   link816 bss-base safety + weak-symbol resolution +
-  heap_end-vs-heap_start sanity, iigs/toolbox.h compile-check,
+  heap_end-vs-heap_start sanity, iigs/toolbox.h compile + link
+  check (singles inlined, multi-arg wrappers in iigsToolbox.s),
   standalone runtime headers, AsmPrinter peepholes for STZ /
   PEA / PEI — single-STA, shared-LDA-multi-STA, and DPF0-
-  forwarding cases — malloc/free coalesce ordering).
-  Currently 100% pass at -O2 throughout.
+  forwarding cases — malloc/free coalesce ordering, plus
+  real-world coverage tests: Conway's Game of Life blinker
+  (2D loop + neighbour bounds), binary search tree (recursive
+  struct + malloc), function-pointer dispatch table (indirect
+  JSL via `__jsl_indir`).  Currently 100% pass at -O2 throughout.
 
 **ABI:**
 
@@ -251,6 +255,43 @@ sidecar bytes.
 
 ## Recently fixed
 
+- **DBR pointer-deref RA elision (sumTable miscompile)** —
+  `LDAptr / STAptr / STBptr` inserter's first-thing
+  `COPY $a = ptr_vreg` was being elided by RA when the loop body
+  had multiple Acc16 PHIs competing for A.  PHI-elim silently
+  dropped the COPY needed to refresh A with the pointer at the
+  top of each iteration; sumTable's inner loop did `STA $E0`
+  while A held the accumulator.  Fix: spill the pointer to a
+  fresh stack slot via `STAfi` and reload via `LDAfi` — forces
+  RA to materialize the value through real machine ops.  See
+  `feedback_dbr_ptr_deref_spill.md`.
+
+- **softDouble.c -O2 hold-out** — with the DBR fix in place,
+  `dclass` can be `noinline` (its pointer-arg writes go through
+  `STBptr / STAptr` which now use `[$E0],Y` indirect-long with
+  bank=0).  Drops register pressure in `__muldf3 / __divdf3 /
+  __adddf3` enough that greedy regalloc no longer runs out.  All
+  three smoke build sites moved from `-O1` to `-O2`.
+
+- **IMG slot count doubled (8 → 16)** — Img16 / Wide16 register
+  classes now hold IMG0..IMG15, backed by DP $C0..$CE + $D0..$DE.
+  Reduces greedy regalloc spills for moderately-busy functions.
+  Existing `IMG0..IMG7 → $D0..$DE` mapping unchanged so smoke
+  tests that assume specific DP carriers (e.g. DPF0 at $F0) still
+  work.  User app DP is now $00..$BF (was $00..$CF).
+
+- **Real-world smoke coverage added** — Conway's Game of Life
+  blinker (2D arrays + neighbour bounds), binary search tree
+  (recursive struct + malloc), function-pointer dispatch table
+  (indirect-JSL via `__jsl_indir`).  Total smoke tests at 107.
+
+- **iigs/toolbox.h expanded** — from 4 stubs to 18+ wrappers
+  across Tool Locator, Memory Manager, Misc Tools, QuickDraw II,
+  Event Manager, Window Manager, plus GS/OS Quit.  Multi-arg
+  wrappers live in `runtime/src/iigsToolbox.s` (the backend's
+  inline-asm constraints can't take memory operands); single-arg
+  ones stay inline.
+
 - **#70 — iterative qsort -O2 miscompile** — `W65816StackSlotCleanup`
   Pass -2 was deleting a store to a slot the loop body read.
   Function-wide `slotHasOtherRefs` safety check added (Pass -1 and