selector lamps

.gitignore

@@ -1 +1,2 @@
 *.pyc
+captures/

README.md

@@ -20,6 +20,85 @@ To turn the structured decompile output into conservative C-like pseudocode:
 .\.venv\Scripts\python.exe h8536_pseudocode.py build\rom_decompiled.json --out build\rom_pseudocode.c --cycles
 ```
 
+To generate a focused RX/TX serial-path pseudocode view from the reconstruction metadata:
+
+```powershell
+.\.venv\Scripts\python.exe h8536_serial_pseudocode.py build\rom_decompiled.json --out build\rom_serial_pseudocode.c
+```
+
+To run the newer sidecar protocol and gate/queue analysis tools:
+
+```powershell
+.\.venv\Scripts\python.exe h8536_serial_gate.py build\rom_decompiled.json --out build\rom_serial_gate.txt
+.\.venv\Scripts\python.exe h8536_rx_branch_trace.py build\rom_decompiled.json --out build\rom_rx_branch_trace.txt
+.\.venv\Scripts\python.exe h8536_report_source_trace.py build\rom_decompiled.json --out build\rom_report_sources.txt
+.\.venv\Scripts\python.exe h8536_table_xrefs.py --out build\rom_table_xrefs.txt
+.\.venv\Scripts\python.exe h8536_ccu_seed_hints.py build\rom_decompiled.json --out build\rom_ccu_seed_hints.txt
+.\.venv\Scripts\python.exe h8536_eeprom_layout.py build\rom_decompiled.json --out build\rom_eeprom_layout.txt
+.\.venv\Scripts\python.exe h8536_consistency.py build\rom_decompiled.json --out build\rom_consistency.txt
+.\.venv\Scripts\python.exe h8536_protocol_capture.py ROM\rcp-txd-idle-only.txt
+```
+
+To start the current emulator harness:
+
+```powershell
+.\.venv\Scripts\python.exe h8536_emulator.py --max-steps 1000000 --stop-on-heartbeat --interval-steps 512
+.\.venv\Scripts\python.exe h8536_emulator_probe.py --max-steps 4000000 --stop-on-tx
+.\.venv\Scripts\python.exe h8536_emulator_probe.py --max-steps 1000000 --stop-on-tx --p9-fast-path
+.\.venv\Scripts\python.exe h8536_emulator_rx_probe.py --preset connect-lcd
+.\.venv\Scripts\python.exe h8536_emulator_rx_divergence.py --default-frames --uart-timing --wait-heartbeats 2 --summary-only
+.\.venv\Scripts\python.exe scripts\bench_connect_lcd_sequence.py --port COM5 --relay-port COM6 --prompt-screen
+.\.venv\Scripts\python.exe scripts\connect_ok_matrix.py --suite minimal --prompt-observation --result-json captures\connect-ok-minimal-result.json
+.\.venv\Scripts\python.exe scripts\connect_ok_advance_sweep.py --suite core --prompt-observation --result-json captures\connect-ok-advance-core-result.json
+.\.venv\Scripts\python.exe scripts\serial_ack_probe.py --ack-frame "05 00 40 00 00 1F"
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\ack-race-000-001.json --log captures\ack-race-000-001.txt --result-json captures\ack-race-000-001-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\table-sweep-ack-000-07f.json --log captures\table-sweep-ack-000-07f.txt --result-json captures\table-sweep-ack-000-07f-result.json
+.\.venv\Scripts\python.exe scripts\state_map_runner.py --preset ok --prompt-screen
+.\.venv\Scripts\python.exe scripts\state_map_runner.py --analyze-log captures\ack-race-000-001.txt
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --dry-run
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --port COM5 --duration 30 --log captures\ccu-keepalive.txt
+.\.venv\Scripts\python.exe h8536_emulator_state_search.py --preset connect-queue --target ok --first-hit --json-out build\connect-state-search-ok.json
+.\.venv\Scripts\python.exe h8536_emulator_bench_replay.py captures\bench-connect-lcd-sequence-20260525-214411.txt --assert-bench-parity
+.\.venv\Scripts\python.exe h8536_emulator.py --max-steps 250000 --p9-fast-path --eeprom-seed blank --eeprom-save build\emulator-eeprom-boot.bin --eeprom-report build\emulator-eeprom-boot.txt --eeprom-report-json build\emulator-eeprom-boot.json
+```
+
+The real-device bench helper uses `pyserial`; install repo dependencies with `.\.venv\Scripts\python.exe -m pip install -r requirements.txt` if needed.
+Optional webcam snapshots for `scripts\serial_scenario.py` use OpenCV; install it only on the bench machine that needs panel photos:
+
+```powershell
+.\.venv\Scripts\python.exe -m pip install opencv-python
+```
+
+Example snapshot run:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\copy-step-006d-006c-1000ms.json --parity E --quiet-console --log captures\copy-webcam.txt --result-json captures\copy-webcam-result.json --snapshot-dir captures\copy-webcam-shots --camera-index 4 --snapshot-delays 0.5
+```
+
+Current bench calibration: webcam index `4` gives the useful panel view, and a `0.5` second post-command delay is enough for LCD changes to settle without producing too many images.
+
+The current PT2/protocol reconstruction is documented in [docs/pt2-protocol.md](docs/pt2-protocol.md), with focused mini-notes for [COPY state](docs/pt2-copy-state-machine.md), [menu state](docs/pt2-menu-state-machine.md), the [session rhythm ROM trace](docs/pt2-session-rhythm-trace.md), [continuation commands](docs/pt2-continuation-command-trace.md), and [report aftermath handling](docs/pt2-report-aftermath-trace.md).
+
+## Real Bench Serial Format
+
+The real RCP serial link is `38400 8E1`, not `38400 8N1`. This is backed by the ROM SCI1 init:
+
+- `build/rom_decompiled.asm:437`: `SCI1_SMR = H'24`, async 8-bit, even parity, 1 stop.
+- `build/rom_decompiled.asm:438`: `SCI1_SCR = H'3C`, RX/TX enabled.
+- `build/rom_decompiled.asm:439`: `SCI1_BRR = H'07`.
+
+The traced board path is H8/536 SCI1 through the MAX202: H8 pin 66 `P95/TXD` to MAX202 pin 11, and MAX202 pin 12 to H8 pin 67 `P96/RXD`.
+
+Bench scripts default to even parity now. Keep `--parity E` explicit in important captures, and use `--parity N` only to reproduce older 8N1 captures. With the wrong 8N1 format, commands fall into the RX error/retry path instead of the normal command handlers; apparent `07...` frames from those captures should be treated as error/retry echoes until repeated under 8E1.
+
+Confirmed bench result under 8E1: the CONNECT path can reach `CONNECT:  OK`, the CAM POWER lamp illuminates, and the numeric readouts illuminate as `----`.
+
+Minimal smoke-test shape:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\bench_connect_lcd_sequence.py --port COM5 --relay-port COM6 --parity E --prompt-screen --log captures\8e1-connect-ok-smoke.txt
+```
+
 ## What It Does
 
 - Decodes the H8/500 instruction set used by the H8/536.
@@ -34,6 +113,19 @@ To turn the structured decompile output into conservative C-like pseudocode:
 - Parses the DTC vector table described by the manual and decodes DTC register-information blocks.
 - Tracks SCI setup writes and can infer baud rates from SMR/BRR when `--clock-hz` is supplied.
 - Annotates SCI protocol actions such as TDRE waits, TDR writes, RDR reads, RX/TX interrupt enables, and receive-error clears.
+- Reconstructs evidence-supported SCI1 serial frame candidates, including the apparent six-byte TX/RX units and XOR checksum seeded by `0x5A`.
+- Infers candidate serial protocol semantics from validated frames, including `RX[0] & 0x07` command dispatch, likely index/value byte roles, and response staging through `F850-F854`.
+- Generates a focused RX/TX serial-path pseudocode view from those serial reconstruction and protocol-semantic candidates.
+- Marks H8 word-destination writes fed by byte immediates as explicit zero-extension in pseudocode, including the heartbeat queue write at `loc_4067`.
+- Emits a decompiler/pseudocode consistency report for width semantics that are easy to misread.
+- Decodes observed serial byte captures into six-byte frames, validates checksums, labels capture-observed heartbeat/call/camera-power candidates, and summarizes heartbeat cadence.
+- Accepts both analyzer-style lines such as `RX 006 bytes ...` and the idle reference `frame 006 ...` format in `ROM/rcp-txd-idle-only.txt`.
+- Reconstructs the autonomous serial gate/queue state-machine around `loc_3FD3`, `loc_BAF2`, `F9B0/F9B5`, `FAA2/FAA3/FAA5`, the `F9C4`/FRT2 idle heartbeat gate at `loc_4046`, and the resend path through `BE9E/BED5`.
+- Emits a focused SCI1 RX branch trace covering RXI/ERI byte capture, six-byte checksum validation, selector decode, the `FAA2 == 0` initial dispatcher, the `FAA2 != 0` continuation dispatcher, command `0x00/0x01/0x02/0x04/0x05/0x06/0x07` handlers, table surfaces, retry/error echoes, the separate `BE70/F970` selector-processing and `3E54/F870` serial-report queues, the TXI/RXI continuation-collapse interlock, RX-to-TX feedback loops, and session-timeout side effects.
+- Traces direct callers to `loc_3E54` to identify report queue sources and conservatively flags whether observed report indexes such as `0x0007` are ROM-proven constants or runtime/capture observations.
+- Generates table/index cross-reference reports for candidate value/current/secondary/flag tables and LCD text correlations.
+- Mines ROM-backed CCU seed hints from table xrefs, selector dispatch, LCD text terms, and observed report overlays, then proposes syntactically valid command-0 seed frames and command-1 readback frames for high-value selectors.
+- Mines the ROM-backed X24164 EEPROM layout, including the factory F400-F4FF shadow defaults, the page-0 EEPROM signature/options header, the fifteen blank-by-default 8-byte record slots loaded into F7B8-F82F, and the serial selector-to-persistent-offset map used by command 0/4 handlers.
 - Adds a Sony RCP-TX7 board profile that ties H8/536 pin 66 `P95/TXD` and pin 67 `P96/RXD` to the MAX202 RS232 transceiver.
 - Flags/manual-annotates TEMP-register access ordering for FRT and A/D 16-bit peripheral registers.
 - Scans unreached ROM ranges for ASCII strings and pointer-table candidates.
@@ -47,6 +139,47 @@ To turn the structured decompile output into conservative C-like pseudocode:
 - Handles the E-clock transfer instructions `MOVFPE` and `MOVTPE`.
 - Recognizes likely LCD E-clock access routines at `H'F200`/`H'F201`, including busy-flag polling and data/control writes.
 - Generates a separate C-like pseudocode view from the JSON, preserving labels, calls, branches, register names, inferred symbols, metadata comments, optional cycle notes, and simple structured `if`/`do while` patterns.
+- Provides an early H8/536 emulator harness with ROM/RAM/register memory mapping, reset-vector boot, SCI1 transmit capture, MOV condition-code updates, `SCB/F`, stack/call/return support, indirect `JMP/JSR @Rn` dispatch, scaffolded SCI1 RXI/ERI/TXI and interval timer scheduling, manual-derived FRT1/FRT2 OCIA cycle scheduling, a P9 bit-banged bus model, an X24164 two-wire EEPROM model on traced `P91/SCL` and `P97/SDA`, logical EEPROM image load/save/reporting, a 16x4 LCD bus/DDRAM model for `H'F200`/`H'F201`, and an opt-in P9 transfer fast path.
+- Includes an emulator probe that reports hot PCs, recent P9/SCI accesses, serial report queue/gate traces, RAM lifecycle watches, final SCI1/TXI state, and captured P9 byte candidates while running the real ROM.
+- Includes an RX command probe that boots until SCI1 RXI is serviceable, injects host six-byte frames through RDR/RDRF, can optionally schedule bench-style UART byte arrivals at real spacing, listens for device TX frames, and reports serial latch/table/LCD-buffer and emulated-LCD effects.
+- Includes a bench helper for replaying the emulator-derived CONNECT LCD frame sequence against the real device through COM5, with optional COM6 relay power cycling and timestamped capture logs.
+- Includes a CONNECT: OK bench matrix runner that power-cycles between cases and tests the known sequence, single frames, primer pairs, order permutations, inter-frame gaps, repeats, and hold time to separate magic-frame, primer, cadence, and latch behavior.
+- Includes a CONNECT: OK advance sweep runner that recovers to the known OK cadence, waits for an active RCP report frame, then sends one candidate continuation/ACK frame so ACK-only, selector-zero-refresh, and command-5 special selectors can be compared from the same baseline.
+- Includes a bench ACK probe that reproduces the `01 00 00...` -> `01 00 01...` visible retry burst, waits for `07 80 40 20 90 2D`, then sends a candidate command-5 ACK and reports whether the target keeps repeating.
+- Includes a checksum-resynchronizing bench receiver that scans RX byte streams for valid six-byte frames, avoids common shifted-heartbeat false locks, and can fall back to the old fixed six-byte slicer with `--sync fixed`.
+- Includes a JSON scenario bench runner for repeatable multi-step serial tests, including low-latency ACK-aware command-1 probes that can send the current command-5 ACK candidate immediately after the retry frame appears, with explicit max-ACK/max-target guardrails.
+- The scenario runner can optionally schedule webcam snapshots on each command send, writing image paths into logs/result JSON without delaying timing-sensitive serial steps.
+- Includes a modular fake-CCU runner in `ccu_emulator/` that seeds active state, listens for complete RCP report frames, and immediately sends the neutral command-5 ACK `05 00 40 00 00 1F`; optional periodic refresh frames let lamp/value streaming be tested separately from report ACKs.
+- Includes a PT2 state-map-aware bench runner/analyzer for the current CONNECT gate proof: it hunts a fresh device `07...` visible-drain token candidate, sends exactly one selector-zero command-4 force, probes `E000[0]` with command 1, optionally uses command 7 to recover a hidden finalized response, and labels likely token-destroying turns.
+- Includes a bounded emulator CONNECT state-search tool that patches small ROM-derived RAM/table surfaces, runs either the direct CONNECT branch or the selector-zero queue dispatch path, and classifies LCD outcomes as OK, DXC, NOT ACT, or other.
+- Includes a bench-log replay harness that feeds recorded host TX frames back into the ROM emulator with bench-style UART byte timing by default and asserts parity against the real device's observed response/LCD state.
+
+Current serial observations:
+
+- Idle capture reference: `ROM/rcp-txd-idle-only.txt`.
+- Idle frame: `00 00 00 00 80 DA`.
+- Capture-side label: `heartbeat_alive_candidate`.
+- Idle cadence from the reference file: 54 frames, average about 699.9 ms, min 601 ms, max 803 ms.
+- Static/runtime finding: `F9C4` is a candidate idle heartbeat/report countdown. Init loads `H'14`, `loc_BA26` reloads `H'07` after a send, FRT2 OCIA decrements it, and `loc_4046` can enqueue report `H'0000` when it reaches zero and the queue is empty.
+- Emulator timing finding: the ROM initializes FRT2 with `TCR=H'02` and `OCRA=H'7A12`; using the manual's `phi/32` prescaler gives a 1,000,000-cycle OCIA period, so the default `--clock-hz 10000000` models that tick as 100 ms and the post-send `F9C4=H'07` heartbeat delay as about 700 ms.
+- Runtime-confirmed heartbeat path: `loc_4067` writes `H'0000` into the queue via a zero-extended word move, `loc_BAF2/loc_BB08` dequeue it, `loc_BB1C/loc_BB20/loc_BB2B` stage the TX bytes, and `loc_BA26` emits `00 00 00 00 80 DA`.
+- Emulator LCD finding: the ROM writes the boot/no-active-session message to the LCD bus as ` CONNECT:NOT ACT` on line 0 by the time SCI1 RX is serviceable. Valid and invalid six-byte host frames leave that display active while normal serial replies/heartbeats continue.
+- Bench serial-format finding: real hardware talks `38400 8E1`. Earlier `8N1` captures primarily exercised SCI1 parity/error handling and retry echoes, not the normal command path. After switching bench scripts to even parity, the selector-zero CONNECT path can reach `CONNECT:  OK`.
+- Bench CONNECT recovery finding: `CONNECT:NOT ACT` is recoverable without a power cycle. This makes it a normal no-active-session/cleared-state display rather than a terminal latch; tests can now probe from the idle NOT ACT state directly, then separately check whether OK is held or needs periodic CCU-like refresh traffic.
+- Bench CONNECT cadence finding: the `40 -> 80 -> C0` sequence stayed at `CONNECT:NOT ACT` with 10 ms, 50 ms, and 150 ms gaps, but produced `CONNECT: OK` then returned to `CONNECT:NOT ACT` with 700 ms and 1.5 s gaps. At 700 ms, single `40`/`80`/`C0` frames did not work, but all tested two-frame pairs did. Repeated `80 -> 80` at about 700 ms also worked, so the values do not need to differ. The no-power-cycle NOT ACT recovery capture produced repeated `02 00 02 00 00 5A` OK-path responses before heartbeat traffic resumed.
+- Bench special-selector finding: in the CONNECT OK advance sweep, command-5 selector `0x006C` (`05 00 6C 00 00 33`) produced `CONNECT OK` then a blank LCD with the CAM POWER lamp still on, while selector `0x006D` (`05 00 6D 00 00 32`) produced `CONNECT OK` then `COPY IN PROGRESS` then `CONNECT NOT ACT`. A later fresh isolated `ack-006d` run in `captures/connect-ok-advance-special-20260526-153339.txt` reproduced the copy path after a relay power-cycle. Forced ROM decoding confirms `0x006C -> H'2FAF` and `0x006D -> H'3015`; the `0x006D` path sets display selector `F732=H'1903`, a long `F798` countdown, and the ROM contains the `COPY IN PROGRESS` LCD string. LCD dispatch now traces through `493E[0x19] -> H'930A`, with local table entry `H'9F6A` building `COPY IN PROGRESS` and entry `H'9FDA` building `COPY COMPLETED`; `0x006C` appears to be the completion/exit sibling only after `0x006D` has set the `F795.6/F795.7` copy flags. The RCP-side menu trace now also identifies page `0x01` table entry `H'6FF0` as `OTHERS / COPY TO SLAVES`; it is gated by `E400[0x0015]`, and its local copy-start branch also requires `F791.7` before setting `F76E.6`, `F795.7`, `F731.7`, `F798=H'C8`, `F711.7`, and `F726=H'64`. The RCP-TX7 manual identifies `COPY IN PROGRESS` as the multi-camera `COPY TO SLAVES` transfer state over the RS232C command-link system, with controls locked until `COPY COMPLETED`.
+- ROM report-source finding: the active `02/01 ...` frames exposed during CONNECT OK attempts are autonomous `F870 -> BAF2 -> BA26` report-queue transmissions, not ordinary command-1 readbacks. The ROM sets `FAA2.3/FAA3.7` after sending them, so the CCU probably needs to answer in that continuation window with command `4`, `5`, or `6` to consume the report queue and keep the session alive.
+- Board/P9 finding: traced MCU pin 62 `P91` reaches X24164 pin 6 `SCL`, and MCU pin 68 `P97` reaches the shared X24164 pin 5 `SDA` node. The emulator now treats the ROM's `C121/C08B/C0DB/C10C/C142` P9 routines as an X24164-style two-wire EEPROM bus, with ROM logical addresses `0x000-0x7FF` on the `H'A0/H'A1` control-byte family and `0x800-0xFFF` on `H'E0/H'E1`.
+- EEPROM role finding: `loc_40BB` checks `P7DR.7` and the `F402 == H'6B6F` signature before defaulting EEPROM/shadow tables; `loc_4103` writes ROM default words through `BFE0`, `loc_41D2` reads sixteen 8-byte records into `F7B0-F82F`, and the command-4 path at `BD2B-BD5F` can persist serial table writes when `F76E.7` is set.
+- EEPROM layout finding: `build\rom_eeprom_layout.txt` currently identifies the ROM factory table at `H'C964-H'CA63`, the F400 shadow defaults, page 0 offset `0x000-0x007` as the signature/options header (`00 00 6B 6F FE 00 00 00`), pages 1-F offset `0x00-0x07` as blank-by-default record slots, and 89 selector mappings from the `H'C564` table into F400/EEPROM offsets. `F404` defaults to `H'FE00` and is tested as option/feature bits, while `F76E` combines persistence enable, dispatch suppression, and low-nibble EEPROM page selection.
+- Emulator EEPROM-image finding: `build\emulator-eeprom-boot.txt` captures a blank-EEPROM boot defaulting pass. The ROM writes 2108 words, leaves page 0's signature/options header intact, blanks page 1-F record headers, and the final image matches the ROM factory/default baseline. Use `--eeprom-load`/`--eeprom-save` to persist an emulated EEPROM image across runs and compare command-induced changes.
+- Emulator board-state finding: P7 now reads external pin state for input bits, so the DIP-off default is modeled as `--p7-input 0xFF`; `--eeprom-seed factory` can pre-seed the X24164 devices and `F400-F4FF` shadow from the ROM default table for already-initialized-state experiments.
+- RX probe finding: the `--preset connect-lcd` sequence is sensitive to injection timing and modeled external state. With timed UART injection, the emulator can still reach `CONNECT:  OK`/`02 00 02 00 00 5A`, while the real bench remains at `CONNECT NOT ACT`; this points to missing session/P9/external-panel context rather than a simple checksum or UART-spacing issue.
+- Emulator state-search finding: the minimum ROM-visible OK display condition is now reproducible without serial. Direct entry at `loc_2CB9` with `E000[0]=0x8080` and unsuppressed `F730=0` reaches `CONNECT:  OK`; the queued selector-zero path also reaches OK when `F970[0]=0`, `F9B9=0`, `F9B4=1`, `E000[0]=0x8080`, and `F730=0`. This makes the bench problem sharper: prove whether serial can retain `E000[0]=0x8080` and enqueue selector zero without the reset/clobber path clearing it first.
+- Emulator panel-input finding: `h8536_emulator_rx_probe.py` can now inject ROM-level panel edges using traced shadow/dirty bytes. `--panel-press cam-power` models `F105 -> F6D4.3/F6F2.4`, `--panel-press call` models `F006 -> F6DB.5/F6F3.3`, and raw specs such as `--panel F6D4.6=press` let adjacent report-capable table entries be probed while the ROM still decides whether a serial report, menu action, or no-op happens.
+- Bench follow-up: replaying the emulator CONNECT sequence on the real device did not switch the LCD to OK. The real device answered the `04 00 00 80 00 DE` step with `07 80 C0 60 20 5D` in the captured run and remained at `CONNECT NOT ACT`, so the next mismatch to chase is the missing visible `07 80 C0 60 20 5D` response/session context rather than the LCD OK branch.
+- CCU seed-hint finding: `build\rom_ccu_seed_hints.txt` currently ranks selector `0x000`, `0x0F6`, `0x003`, and `0x040` as the highest-value fake-CCU stream candidates. The generated seed frames are `00 00 00 80 80 5A`, `00 01 76 20 00 0D`, `00 00 03 80 00 D9`, and `00 00 40 FF FF 1A`, with command-1 readbacks listed beside them.
+- Observed capture labels such as `cam_power_button_candidate` and `call_button_candidate` are deliberately treated as capture overlays, not protocol facts hard-coded in ROM.
 
 The generated listing is written to:
 
@@ -60,6 +193,21 @@ The optional JSON output is useful for scripts or later analysis:
 build/rom_decompiled.json
 ```
 
+Common derived outputs:
+
+```text
+build/rom_pseudocode.c
+build/rom_serial_pseudocode.c
+build/rom_serial_gate.txt
+build/rom_report_sources.txt
+build/rom_table_xrefs.txt
+build/rom_ccu_seed_hints.txt
+build/rom_eeprom_layout.txt
+build/rom_consistency.txt
+build/emulator-eeprom-boot.txt
+build/callgraph.dot
+```
+
 ## Useful Options
 
 ```powershell
@@ -89,6 +237,101 @@ python h8536_pseudocode.py --help
 - `--no-structure`: preserve label/goto output instead of simple structured `if`/loop output.
 - `--max-functions N`: emit only the first `N` functions for focused review.
 
+For focused serial pseudocode:
+
+```powershell
+python h8536_serial_pseudocode.py --help
+```
+
+- `--tx-only`: emit only the candidate transmit path.
+- `--rx-only`: emit only the candidate receive path.
+- `--no-evidence`: omit evidence-address comments.
+- `--no-manual`: omit manual-reference comments.
+- `--no-board`: omit board/MAX202 comments.
+- `--no-semantics`: omit candidate command/field semantics.
+
+For protocol trace and capture logs:
+
+```powershell
+python h8536_protocol_trace.py --help
+python h8536_protocol_capture.py --help
+```
+
+- `h8536_protocol_trace.py --direction tx 00 00 15 80 00 CF`: decode raw bytes as protocol frames.
+- `h8536_protocol_capture.py ROM\rcp-txd-idle-only.txt`: parse timestamped captures, recombine split chunks, validate checksums, and summarize cadence/gate hints.
+- `--json` on the capture tool emits machine-readable frame and cadence data.
+
+For gate/queue and table reports:
+
+```powershell
+python h8536_serial_gate.py --help
+python h8536_rx_branch_trace.py --help
+python h8536_report_source_trace.py --help
+python h8536_panel_button_trace.py --help
+python h8536_table_xrefs.py --help
+python h8536_ccu_seed_hints.py --help
+python h8536_eeprom_layout.py --help
+python h8536_consistency.py --help
+```
+
+- `h8536_serial_gate.py`: reports the autonomous TX gate and report queue evidence.
+- `h8536_rx_branch_trace.py`: reports the SCI1 RX branch tree. Current finding: command `0x04/0x05/0x06` are continuation-path commands behind `FAA2 != 0`, so a standalone command-4 force from idle should not reach `BD0E`.
+- `h8536_report_source_trace.py`: traces direct `loc_3E54` report enqueue sources. Current finding: no direct static `R3 = 0x0007` enqueue in the JSON, so CAM power `0x0007` remains runtime/capture-observed unless a later indirect/table path proves it.
+- `h8536_panel_button_trace.py`: decodes the `H'2706` panel-button jump table and traces known CALL/CAM POWER reports back through the input shadow bytes.
+- `h8536_table_xrefs.py`: emits candidate table/index xrefs and LCD text correlation hints.
+- `h8536_ccu_seed_hints.py`: mines table, dispatch, LCD, and observed-report hints for the CCU-side state stream the RCP may expect before active displays/reports.
+- `h8536_eeprom_layout.py`: mines the X24164 EEPROM layout, ROM factory defaults, persistent record slots, and serial selector-to-EEPROM offset mapping.
+- `h8536_consistency.py`: flags JSON-to-pseudocode semantic hazards such as byte immediates written to word destinations.
+
+For the emulator harness:
+
+```powershell
+python h8536_emulator.py --help
+python h8536_emulator_probe.py --help
+python h8536_emulator_rx_probe.py --help
+python h8536_emulator_rx_divergence.py --help
+```
+
+- `--rom PATH`: use an explicit ROM path instead of auto-discovering `ROM\M27C512@DIP28_1.BIN`.
+- `--max-steps N`: bound execution.
+- `--trace`: print executed instructions.
+- `--stop-on-heartbeat`: stop only if `00 00 00 00 80 DA` is emitted through SCI1 TDR.
+- `--interval-steps N`: tune the scaffolded interval timer cadence.
+- `--clock-hz N`: set the CPU/phi clock used for calibrated FRT1/FRT2 compare timing; the default is 10 MHz.
+- `--frt1-ocia-steps N` / `--frt2-ocia-steps N`: optional legacy overrides for forcing rough FRT compare cadence in targeted tests.
+- `--p9-fast-path`: shortcut known P9 transfer routines for exploration. Fast-path byte/marker calls now feed the X24164 EEPROM model, and `BFE0/BFFE` wrapper shortcuts perform EEPROM word write-verify/read operations against the modeled banks.
+- `--p9-fast-optimistic-wrapper`: legacy fallback for older wrapper experiments; the known `BFE0/BFFE` EEPROM wrappers now use the X24164 model instead.
+- `--p7-input 0xFF`: set external P7 input pin state; this matters for the EEPROM defaulting gate at `P7DR.7` and the DIP-switch style inputs.
+- `--eeprom-seed blank|factory`: choose blank X24164 power-on state or pre-seed the X24164/shadow tables from the ROM defaults before reset.
+- `--eeprom-load PATH`: load a 0x1000-byte logical X24164 EEPROM image before boot/probe; page 0 is also mirrored into the F400 shadow so the ROM's early `F402` signature check sees the loaded state.
+- `--eeprom-save PATH`: save the final 0x1000-byte logical EEPROM image after boot/probe.
+- `--eeprom-report PATH` / `--eeprom-report-json PATH`: write a ROM-layout-aware EEPROM snapshot with page records, write logs, factory diffs, and F400 shadow diffs.
+- `--trace-report-gates`, `--trace-report-queue`, and `--trace-ram-lifecycle`: inspect the serial report queue, `loc_4046`/`F9C4` gate, and watched RAM byte history.
+- `--target-frame "00 00 00 00 80 DA"`: compare staged/emitted TX bytes against an expected six-byte frame.
+- `h8536_emulator_rx_probe.py "04 00 00 80 00"`: append the checksum, inject the host frame through SCI1 RX, and summarize responses.
+- `h8536_emulator_rx_probe.py --wait-heartbeats 1 --panel-press cam-power`: inject the traced CAM POWER edge into the ROM panel shadow/dirty path and listen for the resulting selector `0x0007` behavior.
+- `h8536_emulator_rx_probe.py --panel call=press --panel call=release --keep-listening`: preserve ordered synthetic panel actions and test the CALL active/inactive path through the normal ROM dispatcher.
+- `h8536_emulator_rx_probe.py --panel F6D4.6=press`: probe an adjacent raw matrix bit from the table at `H'2706`; raw specs may be shadow bytes like `F6D4.6` or source bytes like `F105.6`.
+- `h8536_emulator_rx_probe.py --uart-timing --uart-baud 38400 "04 00 00 80 00"`: inject all six host bytes with bench-style wire spacing of about 260 us per byte, letting RXI/TXI/timers interleave; if the ROM has not cleared `RDRF` before the next byte, the SCI model raises `ORER`. The real bench link is `8E1`.
+- `h8536_emulator_rx_probe.py --uart-timing --uart-format 8E1 --tx-wire-timing --wait-heartbeats 2 --post-frame-ms 700 "04 00 00 80 00 DE" "04 00 00 80 00 DE"`: replay the CONNECT refresh shape after heartbeat readiness and keep the emulator running for a bench-scale gap after each frame. The RAM trace now tags interesting accesses with the executing ROM PC, models SCI1 TDRE/TXI at 8E1 character time, and reports whether X24164 EEPROM bytes were written.
+- `h8536_emulator_rx_probe.py --preset connect-lcd`: replay the current CONNECT LCD activation candidates.
+- `h8536_emulator_rx_divergence.py --default-frames --uart-timing --wait-heartbeats 2 --summary-only`: run the focused RX divergence trace for the bench mismatch. It flags whether a frame reached cmd0 `BC69`, cmd1 `BCD7`, retry echo, command-7 replay, autonomous `BAF2` report output, or the TX/RX overlap-collapse path.
+- `scripts\serial_table_dump.py --port COM5 --relay-port COM6 --start 0x000 --count 0x200 --log captures\table-read.txt`: read-only command-1 sweep of the firmware-exposed serial table state for EEPROM/shadow inference. Bench serial scripts default to `8E1` because the ROM initializes SCI1 as async 8-bit even parity, 1 stop; pass `--parity N` only when reproducing older 8N1 captures.
+- `scripts\serial_scenario.py scenarios\ack-race-000-001.json --log captures\ack-race-000-001.txt --result-json captures\ack-race-000-001-result.json`: run the focused `0x000 -> 0x001` retry probe with immediate reactive ACK and a 2 ms poll interval, to test whether command 5 can arrive before the second `07 80 40 20 90 2D` retry.
+- `scripts\serial_scenario.py scenarios\early-ack-000-001.json --log captures\early-ack-000-001.txt --result-json captures\early-ack-000-001-result.json`: send the same command-1 pair, then send command-5 ACK immediately without waiting for the retry frame.
+- `scripts\serial_scenario.py scenarios\table-sweep-ack-000-07f.json --log captures\table-sweep-ack-000-07f.txt --result-json captures\table-sweep-ack-000-07f-result.json`: run a repeatable bench scenario that sweeps selectors `0x000-0x07F` and sends `05 00 40 00 00 1F` only after `07 80 40 20 90 2D` appears. The checked-in scenario stops if it reaches 8 ACKs or 32 target hits. Use `--sync fixed` only when comparing against the old non-resyncing receiver.
+- `scripts\state_map_runner.py --preset ok --prime-frame "01 80 40 40 30 EB" --prime-repeat 1 --prompt-screen`: run the state-map proof sequence against the bench device. The runner waits for a device `07...` visible-drain candidate, guards briefly so TXI can finish, sends the selector-zero force, then probes direct readback and command-7 recovery without inserting a command-0/command-1 destroyer before the force.
+- `scripts\state_map_runner.py --analyze-log captures\ack-race-000-001.txt --json-out captures\ack-race-000-001-state-map.json`: classify an existing capture using the same state-map rules and report whether the selector-zero `BD0E -> E000[0]` edge was proven.
+- `h8536_emulator_state_search.py --preset connect-queue --target ok --first-hit --json-out build\connect-state-search-ok.json`: run the bounded emulator state search for the minimum selector-zero queue condition that reaches `CONNECT:  OK`. The default matrix varies `E000[0]` and `F730`, seeds `F970[0]=0`, starts at `loc_2806`, and executes real ROM code into the LCD handler.
+- `h8536_emulator_state_search.py --preset custom --pc 0x2CB9 --word E000=0x8080 --byte F730=0 --target ok`: directly test the CONNECT handler branch with explicit internal state patches.
+- `scripts\bench_connect_lcd_sequence.py --port COM5 --relay-port COM6 --prompt-screen`: power-cycle the bench device, wait for heartbeat readiness, send `04 00 00 40 00 1E`, `04 00 00 80 00 DE`, `04 00 00 C0 00 9E`, log RX/TX, and prompt for observed LCD text.
+- `scripts\bench_connect_lcd_sequence.py --port COM5 --relay-port COM6 --no-power-cycle --prompt-before-send --prompt-screen --post-sequence-read 10 --log captures\connect-notact-to-ok.txt`: prove the recoverable path by waiting for `CONNECT:NOT ACT`, then sending the CONNECT sequence without cycling power.
+- `scripts\connect_ok_matrix.py --suite minimal --prompt-observation --result-json captures\connect-ok-minimal-result.json`: run the first reproducibility pass for the 8E1 CONNECT: OK discovery. It power-cycles between cases and tests the known sequence, each single frame, and the likely primer pairs.
+- `scripts\connect_ok_matrix.py --suite gap --prompt-observation --result-json captures\connect-ok-gap-result.json`: rerun the known `40 -> 80 -> C0` order with varied inter-frame gaps to test whether cadence matters.
+- `scripts\connect_ok_matrix.py --suite hold --prompt-observation --result-json captures\connect-ok-hold-result.json`: rerun the known order with longer post-send observation windows to test whether CONNECT: OK is latched or needs continued traffic.
+- `h8536_emulator_bench_replay.py captures\bench-connect-lcd-sequence-20260525-214411.txt --assert-bench-parity`: replay a real bench log into the emulator using timed UART RX by default and intentionally fail while any response/LCD state still diverges from the bench-observed `CONNECT NOT ACT` plus `07 80 C0 60 20 5D` path. Pass `--polite-rx` for the old wait-until-consumed injection mode.
+- Current status: boots from `H'1000`, initializes SCI1, models the traced X24164 EEPROM bus on P9, captures P9 byte candidates, can optionally fast-path known P9 EEPROM routines, schedules FRT1/FRT2 OCIA from timer registers and `--clock-hz`, captures the ROM-driven LCD line ` CONNECT:NOT ACT`, and emits the observed heartbeat frame `00 00 00 00 80 DA`.
+
 ## Code Layout
 
 - `h8536_decompiler.py`: compatibility wrapper for the CLI.
@@ -109,9 +352,39 @@ python h8536_pseudocode.py --help
 - `h8536/timing.py`: block and loop cycle summaries.
 - `h8536/sci.py`: SCI setup tracking and baud inference.
 - `h8536/sci_protocol.py`: SCI transmit/receive/status semantic annotations.
+- `h8536/serial_reconstruction.py`: cautious higher-level SCI frame reconstruction from decompiled evidence.
+- `h8536/serial_semantics.py`: candidate command/field semantics inferred from serial frame use.
+- `h8536/serial_pseudocode.py`: focused RX/TX protocol pseudocode generation from reconstruction metadata.
+- `h8536/protocol_trace.py`: raw six-byte protocol frame decoder/checksum validator.
+- `h8536/protocol_capture.py`: timestamped serial capture parser, frame recombiner, and cadence/gate-session analyzer.
+- `h8536/serial_scenario.py`: JSON-driven bench scenario engine shared by real-device serial scripts.
+- `h8536/state_map_runner.py`: PT2 state-map proof runner and bench-log analyzer for visible-drain token, selector-zero force, `E000[0]` readback, and command-7 recovery experiments.
+- `ccu_emulator/`: modular fake-CCU package for reactive report ACKs and optional periodic state refreshes.
+- `h8536/serial_gate.py`: autonomous TX gate/queue state-machine reconstruction.
+- `h8536/report_source_trace.py`: direct `loc_3E54` report enqueue source tracer.
+- `h8536/panel_button_trace.py`: panel button matrix/jump-table tracer for CALL, CAM POWER, and adjacent report-capable button paths.
+- `h8536/table_xrefs.py`: table/index xrefs and LCD correlation report generation.
+- `h8536/ccu_seed_hints.py`: ROM miner for likely fake-CCU state seed selectors and candidate command/readback frames.
+- `h8536/eeprom_layout.py`: ROM miner for X24164 EEPROM defaults, 8-byte record slots, and serial persistence mapping.
+- `h8536/consistency.py`: decompiler/pseudocode semantic consistency checks.
+- `h8536/emulator/`: early H8/536 emulator package split into CPU state, memory map, SCI1 TX capture, bench-style UART injection timing, P9/X24164 EEPROM bus model, LCD model, manual-derived FRT timer scheduling, runner, probe, CLI, and peripheral scaffolding.
+- `h8536/emulator/eeprom_image.py`: logical EEPROM image dump/report helpers for emulator runs, including factory diffs and record-slot summaries.
+- `h8536/emulator/panel.py`: synthetic panel input descriptors for known CALL/CAM POWER edges and raw ROM shadow/source-bit injection.
+- `h8536/emulator/rx_probe.py`: host-frame injection and response/listener probe for SCI1 RX experiments.
+- `h8536/emulator/state_search.py`: bounded internal-state search for CONNECT LCD outcomes using ROM execution plus explicit RAM/table patches.
 - `h8536/board_profile.py`: Sony RCP-TX7 board-trace annotations, including the MAX202 RS232 path.
 - `h8536/peripheral_access.py`: FRT/A-D TEMP-register access analysis.
 - `h8536/pseudocode.py`: JSON-to-C-like pseudocode generation.
 - `h8536/render.py`: assembly and JSON output.
 - `h8536/model.py`, `h8536/rom.py`, `h8536/formatting.py`: shared data structures and helpers.
 - `h8536_pseudocode.py`: pseudocode CLI wrapper.
+- `h8536_serial_pseudocode.py`: focused serial pseudocode CLI wrapper.
+- `h8536_protocol_trace.py`, `h8536_protocol_capture.py`: protocol analysis CLI wrappers.
+- `h8536_serial_gate.py`, `h8536_report_source_trace.py`, `h8536_panel_button_trace.py`, `h8536_table_xrefs.py`, `h8536_ccu_seed_hints.py`, `h8536_eeprom_layout.py`, `h8536_consistency.py`: sidecar analysis CLI wrappers.
+- `h8536_emulator.py`, `h8536_emulator_probe.py`, `h8536_emulator_rx_probe.py`, `h8536_emulator_rx_divergence.py`, `h8536_emulator_bench_replay.py`: emulator CLI wrappers.
+- `h8536_emulator_state_search.py`: emulator CONNECT state-search CLI wrapper.
+- `scripts/bench_connect_lcd_sequence.py`: real-device COM5/COM6 bench runner for the CONNECT LCD sequence.
+- `scripts/connect_ok_matrix.py`: real-device COM5/COM6 CONNECT: OK reproducibility matrix runner for single-frame, pair, order, gap, repeat, and hold tests.
+- `scripts/serial_table_dump.py`: read-only COM5/COM6 command-1 table sweep for inferring live EEPROM-backed parameter state. Bench scripts default to `38400 8E1`.
+- `scripts/serial_scenario.py`: JSON-driven COM5/COM6 bench scenario runner for chained probes, waits, read sweeps, and ACK-on-target experiments.
+- `scripts/state_map_runner.py`: COM5/COM6 PT2 state-map proof runner and offline bench-log analyzer.

ROM/rcp-txd-idle-only.txt

@@ -0,0 +1,54 @@
+11:54:40.567  frame 006  00 00 00 00 80 DA
+11:54:41.368  frame 006  00 00 00 00 80 DA
+11:54:41.970  frame 006  00 00 00 00 80 DA
+11:54:42.772  frame 006  00 00 00 00 80 DA
+11:54:43.373  frame 006  00 00 00 00 80 DA
+11:54:44.176  frame 006  00 00 00 00 80 DA
+11:54:44.778  frame 006  00 00 00 00 80 DA
+11:54:45.580  frame 006  00 00 00 00 80 DA
+11:54:46.183  frame 006  00 00 00 00 80 DA
+11:54:46.984  frame 006  00 00 00 00 80 DA
+11:54:47.586  frame 006  00 00 00 00 80 DA
+11:54:48.387  frame 006  00 00 00 00 80 DA
+11:54:48.988  frame 006  00 00 00 00 80 DA
+11:54:49.790  frame 006  00 00 00 00 80 DA
+11:54:50.393  frame 006  00 00 00 00 80 DA
+11:54:51.196  frame 006  00 00 00 00 80 DA
+11:54:51.797  frame 006  00 00 00 00 80 DA
+11:54:52.599  frame 006  00 00 00 00 80 DA
+11:54:53.201  frame 006  00 00 00 00 80 DA
+11:54:54.003  frame 006  00 00 00 00 80 DA
+11:54:54.604  frame 006  00 00 00 00 80 DA
+11:54:55.406  frame 006  00 00 00 00 80 DA
+11:54:56.009  frame 006  00 00 00 00 80 DA
+11:54:56.812  frame 006  00 00 00 00 80 DA
+11:54:57.413  frame 006  00 00 00 00 80 DA
+11:54:58.215  frame 006  00 00 00 00 80 DA
+11:54:58.816  frame 006  00 00 00 00 80 DA
+11:54:59.619  frame 006  00 00 00 00 80 DA
+11:55:00.220  frame 006  00 00 00 00 80 DA
+11:55:01.023  frame 006  00 00 00 00 80 DA
+11:55:01.625  frame 006  00 00 00 00 80 DA
+11:55:02.426  frame 006  00 00 00 00 80 DA
+11:55:03.027  frame 006  00 00 00 00 80 DA
+11:55:03.829  frame 006  00 00 00 00 80 DA
+11:55:04.430  frame 006  00 00 00 00 80 DA
+11:55:05.231  frame 006  00 00 00 00 80 DA
+11:55:05.832  frame 006  00 00 00 00 80 DA
+11:55:06.634  frame 006  00 00 00 00 80 DA
+11:55:07.235  frame 006  00 00 00 00 80 DA
+11:55:07.837  frame 006  00 00 00 00 80 DA
+11:55:08.638  frame 006  00 00 00 00 80 DA
+11:55:09.239  frame 006  00 00 00 00 80 DA
+11:55:10.040  frame 006  00 00 00 00 80 DA
+11:55:10.642  frame 006  00 00 00 00 80 DA
+11:55:11.443  frame 006  00 00 00 00 80 DA
+11:55:12.045  frame 006  00 00 00 00 80 DA
+11:55:12.848  frame 006  00 00 00 00 80 DA
+11:55:13.450  frame 006  00 00 00 00 80 DA
+11:55:14.253  frame 006  00 00 00 00 80 DA
+11:55:14.854  frame 006  00 00 00 00 80 DA
+11:55:15.657  frame 006  00 00 00 00 80 DA
+11:55:16.259  frame 006  00 00 00 00 80 DA
+11:55:17.061  frame 006  00 00 00 00 80 DA
+11:55:17.663  frame 006  00 00 00 00 80 DA

build/bench-sync-after-dip-reset.txt

@@ -0,0 +1,111 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=4216 words=2108 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- 0x0FE page=0x0 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FE page=0x1 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FE page=0x2 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FE page=0x3 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FE page=0x4 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FE page=0x5 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FE page=0x6 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FE page=0x7 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FE page=0x8 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FE page=0x9 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFE page=0xA offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFE page=0xB offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFE page=0xC offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFE page=0xD offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFE page=0xE offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFE page=0xF offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FC page=0x0 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FC page=0x1 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FC page=0x2 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FC page=0x3 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FC page=0x4 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FC page=0x5 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FC page=0x6 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FC page=0x7 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FC page=0x8 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FC page=0x9 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFC page=0xA offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFC page=0xB offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFC page=0xC offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFC page=0xD offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFC page=0xE offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFC page=0xF offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FA page=0x0 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FA page=0x1 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FA page=0x2 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FA page=0x3 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FA page=0x4 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FA page=0x5 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FA page=0x6 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FA page=0x7 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FA page=0x8 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FA page=0x9 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFA page=0xA offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFA page=0xB offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFA page=0xC offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFA page=0xD offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFA page=0xE offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFA page=0xF offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F8 page=0x0 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F8 page=0x1 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F8 page=0x2 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F8 page=0x3 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F8 page=0x4 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F8 page=0x5 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F8 page=0x6 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F8 page=0x7 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F8 page=0x8 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F8 page=0x9 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF8 page=0xA offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF8 page=0xB offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF8 page=0xC offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF8 page=0xD offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF8 page=0xE offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF8 page=0xF offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F6 page=0x0 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F6 page=0x1 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F6 page=0x2 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F6 page=0x3 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F6 page=0x4 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F6 page=0x5 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F6 page=0x6 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F6 page=0x7 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F6 page=0x8 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F6 page=0x9 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF6 page=0xA offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF6 page=0xB offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF6 page=0xC offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF6 page=0xD offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF6 page=0xE offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF6 page=0xF offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- ... 2028 more word writes omitted
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- F400-F4FF shadow matches ROM factory words or no ROM factory baseline was supplied

build/bench-sync-cmd0-readback-zero-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/bench-sync-cmd0-seed-zero-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/bench-sync-factory-trial1.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/bench-sync-polite-trial1-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/bench-sync-polite-trial2-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/bench-sync-state-search-direct-ok.json

@@ -0,0 +1,50 @@
+{
+  "case_count": 1,
+  "description": "Use only --byte/--word/--matrix-* patches and --pc.",
+  "hits": [
+    {
+      "case_index": 0,
+      "display": " CONNECT:  OK    |                  |                  |                 ",
+      "e000": "0x8080",
+      "f730": "0x81",
+      "f9b4": "0x00",
+      "f9b9": "0x00",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:  OK   ",
+      "outcome": "ok",
+      "patches": [
+        "byte:H'F730=0x00",
+        "word:H'E000=0x8080"
+      ],
+      "pc": "H'2CB9",
+      "steps": 37097,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    }
+  ],
+  "kind": "h8536_emulator_state_search",
+  "preset": "custom",
+  "result_count": 1,
+  "results": [
+    {
+      "case_index": 0,
+      "display": " CONNECT:  OK    |                  |                  |                 ",
+      "e000": "0x8080",
+      "f730": "0x81",
+      "f9b4": "0x00",
+      "f9b9": "0x00",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:  OK   ",
+      "outcome": "ok",
+      "patches": [
+        "byte:H'F730=0x00",
+        "word:H'E000=0x8080"
+      ],
+      "pc": "H'2CB9",
+      "steps": 37097,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    }
+  ],
+  "target": "ok"
+}

build/bench-sync-state-search-queue-ok-exact.json

@@ -0,0 +1,56 @@
+{
+  "case_count": 1,
+  "description": "Use only --byte/--word/--matrix-* patches and --pc.",
+  "hits": [
+    {
+      "case_index": 0,
+      "display": " CONNECT:  OK    |                  |                  |                 ",
+      "e000": "0x8080",
+      "f730": "0x81",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:  OK   ",
+      "outcome": "ok",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "byte:H'F730=0x00",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x8080"
+      ],
+      "pc": "H'2806",
+      "steps": 37121,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    }
+  ],
+  "kind": "h8536_emulator_state_search",
+  "preset": "custom",
+  "result_count": 1,
+  "results": [
+    {
+      "case_index": 0,
+      "display": " CONNECT:  OK    |                  |                  |                 ",
+      "e000": "0x8080",
+      "f730": "0x81",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:  OK   ",
+      "outcome": "ok",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "byte:H'F730=0x00",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x8080"
+      ],
+      "pc": "H'2806",
+      "steps": 37121,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    }
+  ],
+  "target": "ok"
+}

build/bench-sync-timed-trial1-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/bench-sync-timed-trial2-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/connect-state-search-ok.json

@@ -0,0 +1,386 @@
+{
+  "case_count": 25,
+  "description": "Queue selector zero in F970, start at loc_2806, then enter loc_2CB9 through the ROM dispatch.",
+  "hits": [
+    {
+      "case_index": 15,
+      "display": " CONNECT:  OK    |                  |                  |                 ",
+      "e000": "0x8080",
+      "f730": "0x81",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:  OK   ",
+      "outcome": "ok",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x8080",
+        "byte:H'F730=0x00"
+      ],
+      "pc": "H'2806",
+      "steps": 37121,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    }
+  ],
+  "kind": "h8536_emulator_state_search",
+  "preset": "connect-queue",
+  "result_count": 16,
+  "results": [
+    {
+      "case_index": 0,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0000",
+        "byte:H'F730=0x00"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 1,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0000",
+        "byte:H'F730=0x01"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 2,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0000",
+        "byte:H'F730=0x41"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 3,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0000",
+        "byte:H'F730=0x81"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 4,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0000",
+        "byte:H'F730=0xC1"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 5,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0080",
+        "byte:H'F730=0x00"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 6,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0080",
+        "byte:H'F730=0x01"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 7,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0080",
+        "byte:H'F730=0x41"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 8,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0080",
+        "byte:H'F730=0x81"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 9,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x0080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'2D37",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x0080",
+        "byte:H'F730=0xC1"
+      ],
+      "pc": "H'2806",
+      "steps": 5109,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'2D37: 6E C6 MOV:L.W @H'00C6, R6"
+    },
+    {
+      "case_index": 10,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x4080",
+      "f730": "0x00",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'A9E8",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x4080",
+        "byte:H'F730=0x00"
+      ],
+      "pc": "H'2806",
+      "steps": 5366,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'A9E8: 7E 58 MOV:S.W R6, @H'0058"
+    },
+    {
+      "case_index": 11,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x4080",
+      "f730": "0x01",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'A9E8",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x4080",
+        "byte:H'F730=0x01"
+      ],
+      "pc": "H'2806",
+      "steps": 5366,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'A9E8: 7E 58 MOV:S.W R6, @H'0058"
+    },
+    {
+      "case_index": 12,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x4080",
+      "f730": "0x41",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x4080",
+        "byte:H'F730=0x41"
+      ],
+      "pc": "H'2806",
+      "steps": 45,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    },
+    {
+      "case_index": 13,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x4080",
+      "f730": "0x81",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'A9E8",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x4080",
+        "byte:H'F730=0x81"
+      ],
+      "pc": "H'2806",
+      "steps": 5366,
+      "stopped_reason": "unsupported_instruction",
+      "unsupported": "unsupported instruction at H'A9E8: 7E 58 MOV:S.W R6, @H'0058"
+    },
+    {
+      "case_index": 14,
+      "display": " CONNECT:NOT ACT |                  |                  |                 ",
+      "e000": "0x4080",
+      "f730": "0xC1",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:NOT ACT",
+      "outcome": "not-act",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x4080",
+        "byte:H'F730=0xC1"
+      ],
+      "pc": "H'2806",
+      "steps": 45,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    },
+    {
+      "case_index": 15,
+      "display": " CONNECT:  OK    |                  |                  |                 ",
+      "e000": "0x8080",
+      "f730": "0x81",
+      "f9b4": "0x01",
+      "f9b9": "0x01",
+      "final_pc": "H'FFFF",
+      "line0": " CONNECT:  OK   ",
+      "outcome": "ok",
+      "patches": [
+        "byte:H'F9B9=0x00",
+        "byte:H'F9B4=0x01",
+        "word:H'F970=0x0000",
+        "word:H'E000=0x8080",
+        "byte:H'F730=0x00"
+      ],
+      "pc": "H'2806",
+      "steps": 37121,
+      "stopped_reason": "stop_pc",
+      "unsupported": null
+    }
+  ],
+  "target": "ok"
+}

build/emulator-eeprom-boot.txt

@@ -0,0 +1,111 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=4216 words=2108 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- 0x0FE page=0x0 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FE page=0x1 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FE page=0x2 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FE page=0x3 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FE page=0x4 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FE page=0x5 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FE page=0x6 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FE page=0x7 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FE page=0x8 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FE page=0x9 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFE page=0xA offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFE page=0xB offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFE page=0xC offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFE page=0xD offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFE page=0xE offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFE page=0xF offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FC page=0x0 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FC page=0x1 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FC page=0x2 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FC page=0x3 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FC page=0x4 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FC page=0x5 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FC page=0x6 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FC page=0x7 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FC page=0x8 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FC page=0x9 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFC page=0xA offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFC page=0xB offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFC page=0xC offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFC page=0xD offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFC page=0xE offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFC page=0xF offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FA page=0x0 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FA page=0x1 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FA page=0x2 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FA page=0x3 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FA page=0x4 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FA page=0x5 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FA page=0x6 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FA page=0x7 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FA page=0x8 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FA page=0x9 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFA page=0xA offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFA page=0xB offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFA page=0xC offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFA page=0xD offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFA page=0xE offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFA page=0xF offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F8 page=0x0 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F8 page=0x1 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F8 page=0x2 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F8 page=0x3 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F8 page=0x4 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F8 page=0x5 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F8 page=0x6 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F8 page=0x7 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F8 page=0x8 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F8 page=0x9 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF8 page=0xA offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF8 page=0xB offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF8 page=0xC offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF8 page=0xD offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF8 page=0xE offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF8 page=0xF offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F6 page=0x0 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F6 page=0x1 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F6 page=0x2 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F6 page=0x3 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F6 page=0x4 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F6 page=0x5 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F6 page=0x6 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F6 page=0x7 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F6 page=0x8 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F6 page=0x9 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF6 page=0xA offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF6 page=0xB offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF6 page=0xC offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF6 page=0xD offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF6 page=0xE offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF6 page=0xF offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- ... 2028 more word writes omitted
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- F400-F4FF shadow matches ROM factory words or no ROM factory baseline was supplied

build/emulator-eeprom-loaded-boot.json

@@ -0,0 +1,300 @@
+{
+  "factory_diffs": [],
+  "kind": "emulator_eeprom_snapshot",
+  "records": [
+    {
+      "address": 0,
+      "address_hex": "0x000",
+      "ascii": "..ko....",
+      "bytes_hex": "00 00 6B 6F FE 00 00 00",
+      "is_blank_spaces": false,
+      "page": 0,
+      "page_hex": "0x0",
+      "range_hex": "0x000-0x007",
+      "words_hex": [
+        "0x0000",
+        "0x6B6F",
+        "0xFE00",
+        "0x0000"
+      ]
+    },
+    {
+      "address": 256,
+      "address_hex": "0x100",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 1,
+      "page_hex": "0x1",
+      "range_hex": "0x100-0x107",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 512,
+      "address_hex": "0x200",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 2,
+      "page_hex": "0x2",
+      "range_hex": "0x200-0x207",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 768,
+      "address_hex": "0x300",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 3,
+      "page_hex": "0x3",
+      "range_hex": "0x300-0x307",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 1024,
+      "address_hex": "0x400",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 4,
+      "page_hex": "0x4",
+      "range_hex": "0x400-0x407",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 1280,
+      "address_hex": "0x500",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 5,
+      "page_hex": "0x5",
+      "range_hex": "0x500-0x507",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 1536,
+      "address_hex": "0x600",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 6,
+      "page_hex": "0x6",
+      "range_hex": "0x600-0x607",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 1792,
+      "address_hex": "0x700",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 7,
+      "page_hex": "0x7",
+      "range_hex": "0x700-0x707",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 2048,
+      "address_hex": "0x800",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 8,
+      "page_hex": "0x8",
+      "range_hex": "0x800-0x807",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 2304,
+      "address_hex": "0x900",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 9,
+      "page_hex": "0x9",
+      "range_hex": "0x900-0x907",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 2560,
+      "address_hex": "0xA00",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 10,
+      "page_hex": "0xA",
+      "range_hex": "0xA00-0xA07",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 2816,
+      "address_hex": "0xB00",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 11,
+      "page_hex": "0xB",
+      "range_hex": "0xB00-0xB07",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 3072,
+      "address_hex": "0xC00",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 12,
+      "page_hex": "0xC",
+      "range_hex": "0xC00-0xC07",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 3328,
+      "address_hex": "0xD00",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 13,
+      "page_hex": "0xD",
+      "range_hex": "0xD00-0xD07",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 3584,
+      "address_hex": "0xE00",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 14,
+      "page_hex": "0xE",
+      "range_hex": "0xE00-0xE07",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    },
+    {
+      "address": 3840,
+      "address_hex": "0xF00",
+      "ascii": "        ",
+      "bytes_hex": "20 20 20 20 20 20 20 20",
+      "is_blank_spaces": true,
+      "page": 15,
+      "page_hex": "0xF",
+      "range_hex": "0xF00-0xF07",
+      "words_hex": [
+        "0x2020",
+        "0x2020",
+        "0x2020",
+        "0x2020"
+      ]
+    }
+  ],
+  "shadow_f400": {
+    "diff_count": 1,
+    "diffs": [
+      {
+        "actual_word": 21760,
+        "actual_word_hex": "0x5500",
+        "address": 62634,
+        "address_hex": "H'F4AA",
+        "aligned_offset": 170,
+        "aligned_offset_hex": "0xAA",
+        "expected_word": 32768,
+        "expected_word_hex": "0x8000",
+        "mapped_selectors": [
+          274
+        ],
+        "mapped_selectors_hex": [
+          "0x112"
+        ],
+        "offset": 170,
+        "offset_hex": "0xAA",
+        "page": 0,
+        "page_hex": "0x0",
+        "record_byte": null,
+        "role": "factory_shadow_offset"
+      }
+    ]
+  },
+  "summary": {
+    "factory_diff_word_count": 0,
+    "logical_size": 4096,
+    "logical_size_hex": "0x1000",
+    "record_count": 16,
+    "sha256": "4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6",
+    "write_byte_count": 0,
+    "write_word_count": 0
+  },
+  "write_events": [],
+  "write_word_events": []
+}

build/emulator-eeprom-loaded-boot.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/panel_button_trace.md

@@ -0,0 +1,74 @@
+# PT2 Known Button ROM Trace
+
+This report follows the panel button edge path from the serial-visible reports back into the ROM input scanner.
+The key table is the indirect handler table at `H'2706`, used by `loc_1C0E` after byte-level panel input changes are detected.
+
+## Known Anchors
+
+### CAM POWER
+
+- Emitted selector: `0x0007`
+- Handler: `H'1F40`
+- Edge source: `F105 -> F6D4` via `F6F2.4`
+- Trigger bit: `F6D4.3`
+- Table slot: `H'274C` -> `H'1F40`
+- Current-level tests: F6D4.3
+- State writes: E80E
+
+### IRIS/M.BLACK LINK
+
+- Emitted selector: `0x0013`
+- Handler: `H'200E`
+- Edge source: `F006 -> F6DB` via `F6F3.3`
+- Trigger bit: `F6DB.7`
+- Table slot: `H'27C4` -> `H'200E`
+- Current-level tests: F6DB.7
+- State writes: E826
+
+### CALL
+
+- Emitted selector: `0x0015`
+- Handler: `H'20A1`
+- Edge source: `F006 -> F6DB` via `F6F3.3`
+- Trigger bit: `F6DB.5`
+- Table slot: `H'27C0` -> `H'20A1`
+- Current-level tests: F6DB.5
+- State writes: E82A
+
+## Button Matrix Entries With Serial Reports
+
+| Source | Shadow bit | Dirty | Handler | Selector(s) | State writes |
+| --- | --- | --- | --- | --- | --- |
+| `F105` | `F6D4.6` | `F6F2.4` | `H'2048` | `0x006B` | `E8D6` |
+| `F105` | `F6D4.3` | `F6F2.4` | `H'1F40` | `0x0007` | `E80E` |
+| `F105` | `F6D4.2` | `F6F2.4` | `H'1EDE` | `0x0017`, `0x0018` | `E82E`, `E830` |
+| `F105` | `F6D4.1` | `F6F2.4` | `H'1EA9` | `0x00F8` | `E9F0` |
+| `F105` | `F6D4.0` | `F6F2.4` | `H'1E20` | `0x00B7`, `0x00C4`, `0x00C6`, `0x0097` | `E96E`, `E988`, `E98C`, `E92E` |
+| `F106` | `F6D3.7` | `F6F2.3` | `H'1DCE` | `0x0096` | `E92C` |
+| `F106` | `F6D3.6` | `F6F2.3` | `H'1D87` | `0x0097` | `E92E` |
+| `F106` | `F6D3.5` | `F6F2.3` | `H'1D56` | `0x001A` | `E834` |
+| `F106` | `F6D3.4` | `F6F2.3` | `H'1D25` | `0x001A` | `E834` |
+| `F106` | `F6D3.3` | `F6F2.3` | `H'1CF4` | `0x001A` | `E834` |
+| `F106` | `F6D3.2` | `F6F2.3` | `H'1CCE` | `0x001A` | `E834` |
+| `F106` | `F6D3.1` | `F6F2.3` | `H'1CB2` | `0x001A` | `E834` |
+| `F109` | `F6D0.7` | `F6F2.0` | `H'24E8` | `0x008F` | `E91E` |
+| `F109` | `F6D0.6` | `F6F2.0` | `H'252E` | `0x008F` | `E91E` |
+| `F109` | `F6D0.3` | `F6F2.0` | `H'24A9` | `0x0083` | `E906` |
+| `F109` | `F6D0.2` | `F6F2.0` | `H'2408` | `0x0083` | `E906` |
+| `F109` | `F6D0.1` | `F6F2.0` | `H'2390` | `0x0083` | `E906` |
+| `F005` | `F6DC.7` | `F6F3.4` | `H'20F1` | `0x00B9` | `E972` |
+| `F005` | `F6DC.5` | `F6F3.4` | `H'2204` | `0x0093` | `E926` |
+| `F005` | `F6DC.4` | `F6F3.4` | `H'226D` | `0x0093` | `E926` |
+| `F005` | `F6DC.3` | `F6F3.4` | `H'22A6` | `0x0093` | `E926` |
+| `F005` | `F6DC.1` | `F6F3.4` | `H'22FC` | `0x0093` | `E926` |
+| `F005` | `F6DC.0` | `F6F3.4` | `H'2326` | `0x0093` | `E926` |
+| `F006` | `F6DB.7` | `F6F3.3` | `H'200E` | `0x0013` | `E826` |
+| `F006` | `F6DB.5` | `F6F3.3` | `H'20A1` | `0x0015` | `E82A` |
+| `F006` | `F6DB.3` | `F6F3.3` | `H'20BE` | `0x009A` | `E934` |
+
+## Practical Read
+
+- CALL and CAM POWER do share the general panel edge path with many other buttons.
+- The shared path is: panel byte snapshot -> shadow byte -> dirty bit -> `loc_1C0E` jump table -> handler -> `loc_3E54` report.
+- Other buttons diverge in their handlers: many require `F731/F730/F791` session/menu gates, mutate page state, or emit different selectors.
+- Some table entries are `H'1C25`, an immediate `RTS`, so those physical matrix positions are intentionally ignored in this firmware context.

build/pin50-p77-high-blank-eeprom.txt

@@ -0,0 +1,191 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=f47a8ec3e9aff2318d896942282ad4fe37d6391c82914f54a5da8a37de1300c6
+writes: bytes=0 words=0 factory_diff_words=2048
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x1 EEPROM 0x100-0x107 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x2 EEPROM 0x200-0x207 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x3 EEPROM 0x300-0x307 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x4 EEPROM 0x400-0x407 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x5 EEPROM 0x500-0x507 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x6 EEPROM 0x600-0x607 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x7 EEPROM 0x700-0x707 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x8 EEPROM 0x800-0x807 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x9 EEPROM 0x900-0x907 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xA EEPROM 0xA00-0xA07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xB EEPROM 0xB00-0xB07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xC EEPROM 0xC00-0xC07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xD EEPROM 0xD00-0xD07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xE EEPROM 0xE00-0xE07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xF EEPROM 0xF00-0xF07 bytes=FF FF FF FF FF FF FF FF text='........'
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- 0x000 page=0x0 offset=0x00 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- 0x002 page=0x0 offset=0x02 expected=0x6B6F actual=0xFFFF (record_header_or_label)
+- 0x004 page=0x0 offset=0x04 expected=0xFE00 actual=0xFFFF (record_header_or_label)
+- 0x006 page=0x0 offset=0x06 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- 0x008 page=0x0 offset=0x08 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x004)
+- 0x00A page=0x0 offset=0x0A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x012)
+- 0x00C page=0x0 offset=0x0C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x013)
+- 0x00E page=0x0 offset=0x0E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x017)
+- 0x010 page=0x0 offset=0x10 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x018)
+- 0x012 page=0x0 offset=0x12 expected=0x0808 actual=0xFFFF (factory_shadow_offset; selectors=0x01A)
+- 0x014 page=0x0 offset=0x14 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x01F)
+- 0x016 page=0x0 offset=0x16 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x020)
+- 0x018 page=0x0 offset=0x18 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x023)
+- 0x01A page=0x0 offset=0x1A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x037)
+- 0x01C page=0x0 offset=0x1C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x038)
+- 0x01E page=0x0 offset=0x1E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x080)
+- 0x020 page=0x0 offset=0x20 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x081)
+- 0x022 page=0x0 offset=0x22 expected=0x0020 actual=0xFFFF (factory_shadow_offset; selectors=0x083)
+- 0x024 page=0x0 offset=0x24 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x088)
+- 0x026 page=0x0 offset=0x26 expected=0x0400 actual=0xFFFF (factory_shadow_offset; selectors=0x089)
+- 0x028 page=0x0 offset=0x28 expected=0x0800 actual=0xFFFF (factory_shadow_offset; selectors=0x08B)
+- 0x02A page=0x0 offset=0x2A expected=0x0040 actual=0xFFFF (factory_shadow_offset; selectors=0x08D)
+- 0x02C page=0x0 offset=0x2C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x08F)
+- 0x02E page=0x0 offset=0x2E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x091)
+- 0x030 page=0x0 offset=0x30 expected=0xFF80 actual=0xFFFF (factory_shadow_offset; selectors=0x092)
+- 0x032 page=0x0 offset=0x32 expected=0x4040 actual=0xFFFF (factory_shadow_offset; selectors=0x093)
+- 0x034 page=0x0 offset=0x34 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x095)
+- 0x036 page=0x0 offset=0x36 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x098)
+- 0x038 page=0x0 offset=0x38 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09A)
+- 0x03A page=0x0 offset=0x3A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x09D)
+- 0x03C page=0x0 offset=0x3C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09E)
+- 0x03E page=0x0 offset=0x3E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09F)
+- 0x040 page=0x0 offset=0x40 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A3)
+- 0x042 page=0x0 offset=0x42 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A4)
+- 0x044 page=0x0 offset=0x44 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A5)
+- 0x046 page=0x0 offset=0x46 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A6)
+- 0x048 page=0x0 offset=0x48 expected=0xF000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A7)
+- 0x04A page=0x0 offset=0x4A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A9)
+- 0x04C page=0x0 offset=0x4C expected=0x2000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AA)
+- 0x04E page=0x0 offset=0x4E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AC)
+- 0x050 page=0x0 offset=0x50 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AD)
+- 0x052 page=0x0 offset=0x52 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AE)
+- 0x054 page=0x0 offset=0x54 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AF)
+- 0x056 page=0x0 offset=0x56 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B0)
+- 0x058 page=0x0 offset=0x58 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B2)
+- 0x05A page=0x0 offset=0x5A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B3)
+- 0x05C page=0x0 offset=0x5C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B4)
+- 0x05E page=0x0 offset=0x5E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B6)
+- 0x060 page=0x0 offset=0x60 expected=0xF800 actual=0xFFFF (factory_shadow_offset; selectors=0x0B7)
+- 0x062 page=0x0 offset=0x62 expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B9)
+- 0x064 page=0x0 offset=0x64 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BC)
+- 0x066 page=0x0 offset=0x66 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BD)
+- 0x068 page=0x0 offset=0x68 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C0)
+- 0x06A page=0x0 offset=0x6A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C1)
+- 0x06C page=0x0 offset=0x6C expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C3)
+- 0x06E page=0x0 offset=0x6E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C4)
+- 0x070 page=0x0 offset=0x70 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C5)
+- 0x072 page=0x0 offset=0x72 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C6)
+- 0x074 page=0x0 offset=0x74 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C7)
+- 0x076 page=0x0 offset=0x76 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C8)
+- 0x078 page=0x0 offset=0x78 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C9)
+- 0x07A page=0x0 offset=0x7A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CA)
+- 0x07C page=0x0 offset=0x7C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CB)
+- 0x07E page=0x0 offset=0x7E expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CC)
+- 0x080 page=0x0 offset=0x80 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CD)
+- 0x082 page=0x0 offset=0x82 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D4)
+- 0x084 page=0x0 offset=0x84 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D5)
+- 0x086 page=0x0 offset=0x86 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D6)
+- 0x088 page=0x0 offset=0x88 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D7)
+- 0x08A page=0x0 offset=0x8A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D8)
+- 0x08C page=0x0 offset=0x8C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D9)
+- 0x08E page=0x0 offset=0x8E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0DA)
+- 0x090 page=0x0 offset=0x90 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F6)
+- 0x092 page=0x0 offset=0x92 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F9)
+- 0x094 page=0x0 offset=0x94 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FA)
+- 0x096 page=0x0 offset=0x96 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FB)
+- 0x098 page=0x0 offset=0x98 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FC)
+- 0x09A page=0x0 offset=0x9A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FD)
+- 0x09C page=0x0 offset=0x9C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FE)
+- 0x09E page=0x0 offset=0x9E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FF)
+- ... 1968 more factory diffs omitted
+
+F400 Shadow Diffs:
+- H'F400 offset=0x00 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- H'F402 offset=0x02 expected=0x6B6F actual=0xFFFF (record_header_or_label)
+- H'F404 offset=0x04 expected=0xFE00 actual=0xFFFF (record_header_or_label)
+- H'F406 offset=0x06 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- H'F408 offset=0x08 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x004)
+- H'F40A offset=0x0A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x012)
+- H'F40C offset=0x0C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x013)
+- H'F40E offset=0x0E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x017)
+- H'F410 offset=0x10 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x018)
+- H'F412 offset=0x12 expected=0x0808 actual=0xFFFF (factory_shadow_offset; selectors=0x01A)
+- H'F414 offset=0x14 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x01F)
+- H'F416 offset=0x16 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x020)
+- H'F418 offset=0x18 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x023)
+- H'F41A offset=0x1A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x037)
+- H'F41C offset=0x1C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x038)
+- H'F41E offset=0x1E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x080)
+- H'F420 offset=0x20 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x081)
+- H'F422 offset=0x22 expected=0x0020 actual=0xFFFF (factory_shadow_offset; selectors=0x083)
+- H'F424 offset=0x24 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x088)
+- H'F426 offset=0x26 expected=0x0400 actual=0xFFFF (factory_shadow_offset; selectors=0x089)
+- H'F428 offset=0x28 expected=0x0800 actual=0xFFFF (factory_shadow_offset; selectors=0x08B)
+- H'F42A offset=0x2A expected=0x0040 actual=0xFFFF (factory_shadow_offset; selectors=0x08D)
+- H'F42C offset=0x2C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x08F)
+- H'F42E offset=0x2E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x091)
+- H'F430 offset=0x30 expected=0xFF80 actual=0xFFFF (factory_shadow_offset; selectors=0x092)
+- H'F432 offset=0x32 expected=0x4040 actual=0xFFFF (factory_shadow_offset; selectors=0x093)
+- H'F434 offset=0x34 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x095)
+- H'F436 offset=0x36 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x098)
+- H'F438 offset=0x38 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09A)
+- H'F43A offset=0x3A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x09D)
+- H'F43C offset=0x3C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09E)
+- H'F43E offset=0x3E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09F)
+- H'F440 offset=0x40 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A3)
+- H'F442 offset=0x42 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A4)
+- H'F444 offset=0x44 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A5)
+- H'F446 offset=0x46 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A6)
+- H'F448 offset=0x48 expected=0xF000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A7)
+- H'F44A offset=0x4A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A9)
+- H'F44C offset=0x4C expected=0x2000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AA)
+- H'F44E offset=0x4E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AC)
+- H'F450 offset=0x50 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AD)
+- H'F452 offset=0x52 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AE)
+- H'F454 offset=0x54 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AF)
+- H'F456 offset=0x56 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B0)
+- H'F458 offset=0x58 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B2)
+- H'F45A offset=0x5A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B3)
+- H'F45C offset=0x5C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B4)
+- H'F45E offset=0x5E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B6)
+- H'F460 offset=0x60 expected=0xF800 actual=0xFFFF (factory_shadow_offset; selectors=0x0B7)
+- H'F462 offset=0x62 expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B9)
+- H'F464 offset=0x64 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BC)
+- H'F466 offset=0x66 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BD)
+- H'F468 offset=0x68 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C0)
+- H'F46A offset=0x6A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C1)
+- H'F46C offset=0x6C expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C3)
+- H'F46E offset=0x6E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C4)
+- H'F470 offset=0x70 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C5)
+- H'F472 offset=0x72 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C6)
+- H'F474 offset=0x74 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C7)
+- H'F476 offset=0x76 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C8)
+- H'F478 offset=0x78 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C9)
+- H'F47A offset=0x7A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CA)
+- H'F47C offset=0x7C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CB)
+- H'F47E offset=0x7E expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CC)
+- H'F480 offset=0x80 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CD)
+- H'F482 offset=0x82 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D4)
+- H'F484 offset=0x84 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D5)
+- H'F486 offset=0x86 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D6)
+- H'F488 offset=0x88 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D7)
+- H'F48A offset=0x8A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D8)
+- H'F48C offset=0x8C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D9)
+- H'F48E offset=0x8E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0DA)
+- H'F490 offset=0x90 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F6)
+- H'F492 offset=0x92 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F9)
+- H'F494 offset=0x94 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FA)
+- H'F496 offset=0x96 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FB)
+- H'F498 offset=0x98 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FC)
+- H'F49A offset=0x9A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FD)
+- H'F49C offset=0x9C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FE)
+- H'F49E offset=0x9E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FF)
+- ... 47 more shadow diffs omitted

build/pin50-p77-high-fast-blank-eeprom.txt

@@ -0,0 +1,111 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=4216 words=2108 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- 0x0FE page=0x0 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FE page=0x1 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FE page=0x2 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FE page=0x3 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FE page=0x4 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FE page=0x5 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FE page=0x6 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FE page=0x7 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FE page=0x8 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FE page=0x9 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFE page=0xA offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFE page=0xB offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFE page=0xC offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFE page=0xD offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFE page=0xE offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFE page=0xF offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FC page=0x0 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FC page=0x1 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FC page=0x2 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FC page=0x3 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FC page=0x4 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FC page=0x5 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FC page=0x6 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FC page=0x7 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FC page=0x8 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FC page=0x9 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFC page=0xA offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFC page=0xB offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFC page=0xC offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFC page=0xD offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFC page=0xE offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFC page=0xF offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FA page=0x0 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FA page=0x1 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FA page=0x2 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FA page=0x3 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FA page=0x4 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FA page=0x5 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FA page=0x6 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FA page=0x7 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FA page=0x8 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FA page=0x9 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFA page=0xA offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFA page=0xB offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFA page=0xC offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFA page=0xD offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFA page=0xE offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFA page=0xF offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F8 page=0x0 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F8 page=0x1 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F8 page=0x2 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F8 page=0x3 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F8 page=0x4 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F8 page=0x5 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F8 page=0x6 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F8 page=0x7 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F8 page=0x8 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F8 page=0x9 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF8 page=0xA offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF8 page=0xB offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF8 page=0xC offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF8 page=0xD offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF8 page=0xE offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF8 page=0xF offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F6 page=0x0 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F6 page=0x1 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F6 page=0x2 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F6 page=0x3 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F6 page=0x4 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F6 page=0x5 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F6 page=0x6 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F6 page=0x7 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F6 page=0x8 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F6 page=0x9 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF6 page=0xA offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF6 page=0xB offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF6 page=0xC offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF6 page=0xD offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF6 page=0xE offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF6 page=0xF offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- ... 2028 more word writes omitted
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- F400-F4FF shadow matches ROM factory words or no ROM factory baseline was supplied

build/pin50-p77-high-fast-factory-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/pin50-p77-low-blank-eeprom.txt

@@ -0,0 +1,191 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=f47a8ec3e9aff2318d896942282ad4fe37d6391c82914f54a5da8a37de1300c6
+writes: bytes=0 words=0 factory_diff_words=2048
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x1 EEPROM 0x100-0x107 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x2 EEPROM 0x200-0x207 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x3 EEPROM 0x300-0x307 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x4 EEPROM 0x400-0x407 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x5 EEPROM 0x500-0x507 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x6 EEPROM 0x600-0x607 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x7 EEPROM 0x700-0x707 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x8 EEPROM 0x800-0x807 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0x9 EEPROM 0x900-0x907 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xA EEPROM 0xA00-0xA07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xB EEPROM 0xB00-0xB07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xC EEPROM 0xC00-0xC07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xD EEPROM 0xD00-0xD07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xE EEPROM 0xE00-0xE07 bytes=FF FF FF FF FF FF FF FF text='........'
+- page 0xF EEPROM 0xF00-0xF07 bytes=FF FF FF FF FF FF FF FF text='........'
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- 0x000 page=0x0 offset=0x00 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- 0x002 page=0x0 offset=0x02 expected=0x6B6F actual=0xFFFF (record_header_or_label)
+- 0x004 page=0x0 offset=0x04 expected=0xFE00 actual=0xFFFF (record_header_or_label)
+- 0x006 page=0x0 offset=0x06 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- 0x008 page=0x0 offset=0x08 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x004)
+- 0x00A page=0x0 offset=0x0A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x012)
+- 0x00C page=0x0 offset=0x0C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x013)
+- 0x00E page=0x0 offset=0x0E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x017)
+- 0x010 page=0x0 offset=0x10 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x018)
+- 0x012 page=0x0 offset=0x12 expected=0x0808 actual=0xFFFF (factory_shadow_offset; selectors=0x01A)
+- 0x014 page=0x0 offset=0x14 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x01F)
+- 0x016 page=0x0 offset=0x16 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x020)
+- 0x018 page=0x0 offset=0x18 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x023)
+- 0x01A page=0x0 offset=0x1A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x037)
+- 0x01C page=0x0 offset=0x1C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x038)
+- 0x01E page=0x0 offset=0x1E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x080)
+- 0x020 page=0x0 offset=0x20 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x081)
+- 0x022 page=0x0 offset=0x22 expected=0x0020 actual=0xFFFF (factory_shadow_offset; selectors=0x083)
+- 0x024 page=0x0 offset=0x24 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x088)
+- 0x026 page=0x0 offset=0x26 expected=0x0400 actual=0xFFFF (factory_shadow_offset; selectors=0x089)
+- 0x028 page=0x0 offset=0x28 expected=0x0800 actual=0xFFFF (factory_shadow_offset; selectors=0x08B)
+- 0x02A page=0x0 offset=0x2A expected=0x0040 actual=0xFFFF (factory_shadow_offset; selectors=0x08D)
+- 0x02C page=0x0 offset=0x2C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x08F)
+- 0x02E page=0x0 offset=0x2E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x091)
+- 0x030 page=0x0 offset=0x30 expected=0xFF80 actual=0xFFFF (factory_shadow_offset; selectors=0x092)
+- 0x032 page=0x0 offset=0x32 expected=0x4040 actual=0xFFFF (factory_shadow_offset; selectors=0x093)
+- 0x034 page=0x0 offset=0x34 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x095)
+- 0x036 page=0x0 offset=0x36 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x098)
+- 0x038 page=0x0 offset=0x38 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09A)
+- 0x03A page=0x0 offset=0x3A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x09D)
+- 0x03C page=0x0 offset=0x3C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09E)
+- 0x03E page=0x0 offset=0x3E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09F)
+- 0x040 page=0x0 offset=0x40 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A3)
+- 0x042 page=0x0 offset=0x42 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A4)
+- 0x044 page=0x0 offset=0x44 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A5)
+- 0x046 page=0x0 offset=0x46 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A6)
+- 0x048 page=0x0 offset=0x48 expected=0xF000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A7)
+- 0x04A page=0x0 offset=0x4A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A9)
+- 0x04C page=0x0 offset=0x4C expected=0x2000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AA)
+- 0x04E page=0x0 offset=0x4E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AC)
+- 0x050 page=0x0 offset=0x50 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AD)
+- 0x052 page=0x0 offset=0x52 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AE)
+- 0x054 page=0x0 offset=0x54 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AF)
+- 0x056 page=0x0 offset=0x56 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B0)
+- 0x058 page=0x0 offset=0x58 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B2)
+- 0x05A page=0x0 offset=0x5A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B3)
+- 0x05C page=0x0 offset=0x5C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B4)
+- 0x05E page=0x0 offset=0x5E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B6)
+- 0x060 page=0x0 offset=0x60 expected=0xF800 actual=0xFFFF (factory_shadow_offset; selectors=0x0B7)
+- 0x062 page=0x0 offset=0x62 expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B9)
+- 0x064 page=0x0 offset=0x64 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BC)
+- 0x066 page=0x0 offset=0x66 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BD)
+- 0x068 page=0x0 offset=0x68 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C0)
+- 0x06A page=0x0 offset=0x6A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C1)
+- 0x06C page=0x0 offset=0x6C expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C3)
+- 0x06E page=0x0 offset=0x6E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C4)
+- 0x070 page=0x0 offset=0x70 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C5)
+- 0x072 page=0x0 offset=0x72 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C6)
+- 0x074 page=0x0 offset=0x74 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C7)
+- 0x076 page=0x0 offset=0x76 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C8)
+- 0x078 page=0x0 offset=0x78 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C9)
+- 0x07A page=0x0 offset=0x7A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CA)
+- 0x07C page=0x0 offset=0x7C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CB)
+- 0x07E page=0x0 offset=0x7E expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CC)
+- 0x080 page=0x0 offset=0x80 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CD)
+- 0x082 page=0x0 offset=0x82 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D4)
+- 0x084 page=0x0 offset=0x84 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D5)
+- 0x086 page=0x0 offset=0x86 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D6)
+- 0x088 page=0x0 offset=0x88 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D7)
+- 0x08A page=0x0 offset=0x8A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D8)
+- 0x08C page=0x0 offset=0x8C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D9)
+- 0x08E page=0x0 offset=0x8E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0DA)
+- 0x090 page=0x0 offset=0x90 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F6)
+- 0x092 page=0x0 offset=0x92 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F9)
+- 0x094 page=0x0 offset=0x94 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FA)
+- 0x096 page=0x0 offset=0x96 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FB)
+- 0x098 page=0x0 offset=0x98 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FC)
+- 0x09A page=0x0 offset=0x9A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FD)
+- 0x09C page=0x0 offset=0x9C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FE)
+- 0x09E page=0x0 offset=0x9E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FF)
+- ... 1968 more factory diffs omitted
+
+F400 Shadow Diffs:
+- H'F400 offset=0x00 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- H'F402 offset=0x02 expected=0x6B6F actual=0xFFFF (record_header_or_label)
+- H'F404 offset=0x04 expected=0xFE00 actual=0xFFFF (record_header_or_label)
+- H'F406 offset=0x06 expected=0x0000 actual=0xFFFF (record_header_or_label)
+- H'F408 offset=0x08 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x004)
+- H'F40A offset=0x0A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x012)
+- H'F40C offset=0x0C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x013)
+- H'F40E offset=0x0E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x017)
+- H'F410 offset=0x10 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x018)
+- H'F412 offset=0x12 expected=0x0808 actual=0xFFFF (factory_shadow_offset; selectors=0x01A)
+- H'F414 offset=0x14 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x01F)
+- H'F416 offset=0x16 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x020)
+- H'F418 offset=0x18 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x023)
+- H'F41A offset=0x1A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x037)
+- H'F41C offset=0x1C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x038)
+- H'F41E offset=0x1E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x080)
+- H'F420 offset=0x20 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x081)
+- H'F422 offset=0x22 expected=0x0020 actual=0xFFFF (factory_shadow_offset; selectors=0x083)
+- H'F424 offset=0x24 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x088)
+- H'F426 offset=0x26 expected=0x0400 actual=0xFFFF (factory_shadow_offset; selectors=0x089)
+- H'F428 offset=0x28 expected=0x0800 actual=0xFFFF (factory_shadow_offset; selectors=0x08B)
+- H'F42A offset=0x2A expected=0x0040 actual=0xFFFF (factory_shadow_offset; selectors=0x08D)
+- H'F42C offset=0x2C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x08F)
+- H'F42E offset=0x2E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x091)
+- H'F430 offset=0x30 expected=0xFF80 actual=0xFFFF (factory_shadow_offset; selectors=0x092)
+- H'F432 offset=0x32 expected=0x4040 actual=0xFFFF (factory_shadow_offset; selectors=0x093)
+- H'F434 offset=0x34 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x095)
+- H'F436 offset=0x36 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x098)
+- H'F438 offset=0x38 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09A)
+- H'F43A offset=0x3A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x09D)
+- H'F43C offset=0x3C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09E)
+- H'F43E offset=0x3E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x09F)
+- H'F440 offset=0x40 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A3)
+- H'F442 offset=0x42 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A4)
+- H'F444 offset=0x44 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A5)
+- H'F446 offset=0x46 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A6)
+- H'F448 offset=0x48 expected=0xF000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A7)
+- H'F44A offset=0x4A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0A9)
+- H'F44C offset=0x4C expected=0x2000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AA)
+- H'F44E offset=0x4E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AC)
+- H'F450 offset=0x50 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AD)
+- H'F452 offset=0x52 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AE)
+- H'F454 offset=0x54 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0AF)
+- H'F456 offset=0x56 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B0)
+- H'F458 offset=0x58 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B2)
+- H'F45A offset=0x5A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B3)
+- H'F45C offset=0x5C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B4)
+- H'F45E offset=0x5E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B6)
+- H'F460 offset=0x60 expected=0xF800 actual=0xFFFF (factory_shadow_offset; selectors=0x0B7)
+- H'F462 offset=0x62 expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0B9)
+- H'F464 offset=0x64 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BC)
+- H'F466 offset=0x66 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0BD)
+- H'F468 offset=0x68 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C0)
+- H'F46A offset=0x6A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C1)
+- H'F46C offset=0x6C expected=0x4000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C3)
+- H'F46E offset=0x6E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C4)
+- H'F470 offset=0x70 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C5)
+- H'F472 offset=0x72 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C6)
+- H'F474 offset=0x74 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C7)
+- H'F476 offset=0x76 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C8)
+- H'F478 offset=0x78 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0C9)
+- H'F47A offset=0x7A expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CA)
+- H'F47C offset=0x7C expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CB)
+- H'F47E offset=0x7E expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CC)
+- H'F480 offset=0x80 expected=0x0000 actual=0xFFFF (factory_shadow_offset; selectors=0x0CD)
+- H'F482 offset=0x82 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D4)
+- H'F484 offset=0x84 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D5)
+- H'F486 offset=0x86 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D6)
+- H'F488 offset=0x88 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D7)
+- H'F48A offset=0x8A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D8)
+- H'F48C offset=0x8C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0D9)
+- H'F48E offset=0x8E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0DA)
+- H'F490 offset=0x90 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F6)
+- H'F492 offset=0x92 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0F9)
+- H'F494 offset=0x94 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FA)
+- H'F496 offset=0x96 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FB)
+- H'F498 offset=0x98 expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FC)
+- H'F49A offset=0x9A expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FD)
+- H'F49C offset=0x9C expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FE)
+- H'F49E offset=0x9E expected=0x8000 actual=0xFFFF (factory_shadow_offset; selectors=0x0FF)
+- ... 47 more shadow diffs omitted

build/pin50-p77-low-eeprom.txt

@@ -0,0 +1,31 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=0 words=0 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- none since EEPROM setup/load
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- H'F4AA offset=0xAA expected=0x8000 actual=0x5500 (factory_shadow_offset; selectors=0x112)

build/pin50-p77-low-fast-blank-eeprom.txt

@@ -0,0 +1,111 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=4216 words=2108 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- 0x0FE page=0x0 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FE page=0x1 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FE page=0x2 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FE page=0x3 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FE page=0x4 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FE page=0x5 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FE page=0x6 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FE page=0x7 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FE page=0x8 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FE page=0x9 offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFE page=0xA offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFE page=0xB offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFE page=0xC offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFE page=0xD offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFE page=0xE offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFE page=0xF offset=0xFE 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FC page=0x0 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FC page=0x1 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FC page=0x2 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FC page=0x3 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FC page=0x4 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FC page=0x5 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FC page=0x6 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FC page=0x7 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FC page=0x8 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FC page=0x9 offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFC page=0xA offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFC page=0xB offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFC page=0xC offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFC page=0xD offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFC page=0xE offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFC page=0xF offset=0xFC 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FA page=0x0 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FA page=0x1 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FA page=0x2 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FA page=0x3 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FA page=0x4 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FA page=0x5 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FA page=0x6 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FA page=0x7 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FA page=0x8 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FA page=0x9 offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFA page=0xA offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFA page=0xB offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFA page=0xC offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFA page=0xD offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFA page=0xE offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFA page=0xF offset=0xFA 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F8 page=0x0 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F8 page=0x1 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F8 page=0x2 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F8 page=0x3 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F8 page=0x4 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F8 page=0x5 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F8 page=0x6 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F8 page=0x7 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F8 page=0x8 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F8 page=0x9 offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF8 page=0xA offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF8 page=0xB offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF8 page=0xC offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF8 page=0xD offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF8 page=0xE offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF8 page=0xF offset=0xF8 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F6 page=0x0 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F6 page=0x1 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F6 page=0x2 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F6 page=0x3 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F6 page=0x4 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F6 page=0x5 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F6 page=0x6 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F6 page=0x7 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F6 page=0x8 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F6 page=0x9 offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF6 page=0xA offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF6 page=0xB offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF6 page=0xC offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF6 page=0xD offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF6 page=0xE offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF6 page=0xF offset=0xF6 0xFFFF->0x0000 source=linear_word (factory_shadow_offset)
+- ... 2028 more word writes omitted
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- F400-F4FF shadow matches ROM factory words or no ROM factory baseline was supplied

build/pin50-p77-low-fast-factory-eeprom.txt

@@ -0,0 +1,111 @@
+Emulator EEPROM Snapshot
+
+size=0x1000 sha256=4bed7704e1ea085487ca325c43bd60da75d37b6ae6f8292544e069a8825c64c6
+writes: bytes=4216 words=2108 factory_diff_words=0
+
+Persistent Records:
+- page 0x0 EEPROM 0x000-0x007 bytes=00 00 6B 6F FE 00 00 00 text='..ko....'
+- page 0x1 EEPROM 0x100-0x107 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x2 EEPROM 0x200-0x207 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x3 EEPROM 0x300-0x307 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x4 EEPROM 0x400-0x407 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x5 EEPROM 0x500-0x507 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x6 EEPROM 0x600-0x607 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x7 EEPROM 0x700-0x707 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x8 EEPROM 0x800-0x807 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0x9 EEPROM 0x900-0x907 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xA EEPROM 0xA00-0xA07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xB EEPROM 0xB00-0xB07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xC EEPROM 0xC00-0xC07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xD EEPROM 0xD00-0xD07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xE EEPROM 0xE00-0xE07 bytes=20 20 20 20 20 20 20 20 text='        '
+- page 0xF EEPROM 0xF00-0xF07 bytes=20 20 20 20 20 20 20 20 text='        '
+
+EEPROM Word Writes:
+- 0x0FE page=0x0 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FE page=0x1 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FE page=0x2 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FE page=0x3 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FE page=0x4 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FE page=0x5 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FE page=0x6 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FE page=0x7 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FE page=0x8 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FE page=0x9 offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFE page=0xA offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFE page=0xB offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFE page=0xC offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFE page=0xD offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFE page=0xE offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFE page=0xF offset=0xFE 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FC page=0x0 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FC page=0x1 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FC page=0x2 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FC page=0x3 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FC page=0x4 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FC page=0x5 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FC page=0x6 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FC page=0x7 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FC page=0x8 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FC page=0x9 offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFC page=0xA offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFC page=0xB offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFC page=0xC offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFC page=0xD offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFC page=0xE offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFC page=0xF offset=0xFC 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0FA page=0x0 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1FA page=0x1 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2FA page=0x2 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3FA page=0x3 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4FA page=0x4 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5FA page=0x5 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6FA page=0x6 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7FA page=0x7 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8FA page=0x8 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9FA page=0x9 offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAFA page=0xA offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBFA page=0xB offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCFA page=0xC offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDFA page=0xD offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEFA page=0xE offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFFA page=0xF offset=0xFA 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F8 page=0x0 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F8 page=0x1 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F8 page=0x2 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F8 page=0x3 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F8 page=0x4 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F8 page=0x5 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F8 page=0x6 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F8 page=0x7 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F8 page=0x8 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F8 page=0x9 offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF8 page=0xA offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF8 page=0xB offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF8 page=0xC offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF8 page=0xD offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF8 page=0xE offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF8 page=0xF offset=0xF8 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x0F6 page=0x0 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x1F6 page=0x1 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x2F6 page=0x2 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x3F6 page=0x3 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x4F6 page=0x4 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x5F6 page=0x5 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x6F6 page=0x6 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x7F6 page=0x7 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x8F6 page=0x8 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0x9F6 page=0x9 offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xAF6 page=0xA offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xBF6 page=0xB offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xCF6 page=0xC offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xDF6 page=0xD offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xEF6 page=0xE offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- 0xFF6 page=0xF offset=0xF6 0x0000->0x0000 source=linear_word (factory_shadow_offset)
+- ... 2028 more word writes omitted
+
+Factory Diffs:
+- current EEPROM image matches ROM factory/default image
+
+F400 Shadow Diffs:
+- F400-F4FF shadow matches ROM factory words or no ROM factory baseline was supplied

build/rom_0013_button_handler_linear.asm

@@ -0,0 +1,200 @@
+; H8/536 ROM disassembly
+; input: ROM\M27C512@DIP28_1.BIN
+; bytes: 65536
+; vector mode: min
+; analysis: linear sweep
+;
+; Notes from the manual:
+; - H8/536 uses the H8/500 CPU instruction set.
+; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
+; - The register field is H'FE80-H'FFFF; names below come from appendix B.
+; - @aa:8 short absolute operands use BR as the upper address byte.
+; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
+; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
+
+; Memory Map
+; H'0000-H'009F exception_vectors  vectors
+; H'00A0-H'00FF dtc_vectors        dtc_vectors
+; H'0100-H'F67F program_or_external program
+; H'F680-H'FE7F on_chip_ram        ram
+; H'FE80-H'FFFF register_field     registers
+
+; Vectors
+; H'0000 reset                    -> vec_reset_1000 (H'1000)
+; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
+; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
+; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
+; H'0010 address_error            -> vec_reset_1000 (H'1000)
+; H'0012 trace                    -> vec_reset_1000 (H'1000)
+; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
+; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
+; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
+; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
+; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
+; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
+; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
+; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
+; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
+; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
+; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
+; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
+; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
+; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
+; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
+; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
+; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
+; H'0040 irq0                     -> vec_reset_1000 (H'1000)
+; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
+; H'0048 irq1                     -> vec_reset_1000 (H'1000)
+; H'0050 irq2                     -> vec_reset_1000 (H'1000)
+; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
+; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
+; H'005A irq5                     -> vec_reset_1000 (H'1000)
+; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
+; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
+; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
+; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
+; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
+; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)
+
+; Symbols
+; mem_E026         H'E026 program_or_external memory   r=4 w=0 width=word
+; mem_E02A         H'E02A program_or_external memory   r=1 w=0 width=word
+; mem_E046         H'E046 program_or_external memory   r=0 w=1 width=word
+; mem_E110         H'E110 program_or_external memory   r=1 w=0 width=word
+; mem_E134         H'E134 program_or_external memory   r=1 w=0 width=word
+; mem_E824         H'E824 program_or_external memory   r=0 w=1 width=word
+; mem_E826         H'E826 program_or_external memory   r=0 w=4 width=word
+; mem_E82A         H'E82A program_or_external memory   r=0 w=1 width=word
+; mem_E8D6         H'E8D6 program_or_external memory   r=0 w=1 width=word
+; ram_F6D4         H'F6D4 on_chip_ram        ram      r=1 w=0 width=byte
+; ram_F6DB         H'F6DB on_chip_ram        ram      r=3 w=0 width=byte
+; ram_F713         H'F713 on_chip_ram        ram      r=2 w=2 width=byte
+; ram_F726         H'F726 on_chip_ram        ram      r=0 w=1 width=byte
+; ram_F730         H'F730 on_chip_ram        ram      r=1 w=0 width=byte
+; ram_F731         H'F731 on_chip_ram        ram      r=5 w=2 width=byte
+; ram_F732         H'F732 on_chip_ram        ram      r=0 w=1 width=word
+; ram_F76A         H'F76A on_chip_ram        ram      r=0 w=1 width=word
+; ram_F76E         H'F76E on_chip_ram        ram      r=1 w=1 width=byte
+; ram_F791         H'F791 on_chip_ram        ram      r=2 w=1 width=byte
+; ram_F798         H'F798 on_chip_ram        ram      r=0 w=2 width=byte
+; ram_FB03         H'FB03 on_chip_ram        ram      r=1 w=1 width=byte
+
+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
+; LCD/Text Scan
+; search 'CONNECT': not literal, hits=0
+
+1FC0: F7 13 C5 1D    ROTR.B @(H'13C5,R7)
+1FC4: E8 24 07 80 00 MOV:G.W #H'8000, @(H'24,R0)
+1FC9: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+1FCB: 5B 40 12       MOV:I.W #H'4012, R3 ; dataflow R3=H'4012
+1FCE: 1E 1E 83       BSR loc_3E54
+1FD1: 19             RTS
+1FD2: 15 F7 91 D7    BCLR.B #7, @H'F791 ; refs ram_F791 in on_chip_ram
+1FD6: 15 F7 13 D5    BCLR.B #5, @H'F713 ; refs ram_F713 in on_chip_ram
+1FDA: 1D E8 24 06 00 MOV:G.W #H'00, @H'E824 ; refs mem_E824 in program_or_external
+1FDF: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+1FE1: 5B 40 12       MOV:I.W #H'4012, R3 ; dataflow R3=H'4012
+1FE4: 1E 1E 6D       BSR loc_3E54
+1FE7: 19             RTS
+1FE8: 1D E0 26 80    MOV:G.W @H'E026, R0 ; refs mem_E026 in program_or_external
+1FEC: A8 CF          BSET.W #15, R0
+1FEE: 1D E8 26 90    MOV:G.W R0, @H'E826 ; refs mem_E826 in program_or_external
+1FF2: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+1FF4: 5B 00 13       MOV:I.W #H'0013, R3 ; dataflow R3=H'0013
+1FF7: 1E 1E 5A       BSR loc_3E54
+1FFA: 19             RTS
+1FFB: 1D E0 26 80    MOV:G.W @H'E026, R0 ; refs mem_E026 in program_or_external
+1FFF: A8 DF          BCLR.W #15, R0
+2001: 1D E8 26 90    MOV:G.W R0, @H'E826 ; refs mem_E826 in program_or_external
+2005: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+2007: 5B 00 13       MOV:I.W #H'0013, R3 ; dataflow R3=H'0013
+200A: 1E 1E 47       BSR loc_3E54
+200D: 19             RTS
+200E: 15 F6 DB F7    BTST.B #7, @H'F6DB ; refs ram_F6DB in on_chip_ram
+2012: 27 33          BEQ loc_2047
+2014: 15 F7 31 04 03 CMP:G.B #H'03, @H'F731 ; refs ram_F731 in on_chip_ram
+2019: 22 2C          BHI loc_2047
+201B: 15 F7 91 F5    BTST.B #5, @H'F791 ; refs ram_F791 in on_chip_ram
+201F: 26 14          BNE loc_2035
+2021: 1D E0 26 80    MOV:G.W @H'E026, R0 ; refs mem_E026 in program_or_external
+2025: A8 CE          BSET.W #14, R0
+2027: 1D E8 26 90    MOV:G.W R0, @H'E826 ; refs mem_E826 in program_or_external
+202B: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+202D: 5B 00 13       MOV:I.W #H'0013, R3 ; dataflow R3=H'0013
+2030: 1E 1E 21       BSR loc_3E54
+2033: 20 12          BRA loc_2047
+
+loc_2035:
+2035: 1D E0 26 80    MOV:G.W @H'E026, R0 ; refs mem_E026 in program_or_external
+2039: A8 DE          BCLR.W #14, R0
+203B: 1D E8 26 90    MOV:G.W R0, @H'E826 ; refs mem_E826 in program_or_external
+203F: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+2041: 5B 00 13       MOV:I.W #H'0013, R3 ; dataflow R3=H'0013
+2044: 1E 1E 0D       BSR loc_3E54
+
+loc_2047:
+2047: 19             RTS
+2048: 15 F6 D4 F6    BTST.B #6, @H'F6D4 ; refs ram_F6D4 in on_chip_ram
+204C: 27 52          BEQ loc_20A0
+204E: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram
+2053: 22 4B          BHI loc_20A0
+2055: 15 F7 30 F7    BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram
+2059: 27 19          BEQ loc_2074
+205B: 1D E8 D6 07 80 00 MOV:G.W #H'8000, @H'E8D6 ; refs mem_E8D6 in program_or_external
+2061: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+2063: 5B 00 6B       MOV:I.W #H'006B, R3 ; dataflow R3=H'006B
+2066: 1E 1D EB       BSR loc_3E54
+2069: 15 F7 31 C7    BSET.B #7, @H'F731 ; refs ram_F731 in on_chip_ram
+206D: 15 F7 98 06 C8 MOV:G.B #H'C8, @H'F798 ; refs ram_F798 in on_chip_ram
+2072: 20 2C          BRA loc_20A0
+
+loc_2074:
+2074: 1D F7 32 13    CLR.W @H'F732 ; refs ram_F732 in on_chip_ram
+2078: 15 FB 03 D7    BCLR.B #7, @H'FB03 ; refs ram_FB03 in on_chip_ram
+207C: 1D E0 46 13    CLR.W @H'E046 ; refs mem_E046 in program_or_external
+2080: 1D F7 6A 13    CLR.W @H'F76A ; refs ram_F76A in on_chip_ram
+2084: 1E 28 73       BSR loc_48FA
+2087: 15 F7 13 C6    BSET.B #6, @H'F713 ; refs ram_F713 in on_chip_ram
+208B: 15 F7 26 06 1E MOV:G.B #H'1E, @H'F726 ; refs ram_F726 in on_chip_ram
+2090: 15 F7 6E C6    BSET.B #6, @H'F76E ; refs ram_F76E in on_chip_ram
+2094: 15 F7 31 C7    BSET.B #7, @H'F731 ; refs ram_F731 in on_chip_ram
+2098: 15 F7 98 06 C8 MOV:G.B #H'C8, @H'F798 ; refs ram_F798 in on_chip_ram
+209D: 1E 36 38       BSR loc_56D8
+
+loc_20A0:
+20A0: 19             RTS
+20A1: 1D E0 2A 80    MOV:G.W @H'E02A, R0 ; refs mem_E02A in program_or_external
+20A5: 15 F6 DB F5    BTST.B #5, @H'F6DB ; refs ram_F6DB in on_chip_ram
+20A9: 27 04          BEQ loc_20AF
+20AB: A8 CF          BSET.W #15, R0
+20AD: 20 02          BRA loc_20B1
+
+loc_20AF:
+20AF: A8 DF          BCLR.W #15, R0
+
+loc_20B1:
+20B1: 1D E8 2A 90    MOV:G.W R0, @H'E82A ; refs mem_E82A in program_or_external
+20B5: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+20B7: 5B 00 15       MOV:I.W #H'0015, R3 ; dataflow R3=H'0015
+20BA: 1E 1D 97       BSR loc_3E54
+20BD: 19             RTS
+20BE: 15 F6 DB F3    BTST.B #3, @H'F6DB ; refs ram_F6DB in on_chip_ram
+20C2: 27 2C          BEQ loc_20F0
+20C4: 15 F7 31 04 03 CMP:G.B #H'03, @H'F731 ; refs ram_F731 in on_chip_ram
+20C9: 22 25          BHI loc_20F0
+20CB: 1D E1 10 16    TST.W @H'E110 ; refs mem_E110 in program_or_external
+20CF: 27 05          BEQ loc_20D6
+20D1: 1E 06 14       BSR loc_26E8
+20D4: 20 1A          BRA loc_20F0
+
+loc_20D6:
+20D6: 1D E1 34 80    MOV:G.W @H'E134, R0 ; refs mem_E134 in program_or_external
+20DA: A8 FB          BTST.W #11, R0
+20DC: 27 04          BEQ loc_20E2
+20DE: A8 DB          BCLR.W #11, R0

build/rom_0013_handler_linear.asm

@@ -0,0 +1,135 @@
+; H8/536 ROM disassembly
+; input: ROM\M27C512@DIP28_1.BIN
+; bytes: 65536
+; vector mode: min
+; analysis: linear sweep
+;
+; Notes from the manual:
+; - H8/536 uses the H8/500 CPU instruction set.
+; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
+; - The register field is H'FE80-H'FFFF; names below come from appendix B.
+; - @aa:8 short absolute operands use BR as the upper address byte.
+; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
+; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
+
+; Memory Map
+; H'0000-H'009F exception_vectors  vectors
+; H'00A0-H'00FF dtc_vectors        dtc_vectors
+; H'0100-H'F67F program_or_external program
+; H'F680-H'FE7F on_chip_ram        ram
+; H'FE80-H'FFFF register_field     registers
+
+; Vectors
+; H'0000 reset                    -> vec_reset_1000 (H'1000)
+; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
+; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
+; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
+; H'0010 address_error            -> vec_reset_1000 (H'1000)
+; H'0012 trace                    -> vec_reset_1000 (H'1000)
+; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
+; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
+; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
+; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
+; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
+; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
+; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
+; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
+; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
+; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
+; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
+; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
+; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
+; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
+; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
+; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
+; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
+; H'0040 irq0                     -> vec_reset_1000 (H'1000)
+; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
+; H'0048 irq1                     -> vec_reset_1000 (H'1000)
+; H'0050 irq2                     -> vec_reset_1000 (H'1000)
+; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
+; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
+; H'005A irq5                     -> vec_reset_1000 (H'1000)
+; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
+; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
+; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
+; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
+; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
+; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)
+
+; Symbols
+; mem_E02E         H'E02E program_or_external memory   r=1 w=0 width=word
+; mem_E030         H'E030 program_or_external memory   r=1 w=0 width=word
+; mem_E826         H'E826 program_or_external memory   r=2 w=0 width=word
+; mem_E82E         H'E82E program_or_external memory   r=0 w=1 width=word
+; ram_F711         H'F711 on_chip_ram        ram      r=4 w=4 width=byte
+; ram_F713         H'F713 on_chip_ram        ram      r=2 w=2 width=byte
+; ram_F716         H'F716 on_chip_ram        ram      r=4 w=4 width=byte
+; ram_F791         H'F791 on_chip_ram        ram      r=4 w=4 width=byte
+
+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
+; LCD/Text Scan
+; search 'CONNECT': not literal, hits=0
+
+2E00: 30 FE A3       BRA loc_2CA6
+2E03: 30 FE A0       BRA loc_2CA6
+2E06: 1D E8 26 FF    BTST.W #15, @H'E826 ; refs mem_E826 in program_or_external
+2E0A: 27 0A          BEQ loc_2E16
+2E0C: 15 F7 91 C6    BSET.B #6, @H'F791 ; refs ram_F791 in on_chip_ram
+2E10: 15 F7 13 C4    BSET.B #4, @H'F713 ; refs ram_F713 in on_chip_ram
+2E14: 20 08          BRA loc_2E1E
+
+loc_2E16:
+2E16: 15 F7 91 D6    BCLR.B #6, @H'F791 ; refs ram_F791 in on_chip_ram
+2E1A: 15 F7 13 D4    BCLR.B #4, @H'F713 ; refs ram_F713 in on_chip_ram
+
+loc_2E1E:
+2E1E: 1D E8 26 FE    BTST.W #14, @H'E826 ; refs mem_E826 in program_or_external
+2E22: 27 0A          BEQ loc_2E2E
+2E24: 15 F7 91 C5    BSET.B #5, @H'F791 ; refs ram_F791 in on_chip_ram
+2E28: 15 F7 16 C7    BSET.B #7, @H'F716 ; refs ram_F716 in on_chip_ram
+2E2C: 20 08          BRA loc_2E36
+
+loc_2E2E:
+2E2E: 15 F7 91 D5    BCLR.B #5, @H'F791 ; refs ram_F791 in on_chip_ram
+2E32: 15 F7 16 D7    BCLR.B #7, @H'F716 ; refs ram_F716 in on_chip_ram
+
+loc_2E36:
+2E36: 30 FE 6D       BRA loc_2CA6
+2E39: FC E0 00 81    MOV:G.W @(-H'2000,R4), R1
+2E3D: A9 FF          BTST.W #15, R1
+2E3F: 26 0E          BNE loc_2E4F
+2E41: A9 FE          BTST.W #14, R1
+2E43: 26 0A          BNE loc_2E4F
+2E45: 15 F7 11 D0    BCLR.B #0, @H'F711 ; refs ram_F711 in on_chip_ram
+2E49: 15 F7 16 D5    BCLR.B #5, @H'F716 ; refs ram_F716 in on_chip_ram
+2E4D: 20 08          BRA loc_2E57
+
+loc_2E4F:
+2E4F: 15 F7 11 C0    BSET.B #0, @H'F711 ; refs ram_F711 in on_chip_ram
+2E53: 15 F7 16 C5    BSET.B #5, @H'F716 ; refs ram_F716 in on_chip_ram
+
+loc_2E57:
+2E57: 30 FE 4C       BRA loc_2CA6
+2E5A: FC E0 00 81    MOV:G.W @(-H'2000,R4), R1
+2E5E: A9 FF          BTST.W #15, R1
+2E60: 26 06          BNE loc_2E68
+2E62: 15 F7 11 D1    BCLR.B #1, @H'F711 ; refs ram_F711 in on_chip_ram
+2E66: 20 04          BRA loc_2E6C
+
+loc_2E68:
+2E68: 15 F7 11 C1    BSET.B #1, @H'F711 ; refs ram_F711 in on_chip_ram
+
+loc_2E6C:
+2E6C: 30 FE 37       BRA loc_2CA6
+2E6F: 1D E0 30 81    MOV:G.W @H'E030, R1 ; refs mem_E030 in program_or_external
+2E73: 1D E0 2E 71    CMP:G.W @H'E02E, R1 ; refs mem_E02E in program_or_external
+2E77: 27 0C          BEQ loc_2E85
+2E79: 1D E8 2E 91    MOV:G.W R1, @H'E82E ; refs mem_E82E in program_or_external
+2E7D: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80
+2E7F: 5B 00 17       MOV:I.W #H'0017, R3 ; dataflow R3=H'0017

build/rom_0013_table_xrefs.txt

@@ -0,0 +1,38 @@
+Table/Index Cross-Reference Report for build\rom_0013_handler_linear.json
+=========================================================================
+
+Static offsets are emitted only when an index register value can be derived from nearby immediate loads in the current JSON. Other indexed accesses are dynamic.
+
+LCD correlation hints
+  term 'CONNECT': no LCD/text candidate hits in current decompile
+  term 'CONNECT: OK': no LCD/text candidate hits in current decompile
+  term 'CONNECT: NOT ACT': no LCD/text candidate hits in current decompile
+  term 'NOT ACT': no LCD/text candidate hits in current decompile
+  term 'COMM LINK': no LCD/text candidate hits in current decompile
+  term 'COMPLETED': no LCD/text candidate hits in current decompile
+  caveat: LCD strings can be builder/script output; absence of a literal term does not disprove runtime composition.
+
+primary_value_table_candidate H'E000-H'E3FF (negative H'2000; direct H'F900-H'F91F)
+  accesses=4 reads=4 writes=0 dynamic=2
+  static offsets: H'002E, H'0030
+  functions: <no function>:4
+  - H'2E39 read index dynamic via R4 operand @(-H'2000,R4); <no function>; MOV:G.W @(-H'2000,R4), R1
+  - H'2E5A read index dynamic via R4 operand @(-H'2000,R4); <no function>; MOV:G.W @(-H'2000,R4), R1
+  - H'2E6F read offset H'0030 selector 0x018 -> H'E030; <no function>; MOV:G.W @H'E030, R1
+  - H'2E73 read offset H'002E selector 0x017 -> H'E02E; <no function>; CMP:G.W @H'E02E, R1
+
+secondary_value_table_candidate H'E400-H'E7FF (negative H'1C00; direct H'F940-H'F95F)
+  accesses=0 reads=0 writes=0 dynamic=0
+  no references found in current JSON
+
+current_value_table_candidate H'E800-H'EBFF (negative H'1800; direct H'F920-H'F93F)
+  accesses=3 reads=2 writes=1 dynamic=0
+  static offsets: H'0026, H'002E
+  functions: <no function>:3
+  - H'2E06 read offset H'0026 selector 0x013 -> H'E826; <no function>; BTST.W #15, @H'E826
+  - H'2E1E read offset H'0026 selector 0x013 -> H'E826; <no function>; BTST.W #14, @H'E826
+  - H'2E79 write offset H'002E selector 0x017 -> H'E82E; <no function>; MOV:G.W R1, @H'E82E
+
+flag_table_candidate H'EC00-H'EFFF (negative H'1400; direct H'F980-H'F99F)
+  accesses=0 reads=0 writes=0 dynamic=0
+  no references found in current JSON

build/rom_ccu_seed_hints.txt

@@ -0,0 +1,186 @@
+H8/536 CCU Seed Hint Report
+
+Summary: The RCP likely waits for the CCU to seed mirrored state tables, then uses those selector values to update LCD text, panel lamps, and report state changes.
+Confidence: medium
+
+Table Model:
+- primary_value_table_candidate: H'E000-H'E3FF; accesses=31 static selectors=0x000, 0x002, 0x003, 0x023, 0x040, 0x081, 0x092, 0x093, 0x0A7, 0x0B7, 0x0B9, 0x0F6
+- secondary_value_table_candidate: H'E400-H'E7FF; accesses=8 static selectors=none
+- current_value_table_candidate: H'E800-H'EBFF; accesses=14 static selectors=0x000, 0x003, 0x040, 0x081, 0x092, 0x0F6
+- flag_table_candidate: H'EC00-H'EFFF; accesses=6 static selectors=0x000
+
+Highest-Value Selector Candidates:
+- 0x093 white_balance_black_flare_mode_lane: score=19 tables=primary_value_table_candidate
+  - primary_value_table_candidate read in loc_17C9: BTST.W #12, @H'E126
+  - primary_value_table_candidate read in loc_17FB: BTST.W #12, @H'E126
+  - primary_value_table_candidate read in loc_182D: BTST.W #5, @H'E126
+  - primary_value_table_candidate read in loc_1891: BTST.W #5, @H'E126
+  seed frames: 0x8000 -> 00 01 13 80 00 C8; 0x4000 -> 00 01 13 40 00 08; 0x2000 -> 00 01 13 20 00 68
+  readback frame: 01 01 13 00 00 49
+- 0x000 heartbeat_or_idle_report_candidate: score=18 tables=primary_value_table_candidate, current_value_table_candidate, flag_table_candidate
+  - primary_value_table_candidate write in loc_4096: MOV:G.W #H'0080, @H'E000
+  - current_value_table_candidate write in loc_4096: MOV:G.W #H'0080, @H'E800
+  - flag_table_candidate write in loc_4075: CLR.W @(-H'1400,R0)
+  - idle report selector and CONNECT OK emulator condition both center on selector zero
+  seed frames: 0x0080 -> 00 00 00 00 80 DA; 0x8080 -> 00 00 00 80 80 5A
+  readback frame: 01 00 00 00 00 5B
+- 0x0F6 active_status_bridge_candidate: score=14 tables=primary_value_table_candidate, current_value_table_candidate
+  - primary_value_table_candidate read in loc_48FA: BTST.W #13, @H'E1EC
+  - primary_value_table_candidate read in loc_48FA: MOV:G.W @H'E1EC, R0
+  - current_value_table_candidate write in loc_48FA: MOV:G.W R0, @H'E9EC
+  - loc_48FA tests E1EC bit13 and can enqueue report selector 0x00F6
+  seed frames: 0x2000 -> 00 01 76 20 00 0D
+  readback frame: 01 01 76 00 00 2C
+- 0x003 default_enabled_bit_candidate: score=11 tables=primary_value_table_candidate, current_value_table_candidate
+  - primary_value_table_candidate write in loc_4096: MOV:G.W #H'8000, @H'E006
+  - current_value_table_candidate write in loc_4096: MOV:G.W #H'8000, @H'E806
+  - ROM default table writes E000/E800 selector 0x003 to 0x8000
+  seed frames: 0x8000 -> 00 00 03 80 00 D9
+  readback frame: 01 00 03 00 00 58
+- 0x040 default_all_ones_or_status_block_candidate: score=11 tables=primary_value_table_candidate, current_value_table_candidate
+  - primary_value_table_candidate write in loc_4096: MOV:G.W #H'FFFF, @H'E080
+  - current_value_table_candidate write in loc_4096: MOV:G.W #H'FFFF, @H'E880
+  - ROM default table writes E000/E800 selector 0x040 to 0xFFFF and bench tests repeatedly touched the 0x40 family
+  seed frames: 0xFFFF -> 00 00 40 FF FF 1A; 0x4030 -> 00 00 40 40 30 6A
+  readback frame: 01 00 40 00 00 1B
+- 0x06B standard_lamp_lane: score=11 tables=none
+  - when F731.7 is set, command 5 on this selector clears F731.7/F790.7
+  - Bench-visible STANDARD lamp lane found from ROM-derived F6D4.6 handler candidate.
+  - selector dispatches to H'2F72
+  seed frames: 0x8000 -> 00 00 6B 80 00 B1
+  readback frame: 01 00 6B 00 00 30
+- 0x015 call_and_red_tally_lamp_lane: score=9 tables=none
+  - observed RCP autonomous report frame(s): 00 00 15 80 00 CF, 00 00 15 00 00 4F
+  - Bench-visible CALL lamp and red tally lane; local CALL handler mirrors F6DB.5 into E800[0x0015].15.
+  - selector dispatches to H'2E39
+  seed frames: 0x8000 -> 00 00 15 80 00 CF; 0x0000 -> 00 00 15 00 00 4F
+  readback frame: 01 00 15 00 00 4E
+- 0x081 state_selector_candidate: score=9 tables=primary_value_table_candidate, current_value_table_candidate
+  - primary_value_table_candidate read in vec_ad_adi_3D99: MOV:G.W @H'E102, R0
+  - primary_value_table_candidate read in vec_ad_adi_3D99: CMP:G.W @H'E102, R1
+  - current_value_table_candidate write in loc_15E0: MOV:G.W R1, @H'E902
+  readback frame: 01 01 01 00 00 5B
+- 0x092 state_selector_candidate: score=9 tables=primary_value_table_candidate, current_value_table_candidate
+  - primary_value_table_candidate read in loc_2650: MOV:G.W @H'E124, R0
+  - primary_value_table_candidate read in loc_2650: CMP:G.W @H'E124, R0
+  - current_value_table_candidate write in loc_2650: MOV:G.W R0, @H'E924
+  readback frame: 01 01 12 00 00 48
+- 0x06C command5_be70_candidate: score=7 tables=none
+  - continuation command 5 calls BE70 for selector 0x006C
+  - selector dispatches to H'2FAF
+  readback frame: 01 00 6C 00 00 37
+- 0x06D command5_be70_candidate: score=7 tables=none
+  - continuation command 5 calls BE70 for selector 0x006D
+  - selector dispatches to H'3015
+  readback frame: 01 00 6D 00 00 36
+- 0x110 knee_auto_lamp_or_page_status_lane: score=7 tables=primary_value_table_candidate
+  - primary_value_table_candidate read in loc_1795: BTST.W #15, @H'E220
+  - Bench-visible KNEE AUTO source; ROM notes indicate timed KNEE/detail page interaction.
+  seed frames: 0x8000 -> 00 01 90 80 00 4B
+  readback frame: 01 01 90 00 00 CA
+- 0x013 slave_and_iris_mblack_link_lamps: score=6 tables=none
+  - Selector 0x0013 is a two-bit lamp/status word. ROM dispatch H'2E06 reads current table word H'E826 and fans bit 15 and bit 14 into panel latch RAM.
+  - 0x8000 SLAVE lamp: sets F791.6 and F713.4
+  - 0x4000 IRIS/M.BLACK LINK lamp: sets F791.5 and F716.7
+  - selector dispatches to H'2E06
+  seed frames: 0x8000 -> 00 00 13 80 00 C9; 0x4000 -> 00 00 13 40 00 09; 0x0000 -> 00 00 13 00 00 49
+  readback frame: 01 00 13 00 00 48
+- 0x017 bars_lamp_lane: score=6 tables=none
+  - Bench-visible BARS lamp/latch lane; low writes do not reliably clear the visible latch.
+  - selector dispatches to H'2E85
+  seed frames: 0x8000 -> 00 00 17 80 00 CD; 0x4000 -> 00 00 17 40 00 0D; 0x0000 -> 00 00 17 00 00 4D
+  readback frame: 01 00 17 00 00 4C
+- 0x01A monitor_selector_lamps: score=6 tables=none
+  - Bench-visible MONITOR selector cluster found from ROM-derived button-output sweep.
+  - selector dispatches to H'2EC4
+  seed frames: 0x0808 -> 00 00 1A 08 08 40; 0x2020 -> 00 00 1A 20 20 40; 0x4040 -> 00 00 1A 40 40 40
+  readback frame: 01 00 1A 00 00 41
+- 0x024 lcd_selector_button_lamp: score=6 tables=none
+  - Bench-visible LCD selector-button lamp lane.
+  - selector dispatches to H'2F0C
+  seed frames: 0x8000 -> 00 00 24 80 00 FE; 0x0000 -> 00 00 24 00 00 7E
+  readback frame: 01 00 24 00 00 7F
+- 0x007 camera_power_report_candidate: score=5 tables=none
+  - observed RCP autonomous report frame(s): 00 00 07 80 00 DD
+  - selector dispatches to H'2DC3
+  readback frame: 01 00 07 00 00 5C
+- 0x023 state_selector_candidate: score=5 tables=primary_value_table_candidate
+  - primary_value_table_candidate write in loc_400C: CLR.W @H'E046
+  - selector dispatches to H'2EE6
+  readback frame: 01 00 23 00 00 78
+- 0x06E command5_be70_candidate: score=5 tables=none
+  - continuation command 5 calls BE70 for selector 0x006E
+  readback frame: 01 00 6E 00 00 35
+- 0x096 connection_latch_clear_candidate: score=5 tables=none
+  - when F731.7 is set, command 5 on this selector clears F731.7/F790.7
+  readback frame: 01 01 16 00 00 4C
+- 0x097 connection_latch_clear_candidate: score=5 tables=none
+  - when F731.7 is set, command 5 on this selector clears F731.7/F790.7
+  readback frame: 01 01 17 00 00 4D
+- 0x0C6 connection_latch_clear_candidate: score=5 tables=none
+  - when F731.7 is set, command 5 on this selector clears F731.7/F790.7
+  readback frame: 01 01 46 00 00 1C
+- 0x0F8 connection_latch_clear_candidate: score=5 tables=none
+  - when F731.7 is set, command 5 on this selector clears F731.7/F790.7
+  readback frame: 01 01 78 00 00 22
+- 0x082 iris_readout_lane: score=4 tables=none
+  - Bench-visible IRIS seven-segment/display lane.
+  seed frames: 0x8000 -> 00 01 02 80 00 D9; 0x4000 -> 00 01 02 40 00 19; 0x0000 -> 00 01 02 00 00 59
+  readback frame: 01 01 02 00 00 58
+
+Display Text Hints:
+- CONNECT: 0 hit(s)
+- COMM LINK: 4 hit(s) - H'77F4 'literal COMM LINK', H'78F4 'literal COMM LINK', H'77F4 'COMM LINK ITEM-1Xw'
+- COMPLETED: 2 hit(s) - H'A027 'literal COMPLETED', H'A025 'COMPLETED'
+- CAM: 6 hit(s) - H'7149 'literal CAM', H'71FC 'literal CAM', H'72C7 'literal CAM'
+- BARS: 12 hit(s) - H'72D1 'literal BARS', H'757D 'literal BARS', H'9C61 'literal BARS'
+- BLACK: 22 hit(s) - H'65CC 'literal BLACK', H'6647 'literal BLACK', H'6709 'literal BLACK'
+- IRIS: 6 hit(s) - H'6461 'literal IRIS', H'6A92 'literal IRIS', H'A5CA 'literal IRIS'
+- GAIN: 10 hit(s) - H'6825 'literal GAIN', H'7813 'literal GAIN', H'98A1 'literal GAIN'
+- SHUTTER: 4 hit(s) - H'6FB2 'literal SHUTTER', H'781A 'literal SHUTTER', H'6FAE 'SHUTTER     Xo'
+- CALL: 8 hit(s) - H'B53E 'literal CALL', H'B563 'literal CALL', H'B62F 'literal CALL'
+- POWER: 0 hit(s)
+- AUTO: 34 hit(s) - H'693E 'literal AUTO', H'6A52 'literal AUTO', H'6B40 'literal AUTO'
+- DIAG: 6 hit(s) - H'6BF5 'literal DIAG', H'6C19 'literal DIAG', H'6E46 'literal DIAG'
+- DXC: 0 hit(s)
+
+Selector Dispatch Hints:
+- table H'28A6: 25 non-default/interesting entries
+  - selector 0x000 -> H'2CB9 (dispatch index 0x000)
+  - selector 0x007 -> H'2DC3 (dispatch index 0x007)
+  - selector 0x012 -> H'2E03 (dispatch index 0x012)
+  - selector 0x013 -> H'2E06 (dispatch index 0x013)
+  - selector 0x015 -> H'2E39 (dispatch index 0x015)
+  - selector 0x016 -> H'2E5A (dispatch index 0x016)
+  - selector 0x017 -> H'2E85 (dispatch index 0x017)
+  - selector 0x018 -> H'2E6F (dispatch index 0x018)
+  - selector 0x01A -> H'2EC4 (dispatch index 0x01A)
+  - selector 0x023 -> H'2EE6 (dispatch index 0x023)
+  - selector 0x024 -> H'2F0C (dispatch index 0x024)
+  - selector 0x025 -> H'2F1C (dispatch index 0x025)
+  - selector 0x043 -> H'2F4A (dispatch index 0x043)
+  - selector 0x04A -> H'2F5C (dispatch index 0x04A)
+  - selector 0x04E -> H'2F5C (dispatch index 0x04E)
+  - selector 0x052 -> H'2F5C (dispatch index 0x052)
+
+Candidate Fake-CCU Seed Plan:
+- cmd0 seed selector 0x000 = 0x8080: 00 00 00 80 80 5A
+  selector zero active/connect candidate from emulator state search
+- cmd0 seed selector 0x003 = 0x8000: 00 00 03 80 00 D9
+  ROM default state also sets selector 0x003 high bit
+- cmd0 seed selector 0x040 = 0xFFFF: 00 00 40 FF FF 1A
+  ROM default all-ones/status candidate touched by bench 0x40 family
+- cmd0 seed selector 0x0F6 = 0x2000: 00 01 76 20 00 0D
+  sets E1EC bit13 candidate used by loc_48FA report bridge
+
+Bench Implications:
+- Do not wait for non-heartbeat reports as the only activation source; the CCU may be expected to push initial table state first.
+- Use command 0 writes for initial seeding, then command 1 readbacks for verification. Treat command 4/5/6 as continuation-only until a live report proves otherwise.
+- Selector zero remains the highest-value activation candidate because the emulator reaches CONNECT OK when E000[0]=0x8080 and the selector-zero processing queue runs.
+- E1EC/selector 0x00F6 is a strong follow-up candidate because loc_48FA tests bit13 there and can enqueue report 0x00F6.
+- LCD text terms such as CAM/BARS/BLACK/COMM LINK appear in ROM records, but they are not direct serial payload strings; they point to selector-driven display builders.
+
+Caveats:
+- Selector names are candidates, not confirmed protocol labels.
+- Static table xrefs prove that firmware reads/writes a selector; they do not prove the external CCU must seed it on boot.
+- Generated frames are syntactically valid six-byte host frames; bench safety still depends on timing and current RCP state.

build/rom_consistency.txt

@@ -0,0 +1,9 @@
+Decompiler/Pseudocode Consistency
+3 byte-immediate-to-word destination case(s) require explicit zero-extension in pseudocode.
+
+- H'1043: MOV:G.W #H'00, @FRT1_FRC_H [requires_zero_extend8_to16_pseudocode]
+  Word-sized MOV with an 8-bit immediate writes a zero-extended word. Pseudocode should not model this as a one-byte write or preserve the old low byte.
+- H'1058: MOV:G.W #H'00, @FRT2_FRC_H [requires_zero_extend8_to16_pseudocode]
+  Word-sized MOV with an 8-bit immediate writes a zero-extended word. Pseudocode should not model this as a one-byte write or preserve the old low byte.
+- H'4067: MOV:G.W #H'00, @(-H'0790,R2) [requires_zero_extend8_to16_pseudocode]
+  Word-sized MOV with an 8-bit immediate writes a zero-extended word. Pseudocode should not model this as a one-byte write or preserve the old low byte.

build/rom_copy_text_linear.asm

@@ -0,0 +1,203 @@
+; H8/536 ROM disassembly
+; input: ROM\M27C512@DIP28_1.BIN
+; bytes: 65536
+; vector mode: min
+; analysis: linear sweep
+;
+; Notes from the manual:
+; - H8/536 uses the H8/500 CPU instruction set.
+; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
+; - The register field is H'FE80-H'FFFF; names below come from appendix B.
+; - @aa:8 short absolute operands use BR as the upper address byte.
+; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
+; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
+; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
+; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
+
+; Memory Map
+; H'0000-H'009F exception_vectors  vectors
+; H'00A0-H'00FF dtc_vectors        dtc_vectors
+; H'0100-H'F67F program_or_external program
+; H'F680-H'FE7F on_chip_ram        ram
+; H'FE80-H'FFFF register_field     registers
+
+; Vectors
+; H'0000 reset                    -> vec_reset_1000 (H'1000)
+; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
+; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
+; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
+; H'0010 address_error            -> vec_reset_1000 (H'1000)
+; H'0012 trace                    -> vec_reset_1000 (H'1000)
+; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
+; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
+; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
+; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
+; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
+; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
+; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
+; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
+; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
+; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
+; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
+; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
+; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
+; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
+; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
+; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
+; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
+; H'0040 irq0                     -> vec_reset_1000 (H'1000)
+; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
+; H'0048 irq1                     -> vec_reset_1000 (H'1000)
+; H'0050 irq2                     -> vec_reset_1000 (H'1000)
+; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
+; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
+; H'005A irq5                     -> vec_reset_1000 (H'1000)
+; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
+; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
+; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
+; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
+; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
+; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)
+
+; Symbols
+; ram_F738         H'F738 on_chip_ram        ram      r=0 w=2 width=word
+; ram_F73A         H'F73A on_chip_ram        ram      r=0 w=2 width=word
+; ram_F73C         H'F73C on_chip_ram        ram      r=0 w=2 width=word
+; ram_F73E         H'F73E on_chip_ram        ram      r=0 w=3 width=word
+; ram_F740         H'F740 on_chip_ram        ram      r=0 w=2 width=word
+; ram_F742         H'F742 on_chip_ram        ram      r=0 w=3 width=word
+; ram_F754         H'F754 on_chip_ram        ram      r=0 w=3 width=word
+
+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
+; LCD/Text Scan
+; search 'CONNECT': not literal, hits=0
+;   near: H'A025 'COMPLETED', H'9F98 'COPY', H'A008 'COPY'
+; LCD text regions
+; region H'9F98-H'A033 count=4   'COPY', 'IN PROGRESS', 'COPY', 'COMPLETED'
+; LCD text candidates
+; text H'9F98   len=14  medium 'COPY' xrefs=2
+; text H'9FB5   len=14  medium 'IN PROGRESS' xrefs=2
+; text H'A008   len=14  medium 'COPY' xrefs=2
+; text H'A025   len=14  medium 'COMPLETED' xrefs=2
+
+9F80: 40 06          CMP:E #H'06, R0 ; cycles=2
+9F82: 00             NOP ; cycles=2
+9F83: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
+9F88: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
+9F8D: 1D F7 54 06 00 MOV:G.W #H'00, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
+9F92: 1E C1 71       BSR loc_6106 ; cycles=13
+9F95: 20 10          BRA loc_9FA7 ; cycles=8
+9F97: 06             .db H'06
+9F98: 20 20          BRA loc_9FBA ; cycles=7
+9F9A: 20 20          BRA loc_9FBC ; cycles=7
+9F9C: 20 43          BRA loc_9FE1 ; cycles=7
+9F9E: 4F 50 59       CMP:I #H'5059, R7 ; cycles=3
+9FA1: 20 20          BRA loc_9FC3 ; cycles=8
+9FA3: 20 20          BRA loc_9FC5 ; cycles=8
+9FA5: 20 07          BRA loc_9FAE ; cycles=8
+
+loc_9FA7:
+9FA7: 58 9F 97       MOV:I.W #H'9F97, R0 ; LCD text xref H'9F98 'COPY'; dataflow R0=H'9F97; cycles=3
+9FAA: 1E BA E4       BSR loc_5A91 ; cycles=13
+9FAD: 55 01          MOV:E.B #H'01, R5 ; dataflow R5=H'01; cycles=2
+9FAF: 1E 9F 1A       BSR loc_3ECC ; cycles=14
+9FB2: 20 10          BRA loc_9FC4 ; cycles=7
+9FB4: 06             .db H'06
+9FB5: 20 49          BRA loc_A000 ; cycles=8
+9FB7: 4E 20 50       CMP:I #H'2050, R6 ; cycles=3
+
+loc_9FBA:
+9FBA: 52 4F          MOV:E.B #H'4F, R2 ; dataflow R2=H'4F; cycles=2
+
+loc_9FBC:
+9FBC: 47 52          CMP:E #H'52, R7 ; cycles=2
+9FBE: 45 53          CMP:E #H'53, R5 ; cycles=2
+9FC0: 53 20          MOV:E.B #H'20, R3 ; dataflow R3=H'20; cycles=2
+9FC2: 20 07          BRA loc_9FCB ; cycles=7
+
+loc_9FC4:
+9FC4: 58 9F B4       MOV:I.W #H'9FB4, R0 ; LCD text xref H'9FB5 'IN PROGRESS'; dataflow R0=H'9FB4; cycles=3
+9FC7: 1E BA C7       BSR loc_5A91 ; cycles=14
+9FCA: 55 02          MOV:E.B #H'02, R5 ; dataflow R5=H'02; cycles=2
+9FCC: 1E 9E FD       BSR loc_3ECC ; cycles=13
+9FCF: 1E C1 6A       BSR loc_613C ; cycles=14
+9FD2: 1E BA 2F       BSR loc_5A04 ; cycles=13
+9FD5: 19             RTS ; cycles=13
+9FD6: 00             NOP ; cycles=2
+9FD7: 00             NOP ; cycles=2
+9FD8: 00             NOP ; cycles=2
+9FD9: FF 1D F7 36    SUB.W @(H'1DF7,R7), R6 ; cycles=6
+9FDD: 06             .db H'06
+9FDE: 00             NOP ; cycles=2
+9FDF: 1D F7 38 06 00 MOV:G.W #H'00, @H'F738 ; refs ram_F738 in on_chip_ram; cycles=9
+9FE4: 1D F7 3A 06 00 MOV:G.W #H'00, @H'F73A ; refs ram_F73A in on_chip_ram; cycles=11
+9FE9: 1D F7 3C 06 00 MOV:G.W #H'00, @H'F73C ; refs ram_F73C in on_chip_ram; cycles=9
+9FEE: 1D F7 40 06 00 MOV:G.W #H'00, @H'F740 ; refs ram_F740 in on_chip_ram; cycles=11
+9FF3: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
+9FF8: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
+9FFD: 1D F7 54 06 00 MOV:G.W #H'00, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
+A002: 1E C1 01       BSR loc_6106 ; cycles=13
+A005: 20 10          BRA loc_A017 ; cycles=8
+A007: 06             .db H'06
+A008: 20 20          BRA loc_A02A ; cycles=7
+A00A: 20 20          BRA loc_A02C ; cycles=7
+A00C: 20 43          BRA loc_A051 ; cycles=7
+A00E: 4F 50 59       CMP:I #H'5059, R7 ; cycles=3
+A011: 20 20          BRA loc_A033 ; cycles=8
+A013: 20 20          BRA loc_A035 ; cycles=8
+A015: 20 07          BRA loc_A01E ; cycles=8
+
+loc_A017:
+A017: 58 A0 07       MOV:I.W #H'A007, R0 ; LCD text xref H'A008 'COPY'; dataflow R0=H'A007; cycles=3
+A01A: 1E BA 74       BSR loc_5A91 ; cycles=13
+A01D: 55 01          MOV:E.B #H'01, R5 ; dataflow R5=H'01; cycles=2
+A01F: 1E 9E AA       BSR loc_3ECC ; cycles=14
+A022: 20 10          BRA loc_A034 ; cycles=7
+A024: 06             .db H'06
+A025: 20 20          BRA loc_A047 ; cycles=8
+A027: 43 4F          CMP:E #H'4F, R3 ; cycles=2
+A029: 4D 50 4C       CMP:I #H'504C, R5 ; cycles=3
+
+loc_A02C:
+A02C: 45 54          CMP:E #H'54, R5 ; cycles=2
+A02E: 45 44          CMP:E #H'44, R5 ; cycles=2
+A030: 20 20          BRA loc_A052 ; cycles=7
+A032: 20 07          BRA loc_A03B ; cycles=7
+
+loc_A034:
+A034: 58 A0 24       MOV:I.W #H'A024, R0 ; LCD text xref H'A025 'COMPLETED'; dataflow R0=H'A024; cycles=3
+A037: 1E BA 57       BSR loc_5A91 ; cycles=14
+A03A: 55 02          MOV:E.B #H'02, R5 ; dataflow R5=H'02; cycles=2
+A03C: 1E 9E 8D       BSR loc_3ECC ; cycles=13
+A03F: 1E C0 FA       BSR loc_613C ; cycles=14
+A042: 1E B9 BF       BSR loc_5A04 ; cycles=13
+A045: 19             RTS ; cycles=13
+A046: 00             NOP ; cycles=2
+
+loc_A047:
+A047: 00             NOP ; cycles=2
+A048: 00             NOP ; cycles=2
+A049: FF 1E C2 FB    BTST.W #11, @(H'1EC2,R7) ; cycles=6
+A04D: 19             RTS ; cycles=13
+A04E: 00             NOP ; cycles=2
+A04F: 00             NOP ; cycles=2
+A050: 00             NOP ; cycles=2
+
+loc_A051:
+A051: FF 1D F7 36    SUB.W @(H'1DF7,R7), R6 ; cycles=6
+A055: 06             .db H'06
+A056: 00             NOP ; cycles=2
+A057: 1D F7 38 06 00 MOV:G.W #H'00, @H'F738 ; refs ram_F738 in on_chip_ram; cycles=9
+A05C: 1D F7 3A 06 00 MOV:G.W #H'00, @H'F73A ; refs ram_F73A in on_chip_ram; cycles=11
+A061: 1D F7 3C 06 00 MOV:G.W #H'00, @H'F73C ; refs ram_F73C in on_chip_ram; cycles=9
+A066: 1D F7 40 06 00 MOV:G.W #H'00, @H'F740 ; refs ram_F740 in on_chip_ram; cycles=11
+A06B: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
+A070: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
+A075: 1D F7 54 07 00 B9 MOV:G.W #H'00B9, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
+A07B: 59 00 A9       MOV:I.W #H'00A9, R1 ; dataflow R1=H'00A9; cycles=3
+A07E: 58 00 00       MOV:I.W #H'0000, R0 ; dataflow R0=H'0000; cycles=3

build/rom_decompiled.asm

@@ -230,6 +230,16 @@
 ; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
 ; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
 
+; Serial Protocol Reconstruction
+; TX candidate: 6 bytes H'F858-H'F85D, checksum H'F85D seeded by H'005A (confidence high 0.95)
+;   TX path: initial byte is written from the TX frame buffer, then subsequent bytes are sent by the TXI path when TDRE is reasserted
+; RX candidate: 6 bytes capture H'F868-H'F86D, validate H'F860-H'F865 checksum H'F865 seeded by H'005A (confidence high 0.9)
+;   caveat: candidate frame means six consecutive bytes within the observed RX timing/state machine, not a proven delimited packet
+; Serial RAM role candidates
+;   H'F9C0: post_tx_report_delay - post_tx_report_delay at H'F9C0 is a candidate/evidence-supported RAM timer role; FRT1 OCIA tick ISR H'BEEA decrements it
+;   H'F9C1: secondary_tx_report_delay - secondary_tx_report_delay at H'F9C1 is a candidate/evidence-supported RAM timer role; FRT1 OCIA tick ISR H'BEEA decrements it
+;   H'F9C6: periodic_report_countdown - periodic_report_countdown at H'F9C6 is a candidate/evidence-supported RAM timer role; FRT1 OCIA tick ISR H'BEEA decrements it
+
 ; LCD/Text Scan
 ; search 'CONNECT': not literal, hits=0
 ;   near: H'A025 'COMPLETED', H'8E79 'ON  CONT1  OFF~X', H'8F55 'ON  CONT2  OFF~X', H'94A9 'ON'
@@ -425,10 +435,10 @@ vec_reset_1000:
 108B: 15 FE C8 06 3B MOV:G.B #H'3B, @PWM3_TCR ; PWM3_TCR = H'3B (OE=0 OS=0 CKS2=0 CKS1=1 CKS0=1); cycles=9
 1090: 15 FE C9 06 7D MOV:G.B #H'7D, @PWM3_DTR ; PWM3_DTR = H'7D; cycles=9
 1095: 15 FE D8 06 24 MOV:G.B #H'24, @SCI1_SMR ; SCI1_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI1 SMR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); cycles=9
-109A: 15 FE DA 06 3C MOV:G.B #H'3C, @SCI1_SCR ; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); disable SCI1 TX interrupt (TIE); disable SCI1 receive and receive-error interrupts (RIE); enable SCI1 transmitter (TE); enable SCI1 receiver (RE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
+109A: 15 FE DA 06 3C MOV:G.B #H'3C, @SCI1_SCR ; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); disable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; disable SCI1 receive and receive-error interrupts (RIE); enable SCI1 transmitter (TE); enable SCI1 receiver (RE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
 109F: 15 FE D9 06 07 MOV:G.B #H'07, @SCI1_BRR ; SCI1_BRR = H'07; SCI1 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI1 BRR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); cycles=9
 10A4: 15 FE F0 06 24 MOV:G.B #H'24, @SCI2_SMR ; SCI2_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI2 SMR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
-10A9: 15 FE F2 06 0C MOV:G.B #H'0C, @SCI2_SCR ; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); disable SCI2 TX interrupt (TIE); disable SCI2 receive and receive-error interrupts (RIE); disable SCI2 transmitter (TE); disable SCI2 receiver (RE); SCI2 SCR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
+10A9: 15 FE F2 06 0C MOV:G.B #H'0C, @SCI2_SCR ; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); disable SCI2 TX interrupt (TIE); gates TXI when hardware sets TDRE; disable SCI2 receive and receive-error interrupts (RIE); disable SCI2 transmitter (TE); disable SCI2 receiver (RE); SCI2 SCR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
 10AE: 15 FE F1 06 07 MOV:G.B #H'07, @SCI2_BRR ; SCI2_BRR = H'07; SCI2 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI2 BRR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
 10B3: 15 FE E8 06 19 MOV:G.B #H'19, @ADCSR ; ADCSR = H'19 (ADF=0 ADIE=0 ADST=0 SCAN=1 CKS=1 CH2=0 CH1=0 CH0=1; A/D halt, scan AN0-AN1, 138-state max, ADI disabled); cycles=9
 10B8: 15 FE E9 06 7F MOV:G.B #H'7F, @H'FEE9 ; refs H'FEE9 in register_field; cycles=9
@@ -3017,27 +3027,27 @@ BA2A: 26 FA          BNE loc_BA26 ; cycles=3/7 nt/t
 BA2C: 15 F9 C0 06 64 MOV:G.B #H'64, @H'F9C0 ; refs ram_F9C0 in on_chip_ram; cycles=9
 BA31: 15 F9 C4 06 07 MOV:G.B #H'07, @H'F9C4 ; refs ram_F9C4 in on_chip_ram; cycles=9
 BA36: 1D F8 50 80    MOV:G.W @H'F850, R0 ; refs ram_F850 in on_chip_ram; cycles=7
-BA3A: 1D F8 58 90    MOV:G.W R0, @H'F858 ; refs ram_F858 in on_chip_ram; cycles=7
+BA3A: 1D F8 58 90    MOV:G.W R0, @H'F858 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F858 in on_chip_ram; cycles=7
 BA3E: 1D F8 52 80    MOV:G.W @H'F852, R0 ; refs ram_F852 in on_chip_ram; cycles=7
-BA42: 1D F8 5A 90    MOV:G.W R0, @H'F85A ; refs ram_F85A in on_chip_ram; cycles=7
+BA42: 1D F8 5A 90    MOV:G.W R0, @H'F85A ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85A in on_chip_ram; cycles=7
 BA46: 15 F8 54 80    MOV:G.B @H'F854, R0 ; refs ram_F854 in on_chip_ram; cycles=7
-BA4A: 15 F8 5C 90    MOV:G.B R0, @H'F85C ; refs ram_F85C in on_chip_ram; cycles=7
-BA4E: 50 5A          MOV:E.B #H'5A, R0 ; dataflow R0=H'5A; cycles=2
-BA50: 15 F8 58 60    XOR.B @H'F858, R0 ; refs ram_F858 in on_chip_ram; cycles=7
-BA54: 15 F8 59 60    XOR.B @H'F859, R0 ; refs ram_F859 in on_chip_ram; cycles=7
-BA58: 15 F8 5A 60    XOR.B @H'F85A, R0 ; refs ram_F85A in on_chip_ram; cycles=7
-BA5C: 15 F8 5B 60    XOR.B @H'F85B, R0 ; refs ram_F85B in on_chip_ram; cycles=7
-BA60: 15 F8 5C 60    XOR.B @H'F85C, R0 ; refs ram_F85C in on_chip_ram; cycles=7
-BA64: 15 F8 5D 90    MOV:G.B R0, @H'F85D ; refs ram_F85D in on_chip_ram; cycles=7
+BA4A: 15 F8 5C 90    MOV:G.B R0, @H'F85C ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85C in on_chip_ram; cycles=7
+BA4E: 50 5A          MOV:E.B #H'5A, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX checksum starts from seed H'005A; confidence high; dataflow R0=H'5A; cycles=2
+BA50: 15 F8 58 60    XOR.B @H'F858, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F858 in on_chip_ram; cycles=7
+BA54: 15 F8 59 60    XOR.B @H'F859, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F859 in on_chip_ram; cycles=7
+BA58: 15 F8 5A 60    XOR.B @H'F85A, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85A in on_chip_ram; cycles=7
+BA5C: 15 F8 5B 60    XOR.B @H'F85B, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85B in on_chip_ram; cycles=7
+BA60: 15 F8 5C 60    XOR.B @H'F85C, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85C in on_chip_ram; cycles=7
+BA64: 15 F8 5D 90    MOV:G.B R0, @H'F85D ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate checksum byte write targets H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85D in on_chip_ram; cycles=7
 
 loc_BA68:
 BA68: 15 FE DC F7    BTST.B #7, @SCI1_SSR ; wait for SCI1 transmit data register empty (TDRE=1); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR in register_field; cycles=7
 BA6C: 27 FA          BEQ loc_BA68 ; repeat SCI1 transmit-empty wait while TDRE=0; cycles=3/7 nt/t
-BA6E: 15 F8 58 80    MOV:G.B @H'F858, R0 ; refs ram_F858 in on_chip_ram; cycles=7
-BA72: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; cycles=7
-BA76: 15 F9 C2 06 01 MOV:G.B #H'01, @H'F9C2 ; refs ram_F9C2 in on_chip_ram; cycles=9
-BA7B: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
-BA7F: 15 FE DA C7    BSET.B #7, @SCI1_SCR ; set TIE (bit 7) of SCI1_SCR; enable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=8
+BA6E: 15 F8 58 80    MOV:G.B @H'F858, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: initial SCI1 TDR send is supported by a read from H'F858; confidence high; refs ram_F858 in on_chip_ram; cycles=7
+BA72: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: initial SCI1 TDR send is supported by a read from H'F858; confidence high; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; cycles=7
+BA76: 15 F9 C2 06 01 MOV:G.B #H'01, @H'F9C2 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: write evidence supports TX index H'F9C2 being initialized to 1; confidence high; refs ram_F9C2 in on_chip_ram; cycles=9
+BA7B: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 TDRE after TDR write; TXI can fire again when hardware reasserts TDRE; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BA7F: 15 FE DA C7    BSET.B #7, @SCI1_SCR ; set TIE (bit 7) of SCI1_SCR; enable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=8
 BA83: 19             RTS ; cycles=13
 
 vec_sci1_txi_BA84:
@@ -3049,22 +3059,22 @@ BA90: 15 F9 C3 16    TST.B @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=7
 BA94: 27 13          BEQ loc_BAA9 ; cycles=3/7 nt/t
 BA96: 15 FA A2 D3    BCLR.B #3, @H'FAA2 ; refs ram_FAA2 in on_chip_ram; cycles=9
 BA9A: 15 FA A3 13    CLR.B @H'FAA3 ; refs ram_FAA3 in on_chip_ram; cycles=9
-BA9E: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
+BA9E: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
 BAA2: 15 F9 C0 06 1F MOV:G.B #H'1F, @H'F9C0 ; refs ram_F9C0 in on_chip_ram; cycles=9
 BAA7: 20 48          BRA loc_BAF1 ; cycles=8
 
 loc_BAA9:
 BAA9: BF 90          MOV:G.W R0, @-R7 ; cycles=5
-BAAB: 15 F9 C2 80    MOV:G.B @H'F9C2, R0 ; refs ram_F9C2 in on_chip_ram; cycles=6
+BAAB: 15 F9 C2 80    MOV:G.B @H'F9C2, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR sends SCI1 TDR from indexed H'F858 buffer; confidence high; refs ram_F9C2 in on_chip_ram; cycles=6
 BAAF: A0 12          EXTU.B R0 ; cycles=3
-BAB1: F0 F8 58 80    MOV:G.B @(-H'07A8,R0), R0 ; cycles=6
-BAB5: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; cycles=6
+BAB1: F0 F8 58 80    MOV:G.B @(-H'07A8,R0), R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR sends SCI1 TDR from indexed H'F858 buffer; confidence high; cycles=6
+BAB5: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR sends SCI1 TDR from indexed H'F858 buffer; confidence high; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; cycles=6
 BAB9: CF 80          MOV:G.W @R7+, R0 ; cycles=6
-BABB: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
-BABF: 15 F9 C2 08    ADD:Q.B #1, @H'F9C2 ; refs ram_F9C2 in on_chip_ram; cycles=8
-BAC3: 15 F9 C2 04 06 CMP:G.B #H'06, @H'F9C2 ; refs ram_F9C2 in on_chip_ram; cycles=6
+BABB: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 TDRE after TDR write; TXI can fire again when hardware reasserts TDRE; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BABF: 15 F9 C2 08    ADD:Q.B #1, @H'F9C2 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR increments TX index H'F9C2; confidence high; refs ram_F9C2 in on_chip_ram; cycles=8
+BAC3: 15 F9 C2 04 06 CMP:G.B #H'06, @H'F9C2 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR compares TX index to frame length 6; confidence high; refs ram_F9C2 in on_chip_ram; cycles=6
 BAC8: 26 27          BNE loc_BAF1 ; cycles=3/7 nt/t
-BACA: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
+BACA: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
 BACE: 15 F7 95 F6    BTST.B #6, @H'F795 ; refs ram_F795 in on_chip_ram; cycles=7
 BAD2: 26 14          BNE loc_BAE8 ; cycles=3/7 nt/t
 BAD4: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
@@ -3125,15 +3135,15 @@ loc_BB56:
 BB56: 19             RTS ; cycles=12
 
 vec_sci1_eri_BB57:
-BB57: 15 FA A4 C7    BSET.B #7, @H'FAA4 ; refs ram_FAA4 in on_chip_ram; cycles=8
-BB5B: 15 FE DC D5    BCLR.B #5, @SCI1_SSR ; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
-BB5F: 15 FE DC D4    BCLR.B #4, @SCI1_SSR ; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
-BB63: 15 FE DC D3    BCLR.B #3, @SCI1_SSR ; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB57: 15 FA A4 C7    BSET.B #7, @H'FAA4 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; refs ram_FAA4 in on_chip_ram; cycles=8
+BB5B: 15 FE DC D5    BCLR.B #5, @SCI1_SSR ; clear ORER (bit 5) of SCI1_SSR; clear SCI1 ORER with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB5F: 15 FE DC D4    BCLR.B #4, @SCI1_SSR ; clear FER (bit 4) of SCI1_SSR; clear SCI1 FER with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB63: 15 FE DC D3    BCLR.B #3, @SCI1_SSR ; clear PER (bit 3) of SCI1_SSR; clear SCI1 PER with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
 
 vec_sci1_rxi_BB67:
 BB67: 12 03          STM.W {R0,R1}, @-SP ; cycles=12
-BB69: 15 FE DC D6    BCLR.B #6, @SCI1_SSR ; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
-BB6D: 15 FE DD 80    MOV:G.B @SCI1_RDR, R0 ; read SCI1 received byte from RDR; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR in register_field; cycles=6
+BB69: 15 FE DC D6    BCLR.B #6, @SCI1_SSR ; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 RDRF with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB6D: 15 FE DD 80    MOV:G.B @SCI1_RDR, R0 ; read SCI1 received byte from RDR; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR in register_field; cycles=6
 BB71: 15 F9 C1 16    TST.B @H'F9C1 ; refs ram_F9C1 in on_chip_ram; cycles=6
 BB75: 26 06          BNE loc_BB7D ; cycles=3/8 nt/t
 BB77: 15 F9 C3 13    CLR.B @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=8
@@ -3148,12 +3158,12 @@ BB88: 20 19          BRA loc_BBA3 ; cycles=7
 loc_BB8A:
 BB8A: 15 F9 C3 81    MOV:G.B @H'F9C3, R1 ; refs ram_F9C3 in on_chip_ram; cycles=7
 BB8E: A1 12          EXTU.B R1 ; cycles=3
-BB90: F1 F8 68 90    MOV:G.B R0, @(-H'0798,R1) ; cycles=7
-BB94: A1 08          ADD:Q.B #1, R1 ; cycles=4
-BB96: 15 F9 C3 91    MOV:G.B R1, @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=7
-BB9A: 41 06          CMP:E #H'06, R1 ; cycles=2
+BB90: F1 F8 68 90    MOV:G.B R0, @(-H'0798,R1) ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: received bytes are stored into candidate capture buffer H'F868-H'F86D; confidence high; cycles=7
+BB94: A1 08          ADD:Q.B #1, R1 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX byte count/index is incremented and stored at H'F9C3; confidence high; cycles=4
+BB96: 15 F9 C3 91    MOV:G.B R1, @H'F9C3 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX byte count/index is incremented and stored at H'F9C3; confidence high; refs ram_F9C3 in on_chip_ram; cycles=7
+BB9A: 41 06          CMP:E #H'06, R1 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX ISR compares incremented count to candidate frame length 6; confidence high; cycles=2
 BB9C: 26 05          BNE loc_BBA3 ; cycles=3/7 nt/t
-BB9E: 15 F9 C5 06 14 MOV:G.B #H'14, @H'F9C5 ; refs ram_F9C5 in on_chip_ram; cycles=9
+BB9E: 15 F9 C5 06 14 MOV:G.B #H'14, @H'F9C5 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX ISR sets H'F9C5 after count reaches 6; confidence high; refs ram_F9C5 in on_chip_ram; cycles=9
 
 loc_BBA3:
 BBA3: 15 F9 C1 06 05 MOV:G.B #H'05, @H'F9C1 ; refs ram_F9C1 in on_chip_ram; cycles=9
@@ -3161,24 +3171,24 @@ BBA8: 02 03          LDM.W @SP+, {R0,R1} ; cycles=14
 BBAA: 0A             RTE ; cycles=13
 
 loc_BBAB:
-BBAB: 15 F9 C3 04 06 CMP:G.B #H'06, @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=6
+BBAB: 15 F9 C3 04 06 CMP:G.B #H'06, @H'F9C3 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing path requires H'F9C3 to equal 6; confidence high; refs ram_F9C3 in on_chip_ram; cycles=6
 BBB0: 36 02 BC       BNE loc_BE6F ; cycles=3/7 nt/t
-BBB3: 1D F8 68 80    MOV:G.W @H'F868, R0 ; refs ram_F868 in on_chip_ram; cycles=6
-BBB7: 1D F8 60 90    MOV:G.W R0, @H'F860 ; refs ram_F860 in on_chip_ram; cycles=6
-BBBB: 1D F8 6A 80    MOV:G.W @H'F86A, R0 ; refs ram_F86A in on_chip_ram; cycles=6
-BBBF: 1D F8 62 90    MOV:G.W R0, @H'F862 ; refs ram_F862 in on_chip_ram; cycles=6
-BBC3: 1D F8 6C 80    MOV:G.W @H'F86C, R0 ; refs ram_F86C in on_chip_ram; cycles=6
-BBC7: 1D F8 64 90    MOV:G.W R0, @H'F864 ; refs ram_F864 in on_chip_ram; cycles=6
+BBB3: 1D F8 68 80    MOV:G.W @H'F868, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F868 in on_chip_ram; cycles=6
+BBB7: 1D F8 60 90    MOV:G.W R0, @H'F860 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F860 in on_chip_ram; cycles=6
+BBBB: 1D F8 6A 80    MOV:G.W @H'F86A, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F86A in on_chip_ram; cycles=6
+BBBF: 1D F8 62 90    MOV:G.W R0, @H'F862 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F862 in on_chip_ram; cycles=6
+BBC3: 1D F8 6C 80    MOV:G.W @H'F86C, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F86C in on_chip_ram; cycles=6
+BBC7: 1D F8 64 90    MOV:G.W R0, @H'F864 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F864 in on_chip_ram; cycles=6
 BBCB: 15 F9 C3 13    CLR.B @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=8
 BBCF: 15 FA A4 F7    BTST.B #7, @H'FAA4 ; refs ram_FAA4 in on_chip_ram; cycles=6
 BBD3: 36 02 53       BNE loc_BE29 ; cycles=3/8 nt/t
-BBD6: 50 5A          MOV:E.B #H'5A, R0 ; dataflow R0=H'5A; cycles=2
-BBD8: 15 F8 60 60    XOR.B @H'F860, R0 ; refs ram_F860 in on_chip_ram; cycles=7
-BBDC: 15 F8 61 60    XOR.B @H'F861, R0 ; refs ram_F861 in on_chip_ram; cycles=7
-BBE0: 15 F8 62 60    XOR.B @H'F862, R0 ; refs ram_F862 in on_chip_ram; cycles=7
-BBE4: 15 F8 63 60    XOR.B @H'F863, R0 ; refs ram_F863 in on_chip_ram; cycles=7
-BBE8: 15 F8 64 60    XOR.B @H'F864, R0 ; refs ram_F864 in on_chip_ram; cycles=7
-BBEC: 15 F8 65 70    CMP:G.B @H'F865, R0 ; refs ram_F865 in on_chip_ram; cycles=7
+BBD6: 50 5A          MOV:E.B #H'5A, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: candidate RX checksum validation starts from seed H'005A; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; dataflow R0=H'5A; cycles=2
+BBD8: 15 F8 60 60    XOR.B @H'F860, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F860 in on_chip_ram; cycles=7
+BBDC: 15 F8 61 60    XOR.B @H'F861, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F861 in on_chip_ram; cycles=7
+BBE0: 15 F8 62 60    XOR.B @H'F862, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F862 in on_chip_ram; cycles=7
+BBE4: 15 F8 63 60    XOR.B @H'F863, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F863 in on_chip_ram; cycles=7
+BBE8: 15 F8 64 60    XOR.B @H'F864, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F864 in on_chip_ram; cycles=7
+BBEC: 15 F8 65 70    CMP:G.B @H'F865, R0 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F865 in on_chip_ram; cycles=7
 BBF0: 36 02 36       BNE loc_BE29 ; cycles=3/7 nt/t
 BBF3: 15 FA A6 13    CLR.B @H'FAA6 ; refs ram_FAA6 in on_chip_ram; cycles=8
 BBF7: 15 F8 61 85    MOV:G.B @H'F861, R5 ; refs ram_F861 in on_chip_ram; cycles=6
@@ -3395,11 +3405,11 @@ BDFF: 15 FA A2 13    CLR.B @H'FAA2 ; refs ram_FAA2 in on_chip_ram; cycles=8
 BE03: 20 6A          BRA loc_BE6F ; cycles=8
 
 loc_BE05:
-BE05: 1D F8 58 80    MOV:G.W @H'F858, R0 ; refs ram_F858 in on_chip_ram; cycles=6
+BE05: 1D F8 58 80    MOV:G.W @H'F858, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F858 in on_chip_ram; cycles=6
 BE09: 1D F8 50 90    MOV:G.W R0, @H'F850 ; refs ram_F850 in on_chip_ram; cycles=6
-BE0D: 1D F8 5A 80    MOV:G.W @H'F85A, R0 ; refs ram_F85A in on_chip_ram; cycles=6
+BE0D: 1D F8 5A 80    MOV:G.W @H'F85A, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85A in on_chip_ram; cycles=6
 BE11: 1D F8 52 90    MOV:G.W R0, @H'F852 ; refs ram_F852 in on_chip_ram; cycles=6
-BE15: 1D F8 5C 80    MOV:G.W @H'F85C, R0 ; refs ram_F85C in on_chip_ram; cycles=6
+BE15: 1D F8 5C 80    MOV:G.W @H'F85C, R0 ; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85C in on_chip_ram; cycles=6
 BE19: 1D F8 54 90    MOV:G.W R0, @H'F854 ; refs ram_F854 in on_chip_ram; cycles=6
 BE1D: 15 F9 C0 06 1F MOV:G.B #H'1F, @H'F9C0 ; refs ram_F9C0 in on_chip_ram; cycles=9
 BE22: 1E FC 01       BSR loc_BA26 ; cycles=13
@@ -3490,20 +3500,20 @@ loc_BEE8:
 BEE8: 19             RTS ; cycles=12
 
 vec_frt1_ocia_BEEA:
-BEEA: 15 FE 91 D5    BCLR.B #5, @FRT1_TCSR ; clear OCFA (bit 5) of FRT1_TCSR; cycles=9
-BEEE: 15 F9 C0 16    TST.B @H'F9C0 ; refs ram_F9C0 in on_chip_ram; cycles=7
+BEEA: 15 FE 91 D5    BCLR.B #5, @FRT1_TCSR ; clear OCFA (bit 5) of FRT1_TCSR; candidate/evidence-supported RAM role post_tx_report_delay at H'F9C0; evidence: candidate periodic tick ISR at H'BEEA for FRT1 OCIA vector H'0062 clears OCFA; confidence candidate/evidence-supported; candidate/evidence-supported RAM role secondary_tx_report_delay at H'F9C1; evidence: candidate periodic tick ISR at H'BEEA for FRT1 OCIA vector H'0062 clears OCFA; confidence candidate/evidence-supported; candidate/evidence-supported RAM role periodic_report_countdown at H'F9C6; evidence: candidate periodic tick ISR at H'BEEA for FRT1 OCIA vector H'0062 clears OCFA; confidence candidate/evidence-supported; cycles=9
+BEEE: 15 F9 C0 16    TST.B @H'F9C0 ; candidate/evidence-supported RAM role post_tx_report_delay at H'F9C0; evidence: candidate post-TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C0 in on_chip_ram; cycles=7
 BEF2: 27 04          BEQ loc_BEF8 ; cycles=3/7 nt/t
-BEF4: 15 F9 C0 0C    ADD:Q.B #-1, @H'F9C0 ; refs ram_F9C0 in on_chip_ram; cycles=9
+BEF4: 15 F9 C0 0C    ADD:Q.B #-1, @H'F9C0 ; candidate/evidence-supported RAM role post_tx_report_delay at H'F9C0; evidence: candidate post-TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C0 in on_chip_ram; cycles=9
 
 loc_BEF8:
-BEF8: 15 F9 C1 16    TST.B @H'F9C1 ; refs ram_F9C1 in on_chip_ram; cycles=7
+BEF8: 15 F9 C1 16    TST.B @H'F9C1 ; candidate/evidence-supported RAM role secondary_tx_report_delay at H'F9C1; evidence: candidate secondary TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C1 in on_chip_ram; cycles=7
 BEFC: 27 04          BEQ loc_BF02 ; cycles=3/7 nt/t
-BEFE: 15 F9 C1 0C    ADD:Q.B #-1, @H'F9C1 ; refs ram_F9C1 in on_chip_ram; cycles=9
+BEFE: 15 F9 C1 0C    ADD:Q.B #-1, @H'F9C1 ; candidate/evidence-supported RAM role secondary_tx_report_delay at H'F9C1; evidence: candidate secondary TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C1 in on_chip_ram; cycles=9
 
 loc_BF02:
-BF02: 1D F9 C6 16    TST.W @H'F9C6 ; refs ram_F9C6 in on_chip_ram; cycles=7
+BF02: 1D F9 C6 16    TST.W @H'F9C6 ; candidate/evidence-supported RAM role periodic_report_countdown at H'F9C6; evidence: candidate periodic report countdown is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C6 in on_chip_ram; cycles=7
 BF06: 27 04          BEQ loc_BF0C ; cycles=3/7 nt/t
-BF08: 1D F9 C6 0C    ADD:Q.W #-1, @H'F9C6 ; refs ram_F9C6 in on_chip_ram; cycles=9
+BF08: 1D F9 C6 0C    ADD:Q.W #-1, @H'F9C6 ; candidate/evidence-supported RAM role periodic_report_countdown at H'F9C6; evidence: candidate periodic report countdown is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C6 in on_chip_ram; cycles=9
 
 loc_BF0C:
 BF0C: 15 F6 F6 F7    BTST.B #7, @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=7

build/rom_eeprom_layout.txt

@@ -0,0 +1,179 @@
+H8/536 EEPROM Layout Report
+
+Summary: The ROM treats the traced P9 bus as two X24164-style EEPROM banks, mirrors a 0x100-byte factory/default block into F400-F4FF, and loads sixteen 8-byte persistent records into F7B0-F82F at boot.
+Confidence: medium-high
+
+Physical / Logical Model:
+- lower_x24164_candidate: logical 0x000-0x7FF control A0/A1
+- upper_x24164_candidate: logical 0x800-0xFFF control E0/E1
+- bus: P91/SCL and P97/SDA bit-banged two-wire bus through ROM routines C121/C08B/C0DB/C10C/C142
+- page model: 16 logical pages of 0x100 bytes; low 8 address bits are sent as the EEPROM word address
+
+Boot Flow:
+- H'40BB eeprom_boot_gate: initializes queue/table scratch, checks P7DR.7, then checks F402 == H'6B6F before trusting persisted state
+- H'4103 factory_default_fill: copies ROM C964-CA63 into F400-F4FF and writes the same 0x100-byte defaults to each EEPROM page
+- H'4187 record_header_blank: overwrites page offsets 0x00-0x07 on pages 0x1-0xF with four H'2020 words after factory replication; page 0 keeps the signature/options header
+- H'41D2 persistent_record_load: reads page offsets 0x00-0x07 from pages 0x0-0xF into F7B0-F82F; record 0 is a signature/options header, records 1-F are label/identity-like slots
+- H'BD2B serial_persist_path: command-4 continuation writes the live value into F400+map[selector] and persists it through BFE0 when F76E.7 is set
+
+Factory Shadow Block:
+- ROM H'C964 length 0x100 mirrors to H'F400-H'F4FF
+- H'F402 offset 0x02 default 0x6B6F (ascii='ko'; xrefs=1)
+- H'F404 offset 0x04 default 0xFE00 (xrefs=8)
+- H'F408 offset 0x08 default 0x8000 (selectors=0x004)
+- H'F40A offset 0x0A default 0x0000 (selectors=0x012)
+- H'F40C offset 0x0C default 0x0000 (selectors=0x013)
+- H'F40E offset 0x0E default 0x8000 (selectors=0x017)
+- H'F410 offset 0x10 default 0x8000 (selectors=0x018)
+- H'F412 offset 0x12 default 0x0808 (selectors=0x01A)
+- H'F414 offset 0x14 default 0x0000 (selectors=0x01F)
+- H'F416 offset 0x16 default 0x0000 (selectors=0x020)
+- H'F418 offset 0x18 default 0x0000 (selectors=0x023)
+- H'F41A offset 0x1A default 0x0000 (selectors=0x037)
+- H'F41C offset 0x1C default 0x0000 (selectors=0x038)
+- H'F41E offset 0x1E default 0x8000 (selectors=0x080)
+- H'F420 offset 0x20 default 0x8000 (selectors=0x081)
+- H'F422 offset 0x22 default 0x0020 (ascii='. '; selectors=0x083)
+- H'F424 offset 0x24 default 0x0000 (selectors=0x088)
+- H'F426 offset 0x26 default 0x0400 (selectors=0x089)
+- H'F428 offset 0x28 default 0x0800 (selectors=0x08B)
+- H'F42A offset 0x2A default 0x0040 (ascii='.@'; selectors=0x08D)
+- H'F42C offset 0x2C default 0x0000 (selectors=0x08F)
+- H'F42E offset 0x2E default 0x8000 (selectors=0x091)
+- H'F430 offset 0x30 default 0xFF80 (selectors=0x092)
+- H'F432 offset 0x32 default 0x4040 (ascii='@@'; selectors=0x093)
+- H'F434 offset 0x34 default 0x0000 (selectors=0x095)
+- H'F436 offset 0x36 default 0x0000 (selectors=0x098)
+- H'F438 offset 0x38 default 0x8000 (selectors=0x09A)
+- H'F43A offset 0x3A default 0x0000 (selectors=0x09D)
+- H'F43C offset 0x3C default 0x8000 (selectors=0x09E)
+- H'F43E offset 0x3E default 0x8000 (selectors=0x09F)
+- H'F440 offset 0x40 default 0x8000 (selectors=0x0A3)
+- H'F442 offset 0x42 default 0x8000 (selectors=0x0A4)
+
+Persistent 8-Byte Records:
+- 16 records: EEPROM 0x000-0x007 .. 0xF00-0xF07 load into RAM H'F7B0-H'F7B7 .. H'F828-H'F82F
+  - record 0x0: EEPROM 0x000-0x007 -> RAM H'F7B0-H'F7B7 default '..ko....'
+  - record 0x1: EEPROM 0x100-0x107 -> RAM H'F7B8-H'F7BF default '        '
+  - record 0x2: EEPROM 0x200-0x207 -> RAM H'F7C0-H'F7C7 default '        '
+  - record 0x3: EEPROM 0x300-0x307 -> RAM H'F7C8-H'F7CF default '        '
+  - record 0x4: EEPROM 0x400-0x407 -> RAM H'F7D0-H'F7D7 default '        '
+  - record 0x5: EEPROM 0x500-0x507 -> RAM H'F7D8-H'F7DF default '        '
+  - record 0x6: EEPROM 0x600-0x607 -> RAM H'F7E0-H'F7E7 default '        '
+  - record 0x7: EEPROM 0x700-0x707 -> RAM H'F7E8-H'F7EF default '        '
+  - record 0x8: EEPROM 0x800-0x807 -> RAM H'F7F0-H'F7F7 default '        '
+  - record 0x9: EEPROM 0x900-0x907 -> RAM H'F7F8-H'F7FF default '        '
+  - record 0xA: EEPROM 0xA00-0xA07 -> RAM H'F800-H'F807 default '        '
+  - record 0xB: EEPROM 0xB00-0xB07 -> RAM H'F808-H'F80F default '        '
+  - record 0xC: EEPROM 0xC00-0xC07 -> RAM H'F810-H'F817 default '        '
+  - record 0xD: EEPROM 0xD00-0xD07 -> RAM H'F818-H'F81F default '        '
+  - record 0xE: EEPROM 0xE00-0xE07 -> RAM H'F820-H'F827 default '        '
+  - record 0xF: EEPROM 0xF00-0xF07 -> RAM H'F828-H'F82F default '        '
+
+Serial Selector -> Shadow/EEPROM Mapping:
+- table H'C564 has 89 nonzero low-byte mappings
+- formula: command 4 persists to EEPROM address (((F76E & 0x0F) << 8) | (mapping_low_byte & 0xFE)) when F76E.7 is set
+  - selector 0x004 map_word=0x4808 -> H'F408 page+0x08 default=0x8000
+  - selector 0x012 map_word=0x080A -> H'F40A page+0x0A default=0x0000
+  - selector 0x013 map_word=0x080C -> H'F40C page+0x0C default=0x0000
+  - selector 0x017 map_word=0x600E -> H'F40E page+0x0E default=0x8000
+  - selector 0x018 map_word=0x6010 -> H'F410 page+0x10 default=0x8000
+  - selector 0x01A map_word=0x1012 -> H'F412 page+0x12 default=0x0808
+  - selector 0x01F map_word=0x4414 -> H'F414 page+0x14 default=0x0000
+  - selector 0x020 map_word=0x4416 -> H'F416 page+0x16 default=0x0000
+  - selector 0x023 map_word=0x0418 -> H'F418 page+0x18 default=0x0000
+  - selector 0x037 map_word=0x641A -> H'F41A page+0x1A default=0x0000
+  - selector 0x038 map_word=0x641C -> H'F41C page+0x1C default=0x0000
+  - selector 0x080 map_word=0xE01E -> H'F41E page+0x1E default=0x8000
+  - selector 0x081 map_word=0x6020 -> H'F420 page+0x20 default=0x8000
+  - selector 0x083 map_word=0x6022 -> H'F422 page+0x22 default=0x0020
+  - selector 0x088 map_word=0x4024 -> H'F424 page+0x24 default=0x0000
+  - selector 0x089 map_word=0x4426 -> H'F426 page+0x26 default=0x0400
+  - selector 0x08B map_word=0x4428 -> H'F428 page+0x28 default=0x0800
+  - selector 0x08D map_word=0x442A -> H'F42A page+0x2A default=0x0040
+  - selector 0x08F map_word=0x602C -> H'F42C page+0x2C default=0x0000
+  - selector 0x091 map_word=0x602E -> H'F42E page+0x2E default=0x8000
+  - selector 0x092 map_word=0x6030 -> H'F430 page+0x30 default=0xFF80
+  - selector 0x093 map_word=0x6032 -> H'F432 page+0x32 default=0x4040
+  - selector 0x095 map_word=0x6034 -> H'F434 page+0x34 default=0x0000
+  - selector 0x098 map_word=0x4036 -> H'F436 page+0x36 default=0x0000
+  - selector 0x09A map_word=0x6038 -> H'F438 page+0x38 default=0x8000
+  - selector 0x09D map_word=0x443A -> H'F43A page+0x3A default=0x0000
+  - selector 0x09E map_word=0x603C -> H'F43C page+0x3C default=0x8000
+  - selector 0x09F map_word=0x603E -> H'F43E page+0x3E default=0x8000
+  - selector 0x0A3 map_word=0x6040 -> H'F440 page+0x40 default=0x8000
+  - selector 0x0A4 map_word=0x6042 -> H'F442 page+0x42 default=0x8000
+  - selector 0x0A5 map_word=0x6044 -> H'F444 page+0x44 default=0x8000
+  - selector 0x0A6 map_word=0x6046 -> H'F446 page+0x46 default=0x8000
+  - selector 0x0A7 map_word=0x4048 -> H'F448 page+0x48 default=0xF000
+  - selector 0x0A9 map_word=0xE04A -> H'F44A page+0x4A default=0x8000
+  - selector 0x0AA map_word=0xC44C -> H'F44C page+0x4C default=0x2000
+  - selector 0x0AC map_word=0xC44E -> H'F44E page+0x4E default=0x8000
+  - selector 0x0AD map_word=0xC450 -> H'F450 page+0x50 default=0x8000
+  - selector 0x0AE map_word=0xC452 -> H'F452 page+0x52 default=0x8000
+  - selector 0x0AF map_word=0xC454 -> H'F454 page+0x54 default=0x8000
+  - selector 0x0B0 map_word=0xC456 -> H'F456 page+0x56 default=0x8000
+  - selector 0x0B2 map_word=0xC458 -> H'F458 page+0x58 default=0x8000
+  - selector 0x0B3 map_word=0xC45A -> H'F45A page+0x5A default=0x8000
+  - selector 0x0B4 map_word=0xC45C -> H'F45C page+0x5C default=0x8000
+  - selector 0x0B6 map_word=0xC45E -> H'F45E page+0x5E default=0x8000
+  - selector 0x0B7 map_word=0x4060 -> H'F460 page+0x60 default=0xF800
+  - selector 0x0B9 map_word=0x6862 -> H'F462 page+0x62 default=0x4000
+  - selector 0x0BC map_word=0xE064 -> H'F464 page+0x64 default=0x8000
+  - selector 0x0BD map_word=0xC066 -> H'F466 page+0x66 default=0x8000
+  - selector 0x0C0 map_word=0x4468 -> H'F468 page+0x68 default=0x8000
+  - selector 0x0C1 map_word=0xC46A -> H'F46A page+0x6A default=0x8000
+  - selector 0x0C3 map_word=0xE46C -> H'F46C page+0x6C default=0x4000
+  - selector 0x0C4 map_word=0x446E -> H'F46E page+0x6E default=0x8000
+  - selector 0x0C5 map_word=0xC070 -> H'F470 page+0x70 default=0x8000
+  - selector 0x0C6 map_word=0x4472 -> H'F472 page+0x72 default=0x8000
+  - selector 0x0C7 map_word=0xC474 -> H'F474 page+0x74 default=0x8000
+  - selector 0x0C8 map_word=0xC476 -> H'F476 page+0x76 default=0x0000
+  - selector 0x0C9 map_word=0xC478 -> H'F478 page+0x78 default=0x0000
+  - selector 0x0CA map_word=0xC47A -> H'F47A page+0x7A default=0x0000
+  - selector 0x0CB map_word=0xC47C -> H'F47C page+0x7C default=0x0000
+  - selector 0x0CC map_word=0xC47E -> H'F47E page+0x7E default=0x0000
+  - selector 0x0CD map_word=0xC480 -> H'F480 page+0x80 default=0x0000
+  - selector 0x0D4 map_word=0xC482 -> H'F482 page+0x82 default=0x8000
+  - selector 0x0D5 map_word=0xC484 -> H'F484 page+0x84 default=0x8000
+  - selector 0x0D6 map_word=0xC086 -> H'F486 page+0x86 default=0x8000
+  - selector 0x0D7 map_word=0xC088 -> H'F488 page+0x88 default=0x8000
+  - selector 0x0D8 map_word=0x408A -> H'F48A page+0x8A default=0x8000
+  - selector 0x0D9 map_word=0x408C -> H'F48C page+0x8C default=0x8000
+  - selector 0x0DA map_word=0x408E -> H'F48E page+0x8E default=0x8000
+  - selector 0x0F6 map_word=0x4090 -> H'F490 page+0x90 default=0x8000
+  - selector 0x0F9 map_word=0x4492 -> H'F492 page+0x92 default=0x8000
+  - selector 0x0FA map_word=0x4494 -> H'F494 page+0x94 default=0x8000
+  - selector 0x0FB map_word=0x4496 -> H'F496 page+0x96 default=0x8000
+  - selector 0x0FC map_word=0x4498 -> H'F498 page+0x98 default=0x8000
+  - selector 0x0FD map_word=0x409A -> H'F49A page+0x9A default=0x8000
+  - selector 0x0FE map_word=0x449C -> H'F49C page+0x9C default=0x8000
+  - selector 0x0FF map_word=0x449E -> H'F49E page+0x9E default=0x8000
+  - selector 0x100 map_word=0x44A0 -> H'F4A0 page+0xA0 default=0x8000
+  - selector 0x101 map_word=0x44A2 -> H'F4A2 page+0xA2 default=0x8000
+  - selector 0x10F map_word=0xC4A4 -> H'F4A4 page+0xA4 default=0x8000
+  - selector 0x110 map_word=0x48A6 -> H'F4A6 page+0xA6 default=0x0000
+  - ... 9 more mapped selectors omitted
+
+State Byte Hints:
+- H'F402 factory_signature_word: factory 0x6B6F; boot accepts persisted state only when this word is H'6B6F (xrefs=1)
+- H'F404 feature_or_option_flags_candidate: factory 0xFE00; bits 1-4 are tested with F791 gates in display/status routines (xrefs=8)
+- H'F730 connect_display_state_candidate: volatile/no factory word (xrefs=3)
+- H'F731 session_latch_candidate: volatile/no factory word (xrefs=22)
+- H'F732 display_dispatch_selector_candidate: volatile display dispatch selector feeding the 493E pointer table and 48FA report bridge (xrefs=11)
+- H'F76E eeprom_page_and_persist_flags: bit7 enables command-4 EEPROM persistence, bit6 suppresses 48FA dispatch, low nibble selects EEPROM page (xrefs=4)
+- H'F790 connection_latch_shadow_candidate: volatile/no factory word (xrefs=1)
+- H'F791 feature_flag_gate_candidate: volatile gate tested alongside F404 option bits before setting report/display flags (xrefs=12)
+- H'FB03 report_bridge_suppress_candidate: volatile/no factory word (xrefs=10)
+
+Bench Implications:
+- A live EEPROM dump should first compare F400-F4FF shadow-equivalent offsets against the ROM factory table, especially F402/F404 and mapped offsets.
+- Pages 0x0-0xF offset 0x00-0x07 are loaded into F7B0-F82F; page 0 carries the signature/options header and pages 1-F default to spaces, so non-space bytes there are high-value identity/config data.
+- Serial command 0/4 can mirror values into F400 offsets selected by the ROM mapping table, but command 4 only persists when the continuation path reaches BD2B and F76E.7 is set.
+- F76E is not just a page byte: bit7 gates EEPROM persistence, bit6 suppresses the 48FA dispatch path, and only its low nibble survives into the EEPROM page address.
+- CONNECT OK is still likely gated by volatile table/session state as well as EEPROM-backed defaults; EEPROM differences may explain why bench and emulator diverge, but are unlikely to be the whole protocol by themselves.
+
+Caveats:
+- The selector map proves where firmware mirrors/persists serial values, not what every field means to the panel UI.
+- High bytes in the C564 selector map look structured, but the observed command-0/command-4 paths only use the low byte for F400/EEPROM offsets.
+- Indexed F7B0-F82F record consumers can be missed by a static xref pass; dynamic emulator traces should be used once interesting record bytes are found.

build/rom_f109_handlers.asm

@@ -0,0 +1,433 @@
+; H8/536 ROM disassembly
+; input: ROM\M27C512@DIP28_1.BIN
+; bytes: 65536
+; vector mode: min
+; analysis: recursive trace from vectors
+;
+; Notes from the manual:
+; - H8/536 uses the H8/500 CPU instruction set.
+; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
+; - The register field is H'FE80-H'FFFF; names below come from appendix B.
+; - @aa:8 short absolute operands use BR as the upper address byte.
+; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
+; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
+; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
+; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
+
+; Memory Map
+; H'0000-H'009F exception_vectors  vectors
+; H'00A0-H'00FF dtc_vectors        dtc_vectors
+; H'0100-H'F67F program_or_external program
+; H'F680-H'FE7F on_chip_ram        ram
+; H'FE80-H'FFFF register_field     registers
+
+; Vectors
+; H'0000 reset                    -> vec_reset_1000 (H'1000)
+; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
+; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
+; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
+; H'0010 address_error            -> vec_reset_1000 (H'1000)
+; H'0012 trace                    -> vec_reset_1000 (H'1000)
+; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
+; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
+; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
+; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
+; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
+; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
+; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
+; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
+; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
+; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
+; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
+; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
+; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
+; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
+; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
+; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
+; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
+; H'0040 irq0                     -> vec_reset_1000 (H'1000)
+; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
+; H'0048 irq1                     -> vec_reset_1000 (H'1000)
+; H'0050 irq2                     -> vec_reset_1000 (H'1000)
+; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
+; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
+; H'005A irq5                     -> vec_reset_1000 (H'1000)
+; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
+; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
+; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
+; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
+; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
+; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)
+
+; Symbols
+; mem_E106         H'E106 program_or_external memory   r=5 w=2 width=word
+; mem_E110         H'E110 program_or_external memory   r=7 w=0 width=word
+; mem_E11E         H'E11E program_or_external memory   r=4 w=0 width=word
+; mem_E506         H'E506 program_or_external memory   r=2 w=0 width=word
+; mem_E906         H'E906 program_or_external memory   r=0 w=4 width=word
+; mem_E91E         H'E91E program_or_external memory   r=0 w=2 width=word
+; mem_E922         H'E922 program_or_external memory   r=0 w=1 width=word
+; mem_F404         H'F404 program_or_external memory   r=11 w=0 width=byte
+; ram_F6D0         H'F6D0 on_chip_ram        ram      r=13 w=0 width=byte
+; ram_F6F4         H'F6F4 on_chip_ram        ram      r=0 w=2 width=word
+; ram_F6F6         H'F6F6 on_chip_ram        ram      r=0 w=4 width=byte
+; ram_F730         H'F730 on_chip_ram        ram      r=4 w=0 width=byte
+; ram_F731         H'F731 on_chip_ram        ram      r=7 w=0 width=byte
+; ram_F791         H'F791 on_chip_ram        ram      r=11 w=0 width=byte
+
+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
+; LCD/Text Scan
+; search 'CONNECT': not literal, hits=0
+; LCD text candidates
+; ... 1 more LCD text candidates
+
+2390: 15 F6 D0 F1    BTST.B #1, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+2394: 37 00 70       BEQ loc_2407 ; cycles=3/7 nt/t
+2397: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
+239C: 32 00 68       BHI loc_2407 ; cycles=3/7 nt/t
+239F: 1D E1 10 FF    BTST.W #15, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
+23A3: 27 05          BEQ loc_23AA ; cycles=3/8 nt/t
+23A5: 1E 03 40       BSR loc_26E8 ; cycles=14
+23A8: 20 5D          BRA loc_2407 ; cycles=7
+
+loc_23AA:
+23AA: 15 F6 D0 F2    BTST.B #2, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+23AE: 36 00 CF       BNE loc_2480 ; cycles=3/7 nt/t
+23B1: 15 F7 30 F7    BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=6
+23B5: 27 35          BEQ loc_23EC ; cycles=3/8 nt/t
+23B7: 1D E1 06 80    MOV:G.W @H'E106, R0 ; refs mem_E106 in program_or_external; cycles=6
+
+loc_23BB:
+23BB: A8 1B          SHLR.W R0 ; cycles=3
+
+loc_23BD:
+23BD: A8 81          MOV:G.W R0, R1 ; cycles=3
+23BF: 27 26          BEQ loc_23E7 ; cycles=3/8 nt/t
+23C1: 1D E5 06 51    AND.W @H'E506, R1 ; refs mem_E506 in program_or_external; cycles=6
+23C5: 0C FF C4 51    AND.W #H'FFC4, R1 ; cycles=4
+23C9: 27 F0          BEQ loc_23BB ; cycles=3/8 nt/t
+23CB: 1D E9 06 91    MOV:G.W R1, @H'E906 ; refs mem_E906 in program_or_external; cycles=6
+23CF: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+23D1: 5B 00 83       MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
+23D4: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+23D8: 27 08          BEQ loc_23E2 ; cycles=3/7 nt/t
+23DA: 15 F4 04 F5    BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+23DE: 27 02          BEQ loc_23E2 ; cycles=3/7 nt/t
+23E0: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_23E2:
+23E2: 1E 1A 6F       BSR loc_3E54 ; cycles=13
+23E5: 20 20          BRA loc_2407 ; cycles=8
+
+loc_23E7:
+23E7: 58 00 04       MOV:I.W #H'0004, R0 ; dataflow R0=H'0004; cycles=3
+23EA: 20 48          BRA loc_2434 ; cycles=7
+
+loc_23EC:
+23EC: 1D E1 06 D0    BCLR.W #0, @H'E106 ; refs mem_E106 in program_or_external; cycles=9
+23F0: 5C 00 00       MOV:I.W #H'0000, R4 ; dataflow R4=H'0000; cycles=3
+23F3: 5B 00 83       MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
+23F6: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+23FA: 27 08          BEQ loc_2404 ; cycles=3/7 nt/t
+23FC: 15 F4 04 F5    BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+2400: 27 02          BEQ loc_2404 ; cycles=3/7 nt/t
+2402: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_2404:
+2404: 1E F6 2E       BSR loc_1A35 ; cycles=13
+
+loc_2407:
+2407: 19             RTS ; cycles=13
+2408: 15 F6 D0 F2    BTST.B #2, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+240C: 37 00 70       BEQ loc_247F ; cycles=3/7 nt/t
+240F: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
+2414: 32 00 68       BHI loc_247F ; cycles=3/7 nt/t
+2417: 1D E1 10 FF    BTST.W #15, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
+241B: 27 05          BEQ loc_2422 ; cycles=3/8 nt/t
+241D: 1E 02 C8       BSR loc_26E8 ; cycles=14
+2420: 20 5D          BRA loc_247F ; cycles=7
+
+loc_2422:
+2422: 15 F6 D0 F1    BTST.B #1, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+2426: 26 58          BNE loc_2480 ; cycles=3/7 nt/t
+2428: 15 F7 30 F7    BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=7
+242C: 27 36          BEQ loc_2464 ; cycles=3/7 nt/t
+242E: 1D E1 06 80    MOV:G.W @H'E106, R0 ; refs mem_E106 in program_or_external; cycles=7
+
+loc_2432:
+2432: A8 1A          SHLL.W R0 ; cycles=3
+
+loc_2434:
+2434: A8 81          MOV:G.W R0, R1 ; cycles=3
+2436: 27 26          BEQ loc_245E ; cycles=3/7 nt/t
+2438: 1D E5 06 51    AND.W @H'E506, R1 ; refs mem_E506 in program_or_external; cycles=7
+243C: 0C FF C4 51    AND.W #H'FFC4, R1 ; cycles=4
+2440: 27 F0          BEQ loc_2432 ; cycles=3/7 nt/t
+2442: 1D E9 06 91    MOV:G.W R1, @H'E906 ; refs mem_E906 in program_or_external; cycles=7
+2446: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+2448: 5B 00 83       MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
+244B: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=6
+244F: 27 08          BEQ loc_2459 ; cycles=3/8 nt/t
+2451: 15 F4 04 F5    BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=6
+2455: 27 02          BEQ loc_2459 ; cycles=3/8 nt/t
+2457: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_2459:
+2459: 1E 19 F8       BSR loc_3E54 ; cycles=14
+245C: 20 21          BRA loc_247F ; cycles=7
+
+loc_245E:
+245E: 58 80 00       MOV:I.W #H'8000, R0 ; dataflow R0=H'8000; cycles=3
+2461: 30 FF 59       BRA loc_23BD ; cycles=8
+
+loc_2464:
+2464: 1D E1 06 D0    BCLR.W #0, @H'E106 ; refs mem_E106 in program_or_external; cycles=9
+2468: 5C 00 01       MOV:I.W #H'0001, R4 ; dataflow R4=H'0001; cycles=3
+246B: 5B 00 83       MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
+246E: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+2472: 27 08          BEQ loc_247C ; cycles=3/7 nt/t
+2474: 15 F4 04 F5    BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+2478: 27 02          BEQ loc_247C ; cycles=3/7 nt/t
+247A: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_247C:
+247C: 1E F5 B6       BSR loc_1A35 ; cycles=13
+
+loc_247F:
+247F: 19             RTS ; cycles=13
+
+loc_2480:
+2480: 15 F7 30 F7    BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=7
+2484: 27 05          BEQ loc_248B ; cycles=3/7 nt/t
+2486: 58 40 00       MOV:I.W #H'4000, R0 ; dataflow R0=H'4000; cycles=3
+2489: 20 03          BRA loc_248E ; cycles=8
+
+loc_248B:
+248B: 58 00 20       MOV:I.W #H'0020, R0 ; dataflow R0=H'0020; cycles=3
+
+loc_248E:
+248E: 1D E9 06 90    MOV:G.W R0, @H'E906 ; refs mem_E906 in program_or_external; cycles=7
+2492: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+2494: 5B 00 83       MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
+2497: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=6
+249B: 27 08          BEQ loc_24A5 ; cycles=3/8 nt/t
+249D: 15 F4 04 F5    BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=6
+24A1: 27 02          BEQ loc_24A5 ; cycles=3/8 nt/t
+24A3: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_24A5:
+24A5: 1E 19 AC       BSR loc_3E54 ; cycles=14
+24A8: 19             RTS ; cycles=12
+24A9: 15 F6 D0 F3    BTST.B #3, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
+24AD: 27 38          BEQ loc_24E7 ; cycles=3/8 nt/t
+24AF: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
+24B4: 22 31          BHI loc_24E7 ; cycles=3/7 nt/t
+24B6: 1D E1 10 FF    BTST.W #15, @H'E110 ; refs mem_E110 in program_or_external; cycles=7
+24BA: 27 05          BEQ loc_24C1 ; cycles=3/7 nt/t
+24BC: 1E 02 29       BSR loc_26E8 ; cycles=13
+24BF: 20 26          BRA loc_24E7 ; cycles=8
+
+loc_24C1:
+24C1: 15 F7 30 F7    BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=6
+24C5: 27 20          BEQ loc_24E7 ; cycles=3/8 nt/t
+24C7: 1D E1 06 80    MOV:G.W @H'E106, R0 ; refs mem_E106 in program_or_external; cycles=6
+24CB: A8 E0          BNOT.W #0, R0 ; cycles=3
+24CD: 1D E9 06 90    MOV:G.W R0, @H'E906 ; refs mem_E906 in program_or_external; cycles=6
+24D1: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+24D3: 5B 00 83       MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
+24D6: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+24DA: 27 08          BEQ loc_24E4 ; cycles=3/7 nt/t
+24DC: 15 F4 04 F5    BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+24E0: 27 02          BEQ loc_24E4 ; cycles=3/7 nt/t
+24E2: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_24E4:
+24E4: 1E 19 6D       BSR loc_3E54 ; cycles=13
+
+loc_24E7:
+24E7: 19             RTS ; cycles=13
+24E8: 15 F6 D0 F7    BTST.B #7, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+24EC: 27 3F          BEQ loc_252D ; cycles=3/7 nt/t
+24EE: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=7
+24F3: 22 38          BHI loc_252D ; cycles=3/8 nt/t
+24F5: 1D E1 10 FE    BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
+24F9: 27 05          BEQ loc_2500 ; cycles=3/8 nt/t
+24FB: 1E 01 EA       BSR loc_26E8 ; cycles=14
+24FE: 20 2D          BRA loc_252D ; cycles=7
+
+loc_2500:
+2500: 15 F6 F6 13    CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
+2504: 1D E1 1E 80    MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=7
+2508: A8 FF          BTST.W #15, R0 ; cycles=3
+250A: 26 05          BNE loc_2511 ; cycles=3/7 nt/t
+250C: 58 80 00       MOV:I.W #H'8000, R0 ; dataflow R0=H'8000; cycles=3
+250F: 20 02          BRA loc_2513 ; cycles=8
+
+loc_2511:
+2511: A8 13          CLR.W R0 ; dataflow R0=H'0000; cycles=3
+
+loc_2513:
+2513: 1D E9 1E 90    MOV:G.W R0, @H'E91E ; refs mem_E91E in program_or_external; cycles=6
+2517: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+2519: 5B 00 8F       MOV:I.W #H'008F, R3 ; dataflow R3=H'008F; cycles=3
+251C: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+2520: 27 08          BEQ loc_252A ; cycles=3/7 nt/t
+2522: 15 F4 04 F4    BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+2526: 27 02          BEQ loc_252A ; cycles=3/7 nt/t
+2528: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_252A:
+252A: 1E 19 27       BSR loc_3E54 ; cycles=13
+
+loc_252D:
+252D: 19             RTS ; cycles=13
+252E: 15 F6 D0 F6    BTST.B #6, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+2532: 27 3F          BEQ loc_2573 ; cycles=3/7 nt/t
+2534: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=7
+2539: 22 38          BHI loc_2573 ; cycles=3/8 nt/t
+253B: 1D E1 10 FE    BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
+253F: 27 05          BEQ loc_2546 ; cycles=3/8 nt/t
+2541: 1E 01 A4       BSR loc_26E8 ; cycles=14
+2544: 20 2D          BRA loc_2573 ; cycles=7
+
+loc_2546:
+2546: 15 F6 F6 13    CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
+254A: 1D E1 1E 80    MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=7
+254E: A8 FD          BTST.W #13, R0 ; cycles=3
+2550: 26 05          BNE loc_2557 ; cycles=3/7 nt/t
+2552: 58 20 00       MOV:I.W #H'2000, R0 ; dataflow R0=H'2000; cycles=3
+2555: 20 02          BRA loc_2559 ; cycles=8
+
+loc_2557:
+2557: A8 13          CLR.W R0 ; dataflow R0=H'0000; cycles=3
+
+loc_2559:
+2559: 1D E9 1E 90    MOV:G.W R0, @H'E91E ; refs mem_E91E in program_or_external; cycles=6
+255D: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+255F: 5B 00 8F       MOV:I.W #H'008F, R3 ; dataflow R3=H'008F; cycles=3
+2562: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+2566: 27 08          BEQ loc_2570 ; cycles=3/7 nt/t
+2568: 15 F4 04 F4    BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+256C: 27 02          BEQ loc_2570 ; cycles=3/7 nt/t
+256E: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_2570:
+2570: 1E 18 E1       BSR loc_3E54 ; cycles=13
+
+loc_2573:
+2573: 19             RTS ; cycles=13
+2574: 15 F6 D0 F4    BTST.B #4, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+2578: 37 01 45       BEQ loc_26C0 ; cycles=3/7 nt/t
+257B: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
+2580: 22 51          BHI loc_25D3 ; cycles=3/7 nt/t
+2582: 1D E1 10 FE    BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=7
+2586: 27 05          BEQ loc_258D ; cycles=3/7 nt/t
+2588: 1E 01 5D       BSR loc_26E8 ; cycles=13
+258B: 20 46          BRA loc_25D3 ; cycles=8
+
+loc_258D:
+258D: 1D E1 1E 80    MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=6
+2591: A8 FF          BTST.W #15, R0 ; cycles=3
+2593: 26 06          BNE loc_259B ; cycles=3/8 nt/t
+2595: A8 FD          BTST.W #13, R0 ; cycles=3
+2597: 26 26          BNE loc_25BF ; cycles=3/8 nt/t
+2599: 20 38          BRA loc_25D3 ; cycles=8
+
+loc_259B:
+259B: 15 F6 D0 F5    BTST.B #5, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
+259F: 27 05          BEQ loc_25A6 ; cycles=3/8 nt/t
+25A1: 1E 00 8F       BSR loc_2633 ; cycles=14
+25A4: 20 2D          BRA loc_25D3 ; cycles=7
+
+loc_25A6:
+25A6: 5C 00 00       MOV:I.W #H'0000, R4 ; dataflow R4=H'0000; cycles=3
+25A9: 5B 00 91       MOV:I.W #H'0091, R3 ; dataflow R3=H'0091; cycles=3
+25AC: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+25B0: 27 08          BEQ loc_25BA ; cycles=3/7 nt/t
+25B2: 15 F4 04 F4    BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+25B6: 27 02          BEQ loc_25BA ; cycles=3/7 nt/t
+25B8: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_25BA:
+25BA: 1E F4 78       BSR loc_1A35 ; cycles=13
+25BD: 20 14          BRA loc_25D3 ; cycles=8
+
+loc_25BF:
+25BF: 15 F6 D0 F5    BTST.B #5, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
+25C3: 27 05          BEQ loc_25CA ; cycles=3/8 nt/t
+25C5: 1E 00 FF       BSR loc_26C7 ; cycles=14
+25C8: 20 09          BRA loc_25D3 ; cycles=7
+
+loc_25CA:
+25CA: 15 F6 F6 06 C0 MOV:G.B #H'C0, @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
+25CF: 1D F6 F4 13    CLR.W @H'F6F4 ; refs ram_F6F4 in on_chip_ram; cycles=8
+
+loc_25D3:
+25D3: 19             RTS ; cycles=13
+25D4: 15 F6 D0 F5    BTST.B #5, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+25D8: 37 00 E5       BEQ loc_26C0 ; cycles=3/7 nt/t
+25DB: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
+25E0: 22 50          BHI loc_2632 ; cycles=3/7 nt/t
+25E2: 1D E1 10 FE    BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=7
+25E6: 27 05          BEQ loc_25ED ; cycles=3/7 nt/t
+25E8: 1E 00 FD       BSR loc_26E8 ; cycles=13
+25EB: 20 45          BRA loc_2632 ; cycles=8
+
+loc_25ED:
+25ED: 1D E1 1E 80    MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=6
+25F1: A8 FF          BTST.W #15, R0 ; cycles=3
+25F3: 26 06          BNE loc_25FB ; cycles=3/8 nt/t
+25F5: A8 FD          BTST.W #13, R0 ; cycles=3
+25F7: 26 25          BNE loc_261E ; cycles=3/8 nt/t
+25F9: 20 37          BRA loc_2632 ; cycles=8
+
+loc_25FB:
+25FB: 15 F6 D0 F4    BTST.B #4, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
+25FF: 27 04          BEQ loc_2605 ; cycles=3/8 nt/t
+2601: 0E 30          BSR loc_2633 ; cycles=14
+2603: 20 2D          BRA loc_2632 ; cycles=8
+
+loc_2605:
+2605: 5C 00 01       MOV:I.W #H'0001, R4 ; dataflow R4=H'0001; cycles=3
+2608: 5B 00 91       MOV:I.W #H'0091, R3 ; dataflow R3=H'0091; cycles=3
+260B: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=6
+260F: 27 08          BEQ loc_2619 ; cycles=3/8 nt/t
+2611: 15 F4 04 F4    BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=6
+2615: 27 02          BEQ loc_2619 ; cycles=3/8 nt/t
+2617: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_2619:
+2619: 1E F4 19       BSR loc_1A35 ; cycles=14
+261C: 20 14          BRA loc_2632 ; cycles=7
+
+loc_261E:
+261E: 15 F6 D0 F4    BTST.B #4, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
+2622: 27 05          BEQ loc_2629 ; cycles=3/7 nt/t
+2624: 1E 00 A0       BSR loc_26C7 ; cycles=13
+2627: 20 09          BRA loc_2632 ; cycles=8
+
+loc_2629:
+2629: 15 F6 F6 06 80 MOV:G.B #H'80, @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
+262E: 1D F6 F4 13    CLR.W @H'F6F4 ; refs ram_F6F4 in on_chip_ram; cycles=9
+
+loc_2632:
+2632: 19             RTS ; cycles=12
+
+loc_2633:
+2633: 1D E9 22 07 80 00 MOV:G.W #H'8000, @H'E922 ; refs mem_E922 in program_or_external; cycles=9
+2639: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+263B: 5B 00 91       MOV:I.W #H'0091, R3 ; dataflow R3=H'0091; cycles=3
+263E: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+2642: 27 08          BEQ loc_264C ; cycles=3/7 nt/t
+2644: 15 F4 04 F4    BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+2648: 27 02          BEQ loc_264C ; cycles=3/7 nt/t
+264A: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_264C:
+264C: 1E 18 05       BSR loc_3E54 ; cycles=13
+264F: 19             RTS ; cycles=13

build/rom_f109_tail.asm

@@ -0,0 +1,107 @@
+; H8/536 ROM disassembly
+; input: ROM\M27C512@DIP28_1.BIN
+; bytes: 65536
+; vector mode: min
+; analysis: recursive trace from vectors
+;
+; Notes from the manual:
+; - H8/536 uses the H8/500 CPU instruction set.
+; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
+; - The register field is H'FE80-H'FFFF; names below come from appendix B.
+; - @aa:8 short absolute operands use BR as the upper address byte.
+; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
+; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
+; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
+; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
+
+; Memory Map
+; H'0000-H'009F exception_vectors  vectors
+; H'00A0-H'00FF dtc_vectors        dtc_vectors
+; H'0100-H'F67F program_or_external program
+; H'F680-H'FE7F on_chip_ram        ram
+; H'FE80-H'FFFF register_field     registers
+
+; Vectors
+; H'0000 reset                    -> vec_reset_1000 (H'1000)
+; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
+; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
+; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
+; H'0010 address_error            -> vec_reset_1000 (H'1000)
+; H'0012 trace                    -> vec_reset_1000 (H'1000)
+; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
+; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
+; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
+; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
+; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
+; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
+; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
+; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
+; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
+; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
+; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
+; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
+; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
+; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
+; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
+; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
+; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
+; H'0040 irq0                     -> vec_reset_1000 (H'1000)
+; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
+; H'0048 irq1                     -> vec_reset_1000 (H'1000)
+; H'0050 irq2                     -> vec_reset_1000 (H'1000)
+; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
+; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
+; H'005A irq5                     -> vec_reset_1000 (H'1000)
+; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
+; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
+; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
+; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
+; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
+; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)
+
+; Symbols
+; mem_E924         H'E924 program_or_external memory   r=0 w=1 width=word
+; mem_F404         H'F404 program_or_external memory   r=1 w=0 width=byte
+; ram_F6F6         H'F6F6 on_chip_ram        ram      r=0 w=2 width=byte
+; ram_F732         H'F732 on_chip_ram        ram      r=1 w=1 width=word
+; ram_F734         H'F734 on_chip_ram        ram      r=0 w=1 width=word
+; ram_F791         H'F791 on_chip_ram        ram      r=1 w=0 width=byte
+; ram_FB02         H'FB02 on_chip_ram        ram      r=0 w=1 width=byte
+; ram_FB03         H'FB03 on_chip_ram        ram      r=1 w=1 width=byte
+
+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
+; LCD/Text Scan
+; search 'CONNECT': not literal, hits=0
+; LCD text candidates
+; ... 1 more LCD text candidates
+
+26C0: 15 F6 F6 13    CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
+26C4: 30 FF 0C       BRA loc_25D3 ; cycles=7
+26C7: 15 F6 F6 13    CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=8
+26CB: 1D E9 24 07 FF 80 MOV:G.W #H'FF80, @H'E924 ; refs mem_E924 in program_or_external; cycles=9
+26D1: 52 80          MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
+26D3: 5B 00 92       MOV:I.W #H'0092, R3 ; dataflow R3=H'0092; cycles=3
+26D6: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
+26DA: 27 08          BEQ loc_26E4 ; cycles=3/7 nt/t
+26DC: 15 F4 04 F4    BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
+26E0: 27 02          BEQ loc_26E4 ; cycles=3/7 nt/t
+26E2: AB CE          BSET.W #14, R3 ; cycles=3
+
+loc_26E4:
+26E4: 1E 17 6D       BSR loc_3E54 ; cycles=13
+26E7: 19             RTS ; cycles=13
+26E8: 15 FB 03 C7    BSET.B #7, @H'FB03 ; refs ram_FB03 in on_chip_ram; cycles=9
+26EC: 26 08          BNE loc_26F6 ; cycles=3/7 nt/t
+26EE: 1D F7 32 81    MOV:G.W @H'F732, R1 ; refs ram_F732 in on_chip_ram; cycles=7
+26F2: 1D F7 34 91    MOV:G.W R1, @H'F734 ; refs ram_F734 in on_chip_ram; cycles=7
+
+loc_26F6:
+26F6: 1D F7 32 07 1C 01 MOV:G.W #H'1C01, @H'F732 ; refs ram_F732 in on_chip_ram; cycles=11
+26FC: 15 FB 02 06 14 MOV:G.B #H'14, @H'FB02 ; refs ram_FB02 in on_chip_ram; cycles=9
+2701: 1E 21 F6       BSR loc_48FA ; cycles=14
+2704: 19             RTS ; cycles=12

build/rom_pseudocode.c

@@ -22,6 +22,8 @@ u16 SR;
 u8 CCR, BR, EP, DP, TP;
 int C, Z, N, V;
 
+static inline u16 zero_extend8_to16(u8 value) { return (u16)value; }
+
 /* H8/536 register field symbols used by this ROM. */
 extern volatile u8 P1DDR; /* 0xFE80 */
 extern volatile u8 P1DR; /* 0xFE82 */
@@ -468,11 +470,11 @@ void vec_reset_1000(void)
     SYSCR2 = (uint8_t)(0x84); /* 1034; MOV:G.B #H'84, @SYSCR2; SYSCR2 = H'84 (IRQ5E=0 IRQ4E=0 IRQ3E=0 IRQ2E=0 P6PWME=1 P9PWME=0 P9SCI2E=0; enabled P6 PWM); SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; refs SYSCR2; cycles=9 */
     FRT1_TCR = (uint8_t)(0x02); /* 1039; MOV:G.B #H'02, @FRT1_TCR; FRT1_TCR = H'02 (ICIE=0 OCIEB=0 OCIEA=0 OVIE=0 OEB=0 OEA=0 CKS1=1 CKS0=0); refs FRT1_TCR; cycles=9 */
     FRT1_TCSR = (uint8_t)(0x01); /* 103E; MOV:G.B #H'01, @FRT1_TCSR; FRT1_TCSR = H'01 (ICF=0 OCFB=0 OCFA=0 OVF=0 OLVLB=0 OLVLA=0 IEDG=0 CCLRA=1); refs FRT1_TCSR; cycles=9 */
-    FRT1_FRC_H = (uint16_t)(0x00); /* 1043; MOV:G.W #H'00, @FRT1_FRC_H; FRT1_FRC_H = H'00; refs FRT1_FRC_H; FRT1_FRC W write high TEMP access; cycles=9 */
+    FRT1_FRC_H = zero_extend8_to16(0x00); /* 1043; MOV:G.W #H'00, @FRT1_FRC_H; FRT1_FRC_H = H'00; byte immediate zero-extended into word destination; refs FRT1_FRC_H; FRT1_FRC W write high TEMP access; cycles=9 */
     FRT1_OCRA_H = (uint16_t)(0x009C); /* 1048; MOV:G.W #H'009C, @FRT1_OCRA_H; FRT1_OCRA_H = H'9C; refs FRT1_OCRA_H; FRT1_OCRA W write high TEMP access; cycles=11 */
     FRT2_TCR = (uint8_t)(0x02); /* 104E; MOV:G.B #H'02, @FRT2_TCR; FRT2_TCR = H'02 (ICIE=0 OCIEB=0 OCIEA=0 OVIE=0 OEB=0 OEA=0 CKS1=1 CKS0=0); refs FRT2_TCR; cycles=9 */
     FRT2_TCSR = (uint8_t)(0x01); /* 1053; MOV:G.B #H'01, @FRT2_TCSR; FRT2_TCSR = H'01 (ICF=0 OCFB=0 OCFA=0 OVF=0 OLVLB=0 OLVLA=0 IEDG=0 CCLRA=1); refs FRT2_TCSR; cycles=9 */
-    FRT2_FRC_H = (uint16_t)(0x00); /* 1058; MOV:G.W #H'00, @FRT2_FRC_H; FRT2_FRC_H = H'00; refs FRT2_FRC_H; FRT2_FRC W write high TEMP access; cycles=11 */
+    FRT2_FRC_H = zero_extend8_to16(0x00); /* 1058; MOV:G.W #H'00, @FRT2_FRC_H; FRT2_FRC_H = H'00; byte immediate zero-extended into word destination; refs FRT2_FRC_H; FRT2_FRC W write high TEMP access; cycles=11 */
     FRT2_OCRA_H = (uint16_t)(0x7A12); /* 105D; MOV:G.W #H'7A12, @FRT2_OCRA_H; FRT2_OCRA_H = H'7A12; refs FRT2_OCRA_H; FRT2_OCRA W write high TEMP access; cycles=9 */
     FRT3_TCR = (uint8_t)(0x00); /* 1063; MOV:G.B #H'00, @FRT3_TCR; FRT3_TCR = H'00 (ICIE=0 OCIEB=0 OCIEA=0 OVIE=0 OEB=0 OEA=0 CKS1=0 CKS0=0); refs FRT3_TCR; cycles=9 */
     FRT3_TCSR = (uint8_t)(0x00); /* 1068; MOV:G.B #H'00, @FRT3_TCSR; FRT3_TCSR = H'00 (ICF=0 OCFB=0 OCFA=0 OVF=0 OLVLB=0 OLVLA=0 IEDG=0 CCLRA=0); refs FRT3_TCSR; cycles=9 */
@@ -485,10 +487,10 @@ void vec_reset_1000(void)
     PWM3_TCR = (uint8_t)(0x3B); /* 108B; MOV:G.B #H'3B, @PWM3_TCR; PWM3_TCR = H'3B (OE=0 OS=0 CKS2=0 CKS1=1 CKS0=1); refs PWM3_TCR; cycles=9 */
     PWM3_DTR = (uint8_t)(0x7D); /* 1090; MOV:G.B #H'7D, @PWM3_DTR; PWM3_DTR = H'7D; refs PWM3_DTR; cycles=9 */
     SCI1_SMR = (uint8_t)(0x24); /* 1095; MOV:G.B #H'24, @SCI1_SMR; SCI1_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI1 SMR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); refs SCI1_SMR; cycles=9 */
-    SCI1_SCR = (uint8_t)(0x3C); /* 109A; MOV:G.B #H'3C, @SCI1_SCR; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); disable SCI1 TX interrupt (TIE); disable SCI1 receive and receive-error interrupts (RIE); enable SCI1 transmitter (TE); enable SCI1 receiver (RE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
+    SCI1_SCR = (uint8_t)(0x3C); /* 109A; MOV:G.B #H'3C, @SCI1_SCR; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); disable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; disable SCI1 receive and receive-error interrupts (RIE); enable SCI1 transmitter (TE); enable SCI1 receiver (RE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
     SCI1_BRR = (uint8_t)(0x07); /* 109F; MOV:G.B #H'07, @SCI1_BRR; SCI1_BRR = H'07; SCI1 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI1 BRR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); refs SCI1_BRR; cycles=9 */
     SCI2_SMR = (uint8_t)(0x24); /* 10A4; MOV:G.B #H'24, @SCI2_SMR; SCI2_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI2 SMR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_SMR; cycles=9 */
-    SCI2_SCR = (uint8_t)(0x0C); /* 10A9; MOV:G.B #H'0C, @SCI2_SCR; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); disable SCI2 TX interrupt (TIE); disable SCI2 receive and receive-error interrupts (RIE); disable SCI2 transmitter (TE); disable SCI2 receiver (RE); SCI2 SCR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_SCR; cycles=9 */
+    SCI2_SCR = (uint8_t)(0x0C); /* 10A9; MOV:G.B #H'0C, @SCI2_SCR; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); disable SCI2 TX interrupt (TIE); gates TXI when hardware sets TDRE; disable SCI2 receive and receive-error interrupts (RIE); disable SCI2 transmitter (TE); disable SCI2 receiver (RE); SCI2 SCR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_SCR; cycles=9 */
     SCI2_BRR = (uint8_t)(0x07); /* 10AE; MOV:G.B #H'07, @SCI2_BRR; SCI2_BRR = H'07; SCI2 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI2 BRR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_BRR; cycles=9 */
     ADCSR = (uint8_t)(0x19); /* 10B3; MOV:G.B #H'19, @ADCSR; ADCSR = H'19 (ADF=0 ADIE=0 ADST=0 SCAN=1 CKS=1 CH2=0 CH1=0 CH0=1; A/D halt, scan AN0-AN1, 138-state max, ADI disabled); refs ADCSR; cycles=9 */
     MEM8[0xFEE9] = (uint8_t)(0x7F); /* 10B8; MOV:G.B #H'7F, @H'FEE9; cycles=9 */
@@ -2836,26 +2838,26 @@ void loc_BA26(void)
     MEM8[0xF9C0] = (uint8_t)(0x64); /* BA2C; MOV:G.B #H'64, @H'F9C0; refs ram_F9C0; cycles=9 */
     MEM8[0xF9C4] = (uint8_t)(0x07); /* BA31; MOV:G.B #H'07, @H'F9C4; refs ram_F9C4; cycles=9 */
     R0 = (uint16_t)(MEM16[0xF850]); /* BA36; MOV:G.W @H'F850, R0; refs ram_F850; cycles=7 */
-    MEM16[0xF858] = (uint16_t)(R0); /* BA3A; MOV:G.W R0, @H'F858; refs ram_F858; cycles=7 */
+    MEM16[0xF858] = (uint16_t)(R0); /* BA3A; MOV:G.W R0, @H'F858; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F858; cycles=7 */
     R0 = (uint16_t)(MEM16[0xF852]); /* BA3E; MOV:G.W @H'F852, R0; refs ram_F852; cycles=7 */
-    MEM16[0xF85A] = (uint16_t)(R0); /* BA42; MOV:G.W R0, @H'F85A; refs ram_F85A; cycles=7 */
+    MEM16[0xF85A] = (uint16_t)(R0); /* BA42; MOV:G.W R0, @H'F85A; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85A; cycles=7 */
     R0 = (uint8_t)(MEM8[0xF854]); /* BA46; MOV:G.B @H'F854, R0; refs ram_F854; cycles=7 */
-    MEM8[0xF85C] = (uint8_t)(R0); /* BA4A; MOV:G.B R0, @H'F85C; refs ram_F85C; cycles=7 */
-    R0 = (uint8_t)(0x5A); /* BA4E; MOV:E.B #H'5A, R0; dataflow R0=0x5A; cycles=2 */
-    R0 ^= (uint8_t)(MEM8[0xF858]); /* BA50; XOR.B @H'F858, R0; refs ram_F858; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF859]); /* BA54; XOR.B @H'F859, R0; refs ram_F859; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF85A]); /* BA58; XOR.B @H'F85A, R0; refs ram_F85A; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF85B]); /* BA5C; XOR.B @H'F85B, R0; refs ram_F85B; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF85C]); /* BA60; XOR.B @H'F85C, R0; refs ram_F85C; cycles=7 */
-    MEM8[0xF85D] = (uint8_t)(R0); /* BA64; MOV:G.B R0, @H'F85D; refs ram_F85D; cycles=7 */
+    MEM8[0xF85C] = (uint8_t)(R0); /* BA4A; MOV:G.B R0, @H'F85C; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85C; cycles=7 */
+    R0 = (uint8_t)(0x5A); /* BA4E; MOV:E.B #H'5A, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX checksum starts from seed H'005A; confidence high; dataflow R0=0x5A; cycles=2 */
+    R0 ^= (uint8_t)(MEM8[0xF858]); /* BA50; XOR.B @H'F858, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F858; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF859]); /* BA54; XOR.B @H'F859, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F859; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF85A]); /* BA58; XOR.B @H'F85A, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85A; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF85B]); /* BA5C; XOR.B @H'F85B, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85B; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF85C]); /* BA60; XOR.B @H'F85C, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85C; cycles=7 */
+    MEM8[0xF85D] = (uint8_t)(R0); /* BA64; MOV:G.B R0, @H'F85D; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate checksum byte write targets H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: XOR chain appears to feed the H'F85D checksum byte; confidence high; refs ram_F85D; cycles=7 */
     do {
         set_flags_btst(SCI1_SSR, 7); /* BA68; BTST.B #7, @SCI1_SSR; wait for SCI1 transmit data register empty (TDRE=1); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=7 */
     } while (Z); /* BA6C; BEQ loc_BA68; repeat SCI1 transmit-empty wait while TDRE=0; cycles=3/7 nt/t */
-    R0 = (uint8_t)(MEM8[0xF858]); /* BA6E; MOV:G.B @H'F858, R0; refs ram_F858; cycles=7 */
-    SCI1_TDR = (uint8_t)(R0); /* BA72; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; refs SCI1_TDR; cycles=7 */
-    MEM8[0xF9C2] = (uint8_t)(0x01); /* BA76; MOV:G.B #H'01, @H'F9C2; refs ram_F9C2; cycles=9 */
-    SCI1_SSR &= ~BIT(7); /* BA7B; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
-    SCI1_SCR |= BIT(7); /* BA7F; BSET.B #7, @SCI1_SCR; set TIE (bit 7) of SCI1_SCR; enable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=8 */
+    R0 = (uint8_t)(MEM8[0xF858]); /* BA6E; MOV:G.B @H'F858, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: initial SCI1 TDR send is supported by a read from H'F858; confidence high; refs ram_F858; cycles=7 */
+    SCI1_TDR = (uint8_t)(R0); /* BA72; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: initial SCI1 TDR send is supported by a read from H'F858; confidence high; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; refs SCI1_TDR; cycles=7 */
+    MEM8[0xF9C2] = (uint8_t)(0x01); /* BA76; MOV:G.B #H'01, @H'F9C2; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: write evidence supports TX index H'F9C2 being initialized to 1; confidence high; refs ram_F9C2; cycles=9 */
+    SCI1_SSR &= ~BIT(7); /* BA7B; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 TDRE after TDR write; TXI can fire again when hardware reasserts TDRE; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    SCI1_SCR |= BIT(7); /* BA7F; BSET.B #7, @SCI1_SCR; set TIE (bit 7) of SCI1_SCR; enable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=8 */
     return; /* BA83; RTS; cycles=13 */
 }
 
@@ -2870,21 +2872,21 @@ void vec_sci1_txi_BA84(void)
     if (Z) goto loc_BAA9; /* BA94; BEQ loc_BAA9; cycles=3/7 nt/t */
     MEM8[0xFAA2] &= ~BIT(3); /* BA96; BCLR.B #3, @H'FAA2; refs ram_FAA2; cycles=9 */
     MEM8[0xFAA3] = 0; /* BA9A; CLR.B @H'FAA3; refs ram_FAA3; cycles=9 */
-    SCI1_SCR &= ~BIT(7); /* BA9E; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
+    SCI1_SCR &= ~BIT(7); /* BA9E; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
     MEM8[0xF9C0] = (uint8_t)(0x1F); /* BAA2; MOV:G.B #H'1F, @H'F9C0; refs ram_F9C0; cycles=9 */
     goto loc_BAF1; /* BAA7; BRA loc_BAF1; cycles=8 */
 loc_BAA9:
     MEM16[--R7] = (uint16_t)(R0); /* BAA9; MOV:G.W R0, @-R7; cycles=5 */
-    R0 = (uint8_t)(MEM8[0xF9C2]); /* BAAB; MOV:G.B @H'F9C2, R0; refs ram_F9C2; cycles=6 */
+    R0 = (uint8_t)(MEM8[0xF9C2]); /* BAAB; MOV:G.B @H'F9C2, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR sends SCI1 TDR from indexed H'F858 buffer; confidence high; refs ram_F9C2; cycles=6 */
     R0 = zero_extend8(R0); /* BAAF; EXTU.B R0; cycles=3 */
-    R0 = (uint8_t)(MEM8[R0 - 0x07A8]); /* BAB1; MOV:G.B @(-H'07A8,R0), R0; cycles=6 */
-    SCI1_TDR = (uint8_t)(R0); /* BAB5; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; refs SCI1_TDR; cycles=6 */
+    R0 = (uint8_t)(MEM8[R0 - 0x07A8]); /* BAB1; MOV:G.B @(-H'07A8,R0), R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR sends SCI1 TDR from indexed H'F858 buffer; confidence high; cycles=6 */
+    SCI1_TDR = (uint8_t)(R0); /* BAB5; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR sends SCI1 TDR from indexed H'F858 buffer; confidence high; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; refs SCI1_TDR; cycles=6 */
     R0 = (uint16_t)(MEM16[R7++]); /* BAB9; MOV:G.W @R7+, R0; cycles=6 */
-    SCI1_SSR &= ~BIT(7); /* BABB; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
-    MEM8[0xF9C2] += (uint8_t)(1); /* BABF; ADD:Q.B #1, @H'F9C2; refs ram_F9C2; cycles=8 */
-    set_flags_cmp8(MEM8[0xF9C2], 0x06); /* BAC3; CMP:G.B #H'06, @H'F9C2; refs ram_F9C2; cycles=6 */
+    SCI1_SSR &= ~BIT(7); /* BABB; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 TDRE after TDR write; TXI can fire again when hardware reasserts TDRE; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    MEM8[0xF9C2] += (uint8_t)(1); /* BABF; ADD:Q.B #1, @H'F9C2; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR increments TX index H'F9C2; confidence high; refs ram_F9C2; cycles=8 */
+    set_flags_cmp8(MEM8[0xF9C2], 0x06); /* BAC3; CMP:G.B #H'06, @H'F9C2; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: candidate TX ISR compares TX index to frame length 6; confidence high; refs ram_F9C2; cycles=6 */
     if (!Z) goto loc_BAF1; /* BAC8; BNE loc_BAF1; cycles=3/7 nt/t */
-    SCI1_SCR &= ~BIT(7); /* BACA; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
+    SCI1_SCR &= ~BIT(7); /* BACA; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); gates TXI when hardware sets TDRE; SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
     set_flags_btst(MEM8[0xF795], 6); /* BACE; BTST.B #6, @H'F795; refs ram_F795; cycles=7 */
     if (!Z) goto loc_BAE8; /* BAD2; BNE loc_BAE8; cycles=3/7 nt/t */
     set_flags_btst(MEM8[0xF791], 7); /* BAD4; BTST.B #7, @H'F791; refs ram_F791; cycles=7 */
@@ -2944,18 +2946,18 @@ loc_BB56:
 void vec_sci1_eri_BB57(void)
 {
     /* vector sources: sci1_eri */
-    MEM8[0xFAA4] |= BIT(7); /* BB57; BSET.B #7, @H'FAA4; refs ram_FAA4; cycles=8 */
-    SCI1_SSR &= ~BIT(5); /* BB5B; BCLR.B #5, @SCI1_SSR; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
-    SCI1_SSR &= ~BIT(4); /* BB5F; BCLR.B #4, @SCI1_SSR; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
-    SCI1_SSR &= ~BIT(3); /* BB63; BCLR.B #3, @SCI1_SSR; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    MEM8[0xFAA4] |= BIT(7); /* BB57; BSET.B #7, @H'FAA4; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; refs ram_FAA4; cycles=8 */
+    SCI1_SSR &= ~BIT(5); /* BB5B; BCLR.B #5, @SCI1_SSR; clear ORER (bit 5) of SCI1_SSR; clear SCI1 ORER with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    SCI1_SSR &= ~BIT(4); /* BB5F; BCLR.B #4, @SCI1_SSR; clear FER (bit 4) of SCI1_SSR; clear SCI1 FER with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    SCI1_SSR &= ~BIT(3); /* BB63; BCLR.B #3, @SCI1_SSR; clear PER (bit 3) of SCI1_SSR; clear SCI1 PER with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
 }
 
 void vec_sci1_rxi_BB67(void)
 {
     /* vector sources: sci1_rxi */
     push_registers(R0, R1); /* BB67; STM.W {R0,R1}, @-SP; cycles=12 */
-    SCI1_SSR &= ~BIT(6); /* BB69; BCLR.B #6, @SCI1_SSR; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
-    R0 = (uint8_t)(SCI1_RDR); /* BB6D; MOV:G.B @SCI1_RDR, R0; read SCI1 received byte from RDR; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR; cycles=6 */
+    SCI1_SSR &= ~BIT(6); /* BB69; BCLR.B #6, @SCI1_SSR; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 RDRF with SSR R/(W)* semantics: write 0 clears latched hardware flag, write 1 preserves hardware-owned state; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    R0 = (uint8_t)(SCI1_RDR); /* BB6D; MOV:G.B @SCI1_RDR, R0; read SCI1 received byte from RDR; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR; cycles=6 */
     set_flags_tst8(MEM8[0xF9C1]); /* BB71; TST.B @H'F9C1; refs ram_F9C1; cycles=6 */
     if (!Z) goto loc_BB7D; /* BB75; BNE loc_BB7D; cycles=3/8 nt/t */
     MEM8[0xF9C3] = 0; /* BB77; CLR.B @H'F9C3; refs ram_F9C3; cycles=8 */
@@ -2968,12 +2970,12 @@ loc_BB7D:
 loc_BB8A:
     R1 = (uint8_t)(MEM8[0xF9C3]); /* BB8A; MOV:G.B @H'F9C3, R1; refs ram_F9C3; cycles=7 */
     R1 = zero_extend8(R1); /* BB8E; EXTU.B R1; cycles=3 */
-    MEM8[R1 - 0x0798] = (uint8_t)(R0); /* BB90; MOV:G.B R0, @(-H'0798,R1); cycles=7 */
-    R1 += (uint8_t)(1); /* BB94; ADD:Q.B #1, R1; cycles=4 */
-    MEM8[0xF9C3] = (uint8_t)(R1); /* BB96; MOV:G.B R1, @H'F9C3; refs ram_F9C3; cycles=7 */
-    set_flags_cmp8(R1, 0x06); /* BB9A; CMP:E #H'06, R1; cycles=2 */
+    MEM8[R1 - 0x0798] = (uint8_t)(R0); /* BB90; MOV:G.B R0, @(-H'0798,R1); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: received bytes are stored into candidate capture buffer H'F868-H'F86D; confidence high; cycles=7 */
+    R1 += (uint8_t)(1); /* BB94; ADD:Q.B #1, R1; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX byte count/index is incremented and stored at H'F9C3; confidence high; cycles=4 */
+    MEM8[0xF9C3] = (uint8_t)(R1); /* BB96; MOV:G.B R1, @H'F9C3; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX byte count/index is incremented and stored at H'F9C3; confidence high; refs ram_F9C3; cycles=7 */
+    set_flags_cmp8(R1, 0x06); /* BB9A; CMP:E #H'06, R1; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX ISR compares incremented count to candidate frame length 6; confidence high; cycles=2 */
     if (!Z) goto loc_BBA3; /* BB9C; BNE loc_BBA3; cycles=3/7 nt/t */
-    MEM8[0xF9C5] = (uint8_t)(0x14); /* BB9E; MOV:G.B #H'14, @H'F9C5; refs ram_F9C5; cycles=9 */
+    MEM8[0xF9C5] = (uint8_t)(0x14); /* BB9E; MOV:G.B #H'14, @H'F9C5; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX ISR sets H'F9C5 after count reaches 6; confidence high; refs ram_F9C5; cycles=9 */
 loc_BBA3:
     MEM8[0xF9C1] = (uint8_t)(0x05); /* BBA3; MOV:G.B #H'05, @H'F9C1; refs ram_F9C1; cycles=9 */
     pop_registers(R0, R1); /* BBA8; LDM.W @SP+, {R0,R1}; cycles=14 */
@@ -2982,24 +2984,24 @@ loc_BBA3:
 
 void loc_BBAB(void)
 {
-    set_flags_cmp8(MEM8[0xF9C3], 0x06); /* BBAB; CMP:G.B #H'06, @H'F9C3; refs ram_F9C3; cycles=6 */
+    set_flags_cmp8(MEM8[0xF9C3], 0x06); /* BBAB; CMP:G.B #H'06, @H'F9C3; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing path requires H'F9C3 to equal 6; confidence high; refs ram_F9C3; cycles=6 */
     if (!Z) goto loc_BE6F; /* BBB0; BNE loc_BE6F; cycles=3/7 nt/t */
-    R0 = (uint16_t)(MEM16[0xF868]); /* BBB3; MOV:G.W @H'F868, R0; refs ram_F868; cycles=6 */
-    MEM16[0xF860] = (uint16_t)(R0); /* BBB7; MOV:G.W R0, @H'F860; refs ram_F860; cycles=6 */
-    R0 = (uint16_t)(MEM16[0xF86A]); /* BBBB; MOV:G.W @H'F86A, R0; refs ram_F86A; cycles=6 */
-    MEM16[0xF862] = (uint16_t)(R0); /* BBBF; MOV:G.W R0, @H'F862; refs ram_F862; cycles=6 */
-    R0 = (uint16_t)(MEM16[0xF86C]); /* BBC3; MOV:G.W @H'F86C, R0; refs ram_F86C; cycles=6 */
-    MEM16[0xF864] = (uint16_t)(R0); /* BBC7; MOV:G.W R0, @H'F864; refs ram_F864; cycles=6 */
+    R0 = (uint16_t)(MEM16[0xF868]); /* BBB3; MOV:G.W @H'F868, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F868; cycles=6 */
+    MEM16[0xF860] = (uint16_t)(R0); /* BBB7; MOV:G.W R0, @H'F860; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F860; cycles=6 */
+    R0 = (uint16_t)(MEM16[0xF86A]); /* BBBB; MOV:G.W @H'F86A, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F86A; cycles=6 */
+    MEM16[0xF862] = (uint16_t)(R0); /* BBBF; MOV:G.W R0, @H'F862; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F862; cycles=6 */
+    R0 = (uint16_t)(MEM16[0xF86C]); /* BBC3; MOV:G.W @H'F86C, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F86C; cycles=6 */
+    MEM16[0xF864] = (uint16_t)(R0); /* BBC7; MOV:G.W R0, @H'F864; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX processing copies candidate capture buffer H'F868-H'F86D to validation buffer H'F860-H'F865; confidence high; refs ram_F864; cycles=6 */
     MEM8[0xF9C3] = 0; /* BBCB; CLR.B @H'F9C3; refs ram_F9C3; cycles=8 */
     set_flags_btst(MEM8[0xFAA4], 7); /* BBCF; BTST.B #7, @H'FAA4; refs ram_FAA4; cycles=6 */
     if (!Z) goto loc_BE29; /* BBD3; BNE loc_BE29; cycles=3/8 nt/t */
-    R0 = (uint8_t)(0x5A); /* BBD6; MOV:E.B #H'5A, R0; dataflow R0=0x5A; cycles=2 */
-    R0 ^= (uint8_t)(MEM8[0xF860]); /* BBD8; XOR.B @H'F860, R0; refs ram_F860; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF861]); /* BBDC; XOR.B @H'F861, R0; refs ram_F861; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF862]); /* BBE0; XOR.B @H'F862, R0; refs ram_F862; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF863]); /* BBE4; XOR.B @H'F863, R0; refs ram_F863; cycles=7 */
-    R0 ^= (uint8_t)(MEM8[0xF864]); /* BBE8; XOR.B @H'F864, R0; refs ram_F864; cycles=7 */
-    set_flags_cmp8(R0, MEM8[0xF865]); /* BBEC; CMP:G.B @H'F865, R0; refs ram_F865; cycles=7 */
+    R0 = (uint8_t)(0x5A); /* BBD6; MOV:E.B #H'5A, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: candidate RX checksum validation starts from seed H'005A; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; dataflow R0=0x5A; cycles=2 */
+    R0 ^= (uint8_t)(MEM8[0xF860]); /* BBD8; XOR.B @H'F860, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F860; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF861]); /* BBDC; XOR.B @H'F861, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F861; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF862]); /* BBE0; XOR.B @H'F862, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F862; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF863]); /* BBE4; XOR.B @H'F863, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F863; cycles=7 */
+    R0 ^= (uint8_t)(MEM8[0xF864]); /* BBE8; XOR.B @H'F864, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F864; cycles=7 */
+    set_flags_cmp8(R0, MEM8[0xF865]); /* BBEC; CMP:G.B @H'F865, R0; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: RX path XORs H'F860-H'F864 and compares the result with H'F865; confidence high; refs ram_F865; cycles=7 */
     if (!Z) goto loc_BE29; /* BBF0; BNE loc_BE29; cycles=3/7 nt/t */
     MEM8[0xFAA6] = 0; /* BBF3; CLR.B @H'FAA6; refs ram_FAA6; cycles=8 */
     R5 = (uint8_t)(MEM8[0xF861]); /* BBF7; MOV:G.B @H'F861, R5; refs ram_F861; cycles=6 */
@@ -3193,11 +3195,11 @@ loc_BDDB:
     MEM8[0xFAA2] = 0; /* BDFF; CLR.B @H'FAA2; refs ram_FAA2; cycles=8 */
     goto loc_BE6F; /* BE03; BRA loc_BE6F; cycles=8 */
 loc_BE05:
-    R0 = (uint16_t)(MEM16[0xF858]); /* BE05; MOV:G.W @H'F858, R0; refs ram_F858; cycles=6 */
+    R0 = (uint16_t)(MEM16[0xF858]); /* BE05; MOV:G.W @H'F858, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F858; cycles=6 */
     MEM16[0xF850] = (uint16_t)(R0); /* BE09; MOV:G.W R0, @H'F850; refs ram_F850; cycles=6 */
-    R0 = (uint16_t)(MEM16[0xF85A]); /* BE0D; MOV:G.W @H'F85A, R0; refs ram_F85A; cycles=6 */
+    R0 = (uint16_t)(MEM16[0xF85A]); /* BE0D; MOV:G.W @H'F85A, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85A; cycles=6 */
     MEM16[0xF852] = (uint16_t)(R0); /* BE11; MOV:G.W R0, @H'F852; refs ram_F852; cycles=6 */
-    R0 = (uint16_t)(MEM16[0xF85C]); /* BE15; MOV:G.W @H'F85C, R0; refs ram_F85C; cycles=6 */
+    R0 = (uint16_t)(MEM16[0xF85C]); /* BE15; MOV:G.W @H'F85C, R0; candidate/evidence-supported SCI1 6-byte TX frame; H'F858-H'F85D, checksum H'F85D seeded by H'005A; evidence: TX buffer-region references cluster around H'F858-H'F85D; confidence high; refs ram_F85C; cycles=6 */
     MEM16[0xF854] = (uint16_t)(R0); /* BE19; MOV:G.W R0, @H'F854; refs ram_F854; cycles=6 */
     MEM8[0xF9C0] = (uint8_t)(0x1F); /* BE1D; MOV:G.B #H'1F, @H'F9C0; refs ram_F9C0; cycles=9 */
     loc_BA26(); /* BE22; BSR loc_BA26; cycles=13 */
@@ -3284,18 +3286,18 @@ loc_BEE8:
 void vec_frt1_ocia_BEEA(void)
 {
     /* vector sources: frt1_ocia */
-    FRT1_TCSR &= ~BIT(5); /* BEEA; BCLR.B #5, @FRT1_TCSR; clear OCFA (bit 5) of FRT1_TCSR; refs FRT1_TCSR; cycles=9 */
-    set_flags_tst8(MEM8[0xF9C0]); /* BEEE; TST.B @H'F9C0; refs ram_F9C0; cycles=7 */
+    FRT1_TCSR &= ~BIT(5); /* BEEA; BCLR.B #5, @FRT1_TCSR; clear OCFA (bit 5) of FRT1_TCSR; candidate/evidence-supported RAM role post_tx_report_delay at H'F9C0; evidence: candidate periodic tick ISR at H'BEEA for FRT1 OCIA vector H'0062 clears OCFA; confidence candidate/evidence-supported; candidate/evidence-supported RAM role secondary_tx_report_delay at H'F9C1; evidence: candidate periodic tick ISR at H'BEEA for FRT1 OCIA vector H'0062 clears OCFA; confidence candidate/evidence-supported; candidate/evidence-supported RAM role periodic_report_countdown at H'F9C6; evidence: candidate periodic tick ISR at H'BEEA for FRT1 OCIA vector H'0062 clears OCFA; confidence candidate/evidence-supported; refs FRT1_TCSR; cycles=9 */
+    set_flags_tst8(MEM8[0xF9C0]); /* BEEE; TST.B @H'F9C0; candidate/evidence-supported RAM role post_tx_report_delay at H'F9C0; evidence: candidate post-TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C0; cycles=7 */
     if (!Z) { /* BEF2; BEQ loc_BEF8; cycles=3/7 nt/t */
-        MEM8[0xF9C0] += (uint8_t)(-1); /* BEF4; ADD:Q.B #-1, @H'F9C0; refs ram_F9C0; cycles=9 */
+        MEM8[0xF9C0] += (uint8_t)(-1); /* BEF4; ADD:Q.B #-1, @H'F9C0; candidate/evidence-supported RAM role post_tx_report_delay at H'F9C0; evidence: candidate post-TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C0; cycles=9 */
     }
-    set_flags_tst8(MEM8[0xF9C1]); /* BEF8; TST.B @H'F9C1; refs ram_F9C1; cycles=7 */
+    set_flags_tst8(MEM8[0xF9C1]); /* BEF8; TST.B @H'F9C1; candidate/evidence-supported RAM role secondary_tx_report_delay at H'F9C1; evidence: candidate secondary TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C1; cycles=7 */
     if (!Z) { /* BEFC; BEQ loc_BF02; cycles=3/7 nt/t */
-        MEM8[0xF9C1] += (uint8_t)(-1); /* BEFE; ADD:Q.B #-1, @H'F9C1; refs ram_F9C1; cycles=9 */
+        MEM8[0xF9C1] += (uint8_t)(-1); /* BEFE; ADD:Q.B #-1, @H'F9C1; candidate/evidence-supported RAM role secondary_tx_report_delay at H'F9C1; evidence: candidate secondary TX/report delay timer is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C1; cycles=9 */
     }
-    set_flags_tst16(MEM16[0xF9C6]); /* BF02; TST.W @H'F9C6; refs ram_F9C6; cycles=7 */
+    set_flags_tst16(MEM16[0xF9C6]); /* BF02; TST.W @H'F9C6; candidate/evidence-supported RAM role periodic_report_countdown at H'F9C6; evidence: candidate periodic report countdown is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C6; cycles=7 */
     if (!Z) { /* BF06; BEQ loc_BF0C; cycles=3/7 nt/t */
-        MEM16[0xF9C6] += (uint16_t)(-1); /* BF08; ADD:Q.W #-1, @H'F9C6; refs ram_F9C6; cycles=9 */
+        MEM16[0xF9C6] += (uint16_t)(-1); /* BF08; ADD:Q.W #-1, @H'F9C6; candidate/evidence-supported RAM role periodic_report_countdown at H'F9C6; evidence: candidate periodic report countdown is decremented by the FRT1 OCIA periodic tick ISR; confidence candidate/evidence-supported; refs ram_F9C6; cycles=9 */
     }
     set_flags_btst(MEM8[0xF6F6], 7); /* BF0C; BTST.B #7, @H'F6F6; refs ram_F6F6; cycles=7 */
     if (Z) goto loc_BF22; /* BF10; BEQ loc_BF22; cycles=3/7 nt/t */
@@ -3701,7 +3703,7 @@ loc_4059:
     set_flags_cmp8(R2, MEM8[0xF9B5]); /* 405F; CMP:G.B @H'F9B5, R2; refs ram_F9B5; cycles=6 */
     if (Z) { /* 4063; BNE loc_4074; cycles=3/8 nt/t */
         R2 <<= 1; /* 4065; SHLL.B R2; cycles=2 */
-        MEM16[R2 - 0x0790] = (uint16_t)(0x00); /* 4067; MOV:G.W #H'00, @(-H'0790,R2); cycles=11 */
+        MEM16[R2 - 0x0790] = zero_extend8_to16(0x00); /* 4067; MOV:G.W #H'00, @(-H'0790,R2); byte immediate zero-extended into word destination; cycles=11 */
         MEM8[0xF9B0] += (uint8_t)(1); /* 406C; ADD:Q.B #1, @H'F9B0; refs ram_F9B0; cycles=9 */
         MEM8[0xF9B0] &= ~BIT(7); /* 4070; BCLR.B #7, @H'F9B0; refs ram_F9B0; cycles=9 */
     }

build/rom_report_sources.json

@@ -0,0 +1,256 @@
+{
+  "calls": [
+    {
+      "address": 5622,
+      "address_hex": "H'15F6",
+      "assessment": "Direct static enqueue source for 0x0081, not 0x0007.",
+      "can_directly_enqueue_report_index": false,
+      "dataflow_block": 5609,
+      "function_label": "loc_15E0",
+      "function_start": 5600,
+      "function_start_hex": "H'15E0",
+      "instruction": "BSR loc_3E54",
+      "r2": {
+        "bit7": true,
+        "classification": "constant",
+        "evidence": {
+          "address": 5617,
+          "address_hex": "H'15F1",
+          "instruction": "MOV:E.B #H'80, R2",
+          "mnemonic": "MOV:E.B",
+          "operands": "#H'80, R2"
+        },
+        "reason": "immediate load",
+        "register": "R2",
+        "value": 128,
+        "value_hex": "0x80"
+      },
+      "r3": {
+        "classification": "constant",
+        "evidence": {
+          "address": 5619,
+          "address_hex": "H'15F3",
+          "instruction": "MOV:I.W #H'0081, R3",
+          "mnemonic": "MOV:I.W",
+          "operands": "#H'0081, R3"
+        },
+        "reason": "immediate load",
+        "register": "R3",
+        "value": 129,
+        "value_hex": "0x0081"
+      },
+      "table_hints": [],
+      "target": 15956,
+      "target_hex": "H'3E54",
+      "window_instruction_count": 4,
+      "window_start": 5609,
+      "window_start_hex": "H'15E9"
+    },
+    {
+      "address": 6673,
+      "address_hex": "H'1A11",
+      "assessment": "No static 0x0007 constant here; R3 is dynamic/table-derived.",
+      "can_directly_enqueue_report_index": false,
+      "dataflow_block": 6665,
+      "function_label": "loc_19DB",
+      "function_start": 6619,
+      "function_start_hex": "H'19DB",
+      "instruction": "BSR loc_3E54",
+      "r2": {
+        "bit7": true,
+        "classification": "constant",
+        "evidence": {
+          "address": 6669,
+          "address_hex": "H'1A0D",
+          "instruction": "MOV:E.B #H'80, R2",
+          "mnemonic": "MOV:E.B",
+          "operands": "#H'80, R2"
+        },
+        "reason": "immediate load",
+        "register": "R2",
+        "value": 128,
+        "value_hex": "0x80"
+      },
+      "r3": {
+        "classification": "dynamic/table-derived",
+        "evidence": {
+          "address": 6671,
+          "address_hex": "H'1A0F",
+          "instruction": "MOV:G.W R5, R3",
+          "mnemonic": "MOV:G.W",
+          "operands": "R5, R3"
+        },
+        "reason": "copied from unresolved R5",
+        "register": "R3",
+        "value": null,
+        "value_hex": null
+      },
+      "table_hints": [
+        {
+          "address": 6665,
+          "address_hex": "H'1A09",
+          "instruction": "MOV:G.W R1, @(-H'1800,R3)",
+          "operand": "@(-H'1800,R3)",
+          "table": "current_value_table_candidate"
+        }
+      ],
+      "target": 15956,
+      "target_hex": "H'3E54",
+      "window_instruction_count": 3,
+      "window_start": 6665,
+      "window_start_hex": "H'1A09"
+    },
+    {
+      "address": 6777,
+      "address_hex": "H'1A79",
+      "assessment": "No static 0x0007 constant here; R3 is dynamic/table-derived.",
+      "can_directly_enqueue_report_index": false,
+      "dataflow_block": 6769,
+      "function_label": "loc_1A35",
+      "function_start": 6709,
+      "function_start_hex": "H'1A35",
+      "instruction": "BSR loc_3E54",
+      "r2": {
+        "bit7": true,
+        "classification": "constant",
+        "evidence": {
+          "address": 6773,
+          "address_hex": "H'1A75",
+          "instruction": "MOV:E.B #H'80, R2",
+          "mnemonic": "MOV:E.B",
+          "operands": "#H'80, R2"
+        },
+        "reason": "immediate load",
+        "register": "R2",
+        "value": 128,
+        "value_hex": "0x80"
+      },
+      "r3": {
+        "classification": "dynamic/table-derived",
+        "evidence": {
+          "address": 6775,
+          "address_hex": "H'1A77",
+          "instruction": "MOV:G.W R5, R3",
+          "mnemonic": "MOV:G.W",
+          "operands": "R5, R3"
+        },
+        "reason": "copied from unresolved R5",
+        "register": "R3",
+        "value": null,
+        "value_hex": null
+      },
+      "table_hints": [
+        {
+          "address": 6769,
+          "address_hex": "H'1A71",
+          "instruction": "MOV:G.W R0, @(-H'1800,R3)",
+          "operand": "@(-H'1800,R3)",
+          "table": "current_value_table_candidate"
+        }
+      ],
+      "target": 15956,
+      "target_hex": "H'3E54",
+      "window_instruction_count": 3,
+      "window_start": 6769,
+      "window_start_hex": "H'1A71"
+    },
+    {
+      "address": 9896,
+      "address_hex": "H'26A8",
+      "assessment": "No static 0x0007 constant here; R3 is unknown.",
+      "can_directly_enqueue_report_index": false,
+      "dataflow_block": 9896,
+      "function_label": "loc_2650",
+      "function_start": 9808,
+      "function_start_hex": "H'2650",
+      "instruction": "BSR loc_3E54",
+      "r2": {
+        "bit7": null,
+        "classification": "unknown",
+        "evidence": null,
+        "reason": "decompiler dataflow: block_entry",
+        "register": "R2",
+        "value": null,
+        "value_hex": null
+      },
+      "r3": {
+        "classification": "unknown",
+        "evidence": null,
+        "reason": "decompiler dataflow: block_entry",
+        "register": "R3",
+        "value": null,
+        "value_hex": null
+      },
+      "table_hints": [],
+      "target": 15956,
+      "target_hex": "H'3E54",
+      "window_instruction_count": 0,
+      "window_start": 9896,
+      "window_start_hex": "H'26A8"
+    },
+    {
+      "address": 18726,
+      "address_hex": "H'4926",
+      "assessment": "Direct static enqueue source for 0x00f6, not 0x0007.",
+      "can_directly_enqueue_report_index": false,
+      "dataflow_block": 18709,
+      "function_label": "loc_48FA",
+      "function_start": 18682,
+      "function_start_hex": "H'48FA",
+      "instruction": "BSR loc_3E54",
+      "r2": {
+        "bit7": true,
+        "classification": "constant",
+        "evidence": {
+          "address": 18721,
+          "address_hex": "H'4921",
+          "instruction": "MOV:E.B #H'80, R2",
+          "mnemonic": "MOV:E.B",
+          "operands": "#H'80, R2"
+        },
+        "reason": "immediate load",
+        "register": "R2",
+        "value": 128,
+        "value_hex": "0x80"
+      },
+      "r3": {
+        "classification": "constant",
+        "evidence": {
+          "address": 18723,
+          "address_hex": "H'4923",
+          "instruction": "MOV:I.W #H'00F6, R3",
+          "mnemonic": "MOV:I.W",
+          "operands": "#H'00F6, R3"
+        },
+        "reason": "immediate load",
+        "register": "R3",
+        "value": 246,
+        "value_hex": "0x00F6"
+      },
+      "table_hints": [],
+      "target": 15956,
+      "target_hex": "H'3E54",
+      "window_instruction_count": 5,
+      "window_start": 18709,
+      "window_start_hex": "H'4915"
+    }
+  ],
+  "caveats": [
+    "This is a bounded local static trace, not an emulator run.",
+    "R3 values classified as dynamic/table-derived may still become 0x0007 at runtime.",
+    "Indirect dispatch, table handlers, interrupt interleavings, or callers absent from the JSON may still enqueue 0x0007.",
+    "The generic queue-to-TX path only emits queued entries; this tracer looks for direct report-index sources at loc_3E54 callers."
+  ],
+  "kind": "report_source_trace",
+  "queue_function": 15956,
+  "queue_function_hex": "H'3E54",
+  "report_index_of_interest": 7,
+  "report_index_of_interest_hex": "0x0007",
+  "summary": {
+    "conclusion": "No direct loc_3E54 caller in this JSON statically loads report index 0x0007. 0x0007 remains an observed runtime/capture value unless another indirect or table-dispatch path is proven.",
+    "direct_call_count": 5,
+    "direct_static_hit_count": 0,
+    "dynamic_or_unknown_candidate_count": 3,
+    "status": "not_statically_proven"
+  }
+}

build/rom_report_sources.txt

@@ -0,0 +1,32 @@
+H8/536 loc_3E54 Report Source Trace
+
+Queue function: H'3E54
+Report index of interest: 0x0007
+Direct callers: 5
+Direct static 0x0007 hits: 0
+Dynamic/unknown candidates: 3
+
+Conclusion: No direct loc_3E54 caller in this JSON statically loads report index 0x0007. 0x0007 remains an observed runtime/capture value unless another indirect or table-dispatch path is proven.
+
+Call sites:
+- H'15F6 in loc_15E0: R2.bit7=set, R3=0x0081 (constant); direct_0x0007=False
+  R2 evidence: H'15F1 MOV:E.B #H'80, R2
+  R3 evidence: H'15F3 MOV:I.W #H'0081, R3
+- H'1A11 in loc_19DB: R2.bit7=set, R3=<dynamic> (dynamic/table-derived); direct_0x0007=False
+  R2 evidence: H'1A0D MOV:E.B #H'80, R2
+  R3 evidence: H'1A0F MOV:G.W R5, R3
+  table/context hints: H'1A09 current_value_table_candidate via @(-H'1800,R3)
+- H'1A79 in loc_1A35: R2.bit7=set, R3=<dynamic> (dynamic/table-derived); direct_0x0007=False
+  R2 evidence: H'1A75 MOV:E.B #H'80, R2
+  R3 evidence: H'1A77 MOV:G.W R5, R3
+  table/context hints: H'1A71 current_value_table_candidate via @(-H'1800,R3)
+- H'26A8 in loc_2650: R2.bit7=unknown, R3=<dynamic> (unknown); direct_0x0007=False
+- H'4926 in loc_48FA: R2.bit7=set, R3=0x00F6 (constant); direct_0x0007=False
+  R2 evidence: H'4921 MOV:E.B #H'80, R2
+  R3 evidence: H'4923 MOV:I.W #H'00F6, R3
+
+Caveats:
+- This is a bounded local static trace, not an emulator run.
+- R3 values classified as dynamic/table-derived may still become 0x0007 at runtime.
+- Indirect dispatch, table handlers, interrupt interleavings, or callers absent from the JSON may still enqueue 0x0007.
+- The generic queue-to-TX path only emits queued entries; this tracer looks for direct report-index sources at loc_3E54 callers.

build/rom_rx_branch_trace.txt

@@ -0,0 +1,218 @@
+H8/536 SCI1 RX Branch Trace
+
+Summary: The ROM captures six SCI1 bytes, validates a 0x5A-seeded XOR checksum, decodes RX[0] & 0x07, then splits into initial commands while FAA2 == 0 and continuation commands while FAA2 != 0.
+Confidence: high
+
+Frame Model:
+- capture buffer: H'F868-H'F86D
+- validation buffer: H'F860-H'F865
+- command: RX[0] & 0x07
+- logical index candidate: loc_622B(RX[1], RX[2])
+- value candidate: RX[3:4]
+- checksum: 0x5A XOR RX[0..4] == RX[5]
+
+Selector Decode:
+- loc_622B logical selector decode: present
+  The RX handler builds a raw word from RX[1:2], uses RX[1] bit0-bit2 as a page, keeps RX[2] as the low selector byte, and maps the result into a 0x000-0x1FF logical selector.
+  - page 0, or pages 4-7, and low <= 0x7F: selector = 0x000 + low [H'6234, H'6236, H'6244, H'6248, H'6264]
+  - page 1 and low <= 0xFF: selector = 0x080 + low [H'6238, H'623A, H'624D, H'6251, H'6264]
+  - page 2 and low <= 0x7F: selector = 0x180 + low [H'623C, H'623E, H'6256, H'625A, H'6264]
+  - page 3, page/range failure, or page 0/4-7 with low > 0x7F: selector forced to 0x01FF [H'6240, H'6242, H'625F, H'6261]
+  - implication: RX[1].7 is not part of the selector here because the dispatcher rejects byte1 bit7 before command handling.
+  - implication: Commands shaped as 01 80 xx ... are rejected before loc_622B-derived command handling even if the low byte looks useful.
+  - implication: Page 4-7 encodings appear to alias the page-0 decode path unless the low byte is out of range.
+
+Stages:
+- SCI1 RXI/ERI byte capture: present
+  ERI latches FAA4.7 and clears physical error flags; RXI clears RDRF, reads SCI1_RDR, stores bytes into F868-F86D, reloads F9C1, and sets F9C5 when six bytes are captured.
+  - ERI taken: set FAA4.7, clear ORER/FER/PER, then fall into RXI byte capture [H'BB57, H'BB5B, H'BB5F, H'BB63]
+  - F9C1 == 0 before byte: clear F9C3 so the byte starts a fresh frame [H'BB71, H'BB75, H'BB77]
+  - F9C1 != 0 and F9C3 <= 5: append byte at F868 + F9C3 and increment F9C3 [H'BB7D, H'BB82, H'BB8A, H'BB90, H'BB96]
+  - F9C1 != 0 and F9C3 > 5: clear FAA4 and skip storing this byte [H'BB7D, H'BB82, H'BB84, H'BB88]
+  - incremented F9C3 == 6: load F9C5 with 0x14 as the RX/session timeout window [H'BB9A, H'BB9C, H'BB9E]
+  - any RXI exit: reload F9C1 with 0x05 as the inter-byte timeout [H'BBA3]
+- six-byte validation and checksum: present
+  The main-loop processor only runs when F9C3 is six, copies F868-F86D to F860-F865, clears F9C3, rejects physical-error frames, checks the 0x5A XOR checksum, and decodes the index.
+  - F9C3 != 6: return without processing [H'BBAB, H'BBB0]
+  - FAA4.7 set after capture: enter retry/error path at BE29 [H'BBCF, H'BBD3]
+  - checksum mismatch: enter retry/error path at BE29 [H'BBD6, H'BBD8, H'BBDC, H'BBE0, H'BBE4, H'BBE8, H'BBEC, H'BBF0]
+  - checksum valid: clear FAA6, decode selector from RX[1:2] through loc_622B, and dispatch on RX[0] & 0x07 [H'BBF3, H'BBF7, H'BBFD, H'BC01, H'BC08, H'BC0C]
+- FAA2 split dispatcher: present
+  FAA2 == 0 enters the initial dispatcher for commands 0, 1, 2, and 7. FAA2 != 0 enters the continuation dispatcher; commands 4, 5, and 6 only live there.
+  - FAA2 == 0: set FAA2.7 and test initial commands 0, 1, 2, 7 [H'BC0F, H'BC13, H'BC15, H'BC20, H'BC24, H'BC29, H'BC2E]
+  - FAA2 != 0 and command bit2 set: continuation commands 4, 5, 6, 7 are possible [H'BC0F, H'BC13, H'BC3A, H'BC45, H'BC4A, H'BC4F, H'BC54]
+  - FAA2 != 0 and command bit2 clear: BCLR FAA2.3; if that bit was set, clear FAA3 and re-enter initial dispatcher [H'BC3A, H'BC3C, H'BC5C, H'BC60, H'BC63, H'BC67]
+  - byte1 bit7 set on initial path: branch to BD0B and return without normal command handling [H'BC19, H'BC1D, H'BD0B]
+  - byte1 bit7 set on continuation path: branch to BE27 and return without normal command handling [H'BC3E, H'BC42, H'BE27]
+- checksum/error retry path: present
+  Physical RX errors or checksum failures can either be ignored, clear the session after two retries, or stage a command-7 retry/error echo of RX[1:4].
+  - FAA5.7 == 0: return after clearing FAA4.7; retry echo is disabled [H'BE29, H'BE2D, H'BE31]
+  - FAA5.7 == 1 and FAA6 < 2: stage F850=0x07 and F851-F854=RX[1:4], then call BA26 [H'BE33, H'BE37, H'BE3C, H'BE4D, H'BE52, H'BE5A, H'BE62, H'BE6A]
+  - FAA5.7 == 1 and FAA6 >= 2: load F9C0=0x1F and clear FAA3/FAA2 [H'BE37, H'BE3C, H'BE3E, H'BE43, H'BE47]
+- pending selector ring at loc_BE70: present
+  Several write/ACK paths call BE70 with R5 as the logical selector. BE70 deduplicates that selector against a small F970-like ring using cursors F9B9/F9B4, then appends it if absent.
+  - selector already present: exit without appending [H'BE84, H'BE88, H'BE9D]
+  - ring scan reaches F9B4 cursor: store R5 into the pending ring and advance F9B4 [H'BE80, H'BE82, H'BE91, H'BE95, H'BE99]
+- session timeout and resend side paths: present
+  After any complete RX frame, F9C5 keeps FAA5.7/session-gate state alive for a short window. When that window expires, 3FEF can clear queue cursors and call 400C, while BE9E handles resend countdowns.
+  - F9C5 == 0 at loc_3FEF: clear F9B5/F9B0 and clear FAA5.7; if FAA5.7 was set, call 400C reset/NOT-ACT state clear [H'3FEF, H'3FF3, H'3FF5, H'3FF9, H'3FFD, H'4001, H'4003]
+  - F9C5 != 0 at loc_3FEF: set FAA5.7, allowing retry/resend/session-gated paths [H'3FEF, H'3FF3, H'4007]
+  - BE9E sees no pending FAA5 & FAA3 & 0x80: clear FAA2 and return [H'BE9E, H'BEA5, H'BEA9, H'BEAD, H'BEAF]
+  - BE9E pending and F9C6==0 and F9C8!=0: decrement F9C8, reload F9C6, and possibly resend staged TX through BA26 [H'BEB5, H'BEBB, H'BEC1, H'BEC5, H'BECB, H'BED1, H'BED5]
+  - BE9E pending but F9C8==0: clear F9C5, which lets 3FEF collapse the session gate later [H'BEBB, H'BEBF, H'BEE4]
+
+Command Branches:
+- cmd 0x00 set_value_acked_candidate: initial path only: checksum valid, FAA2 == 0, RX[1].7 == 0; handler H'BC69; writes RX[3:4] into primary/current tables, flags the selector, calls BE70, and sends an echo-style 0x04 response
+  response: F850=0x04; F851-F854 mostly echo RX[1:4]; BA26 sends it
+  - selector zero is special: the low byte is forced to 0x80 after the high byte is taken from RX[3]
+  - nonzero selectors can mirror into an auxiliary table via a mapping table
+  - clears FAA2.7 before exit
+- cmd 0x01 read_value_candidate: initial path only: checksum valid, FAA2 == 0, RX[1].7 == 0; handler H'BCD7; reads primary table E000 + 2*selector and stages a 0x04 response
+  response: F850=0x04; F851 is overwritten with RX[2]; F853/F854 receive table high/low; F852 is not freshly written here
+  - does not enter continuation command handling
+  - clears FAA2.7 before exit
+- cmd 0x02 initial_clear_or_noop_candidate: initial path only: checksum valid, FAA2 == 0, RX[1].7 == 0; handler H'BD04; clears FAA2.7 and returns without staging a response
+  response: no immediate serial response
+  - likely a quiet/session-clear style command on the initial path
+- cmd 0x04 continuation_set_value_candidate: continuation path only: checksum valid, FAA2 != 0, command bit2 set, RX[1].7 == 0; handler H'BD0E; writes a value into the primary table without an immediate serial response; selector zero also updates the current/report table
+  response: no immediate serial response
+  - selector zero is special: RX[3] becomes the high byte and low byte is forced to 0x80
+  - nonzero selectors write E000 and flag EC00.7; the matching E800 current/report write is not present in this handler
+  - nonzero selectors can mirror/persist through F400/BFE0 when mapping and F76E.7 allow it
+  - if FAA2.3 was set from a queued report, advances F9B5 to consume that report
+  - clears FAA3 and FAA2 before exit
+- cmd 0x05 continuation_ack_or_clear_pending_candidate: continuation path only: checksum valid, FAA2 != 0, command bit2 set, RX[1].7 == 0; handler H'BD80; ACK/session-clear path; usually no response, but selected logical indexes feed BE70 or clear connection latches
+  response: no immediate serial response
+  - selectors 0x006C, 0x006D, and 0x006E call BE70
+  - with F731.7 set, selectors 0x006B, 0x0096, 0x0097, 0x00C6, and 0x00F8 clear F731.7/F790.7
+  - if FAA2.3 was set from a queued report, advances F9B5
+  - clears FAA3 and FAA2 before exit
+- cmd 0x06 continuation_set_secondary_candidate: continuation path only: checksum valid, FAA2 != 0, command bit2 set, RX[1].7 == 0; handler H'BDDB; writes RX[3:4] into the secondary table and sets flag-table bit 6
+  response: no immediate serial response
+  - if FAA2.3 was set from a queued report, advances F9B5
+  - clears FAA3 and FAA2 before exit
+- cmd 0x07 retransmit_previous_tx_candidate: initial or continuation path; handler H'BE05; copies the previous finalized TX frame bytes back into staging and sends them again
+  response: previous TX frame retransmitted through BA26
+  - loads F9C0 with 0x1F before sending
+
+Table Surfaces:
+- primary_value_table H'E000-H'E3FF: present; logical selector word table; command 0 and continuation command 4 write it, command 1 reads it [H'BC75, H'BC95, H'BCEC, H'BD1A, H'BD35]
+  - indexed as E000 + 2*selector after loc_622B
+  - selector zero writes force the low byte to 0x80 on commands 0 and 4
+  - this is the table that must contain E000[0]=0x8080 for the emulator-correlated CONNECT OK branch
+- current_report_value_table H'E800-H'EBFF: present; current/report value table used when queued serial reports are converted into TX frames [H'BC79, H'BC99, H'BD1E, H'BB35, H'BB39, H'BB3F]
+  - command 0 writes both primary E000 and current E800 for zero and nonzero selectors
+  - command 4 writes E800 only on the selector-zero special path; the nonzero command-4 path does not show a matching E800 write here
+  - loc_BAF2 reads E800 + 2*queued_selector when building autonomous report frames
+- secondary_value_table H'E400-H'E7FF: present; secondary logical selector word table written by continuation command 6 [H'BDE5, H'BDE9]
+  - command 6 writes RX[3:4] to E400 + 2*selector
+  - the matching EC00 flag bit is bit6 rather than bit7
+- dirty_flag_table H'EC00-H'EDFF: present; per-selector flag bytes; command 0/4 set bit7 and command 6 sets bit6 [H'BC82, H'BC9D, H'BD22, H'BD39, H'BDE9]
+  - the same logical selector indexes this byte table directly, not as a word offset
+  - loc_48FA and other consumers test these table bits before raising follow-on reports
+- mapped_shadow_or_eeprom_surface H'F400-H'F4FF: present; optional mapped mirror/persistence surface selected through ROM tables around C564/C565 [H'BCA1, H'BCA9, H'BD3D, H'BD45, H'BD49, H'BD5F]
+  - nonzero command-0 and command-4 writes consult mapping bytes/words before mirroring into F400
+  - command 4 can call BFE0 to persist the mapped word when F76E.7 is set
+  - selector zero bypasses this mapped mirror path
+
+Downstream Flow Traces:
+- immediate response staging through loc_BA26: present
+  Command 0, command 1, command 7, and the retry/error path stage F850-F854, call BA26, copy that staging area to F858-F85C, compute F85D, send the first byte, then let TXI send bytes 1-5.
+  - stage command-0 echo: F850=0x04 and F851-F854 mirror the accepted host fields before BA26 [H'BCB0, H'BCB5, H'BCC1, H'BCC9, H'BCCD]
+  - stage command-1 readback: F850=0x04, F853/F854 receive the E000 table word, and BA26 sends it [H'BCD7, H'BCEC, H'BCF0, H'BCF6, H'BCFA]
+  - finalize TX frame: BA26 copies F850-F854 to F858-F85C and computes F85D as 0x5A XOR bytes 0-4 [H'BA36, H'BA3A, H'BA42, H'BA4A, H'BA4E, H'BA64]
+  - start SCI1 transmission: BA26 waits for TDRE, writes F858 to SCI1_TDR, sets F9C2=1, clears TDRE, and enables TIE [H'BA68, H'BA72, H'BA76, H'BA7B, H'BA7F]
+  - finish SCI1 transmission: TXI indexes F858+F9C2 until six bytes are sent, then disables TIE [H'BAAB, H'BAB1, H'BAB5, H'BABF, H'BAC3, H'BACA]
+- selector-processing queue BE70/F970 into loc_2806: present
+  BE70 appends unique logical selectors into the F970 ring. The main loop later consumes that ring at loc_2806 and dispatches selector-specific behavior through the 28A6 jump table.
+  - append unique selector: BE70 scans from F9B9 to F9B4, skips duplicates, writes R5 to F970+2*cursor, and advances F9B4 [H'BE70, H'BE78, H'BE84, H'BE91, H'BE95, H'BE99]
+  - consume selector: loc_2806 reads F970+2*F9B9, advances F9B9, masks the selector to 0x01FF, and keeps it in R5 [H'2806, H'280C, H'2819, H'281D, H'2822, H'2826, H'282A]
+  - active-selector side path: selectors matching F736/F738/F73A/F73C/F73E/F740/F742/F754 call loc_48FA before the jump table [H'2837, H'285E, H'2878, H'2892, H'2CAB, H'2CAD]
+  - selector jump table: the consumer jumps through table 28A6; selector zero is emulator-correlated with the CONNECT handler window [H'289F, H'28A3]
+- serial-report queue loc_3E54/F870 into loc_BAF2: present
+  loc_3E54 is a shared enqueue helper. R2.bit7 queues serial-visible report indexes in F870, while R2.bit6 queues selector-processing work in F970. loc_BAF2 is the path that turns F870 entries into outbound 6-byte frames.
+  - enqueue serial report: when R2.7 is set, loc_3E54 deduplicates R3 in F870 and advances F9B0 [H'3E54, H'3E58, H'3E6C, H'3E76, H'3E7A, H'3E7E]
+  - queue backpressure drain: if the serial queue is nearly full, loc_3E54 calls loc_3FD3 until there is space [H'3E82, H'3E8B, H'3E91, H'3E93]
+  - enqueue selector processing: when R2.6 is set, loc_3E54 deduplicates R3 in F970 and advances F9B4 [H'3E9A, H'3E9E, H'3EB2, H'3EBF, H'3EC3, H'3EC7]
+  - dequeue serial report: loc_BAF2 compares F9B5/F9B0, reads F870+2*F9B5, builds a TX report from E800, and calls BA26 [H'BAF2, H'BAF8, H'BB00, H'BB08, H'BB1C, H'BB35, H'BB43]
+  - open continuation latch: after a report send, loc_BAF2 sets FAA2.3, FAA3.7, F9C6, and F9C8; command 4/5/6 can then consume or ACK that report [H'BB00, H'BB46, H'BB4C, H'BB51]
+- TXI/RXI race and continuation collapse: present
+  The TX interrupt handler has an interlock: if a queued report is awaiting continuation and RX bytes are already arriving, it clears the report/continuation state and stops TXI before the normal frame-finish path.
+  - detect overlap: TXI tests FAA2.3, FAA5.7, and nonzero F9C3 before continuing the TX frame [H'BA84, H'BA8A, H'BA90]
+  - collapse continuation: on overlap it clears FAA2.3 and FAA3, disables TIE, and loads F9C0=0x1F [H'BA96, H'BA9A, H'BA9E, H'BAA2]
+  - normal completion path: without the overlap, TXI sends bytes until F9C2 reaches six and then starts the post-TX delay path [H'BAA9, H'BAB5, H'BAC3, H'BACA, H'BADA, H'BAED]
+- session expiry into reset/not-active state: present
+  When F9C5 reaches zero, loc_3FEF clears queue cursors and FAA5.7; if FAA5.7 had been set, loc_400C clears connection/session RAM and refreshes the inactive display state.
+  - expire RX session: F9C5==0 clears F9B5/F9B0 and clears FAA5.7 [H'3FEF, H'3FF5, H'3FF9, H'3FFD]
+  - call reset side path: if clearing FAA5.7 changed the bit, loc_3FEF calls loc_400C [H'4001, H'4003]
+  - clear connection state: loc_400C clears F730/F756-F759/F732/F75C/FB03/F791/F795/F76E and calls follow-on display/session refresh routines [H'400C, H'4010, H'4020, H'4028, H'4034, H'403C, H'4040, H'4042]
+
+RX-to-TX Feedback Loops:
+- command-0 write echo and selector-processing loop: present
+  trigger: valid command 0 while FAA2 == 0
+  path: RX validation -> BC69 table write -> BE70 appends selector to F970 -> BCB0/BA26 sends immediate 0x04 echo -> later loc_2806 consumes F970
+  TX outcome: immediate command-4-style echo frame plus possible later selector-driven reports/display work
+  timing/gate: BA26 sets F9C0=0x64 and F9C4=0x07, temporarily delaying queued TX and heartbeat enqueue
+  bench read: a command-0 probe is stateful: it both writes table state and spends time in the post-TX delay, so it can disturb the continuation window being tested
+  evidence: H'BC69, H'BC75, H'BC86, H'BCB0, H'BCCD, H'BA2C, H'BA31, H'BE70, H'2819, H'28A3
+- command-1 readback and previous-frame loop: present
+  trigger: valid command 1 while FAA2 == 0, followed by optional command 7
+  path: RX validation -> BCD7 reads E000[selector] -> BA26 finalizes TX in F858-F85D -> BE05 can copy F858-F85C back to F850-F854
+  TX outcome: direct 0x04 readback, then command 7 can retransmit the exact last finalized TX frame
+  timing/gate: command 1 clears FAA2.7 and never enters continuation handling; it is a readback path, not an ACK path
+  bench read: command 7 after command 1 proves what was last finalized, but does not prove a hidden continuation token by itself
+  evidence: H'BCD7, H'BCEC, H'BCFA, H'BA36, H'BA64, H'BE05, H'BE09, H'BE22
+- retry/error 07 echo loop: present
+  trigger: physical RX error or checksum mismatch while FAA5.7 is set and retry count FAA6 is below two
+  path: RX validation error -> BE29 retry gate -> BE4D stages F850=0x07 and copies RX[1:4] into F851-F854 -> BA26 sends
+  TX outcome: a 0x07 frame that can echo the host payload bytes, independent of E000/E800 table contents
+  timing/gate: after two retries, the ROM loads F9C0=0x1F and clears FAA3/FAA2 instead of sending another echo
+  bench read: visible 07 frames in a noisy/tight timing run can be retry echoes, not necessarily device status or a continuation token
+  evidence: H'BE29, H'BE2D, H'BE33, H'BE37, H'BE3E, H'BE43, H'BE47, H'BE4D, H'BE6A
+- autonomous report to host continuation loop: present
+  trigger: firmware enqueues a serial-visible report via loc_3E54 with R2.7 set
+  path: loc_3E54 appends report selector to F870 -> loc_3FD3 allows BAF2 when FAA2/F9C0 gates are clear -> BAF2 sends report -> command 4/5/6 continuation can advance F9B5
+  TX outcome: autonomous 6-byte report frame built from E800[selector], with FAA2.3/FAA3.7 left set to await host continuation or ACK
+  timing/gate: F9C0 must count down before BAF2 can send, and F9C6/F9C8/BE9E control repeated sends while FAA3.7 remains live
+  bench read: the actual ACK/write target is not just the selector; it is the report that is live under FAA2.3 before TXI/RXI or BE9E clears it
+  evidence: H'3E54, H'3E76, H'3E7A, H'3FD3, H'3FE5, H'3FEB, H'BAF2, H'BB00, H'BB35, H'BB43, H'BB46, H'BB51, H'BD67, H'BDC2, H'BDED
+- selector-processing to report loop: present
+  trigger: command 0/4/selected command 5 calls BE70, or loc_3E54 is called with R2.6 set
+  path: BE70/F970 selector queue -> loc_2806 selector dispatch -> active-selector side path loc_48FA -> loc_3E54 can enqueue report 0x00F6 when E1EC.13 is set
+  TX outcome: possible later serial report produced through the F870/BAF2 loop rather than an immediate response to the original RX frame
+  timing/gate: loc_48FA is gated by FB03.7, F732 values, E1EC.13, and F76E.6 before reaching its indirect table
+  bench read: selector-zero CONNECT work and visible serial reports can be separated in time; lack of immediate TX does not mean the selector queue did nothing
+  evidence: H'BE70, H'BE91, H'2806, H'2819, H'2CAD, H'48FA, H'490F, H'4921, H'4923, H'4926
+- TXI/RXI overlap cancellation loop: present
+  trigger: host RX bytes begin while a report TX is active, FAA2.3 is set, and FAA5.7 is set
+  path: TXI observes FAA2.3 + FAA5.7 + F9C3 != 0 -> clears FAA2.3/FAA3 -> disables TIE -> loads F9C0=0x1F
+  TX outcome: the pending report/continuation state can be canceled before the host command reaches the continuation dispatcher
+  timing/gate: this depends on byte timing relative to TXI and F9C3, so polite emulator injection can miss it
+  bench read: this is a concrete ROM reason why bench timing might see latches/retries while a too-polite emulator reaches cleaner continuation paths
+  evidence: H'BA84, H'BA8A, H'BA90, H'BA96, H'BA9A, H'BA9E, H'BAA2
+- session-expiry to heartbeat/not-active loop: present
+  trigger: any complete six-byte RX frame loads F9C5, then FRT2 decrements it to zero
+  path: RX complete -> F9C5=0x14 -> FRT2 decrements F9C5 -> loc_3FEF clears session/queues and calls 400C -> loc_4046 can later enqueue heartbeat selector 0
+  TX outcome: eventual return to idle heartbeat/report behavior and inactive-session display state
+  timing/gate: F9C4 gates heartbeat enqueue; BA26 reloads it to 0x07 after each send, matching the roughly 700 ms heartbeat cadence
+  bench read: the common CONNECT NOT ACT after arbitrary six-byte traffic is consistent with this expiry/reset loop
+  evidence: H'BB9E, H'BF31, H'BF37, H'3FEF, H'3FFD, H'4003, H'400C, H'4046, H'4067, H'BA31
+
+State Bits:
+- H'FAA2.7: rx_command_in_progress_candidate - set on initial-path parse; cleared by command 0/1/2 exits or by continuation cleanup
+- H'FAA2.3: queued_report_ack_needed_candidate - set by the autonomous queue send path at BB00; continuation command 4/5/6 can advance F9B5 only when this bit was set
+- H'FAA3.7: pending_resend_mask_candidate - set after queued report send; BE9E masks it with FAA5.7 before resend/clear decisions
+- H'FAA4.7: rx_physical_error_latch_candidate - set by SCI1 ERI and tested before checksum dispatch
+- H'FAA5.7: rx_session_gate_candidate - set while F9C5 is alive after a complete RX frame; gates retry/resend and heartbeat/report enqueue behavior
+
+Bench Implications:
+- A standalone command 4 frame from idle should not hit BD0E; command 4 is continuation-only and initial dispatch does not accept it.
+- Command 5 is not a generic always-live ACK. It only performs ACK/session-clear work on the continuation path while FAA2 != 0.
+- A valid six-byte RX frame loads F9C5 with 0x14, which temporarily sets FAA5.7; when that window expires, loc_3FEF can clear queue/session state and call loc_400C.
+- The observed 07 retry/error family can be produced by BE4D from RX[1:4] after error/checksum retry conditions; it is not automatically proof of a table value or a command-4 continuation token.
+- To prove CONNECT OK through serial, the bench has to create or preserve FAA2 != 0 at the moment command 4 arrives, and ideally FAA2.3 if it expects queued-report advancement.
+
+Caveats:
+- This is an address-driven static branch map, not proof of every runtime predicate value.
+- Semantic names are candidates; the branch destinations and RAM side effects are ROM evidence.
+- loc_BE70/F970 and loc_3E54/F870 are separate queues; this report names them separately because mixing them up changes the command-4/5 interpretation.

build/rom_serial_gate.txt

@@ -0,0 +1,145 @@
+H8/536 Serial Gate/Queue State-Machine Reconstruction
+
+Summary: autonomous serial TX/report queue gate
+Confidence: high
+
+Evidence:
+- loc_3FD3 gate into loc_BAF2: present
+  Requires FAA2 == 0, allows the FAA5.bit7 path only when F9C3 == 0, then requires F9C0 == 0 before BSR loc_BAF2.
+  - H'3FD3: TST.B @H'FAA2
+  - H'3FD7: BNE loc_3FEE
+  - H'3FD9: BTST.B #7, @H'FAA5
+  - H'3FDD: BEQ loc_3FE5
+  - H'3FDF: TST.B @H'F9C3
+  - H'3FE3: BNE loc_3FEE
+  - H'3FE5: TST.B @H'F9C0
+  - H'3FE9: BNE loc_3FEE
+  - H'3FEB: BSR loc_BAF2
+- loc_BAF2 queue send gate: present
+  F9B5 is compared against F9B0; inequality enters the send path, reads a queued word via the F9B5-derived index around F870, stages F850-F854, and calls BA26 at BB43.
+  - H'BAF2: MOV:G.B @H'F9B5, R1
+  - H'BAF8: CMP:G.B @H'F9B0, R1
+  - H'BAFC: BNE loc_BB00
+  - H'BAFE: BRA loc_BB56
+  - H'BB00: BSET.B #3, @H'FAA2
+  - H'BB08: MOV:G.W @(-H'0790,R0), R0
+  - H'BB1C: MOV:G.B R1, @H'F850
+  - H'BB20: MOV:G.B R5, @H'F852
+  - H'BB2B: MOV:G.B R5, @H'F851
+  - H'BB39: MOV:G.B R4, @H'F854
+  - H'BB3F: MOV:G.B R4, @H'F853
+  - H'BB43: BSR loc_BA26
+  - H'BB46: MOV:G.W #H'01F4, @H'F9C6
+  - H'BB4C: MOV:G.B #H'14, @H'F9C8
+  - H'BB51: MOV:G.B #H'80, @H'FAA3
+- resend gate/path: present
+  BE9E masks FAA5 with FAA3, waits for F9C6/F9C8 timeout gates, then if FAA3.bit7 remains set clears F9C3 and calls BA26 from BED5.
+  - H'BE9E: MOV:G.B @H'FAA5, R0
+  - H'BEA5: AND.B @H'FAA3, R0
+  - H'BEA9: MOV:G.B R0, @H'FAA3
+  - H'BEAF: CLR.B @H'FAA2
+  - H'BEB5: TST.W @H'F9C6
+  - H'BEBB: TST.B @H'F9C8
+  - H'BEC5: MOV:G.W #H'01F4, @H'F9C6
+  - H'BECB: BTST.B #7, @H'FAA3
+  - H'BED1: CLR.B @H'F9C3
+  - H'BED5: BSR loc_BA26
+- RX/session maintenance: present
+  F9C5 timeout maintenance clears F9B5/F9B0 and FAA5.bit7; RX command processing uses FAA2 as an in-session latch and paths advance F9B5/F9B0 or clear FAA3/FAA2.
+  - H'3FEF: TST.B @H'F9C5
+  - H'3FF5: CLR.B @H'F9B5
+  - H'3FF9: CLR.B @H'F9B0
+  - H'3FFD: BCLR.B #7, @H'FAA5
+  - H'4007: BSET.B #7, @H'FAA5
+  - H'BBCB: CLR.B @H'F9C3
+  - H'BC0F: TST.B @H'FAA2
+  - H'BC15: BSET.B #7, @H'FAA2
+  - H'BC33: CLR.B @H'FAA2
+  - H'BC5C: BCLR.B #3, @H'FAA2
+  - H'BC63: CLR.B @H'FAA3
+  - H'BCD0: BCLR.B #7, @H'FAA2
+  - H'BCFD: BCLR.B #7, @H'FAA2
+  - H'BD04: BCLR.B #7, @H'FAA2
+  - H'BD6D: ADD:Q.B #1, @H'F9B5
+  - H'BD71: BCLR.B #7, @H'F9B5
+  - H'BD75: CLR.B @H'FAA3
+  - H'BD79: CLR.B @H'FAA2
+  - H'BDC8: ADD:Q.B #1, @H'F9B5
+  - H'BDCC: BCLR.B #7, @H'F9B5
+  - H'BDD0: CLR.B @H'FAA3
+  - H'BDD4: CLR.B @H'FAA2
+  - H'BDF3: ADD:Q.B #1, @H'F9B5
+  - H'BDF7: BCLR.B #7, @H'F9B5
+  - H'BDFB: CLR.B @H'FAA3
+  - H'BDFF: CLR.B @H'FAA2
+- loc_4046 idle heartbeat/report gate: present
+  F9C4 gates the idle/default report enqueue. Reset/init loads H'14, each BA26 send reloads H'07, and the FRT2 OCIA handler decrements it; when it reaches zero loc_4046 can enqueue H'0000 if the queue is empty and the FAA5/F9C3 RX gate permits it. With FRT2 OCRA H'7A12 and CKS=phi/32, a phi near 10 MHz gives about 0.7s for H'07, matching the observed heartbeat cadence.
+  - H'4046: TST.B @H'F9C4
+  - H'404A: BNE loc_4058
+  - H'404C: BTST.B #7, @H'FAA5
+  - H'4050: BEQ loc_4059
+  - H'4052: TST.B @H'F9C3
+  - H'4056: BEQ loc_4059
+  - H'4058: RTS
+  - H'4059: MOV:G.B @H'F9B0, R2
+  - H'405F: CMP:G.B @H'F9B5, R2
+  - H'4063: BNE loc_4074
+  - H'4067: MOV:G.W #H'00, @(-H'0790,R2)
+  - H'406C: ADD:Q.B #1, @H'F9B0
+  - H'4070: BCLR.B #7, @H'F9B0
+  - H'40E0: MOV:G.B #H'14, @H'F9C4
+  - H'BA31: MOV:G.B #H'07, @H'F9C4
+  - H'BF23: BCLR.B #5, @FRT2_TCSR
+  - H'BF27: TST.B @H'F9C4
+  - H'BF2D: ADD:Q.B #-1, @H'F9C4
+  Candidate timer roles:
+  - H'F9C4: candidate idle heartbeat/report gate countdown
+  Timer: FRT2 OCIA, H'BF23, OCRA=H'7A12, observed period ~= 700ms
+- FRT1 OCIA periodic tick countdowns: present
+  Static evidence links vector H'0062 to the FRT1 OCIA handler at H'BEEA; the handler clears FRT1_TCSR.OCFA and conditionally decrements H'F9C0, H'F9C1, and H'F9C6.
+  - H'BEEA: BCLR.B #5, @FRT1_TCSR
+  - H'BEEE: TST.B @H'F9C0
+  - H'BEF4: ADD:Q.B #-1, @H'F9C0
+  - H'BEF8: TST.B @H'F9C1
+  - H'BEFE: ADD:Q.B #-1, @H'F9C1
+  - H'BF02: TST.W @H'F9C6
+  - H'BF08: ADD:Q.W #-1, @H'F9C6
+  Candidate timer roles:
+  - H'F9C0: candidate post-TX/report delay countdown
+  - H'F9C1: candidate secondary delay countdown
+  - H'F9C6: candidate periodic report/heartbeat countdown
+
+State address readers/writers:
+- H'F9B0: reads=4 writes=1 read/write=4
+  H'3E60 read MOV:G.B @H'F9B0, R1; H'3E7A read_write ADD:Q.B #1, @H'F9B0; H'3E7E read_write BCLR.B #7, @H'F9B0; H'3E82 read MOV:G.B @H'F9B0, R0; H'3FF9 write CLR.B @H'F9B0; H'4059 read MOV:G.B @H'F9B0, R2
+- H'F9B4: reads=3 writes=0 read/write=4
+  H'280C read CMP:G.B @H'F9B4, R1; H'3EA6 read MOV:G.B @H'F9B4, R1; H'3EC3 read_write ADD:Q.B #1, @H'F9B4; H'3EC7 read_write BCLR.B #5, @H'F9B4; H'BE78 read MOV:G.B @H'F9B4, R1; H'BE95 read_write ADD:Q.B #1, @H'F9B4
+- H'F9B5: reads=4 writes=1 read/write=6
+  H'3E58 read MOV:G.B @H'F9B5, R0; H'3E8B read CMP:G.B @H'F9B5, R0; H'3FF5 write CLR.B @H'F9B5; H'405F read CMP:G.B @H'F9B5, R2; H'BAF2 read MOV:G.B @H'F9B5, R1; H'BD6D read_write ADD:Q.B #1, @H'F9B5
+- H'F9B9: reads=3 writes=1 read/write=0
+  H'2806 read MOV:G.B @H'F9B9, R1; H'2822 write MOV:G.B R1, @H'F9B9; H'3E9E read MOV:G.B @H'F9B9, R0; H'BE70 read MOV:G.B @H'F9B9, R3
+- H'F9C0: reads=3 writes=7 read/write=1
+  H'3FE5 read TST.B @H'F9C0; H'BA26 read TST.B @H'F9C0; H'BA2C write MOV:G.B #H'64, @H'F9C0; H'BAA2 write MOV:G.B #H'1F, @H'F9C0; H'BADA write MOV:G.B #H'09, @H'F9C0; H'BAE1 write MOV:G.B #H'09, @H'F9C0
+- H'F9C1: reads=2 writes=2 read/write=1
+  H'BAED write CLR.B @H'F9C1; H'BB71 read TST.B @H'F9C1; H'BBA3 write MOV:G.B #H'05, @H'F9C1; H'BEF8 read TST.B @H'F9C1; H'BEFE read_write ADD:Q.B #-1, @H'F9C1
+- H'F9C3: reads=6 writes=4 read/write=0
+  H'3FDF read TST.B @H'F9C3; H'4052 read TST.B @H'F9C3; H'BA90 read TST.B @H'F9C3; H'BB77 write CLR.B @H'F9C3; H'BB7D read CMP:G.B #H'05, @H'F9C3; H'BB8A read MOV:G.B @H'F9C3, R1
+- H'F9C4: reads=2 writes=2 read/write=1
+  H'4046 read TST.B @H'F9C4; H'40E0 write MOV:G.B #H'14, @H'F9C4; H'BA31 write MOV:G.B #H'07, @H'F9C4; H'BF27 read TST.B @H'F9C4; H'BF2D read_write ADD:Q.B #-1, @H'F9C4
+- H'F9C5: reads=2 writes=2 read/write=1
+  H'3FEF read TST.B @H'F9C5; H'BB9E write MOV:G.B #H'14, @H'F9C5; H'BEE4 write CLR.B @H'F9C5; H'BF31 read TST.B @H'F9C5; H'BF37 read_write ADD:Q.B #-1, @H'F9C5
+- H'F9C6: reads=2 writes=2 read/write=1
+  H'BB46 write MOV:G.W #H'01F4, @H'F9C6; H'BEB5 read TST.W @H'F9C6; H'BEC5 write MOV:G.W #H'01F4, @H'F9C6; H'BF02 read TST.W @H'F9C6; H'BF08 read_write ADD:Q.W #-1, @H'F9C6
+- H'F9C8: reads=1 writes=1 read/write=1
+  H'BB4C write MOV:G.B #H'14, @H'F9C8; H'BEBB read TST.B @H'F9C8; H'BEC1 read_write ADD:Q.B #-1, @H'F9C8
+- H'FAA2: reads=6 writes=6 read/write=7
+  H'3FD3 read TST.B @H'FAA2; H'BA84 read BTST.B #3, @H'FAA2; H'BA96 read_write BCLR.B #3, @H'FAA2; H'BB00 read_write BSET.B #3, @H'FAA2; H'BC0F read TST.B @H'FAA2; H'BC15 read_write BSET.B #7, @H'FAA2
+- H'FAA3: reads=2 writes=8 read/write=0
+  H'BA9A write CLR.B @H'FAA3; H'BB51 write MOV:G.B #H'80, @H'FAA3; H'BC63 write CLR.B @H'FAA3; H'BD75 write CLR.B @H'FAA3; H'BDD0 write CLR.B @H'FAA3; H'BDFB write CLR.B @H'FAA3
+- H'FAA5: reads=5 writes=0 read/write=2
+  H'3FD9 read BTST.B #7, @H'FAA5; H'3FFD read_write BCLR.B #7, @H'FAA5; H'4007 read_write BSET.B #7, @H'FAA5; H'404C read BTST.B #7, @H'FAA5; H'BA8A read BTST.B #7, @H'FAA5; H'BE2D read BTST.B #7, @H'FAA5
+
+Caveats:
+- Observed report indexes 0x0007 and 0x0015 are capture overlays/runtime queue entries; this analyzer does not treat them as statically proven ROM constants.
+- Queue entries near F870 are reached through RAM-indexed addressing; static JSON proves the access pattern, not the runtime queue contents.
+- Branch predicates are summarized from local instruction order and targets; this is not an emulator trace.

build/rom_serial_pseudocode.c

@@ -0,0 +1,830 @@
+/*
+ * H8/536 focused SCI RX/TX pseudocode from build\rom_decompiled.json
+ *
+ * This is a protocol-oriented reconstruction from decompiler JSON metadata.
+ * It is intentionally phrased as candidate behavior: it summarizes evidence
+ * from the ROM without claiming source-level intent or a proven packet format.
+ */
+
+/* Candidate summary:
+ * - SCI1 TX 6-byte frame at H'F858-H'F85D: confidence high (0.95)
+ *   reason: all required independent evidence groups were observed
+ * - SCI1 RX 6-byte frame captured at H'F868-H'F86D: confidence high (0.9)
+ *   reason: RX count, copy, and checksum-validation evidence were observed; no explicit header/sync byte was identified
+ *   caveat: candidate frame means six consecutive bytes within the observed RX timing/state machine, not a proven delimited packet
+ */
+
+/* Board path:
+ * Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+ * - TXD: H8 pin 66 P95/TXD <-> MAX202 pin 11
+ *   evidence: MAX202 pin 11 traces to H8 pin 66
+ * - RXD: H8 pin 67 P96/RXD <-> MAX202 pin 12
+ *   evidence: MAX202 pin 12 traces to H8 pin 67
+ */
+
+/* Manual anchors used by the decompiler metadata:
+ * - Manual/0900766b802125d0.md:15748 SCI register map for RDR/TDR/SCR/SSR
+ * - Manual/0900766b802125d0.md:15794 RDR stores received data and is CPU-readable
+ * - Manual/0900766b802125d0.md:15823 TDR holds the next byte to transmit
+ * - Manual/0900766b802125d0.md:15976 SCR.TIE enables/disables TXI on TDRE
+ * - Manual/0900766b802125d0.md:15993 SCR.RIE enables RXI and ERI
+ * - Manual/0900766b802125d0.md:16008 SCR.TE enables the transmitter
+ * - Manual/0900766b802125d0.md:16028 SCR.RE enables the receiver
+ * - Manual/0900766b802125d0.md:16090 SSR flags are cleared by writing zero
+ * - Manual/0900766b802125d0.md:16100 SSR.TDRE means TDR can accept the next byte
+ * - Manual/0900766b802125d0.md:16116 SSR.RDRF means received data reached RDR
+ * - Manual/0900766b802125d0.md:16127 SSR.ORER reports receive overrun
+ * - Manual/0900766b802125d0.md:16140 SSR.FER reports framing errors
+ * - Manual/0900766b802125d0.md:16147 SSR.PER reports parity errors
+ * - Manual/0900766b802125d0.md:2417 FP-80 H8/536 pin 66 is P95/TXD
+ * - Manual/0900766b802125d0.md:2418 FP-80 H8/536 pin 67 is P96/RXD
+ * - Manual/0900766b802125d0.md:11192 Port 9 carries SCI1 and SCI2 serial signals
+ * - Manual/0900766b802125d0.md:11201 P96 is RXD1 input
+ * - Manual/0900766b802125d0.md:11202 P95 is TXD1 output
+ * - Manual/0900766b802125d0.md:15725 SCI1 RXD input pin
+ * - Manual/0900766b802125d0.md:15726 SCI1 TXD output pin
+ * - Manual/0900766b802125d0.md:15750 SCI register table starts with SCI1 RDR/TDR/SMR/SCR/SSR/BRR
+ * - Manual/0900766b802125d0.md:15758 SCI register table lists SCI2 RDR/TDR/SMR/SCR/SSR/BRR
+ * - Manual/0900766b802125d0.md:15794 RDR receive data register
+ * - Manual/0900766b802125d0.md:15823 TDR transmit data register
+ * - Manual/0900766b802125d0.md:15969 SCR enables and disables SCI functions
+ * - Manual/0900766b802125d0.md:16009 SCR.TE makes the TXD pin output
+ * - Manual/0900766b802125d0.md:16029 SCR.RE makes the RXD pin input
+ * - Manual/0900766b802125d0.md:16090 SSR contains transmit/receive status flags
+ * - Manual/0900766b802125d0.md:10560 SYSCR2 controls port 9 pin functions
+ * - Manual/0900766b802125d0.md:10631 SYSCR2.P9SCI2E controls the SCI2 functions of P92-P94
+ */
+
+/* SCI1 link layer:
+ * - 8E1 SCI characters carry the 6 protocol bytes; async 8-bit even parity 1 stop, clock internal, SMR=H'24, BRR=H'07, SCR=H'3C
+ * - baud is clock-dependent; pass --clock-hz on the decompiler for bps.
+ * - No SCI1 RXI/TXI DTC vector entries are present in JSON; RX/TX are modeled as CPU ISR paths.
+ */
+
+#include <stdbool.h>
+#include <stdint.h>
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+
+#define BIT(n) (1u << (n))
+extern volatile u8 MEM8[0x10000];
+
+#define SCI1_SCR MEM8[0xFEDAu]
+#define SCI1_TDR MEM8[0xFEDBu]
+#define SCI1_SSR MEM8[0xFEDCu]
+#define SCI1_RDR MEM8[0xFEDDu]
+
+#define SCI_SCR_TIE 0x80u
+#define SCI_SCR_RIE 0x40u
+#define SCI_SCR_TE  0x20u
+#define SCI_SCR_RE  0x10u
+#define SCI_SSR_TDRE 0x80u
+#define SCI_SSR_RDRF 0x40u
+#define SCI_SSR_ORER 0x20u
+#define SCI_SSR_FER  0x10u
+#define SCI_SSR_PER  0x08u
+
+#define SCI1_TX_FRAME_LENGTH 6u
+#define SCI1_TX_FRAME_BASE 0xF858u
+#define SCI1_TX_FRAME_BYTE(n) MEM8[(u16)(SCI1_TX_FRAME_BASE + (n))]
+#define SCI1_TX_FRAME_CHECKSUM SCI1_TX_FRAME_BYTE(5u)
+#define SCI1_TX_INDEX MEM8[0xF9C2u]
+#define TX_FRAME_LENGTH SCI1_TX_FRAME_LENGTH
+#define TX_FRAME(n) MEM8[(u16)(0xF858u + (n))]
+#define TX_INDEX SCI1_TX_INDEX
+
+#define RX_FRAME_LENGTH 6u
+#define RX_CAPTURE(n) MEM8[(u16)(0xF868u + (n))]
+#define RX_FRAME(n) MEM8[(u16)(0xF860u + (n))]
+#define RX_INDEX MEM8[0xF9C3u]
+#define RX_INTERBYTE_TIMEOUT MEM8[0xF9C1u]
+#define RX_COMPLETE_TIMER MEM8[0xF9C5u]
+#define RX_ERROR_LATCH MEM8[0xFAA4u]
+#define RX_ERROR_LATCH_PHYSICAL_ERROR 0x80u
+
+/* Candidate Protocol Semantics
+ * confidence: medium-high (0.9)
+ * caveat: Semantic names are candidates only. The analyzer reports byte roles, command values, dispatch targets, and response staging patterns observed in code; it does not prove source-level intent or protocol documentation.
+ * byte layout:
+ * - byte0: op_flags (medium-high) - low three bits select a command; upper bits are preserved or gated in some paths
+ * - byte1: addr_page_flags (medium) - candidate high/page byte for logical point/index; bit 7 is tested as a control flag
+ * - byte2: addr_offset (medium) - candidate low/offset byte for logical point/index
+ * - byte3: value_hi (medium) - candidate high byte of a word value
+ * - byte4: value_lo (medium) - candidate low byte of a word value
+ * - byte5: checksum (high) - 0x5A-seeded XOR of bytes 0..4
+ * dispatch: command_low3 = RX_FRAME(0) & 0x07; observed H'00, H'01, H'02, H'04, H'05, H'06, H'07
+ * dispatcher split: FAA2 == 0 accepts initial/idle commands H'00, H'01, H'02, H'07; FAA2 != 0 accepts continuation commands H'04, H'05, H'06, H'07
+ * dispatcher caveat: Initial dispatch follows checksum validation and RX error handling. Command 1 is only on the initial/idle path and is also gated by F861.bit7 == 0.
+ * dispatch evidence: H'BC08, H'BC0C, H'BC20, H'BC22, H'BC24, H'BC26, H'BC29, H'BC2B, H'BC2E, H'BC30, H'BC45, H'BC47, H'BC4A, H'BC4C, H'BC4F, H'BC51, H'BC54, H'BC56
+ * index decoder: RX[1:2] -> logical index via loc_622B (medium)
+ * command candidates:
+ * - H'00 set_value_acked: candidate write of RX[3:4] into primary/current tables, followed by a response; handler H'BC69; responses response_at_BCCD
+ *   availability: valid checksum/no RX physical error && FAA2 == 0
+ * - H'01 read_value: initial/idle-path primary table read only, followed by an odd response staging sequence; handler H'BCD7; responses response_at_BCFA
+ *   availability: valid checksum/no RX physical error && FAA2 == 0 && F861.bit7 == 0
+ *   note: Only accepted on the initial/idle dispatcher path: valid checksum/no RX error, FAA2 == 0, and F861.bit7 == 0.
+ *   note: BCD7 stages F850=0x04, writes F851 from F861 and then overwrites F851 from F862.
+ *   note: BCD7 reads the primary table word at E000 + 2*selector; F854 receives the low byte and F853 receives the high byte.
+ *   note: F852 is not freshly written in the BCD7 handler, so do not describe the response as a fixed 04 00 QQ hi lo frame.
+ * - H'02 clear_or_abort: candidate clear/abort path with no immediate response builder; handler H'BD04; responses none
+ *   availability: valid checksum/no RX physical error && FAA2 == 0
+ * - H'04 set_value_no_immediate_reply: candidate write/update path that stores a value without an immediate serial response; handler H'BD0E; responses none
+ *   availability: valid checksum/no RX physical error && FAA2 != 0
+ * - H'05 ack_or_clear_pending: continuation-only conditional acknowledgement/session clear path; handler H'BD80; responses none
+ *   availability: valid checksum/no RX physical error && FAA2 != 0
+ *   note: Only accepted on the continuation dispatcher path when FAA2 != 0.
+ *   note: For selector 0x0040, frame 05 00 40 00 00 1F performs no response staging.
+ *   note: The handler clears FAA3/FAA2; F9B5 advances only when FAA2.bit3 was set from a queued report.
+ *   note: If FAA2 == 0, command 5 falls through the initial dispatcher instead of doing acknowledgement work.
+ * - H'06 set_secondary_value: candidate secondary-table value write path; handler H'BDDB; responses none
+ *   availability: valid checksum/no RX physical error && FAA2 != 0
+ * - H'07 retransmit_or_error_reply: candidate retransmit path; retry/error handling also builds a command 0x07 RX-payload echo; handler H'BE05; responses response_at_BE22
+ *   availability: valid checksum/no RX physical error && FAA2 == 0 OR valid checksum/no RX physical error && FAA2 != 0
+ *   note: loc_BE4D is a retry/error echo path: F850=0x07 and F861-F864 are copied into F851-F854 before loc_BA26.
+ *   note: Observed frame 07 80 40 20 90 2D means RX bytes F861-F864 were 80 40 20 90; it is not a table value.
+ * command effects:
+ * - H'00 set_value_acked: Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response.
+ *   effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000
+ *   effect: table_write_candidate; target current_value_table_candidate; source same candidate value written to the primary table; table H'E800
+ *   effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00
+ *   evidence: H'BC08, H'BC0C, H'BC20, H'BC22, H'BCB0, H'BCB9, H'BCC1, H'BCC9, H'BCB5, H'BCBD, H'BCC5, H'BCCD
+ * - H'01 read_value: Initial/idle candidate read: reads the primary table and stages an odd value response with F852 possibly stale.
+ *   effect: table_read_candidate; target primary_value_table_candidate; table H'E000
+ *   effect: response_staging_candidate; stage F850-F854 and call loc_BA26
+ *   evidence: H'BC08, H'BC0C, H'BC24, H'BC26, H'BCD7, H'BCE0, H'BCE8, H'BCF0, H'BCF6, H'BCDC, H'BCE4, H'BCFA
+ * - H'02 clear_or_abort: Candidate clear/abort: clears serial session state without an observed immediate response.
+ *   effect: state_clear_candidate; target serial_session_flags_candidate; clear bit 7; state H'FAA2
+ *   evidence: H'BC08, H'BC0C, H'BC29, H'BC2B
+ * - H'04 set_value_no_immediate_reply: Candidate deferred set: writes value bytes and flags the index without an observed immediate response.
+ *   effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000
+ *   effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00
+ *   evidence: H'BC08, H'BC0C, H'BC45, H'BC47
+ * - H'05 ack_or_clear_pending: Continuation-only ACK/session clear: clears FAA3/FAA2 and only advances F9B5 when queued-report FAA2.bit3 was set; selector 0x0040 has no response.
+ *   effect: conditional_ack_session_clear_candidate; target selected event/pending state; when FAA2 != 0, clear FAA3/FAA2; advance F9B5 only if FAA2.bit3 was set from queued-report state; selector 0x0040 stages no response; selector H'0040 has no response
+ *   evidence: H'BC08, H'BC0C, H'BC4A, H'BC4C
+ * - H'06 set_secondary_value: Candidate secondary set: writes value bytes to the secondary table and flags the index.
+ *   effect: table_write_candidate; target secondary_value_table_candidate; source RX[3:4] value bytes; table H'E400
+ *   effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 6; table H'EC00
+ *   evidence: H'BC08, H'BC0C, H'BC4F, H'BC51
+ * - H'07 retransmit_or_error_reply: Candidate retransmit/error reply: reuses prior TX bytes or copies RX payload bytes behind an explicit 0x07 retry/error echo.
+ *   effect: retransmit_candidate; target TX staging bytes H'F850-H'F854 before loc_BA26; source previous TX frame bytes H'F858-H'F85C
+ *   effect: retry_error_echo_candidate; target F850=0x07, F851-F854=F861-F864 before loc_BA26; source RX payload bytes F861-F864; 07 80 40 20 90 2D echoes RX payload 80 40 20 90; it is not a table value
+ *   effect: response_staging_candidate; stage F850-F854 and call loc_BA26
+ *   evidence: H'BC08, H'BC0C, H'BC2E, H'BC30, H'BC54, H'BC56, H'BE09, H'BE11, H'BE19, H'BE22
+ * response schemas:
+ * - response_at_BB43: byte0=computed; byte1=computed; byte2=computed; byte3=current_value_table_candidate; byte4=current_value_table_candidate
+ *   evidence: H'BB1C, H'BB2B, H'BB20, H'BB3F, H'BB39
+ * - response_at_BCCD: byte0=0x04; byte1=rx[1]; byte2=rx[2]; byte3=rx[3]; byte4=rx[4]
+ *   evidence: H'BCB0, H'BCB9, H'BCC1, H'BCC9
+ * - response_at_BCFA: byte0=0x04; byte1=rx[2]; byte2=stale/unchanged; byte3=primary_value_table_candidate; byte4=primary_value_table_candidate
+ *   note: Command 1 BCD7 staging is odd: F850=0x04; F851 is written from F861 then overwritten by F862.
+ *   note: The primary table word is read from E000 + 2*selector; F854/F853 receive low/high value bytes.
+ *   note: F852 may be stale or unchanged in this handler; avoid a fixed 04 00 QQ hi lo response shape.
+ *   evidence: H'BCD7, H'BCE8, H'BCF6, H'BCF0
+ * - response_at_BE22: byte0=tx[0]; byte1=tx[1]; byte2=tx[2]; byte3=tx[3]; byte4=tx[4]
+ *   evidence: H'BE09, H'BE11, H'BE19
+ * - ... 1 more candidate response schemas
+ * table map candidates:
+ * - primary_value_table_candidate at H'E000 (word_value); observed read, write
+ *   evidence: H'19E3, H'1A03, H'1A3D, H'1A6B, H'3F8C, H'4077, H'BC75, H'BC95, H'BCEC, H'BD1A, H'BD35
+ * - secondary_value_table_candidate at H'E400 (word_value); observed read, write
+ *   evidence: H'19AA, H'1A4B, H'1A5B, H'1A81, H'1AB4, H'1AC1, H'407B, H'BDE5
+ * - current_value_table_candidate at H'E800 (word_value); observed read, write
+ *   evidence: H'1A09, H'1A71, H'3F90, H'407F, H'BB35, H'BC79, H'BC99, H'BD1E
+ * - flag_table_candidate at H'EC00 (bit_flags); observed write
+ *   evidence: H'4088, H'BC82, H'BC9D, H'BD22, H'BD39, H'BDE9
+ * panel selector semantics:
+ * - 0x0013 slave_and_iris_mblack_link_lamps: Selector 0x0013 is a two-bit lamp/status word. ROM dispatch H'2E06 reads current table word H'E826 and fans bit 15 and bit 14 into panel latch RAM.
+ *   current word: H'E826; dispatch: H'2E06
+ *   0x8000 -> SLAVE lamp: sets F791.6 and F713.4; RAM F791.6, F713.4
+ *   0x4000 -> IRIS/M.BLACK LINK lamp: sets F791.5 and F716.7; RAM F791.5, F716.7
+ *   observed values: 0x8000 SLAVE lamp on; 0x4000 IRIS/M.BLACK LINK lamp on; 0x0000 SLAVE and IRIS/M.BLACK LINK latch bits clear through H'2E06
+ *   state machine: iris_mblack_link_closed_loop_state_candidate: Bench-proven closed loop: the RCP reports local IRIS/M.BLACK LINK intent, the CCU ACKs selector 0x0013, then the CCU mirrors the accepted selector state back with command 0. The mirrored state controls the next toggle direction.
+ *   frames: active report 00 00 13 40 00 09; clear report 00 00 13 00 00 49; ACK 05 00 13 00 00 4C; mirror active 00 00 13 40 00 09; mirror clear 00 00 13 00 00 49
+ *   local trigger candidates: provisional_iris_mblack_link_button_toggle_report F006.7 / F6DB.7: When F6DB.7 is asserted and F731 <= 3, the ROM toggles current-table bit 14 at H'E826 based on F791.5, then queues selector 0x0013 through loc_3E54.; H'1FE8/H'1FFB: Adjacent local helpers set or clear current-table bit 15 at H'E826 and queue selector 0x0013.
+ *   evidence: bench: 00 00 13 80 00 C9 lights far-right SLAVE lamp, bench: 00 00 13 40 00 09 lights IRIS/M.BLACK LINK lamp, ROM: H'2E06-H'2E32 tests H'E826 bits 15/14 and sets/clears F791/F713/F716 latch bits
+ * - 0x0015 call_and_red_tally_lamp_lane: Bench-visible CALL lamp and red tally lane; local CALL handler mirrors F6DB.5 into E800[0x0015].15.
+ *   current word: H'E82A; dispatch: handler unknown
+ *   observed values: 0x8000 CALL lamp and red tally on; 0x0000 CALL inactive/clear report
+ *   evidence: bench: 00 00 15 80 00 CF lights CALL and red tally, ROM: H'20A1-H'20BA reads F6DB.5, writes H'E82A, and queues selector 0x0015
+ * - 0x0017 bars_lamp_lane: Bench-visible BARS lamp/latch lane; low writes do not reliably clear the visible latch.
+ *   current word: H'E82E; dispatch: handler unknown
+ *   observed values: 0x8000 BARS lamp on; 0x4000 BARS lamp/latch on; 0x0000 BARS low write; visible latch may remain
+ *   evidence: bench: 00 00 17 80 00 CD lights BARS, bench: 00 00 17 40 00 0D also lights the BARS latch in neighbor sweep, ROM: H'1EDE can queue selector 0x0017 from F6D4.2
+ * - 0x001A monitor_selector_lamps: Bench-visible MONITOR selector cluster found from ROM-derived button-output sweep.
+ *   current word: H'E834; dispatch: handler unknown
+ *   observed values: 0x0808 MONITOR ENC lamp; 0x2020 MONITOR B lamp; 0x4040 MONITOR G lamp; 0x8080 MONITOR R lamp
+ *   evidence: bench: 00 00 1A 08 08 40 lights MONITOR ENC, bench: 00 00 1A 20 20 40 lights MONITOR B, bench: 00 00 1A 40 40 40 lights MONITOR G, bench: 00 00 1A 80 80 40 lights MONITOR R, ROM: H'1CB2-H'1D56 writes packed values to H'E834 and queues selector 0x001A
+ * - 0x0024 lcd_selector_button_lamp: Bench-visible LCD selector-button lamp lane.
+ *   current word: H'E848; dispatch: dispatch unknown
+ *   observed values: 0x8000 LCD selector-button lamp visible; 0x0000 lamp remained visible at 0.5 s in isolation run
+ * - 0x006B standard_lamp_lane: Bench-visible STANDARD lamp lane found from ROM-derived F6D4.6 handler candidate.
+ *   current word: H'E8D6; dispatch: handler unknown
+ *   observed values: 0x8000 STANDARD lamp on
+ *   evidence: bench: 00 00 6B 80 00 B1 lights STANDARD, ROM: H'2048 can write H'E8D6=0x8000 and queue selector 0x006B from F6D4.6
+ * - ... 5 more panel selector annotations
+ * state variable candidates:
+ * - event_queue_read_cursor_candidate H'F9B4: reads 1, writes 2; bits 5
+ *   evidence: H'BE78, H'BE95, H'BE99
+ * - event_queue_write_or_pending_cursor_candidate H'F9B5: reads 2, writes 6; bits 7
+ *   evidence: H'405F, H'BAF2, H'BD6D, H'BD71, H'BDC8, H'BDCC, H'BDF3, H'BDF7
+ * - event_queue_base_or_current_slot_candidate H'F9B9: reads 1, writes 0
+ *   evidence: H'BE70
+ * - serial_tx_busy_timer_candidate H'F9C0: reads 2, writes 8
+ *   evidence: H'BA26, H'BA2C, H'BAA2, H'BADA, H'BAE1, H'BAE8, H'BE1D, H'BE3E, H'BEEE, H'BEF4
+ * - idle_heartbeat_gate_countdown_candidate H'F9C4: reads 2, writes 3
+ *   evidence: H'4046, H'40E0, H'BA31, H'BF27, H'BF2D
+ * - rx_session_timeout_candidate H'F9C5: reads 1, writes 3
+ *   evidence: H'BB9E, H'BEE4, H'BF31, H'BF37
+ * - ... 7 more state-variable candidates
+ * retry/error model candidate:
+ * - checksum path: 0x5A-seeded XOR over RX[0..4] differs from RX[5] -> loc_BE29
+ * - retry path: counter H'FAA6, threshold 2; Candidate retry path clears/consults serial flags, increments FAA6, compares it with 2, and when still below the apparent limit enters loc_BE4D to stage a command 0x07 retry/error echo of RX payload bytes F861-F864.
+ *   echo path: loc_BE4D: F850=0x07; F851-F854=F861-F864
+ *   echo caveat: 07 80 40 20 90 2D echoes RX payload 80 40 20 90 and is not a table value.
+ * - command 0x07 path: Candidate retransmit/explicit command 0x07 path either copies previous TX frame bytes back to F850-F854 or stages an observed 0x07 response before loc_BA26.
+ * - evidence: H'BBD8, H'BBDC, H'BBE0, H'BBE4, H'BBE8, H'BBEC, H'BBF0, H'BE4D, H'BE56, H'BE5E, H'BE66, H'BE52, H'BE5A, H'BE62, H'BE6A, H'BE29, H'BE2D, H'BE33, H'BE37, H'BE43, H'BE47, H'BE05, H'BE0D, H'BE15, H'BE09, H'BE11, H'BE19, H'BE22
+ * gate/queue state machine candidate:
+ * - main_loop_may_enter_report_builder: FAA2 == 0 && F9C0 == 0 && ((FAA5.bit7 == 0) || (F9C3 == 0)); Main-loop report gate; session must be idle, TX busy timer clear, and RX gate open.
+ * - idle_heartbeat_report_may_enqueue: F9C4 == 0 && ((FAA5.bit7 == 0) || (F9C3 == 0)) && F9B0 == F9B5; Idle/default report gate; when the FRT2 countdown clears and the queue is empty, loc_4046 can enqueue H'0000 for the later loc_BAF2 -> loc_BA26 send path.
+ *   enqueues report H'0000
+ *   write semantics: loc_4067 is MOV:G.W #H'00, @(-H'0790,R2): the byte immediate is zero-extended by the word destination, so the queue slot becomes H'0000.
+ *   runtime-confirmed frame 00 00 00 00 80 DA via loc_4046 -> loc_BAF2 -> loc_BB08 -> loc_BB1C -> loc_BB20 -> loc_BB2B -> loc_BA26
+ * - queue_has_pending_report: F9B5 != F9B0; Queue/pending cursor gate; non-empty state stages through BB43 before loc_BA26.
+ * - periodic_resend_may_fire: (FAA5 & FAA3 & 0x80) != 0 && F9C6 == 0 && F9C8 != 0 after countdown; Resend gate masks pending state with FAA5, checks F9C6/F9C8, then calls BA26 at BED5.
+ * - rx_completion_sets_session_timer: RX completion sets F9C5 (observed reload H'14) after the sixth byte is captured.
+ * - session_timeout_clears_gate_and_queue: When F9C5 is clear, loc_3FEF clears F9B5/F9B0 and clears FAA5.bit7; when nonzero, it sets FAA5.bit7.
+ * - idle_heartbeat_gate_initial_delay_loaded: Startup/init loads F9C4 with H'14 before the first idle/default report can be queued.
+ * - idle_heartbeat_gate_post_send_delay_loaded: loc_BA26 reloads F9C4 with H'07 after each send, matching the observed heartbeat spacing.
+ * - host_ack_can_advance_queue: Command 0x05 is a continuation-only ACK/session clear path: it clears FAA3/FAA2 and advances F9B5 only when queued-report FAA2.bit3 was set. Selector 0x0040 has no response; if FAA2 == 0 the command falls through instead of doing ACK work.; commands H'05
+ * - caveat: Many panel controls may require host/session traffic before reporting. Observed autonomous call/camera-power indexes are runtime/capture overlays, not ROM constants.
+ * - evidence: H'3FD3, H'3FD7, H'3FD9, H'3FDD, H'3FDF, H'3FE3, H'3FE5, H'3FE9, H'3FEB, H'3FEF, H'3FF3, H'3FF5, H'3FF9, H'3FFD, H'4001, H'4003, H'4005, H'4007, H'4046, H'404A, H'404C, H'4050, H'4052, H'4056, H'4058, H'4059, H'405D, H'405F, H'4063, H'4065, H'4067, H'406C, H'4070, H'BAF2, H'BAF6, H'BAF8, H'BAFC, H'BAFE, H'BB00, H'BB04, H'BB06, H'BB08, H'BB0C, H'BB0E, H'BB11, H'BB13, H'BB15, H'BB17, H'BB19, H'BB1C, H'BB20, H'BB24, H'BB26, H'BB29, H'BB2B, H'BB2F, H'BB33, H'BB35, H'BB39, H'BB3D, H'BB3F, H'BB43, H'BE9E, H'BEA2, H'BEA5, H'BEA9, H'BEAD, H'BEAF, H'BEB3, H'BEB5, H'BEB9, H'BEBB, H'BEBF, H'BEC1, H'BEC5, H'BECB, H'BECF, H'BED1, H'BED5
+ * TX/autonomous report model candidate:
+ * - loc_BB43 -> loc_BA26: bytes 0..2 encode candidate logical index/report id; bytes 3..4 come from current_value_table_candidate; byte5 is 0x5A XOR checksum
+ * - observed overlay candidates: heartbeat_or_idle_report_candidate: 00 00 00 00 80 DA; call_button_report_candidate: 00 00 15 80 00 CF, 00 00 15 00 00 4F; camera_power_report_candidate: 00 00 07 80 00 DD
+ * - runtime confirmation: idle_heartbeat_report_runtime_confirmation: report H'0000 emits 00 00 00 00 80 DA; MOV:G.W #H'00 writes H'0000 to the queue slot
+ * - consistency idle_heartbeat_report_id_width: pass; Decompiler mnemonic MOV:G.W and emulator execution now agree that the H'00 immediate at loc_4067 is zero-extended to report H'0000.
+ * - caveat: Real captures supplied so far show only heartbeat/idle, call, and camera-power autonomous TX frames. Other panel controls may require a host/device request or state transition before the firmware reports them.
+ * - evidence: H'BB1C, H'BB20, H'BB2B, H'BB39, H'BB3F, H'BB43
+ * heartbeat/periodic resend candidate:
+ * - F9C6 reload H'01F4: Candidate periodic report/heartbeat timer reload.
+ * - F9C8 reload H'14: Candidate periodic resend countdown/retry spacing value.
+ * - FAA3 mask H'80: Candidate bit/mask that marks an autonomous report pending.
+ * - BED5 resend path: Candidate periodic resend path feeding the TX staging/send-builder flow.
+ * - evidence: H'BB46, H'BEC5, H'BB4C, H'BB51, H'BECB, H'BED5
+ * interrupt/timer architecture candidate:
+ * - FRT1 OCIA H'BEEA: Candidate periodic tick ISR for serial busy, interbyte, and resend counters.
+ * - FRT2 OCIA H'BF23: Candidate periodic tick ISR for idle heartbeat/report and RX session counters.
+ * - H'F9C0 tx_report_gate_counter_candidate: candidate gate counter used before entering the report builder.
+ * - H'F9C1 rx_interbyte_timeout_candidate: candidate RX interbyte timeout counter.
+ * - H'F9C6 periodic_resend_cadence_counter_candidate: candidate periodic resend/heartbeat cadence counter.
+ * - H'F9C4 idle_heartbeat_gate_countdown_candidate: candidate idle/default report enqueue countdown.
+ * - H'F9C5 rx_session_timeout_candidate: candidate RX/session maintenance timeout counter.
+ * - evidence: H'BEEA, H'BEEE, H'BEF2, H'BEF4, H'BEF8, H'BEFC, H'BEFE, H'BF02, H'BF06, H'BF08, H'BF23, H'BF27, H'BF2B, H'BF2D, H'BF31, H'BF35, H'BF37
+ */
+
+static u8 sci1_rx_candidate_command(void)
+{
+    return (u8)(RX_FRAME(0) & 0x07u);
+}
+
+static u16 sci1_rx_candidate_value(void)
+{
+    return (u16)(((u16)RX_FRAME(3) << 8) | RX_FRAME(4));
+}
+
+static u16 sci1_rx_candidate_logical_index(void)
+{
+    u8 page = RX_FRAME(1);
+    u8 offset = RX_FRAME(2);
+
+    if (page == 0u && offset <= 0x7Fu) {
+        return offset;
+    }
+    if (page == 1u) {
+        return (u16)(0x0080u + offset);
+    }
+    if (page == 2u && offset <= 0x7Fu) {
+        return (u16)(0x0180u + offset);
+    }
+    return 0x01FFu;
+}
+
+static bool sci1_candidate_main_report_gate_open(void)
+{
+    bool session_idle = MEM8[0xFAA2u] == 0u;
+    bool rx_gate_open = (MEM8[0xFAA5u] & 0x80u) == 0u || MEM8[0xF9C3u] == 0u;
+    bool tx_timer_clear = MEM8[0xF9C0u] == 0u;
+
+    return session_idle && rx_gate_open && tx_timer_clear;
+}
+
+static bool sci1_candidate_report_queue_nonempty(void)
+{
+    return MEM8[0xF9B5u] != MEM8[0xF9B0u];
+}
+
+static bool sci1_candidate_idle_heartbeat_enqueue_gate_open(void)
+{
+    bool idle_timer_clear = MEM8[0xF9C4u] == 0u;
+    bool rx_gate_open = (MEM8[0xFAA5u] & 0x80u) == 0u || MEM8[0xF9C3u] == 0u;
+    bool queue_empty = MEM8[0xF9B0u] == MEM8[0xF9B5u];
+
+    return idle_timer_clear && rx_gate_open && queue_empty;
+}
+
+static void sci1_candidate_enqueue_idle_heartbeat_report(void)
+{
+    if (!sci1_candidate_idle_heartbeat_enqueue_gate_open()) {
+        return;
+    }
+
+    /* loc_4067 writes MOV:G.W #H'00, so the queue report id is 0x0000. */
+    candidate_enqueue_report(0x0000u);
+}
+
+static bool sci1_candidate_periodic_resend_gate_open(void)
+{
+    bool pending = (MEM8[0xFAA5u] & MEM8[0xFAA3u] & 0x80u) != 0u;
+    bool period_elapsed = MEM8[0xF9C6u] == 0u && MEM8[0xF9C7u] == 0u;
+    bool resend_countdown_active = MEM8[0xF9C8u] != 0u;
+
+    return pending && period_elapsed && resend_countdown_active;
+}
+
+void frt1_ocia_candidate_tick_isr(void)
+{
+    /* Candidate periodic tick at H'BEEA: decrement nonzero serial counters. */
+    /* TX_REPORT_GATE_COUNTER_CANDIDATE: candidate gate counter used before entering the report builder. */
+    if (MEM8[0xF9C0u] != 0u) {
+        MEM8[0xF9C0u] = (u8)(MEM8[0xF9C0u] - 1u);
+    }
+
+    /* RX_INTERBYTE_TIMEOUT_CANDIDATE: candidate RX interbyte timeout counter. */
+    if (MEM8[0xF9C1u] != 0u) {
+        MEM8[0xF9C1u] = (u8)(MEM8[0xF9C1u] - 1u);
+    }
+
+    /* PERIODIC_RESEND_CADENCE_COUNTER_CANDIDATE: candidate periodic resend/heartbeat cadence counter. */
+    if (MEM8[0xF9C6u] != 0u) {
+        MEM8[0xF9C6u] = (u8)(MEM8[0xF9C6u] - 1u);
+    }
+
+}
+
+void frt2_ocia_candidate_tick_isr(void)
+{
+    /* Candidate periodic tick at H'BF23: decrement nonzero serial counters. */
+    /* IDLE_HEARTBEAT_GATE_COUNTDOWN_CANDIDATE: candidate idle/default report enqueue countdown. */
+    if (MEM8[0xF9C4u] != 0u) {
+        MEM8[0xF9C4u] = (u8)(MEM8[0xF9C4u] - 1u);
+    }
+
+    /* RX_SESSION_TIMEOUT_CANDIDATE: candidate RX/session maintenance timeout counter. */
+    if (MEM8[0xF9C5u] != 0u) {
+        MEM8[0xF9C5u] = (u8)(MEM8[0xF9C5u] - 1u);
+    }
+
+}
+
+static void sci1_candidate_panel_selector_annotation(u16 logical_index, u16 value)
+{
+    /* Known bench/ROM selector labels. This helper is commentary for the decompile. */
+    switch (logical_index) {
+    case 0x0013u:
+        /* 0x0013 slave_and_iris_mblack_link_lamps; current word H'E826; H'2E06. */
+        if ((value & 0x8000u) != 0u) {
+            /* SLAVE lamp: sets F791.6 and F713.4. */
+        } else {
+            /* SLAVE lamp: clears F791.6 and F713.4. */
+        }
+        if ((value & 0x4000u) != 0u) {
+            /* IRIS/M.BLACK LINK lamp: sets F791.5 and F716.7. */
+        } else {
+            /* IRIS/M.BLACK LINK lamp: clears F791.5 and F716.7. */
+        }
+        if (value == 0x8000u) {
+            /* SLAVE lamp on. */
+        }
+        if (value == 0x4000u) {
+            /* IRIS/M.BLACK LINK lamp on. */
+        }
+        if (value == 0x0000u) {
+            /* SLAVE and IRIS/M.BLACK LINK latch bits clear through H'2E06. */
+        }
+        break;
+    case 0x0015u:
+        /* 0x0015 call_and_red_tally_lamp_lane; current word H'E82A; handler unknown. */
+        if (value == 0x8000u) {
+            /* CALL lamp and red tally on. */
+        }
+        if (value == 0x0000u) {
+            /* CALL inactive/clear report. */
+        }
+        break;
+    case 0x0017u:
+        /* 0x0017 bars_lamp_lane; current word H'E82E; handler unknown. */
+        if (value == 0x8000u) {
+            /* BARS lamp on. */
+        }
+        if (value == 0x4000u) {
+            /* BARS lamp/latch on. */
+        }
+        if (value == 0x0000u) {
+            /* BARS low write; visible latch may remain. */
+        }
+        break;
+    case 0x001Au:
+        /* 0x001A monitor_selector_lamps; current word H'E834; handler unknown. */
+        if (value == 0x0808u) {
+            /* MONITOR ENC lamp. */
+        }
+        if (value == 0x2020u) {
+            /* MONITOR B lamp. */
+        }
+        if (value == 0x4040u) {
+            /* MONITOR G lamp. */
+        }
+        if (value == 0x8080u) {
+            /* MONITOR R lamp. */
+        }
+        break;
+    case 0x0024u:
+        /* 0x0024 lcd_selector_button_lamp; current word H'E848; dispatch unknown. */
+        if (value == 0x8000u) {
+            /* LCD selector-button lamp visible. */
+        }
+        if (value == 0x0000u) {
+            /* lamp remained visible at 0.5 s in isolation run. */
+        }
+        break;
+    case 0x006Bu:
+        /* 0x006B standard_lamp_lane; current word H'E8D6; handler unknown. */
+        if (value == 0x8000u) {
+            /* STANDARD lamp on. */
+        }
+        break;
+    case 0x0082u:
+        /* 0x0082 iris_readout_lane; current word H'E904; dispatch unknown. */
+        if (value == 0x8000u) {
+            /* IRIS display OP. */
+        }
+        if (value == 0x4000u) {
+            /* IRIS display 1.4. */
+        }
+        if (value == 0x0000u) {
+            /* IRIS display blank. */
+        }
+        break;
+    case 0x0083u:
+        /* 0x0083 combined_iris_shutter_master_gain_status_lane; current word H'E906; dispatch unknown. */
+        if (value == 0x8000u) {
+            /* IRIS AUTO, SHUTTER OFF, MASTER GAIN -3. */
+        }
+        if (value == 0x4000u) {
+            /* IRIS AUTO, SHUTTER OFF, MASTER GAIN 0. */
+        }
+        if (value == 0x2000u) {
+            /* IRIS AUTO, SHUTTER OFF, MASTER GAIN 3. */
+        }
+        if (value == 0x0004u) {
+            /* IRIS AUTO, SHUTTER OFF, MASTER GAIN HP. */
+        }
+        if (value == 0x0000u) {
+            /* same visible state remained at 0.5 s. */
+        }
+        break;
+    case 0x008Fu:
+        /* 0x008F shutter_display_status_lane; current word H'E91E; dispatch unknown. */
+        if (value == 0x8000u) {
+            /* IRIS AUTO plus shutter value beginning with 1. */
+        }
+        if (value == 0x2000u) {
+            /* IRIS AUTO plus shutter 00.0. */
+        }
+        if (value == 0x0800u) {
+            /* IRIS AUTO plus shutter EVS. */
+        }
+        if (value == 0x1000u) {
+            /* IRIS AUTO plus shutter OFF. */
+        }
+        break;
+    case 0x0093u:
+        /* 0x0093 white_balance_black_flare_mode_lane; current word H'E926; dispatch unknown. */
+        if (value == 0x8000u) {
+            /* BLACK/FLARE MANUAL plus white-balance PRESET. */
+        }
+        if (value == 0x4000u) {
+            /* BLACK/FLARE MANUAL plus white-balance AUTO. */
+        }
+        if (value == 0x2000u) {
+            /* BLACK/FLARE MANUAL plus white-balance MANUAL. */
+        }
+        if (value == 0x1020u) {
+            /* BLACK/FLARE MANUAL plus white-balance MANUAL. */
+        }
+        if (value == 0x4040u) {
+            /* BLACK/FLARE AUTO plus white-balance AUTO. */
+        }
+        if (value == 0x8040u) {
+            /* BLACK/FLARE AUTO plus white-balance PRESET. */
+        }
+        if (value == 0x0020u) {
+            /* BLACK/FLARE MANUAL plus white-balance MANUAL. */
+        }
+        if (value == 0x0040u) {
+            /* BLACK/FLARE AUTO plus white-balance MANUAL. */
+        }
+        if (value == 0x0000u) {
+            /* BLACK/FLARE MANUAL plus white-balance MANUAL. */
+        }
+        break;
+    case 0x0110u:
+        /* 0x0110 knee_auto_lamp_or_page_status_lane; current word H'EA20; dispatch unknown. */
+        if (value == 0x8000u) {
+            /* KNEE AUTO lamp/status on. */
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+void provisional_iris_mblack_link_button_toggle_report(void)
+{
+    /* Provisional name for ROM H'200E: When F6DB.7 is asserted and F731 <= 3, the ROM toggles current-table bit 14 at H'E826 based on F791.5, then queues selector 0x0013 through loc_3E54. */
+    /* Source F006.7 / F6DB.7; gate F731 <= 3; current state F791.5. */
+    if ((MEM8[0xF6DBu] & BIT(7)) == 0u) {
+        return;
+    }
+    if (MEM8[0xF731u] > 3u) {
+        return;
+    }
+
+    if ((MEM8[0xF791u] & BIT(5)) == 0u) {
+        /* Requests selector 0x0013=0x4000: 00 00 13 40 00 09. */
+        /* CCU should ACK 05 00 13 00 00 4C, then mirror 00 00 13 40 00 09. */
+    } else {
+        /* Requests selector 0x0013=0x0000: 00 00 13 00 00 49. */
+        /* CCU should ACK 05 00 13 00 00 4C, then mirror 00 00 13 00 00 49. */
+    }
+}
+
+void sci1_process_candidate_protocol_command(void)
+{
+    u8 command = sci1_rx_candidate_command();
+    u16 logical_index = sci1_rx_candidate_logical_index();
+    u16 value = sci1_rx_candidate_value();
+
+    sci1_candidate_panel_selector_annotation(logical_index, value);
+
+    bool session_active = MEM8[0xFAA2u] != 0u;
+
+    if (!session_active) {
+        /* Initial/idle dispatcher: valid checksum/no RX error, FAA2 == 0. */
+        switch (command) {
+        case 0x00u:
+            /* set_value_acked: candidate write of RX[3:4] into primary/current tables, followed by a response
+             * availability: valid checksum/no RX physical error && FAA2 == 0
+             * candidate effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000
+             * candidate effect: table_write_candidate; target current_value_table_candidate; source same candidate value written to the primary table; table H'E800
+             * candidate effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00
+             * evidence: H'BC08, H'BC0C, H'BC20, H'BC22, H'BCB0, H'BCB9, H'BCC1, H'BCC9, H'BCB5, H'BCBD, H'BCC5, H'BCCD
+             */
+            candidate_set_value_acked(logical_index, value);
+            break;
+        case 0x01u:
+            /* read_value: initial/idle-path primary table read only, followed by an odd response staging sequence
+             * availability: valid checksum/no RX physical error && FAA2 == 0 && F861.bit7 == 0
+             * note: Only accepted on the initial/idle dispatcher path: valid checksum/no RX error, FAA2 == 0, and F861.bit7 == 0.
+             * note: BCD7 stages F850=0x04, writes F851 from F861 and then overwrites F851 from F862.
+             * note: BCD7 reads the primary table word at E000 + 2*selector; F854 receives the low byte and F853 receives the high byte.
+             * note: F852 is not freshly written in the BCD7 handler, so do not describe the response as a fixed 04 00 QQ hi lo frame.
+             * candidate effect: table_read_candidate; target primary_value_table_candidate; table H'E000
+             * candidate effect: response_staging_candidate; stage F850-F854 and call loc_BA26
+             * evidence: H'BC08, H'BC0C, H'BC24, H'BC26, H'BCD7, H'BCE0, H'BCE8, H'BCF0, H'BCF6, H'BCDC, H'BCE4, H'BCFA
+             */
+            if ((RX_FRAME(1) & 0x80u) != 0u) {
+                candidate_unknown_command(command, logical_index, value);
+                break;
+            }
+            candidate_read_value(logical_index, value);
+            break;
+        case 0x02u:
+            /* clear_or_abort: candidate clear/abort path with no immediate response builder
+             * availability: valid checksum/no RX physical error && FAA2 == 0
+             * candidate effect: state_clear_candidate; target serial_session_flags_candidate; clear bit 7; state H'FAA2
+             * evidence: H'BC08, H'BC0C, H'BC29, H'BC2B
+             */
+            candidate_clear_or_abort(logical_index, value);
+            break;
+        case 0x07u:
+            /* retransmit_or_error_reply: candidate retransmit path; retry/error handling also builds a command 0x07 RX-payload echo
+             * availability: valid checksum/no RX physical error && FAA2 == 0 OR valid checksum/no RX physical error && FAA2 != 0
+             * note: loc_BE4D is a retry/error echo path: F850=0x07 and F861-F864 are copied into F851-F854 before loc_BA26.
+             * note: Observed frame 07 80 40 20 90 2D means RX bytes F861-F864 were 80 40 20 90; it is not a table value.
+             * candidate effect: retransmit_candidate; target TX staging bytes H'F850-H'F854 before loc_BA26; source previous TX frame bytes H'F858-H'F85C
+             * candidate effect: retry_error_echo_candidate; target F850=0x07, F851-F854=F861-F864 before loc_BA26; source RX payload bytes F861-F864; 07 80 40 20 90 2D echoes RX payload 80 40 20 90; it is not a table value
+             * candidate effect: response_staging_candidate; stage F850-F854 and call loc_BA26
+             * evidence: H'BC08, H'BC0C, H'BC2E, H'BC30, H'BC54, H'BC56, H'BE09, H'BE11, H'BE19, H'BE22
+             */
+            candidate_retransmit_or_error_reply(logical_index, value);
+            break;
+        default:
+            candidate_unknown_command(command, logical_index, value);
+            break;
+        }
+        return;
+    }
+
+    /* Continuation dispatcher: FAA2 != 0. */
+    switch (command) {
+    case 0x04u:
+        /* set_value_no_immediate_reply: candidate write/update path that stores a value without an immediate serial response
+         * availability: valid checksum/no RX physical error && FAA2 != 0
+         * candidate effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000
+         * candidate effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00
+         * evidence: H'BC08, H'BC0C, H'BC45, H'BC47
+         */
+        candidate_set_value_no_immediate_reply(logical_index, value);
+        break;
+    case 0x05u:
+        /* ack_or_clear_pending: continuation-only conditional acknowledgement/session clear path
+         * availability: valid checksum/no RX physical error && FAA2 != 0
+         * note: Only accepted on the continuation dispatcher path when FAA2 != 0.
+         * note: For selector 0x0040, frame 05 00 40 00 00 1F performs no response staging.
+         * note: The handler clears FAA3/FAA2; F9B5 advances only when FAA2.bit3 was set from a queued report.
+         * note: If FAA2 == 0, command 5 falls through the initial dispatcher instead of doing acknowledgement work.
+         * candidate effect: conditional_ack_session_clear_candidate; target selected event/pending state; when FAA2 != 0, clear FAA3/FAA2; advance F9B5 only if FAA2.bit3 was set from queued-report state; selector 0x0040 stages no response; selector H'0040 has no response
+         * evidence: H'BC08, H'BC0C, H'BC4A, H'BC4C
+         */
+        candidate_ack_or_clear_pending(logical_index, value);
+        break;
+    case 0x06u:
+        /* set_secondary_value: candidate secondary-table value write path
+         * availability: valid checksum/no RX physical error && FAA2 != 0
+         * candidate effect: table_write_candidate; target secondary_value_table_candidate; source RX[3:4] value bytes; table H'E400
+         * candidate effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 6; table H'EC00
+         * evidence: H'BC08, H'BC0C, H'BC4F, H'BC51
+         */
+        candidate_set_secondary_value(logical_index, value);
+        break;
+    case 0x07u:
+        /* retransmit_or_error_reply: candidate retransmit path; retry/error handling also builds a command 0x07 RX-payload echo
+         * availability: valid checksum/no RX physical error && FAA2 == 0 OR valid checksum/no RX physical error && FAA2 != 0
+         * note: loc_BE4D is a retry/error echo path: F850=0x07 and F861-F864 are copied into F851-F854 before loc_BA26.
+         * note: Observed frame 07 80 40 20 90 2D means RX bytes F861-F864 were 80 40 20 90; it is not a table value.
+         * candidate effect: retransmit_candidate; target TX staging bytes H'F850-H'F854 before loc_BA26; source previous TX frame bytes H'F858-H'F85C
+         * candidate effect: retry_error_echo_candidate; target F850=0x07, F851-F854=F861-F864 before loc_BA26; source RX payload bytes F861-F864; 07 80 40 20 90 2D echoes RX payload 80 40 20 90; it is not a table value
+         * candidate effect: response_staging_candidate; stage F850-F854 and call loc_BA26
+         * evidence: H'BC08, H'BC0C, H'BC2E, H'BC30, H'BC54, H'BC56, H'BE09, H'BE11, H'BE19, H'BE22
+         */
+        candidate_retransmit_or_error_reply(logical_index, value);
+        break;
+    default:
+        candidate_unknown_command(command, logical_index, value);
+        break;
+    }
+}
+
+/*
+ * TX reconstruction evidence
+ * candidate/evidence-supported SCI1 6-byte TX frame hypothesis using buffer H'F858-H'F85D with checksum byte H'F85D seeded by H'005A
+ * checksum formula: checksum = 0x5A ^ byte0 ^ byte1 ^ byte2 ^ byte3 ^ byte4
+ * evidence addresses:
+ * - checksum_byte: H'BA64
+ * - initial_send_from_buffer_start: H'BA6E, H'BA72
+ * - tx_buffer_region: H'BA3A, H'BA42, H'BA4A, H'BA50, H'BA54, H'BA58, H'BA5C, H'BA60, H'BA64, H'BA6E, H'BE05, H'BE0D, H'BE15
+ * - tx_checksum_seed: H'BA4E
+ * - tx_index_compare_frame_length: H'BAC3
+ * - tx_index_increment: H'BABF
+ * - tx_index_initialized_to_one: H'BA76
+ * - tx_isr_indexed_send: H'BAAB, H'BAB1, H'BAB5
+ * - xor_checksum_chain: H'BA50, H'BA54, H'BA58, H'BA5C, H'BA60, H'BA64
+ */
+static u8 sci1_tx_candidate_checksum(void)
+{
+    u8 checksum = 0x5Au;
+    checksum ^= TX_FRAME(0);
+    checksum ^= TX_FRAME(1);
+    checksum ^= TX_FRAME(2);
+    checksum ^= TX_FRAME(3);
+    checksum ^= TX_FRAME(4);
+    return checksum;
+}
+
+void sci1_tx_start_candidate_frame(void)
+{
+    /* The ROM appears to have populated TX_FRAME(0..4) before this point. */
+    TX_FRAME(5) = sci1_tx_candidate_checksum();
+
+    while ((SCI1_SSR & SCI_SSR_TDRE) == 0u) {
+        /* wait for transmit data register empty */
+    }
+
+    /* First byte is sent synchronously; TIE enables TXI for the remaining bytes. */
+    SCI1_TDR = TX_FRAME(0);
+    TX_INDEX = 1u;
+    SCI1_SSR &= (u8)~SCI_SSR_TDRE;
+    SCI1_SCR |= SCI_SCR_TIE;
+}
+
+void sci1_txi_candidate_isr(void)
+{
+    /* TXI runs after hardware reasserts SSR.TDRE for the next transmit byte. */
+    if ((SCI1_SSR & SCI_SSR_TDRE) == 0u) {
+        return;
+    }
+
+    if (TX_INDEX < TX_FRAME_LENGTH) {
+        SCI1_TDR = TX_FRAME(TX_INDEX);
+        TX_INDEX = (u8)(TX_INDEX + 1u);
+        SCI1_SSR &= (u8)~SCI_SSR_TDRE;
+    }
+
+    if (TX_INDEX >= TX_FRAME_LENGTH) {
+        SCI1_SCR &= (u8)~SCI_SCR_TIE;
+    }
+}
+
+/*
+ * RX reconstruction evidence
+ * candidate/evidence-supported SCI1 6-byte RX frame hypothesis using capture buffer H'F868-H'F86D; checksum byte H'F865 is validated against XOR seeded by H'005A
+ * checksum formula: checksum = 0x5A ^ byte0 ^ byte1 ^ byte2 ^ byte3 ^ byte4
+ * RX error handling: SCI1 ERI appears to mark a physical receive error and continue into the RXI byte-capture path; the RXI path clears RDRF before reading RDR in the ROM order.
+ * RX error caveat: Manual text distinguishes ORER from FER/PER data transfer into RDR and describes the normal RDR-read then RDRF-clear ordering; this output preserves the observed ROM order.
+ * evidence addresses:
+ * - rx_checksum_seed: H'BBD6
+ * - rx_complete_timer: H'BB9E
+ * - rx_copy_capture_to_frame_buffer: H'BBB3, H'BBBB, H'BBC3, H'BBB7, H'BBBF, H'BBC7
+ * - rx_eri_falls_through_to_rxi: H'BB57, H'BB5B, H'BB5F, H'BB63, H'BB69, H'BB6D
+ * - rx_index_increment_store: H'BB94, H'BB96
+ * - rx_indexed_store: H'BB90
+ * - rx_isr_compare_frame_length: H'BB9A
+ * - rx_processor_requires_six_bytes: H'BBAB
+ * - rx_rdr_read: H'BB6D
+ * - rx_rdrf_clear_before_rdr_read: H'BB69, H'BB6D
+ * - rx_xor_checksum_validation: H'BBD6, H'BBD8, H'BBDC, H'BBE0, H'BBE4, H'BBE8, H'BBEC
+ */
+static u8 sci1_rx_candidate_checksum(void)
+{
+    u8 checksum = 0x5Au;
+    checksum ^= RX_FRAME(0);
+    checksum ^= RX_FRAME(1);
+    checksum ^= RX_FRAME(2);
+    checksum ^= RX_FRAME(3);
+    checksum ^= RX_FRAME(4);
+    return checksum;
+}
+
+bool sci1_process_rx_candidate_frame(void)
+{
+    u8 i;
+
+    if (RX_INDEX != RX_FRAME_LENGTH) {
+        return false;
+    }
+
+    for (i = 0u; i < RX_FRAME_LENGTH; i++) {
+        RX_FRAME(i) = RX_CAPTURE(i);
+    }
+
+    if (sci1_rx_candidate_checksum() != RX_FRAME(5)) {
+        RX_INDEX = 0u;
+        return false;
+    }
+
+    RX_INDEX = 0u;
+    return true;
+}
+
+bool sci1_rx_byte_received_candidate_isr(void)
+{
+    u8 byte;
+
+    SCI1_SSR &= (u8)~SCI_SSR_RDRF;
+    byte = SCI1_RDR;
+
+    if (RX_INTERBYTE_TIMEOUT == 0u) {
+        RX_INDEX = 0u;
+    }
+
+    RX_INTERBYTE_TIMEOUT = 5u;
+    RX_CAPTURE(RX_INDEX) = byte;
+    RX_INDEX = (u8)(RX_INDEX + 1u);
+
+    if (RX_INDEX == RX_FRAME_LENGTH) {
+        RX_COMPLETE_TIMER = 0x14u;
+        return sci1_process_rx_candidate_frame();
+    }
+
+    return false;
+}
+
+void sci1_rx_error_candidate_isr(void)
+{
+    RX_ERROR_LATCH |= RX_ERROR_LATCH_PHYSICAL_ERROR;
+    SCI1_SSR &= (u8)~(SCI_SSR_ORER | SCI_SSR_FER | SCI_SSR_PER);
+    sci1_rx_byte_received_candidate_isr();
+}

build/rom_table_xrefs.txt

@@ -0,0 +1,93 @@
+Table/Index Cross-Reference Report for build\rom_decompiled.json
+================================================================
+
+Static offsets are emitted only when an index register value can be derived from nearby immediate loads in the current JSON. Other indexed accesses are dynamic.
+
+LCD correlation hints
+  term 'CONNECT': no LCD/text candidate hits in current decompile
+  term 'CONNECT: OK': no LCD/text candidate hits in current decompile
+  term 'CONNECT: NOT ACT': no LCD/text candidate hits in current decompile
+  term 'NOT ACT': no LCD/text candidate hits in current decompile
+  term 'COMM LINK': 2 candidate hit(s): H'77F4 'COMM LINK ITEM-1Xw', H'78F4 'COMM LINK ITEM-2Xx'
+  term 'COMPLETED': 1 candidate hit(s): H'A025 'COMPLETED'
+  display builder xrefs: H'5A91:165, H'5EED:15, H'5E24:14, H'5B88:13, H'5C91:10, H'5D9A:5
+  LCD driver routines: H'3F40 lcd_wait_and_transfer
+  caveat: LCD strings can be builder/script output; absence of a literal term does not disprove runtime composition.
+
+primary_value_table_candidate H'E000-H'E3FF (negative H'2000; direct H'F900-H'F91F)
+  accesses=31 reads=21 writes=10 dynamic=11
+  static offsets: H'0000, H'0004, H'0006, H'0046, H'0080, H'0102, H'0124, H'0126, H'014E, H'016E, H'0172, H'01EC, H'0220
+  functions: loc_BBAB:5, loc_2650:3, loc_4096:3, loc_1795:2, loc_19DB:2, loc_1A35:2, loc_48FA:2, vec_ad_adi_3D99:2, <no function>:1, loc_1705:1, loc_174D:1, loc_17C9:1
+  - H'170C read offset H'014E selector 0x0A7 -> H'E14E; loc_1705; BTST.W #15, @H'E14E
+  - H'175A read offset H'016E selector 0x0B7 -> H'E16E; loc_174D; BTST.W #13, @H'E16E
+  - H'179C read offset H'0172 selector 0x0B9 -> H'E172; loc_1795; BTST.W #13, @H'E172
+  - H'17A7 read offset H'0220 selector 0x110 -> H'E220; loc_1795; BTST.W #15, @H'E220
+  - H'17D0 read offset H'0126 selector 0x093 -> H'E126; loc_17C9; BTST.W #12, @H'E126
+  - H'1802 read offset H'0126 selector 0x093 -> H'E126; loc_17FB; BTST.W #12, @H'E126
+  - H'183A read offset H'0126 selector 0x093 -> H'E126; loc_182D; BTST.W #5, @H'E126
+  - H'189E read offset H'0126 selector 0x093 -> H'E126; loc_1891; BTST.W #5, @H'E126
+  - H'18F4 read offset H'0126 selector 0x093 -> H'E126; loc_18E7; BTST.W #5, @H'E126
+  - H'19E3 read index dynamic via R3 operand @(-H'2000,R3); loc_19DB; MOV:G.W @(-H'2000,R3), R0
+  - H'1A03 read index dynamic via R3 operand @(-H'2000,R3); loc_19DB; CMP:G.W @(-H'2000,R3), R1
+  - H'1A3D read index dynamic via R3 operand @(-H'2000,R3); loc_1A35; MOV:G.W @(-H'2000,R3), R0
+  - H'1A6B read index dynamic via R3 operand @(-H'2000,R3); loc_1A35; CMP:G.W @(-H'2000,R3), R0
+  - H'2657 read offset H'0124 selector 0x092 -> H'E124; loc_2650; MOV:G.W @H'E124, R0
+  - H'266F read offset H'0004 selector 0x002 -> H'E004; loc_2650; BTST.W #13, @H'E004
+  - H'268B read offset H'0124 selector 0x092 -> H'E124; loc_2650; CMP:G.W @H'E124, R0
+  - H'3DDA read offset H'0102 selector 0x081 -> H'E102; vec_ad_adi_3D99; MOV:G.W @H'E102, R0
+  - H'3DFA read offset H'0102 selector 0x081 -> H'E102; vec_ad_adi_3D99; CMP:G.W @H'E102, R1
+  - H'3F8C write index dynamic via R0 operand @(-H'2000,R0); <no function>; CLR.W @(-H'2000,R0)
+  - H'402C write offset H'0046 selector 0x023 -> H'E046; loc_400C; CLR.W @H'E046
+  - H'4077 write index dynamic via R0 operand @(-H'2000,R0); loc_4075; CLR.W @(-H'2000,R0)
+  - H'4096 write offset H'0000 selector 0x000 -> H'E000; loc_4096; MOV:G.W #H'0080, @H'E000
+  - H'409C write offset H'0006 selector 0x003 -> H'E006; loc_4096; MOV:G.W #H'8000, @H'E006
+  - H'40A2 write offset H'0080 selector 0x040 -> H'E080; loc_4096; MOV:G.W #H'FFFF, @H'E080
+  - H'490F read offset H'01EC selector 0x0F6 -> H'E1EC; loc_48FA; BTST.W #13, @H'E1EC
+  - H'4915 read offset H'01EC selector 0x0F6 -> H'E1EC; loc_48FA; MOV:G.W @H'E1EC, R0
+  - H'BC75 write index dynamic via R4 operand @(-H'2000,R4); loc_BBAB; MOV:G.W R0, @(-H'2000,R4)
+  - H'BC95 write index dynamic via R4 operand @(-H'2000,R4); loc_BBAB; MOV:G.W R0, @(-H'2000,R4)
+  - H'BCEC read index dynamic via R4 operand @(-H'2000,R4); loc_BBAB; MOV:G.W @(-H'2000,R4), R0
+  - H'BD1A write index dynamic via R4 operand @(-H'2000,R4); loc_BBAB; MOV:G.W R0, @(-H'2000,R4)
+  - H'BD35 write index dynamic via R4 operand @(-H'2000,R4); loc_BBAB; MOV:G.W R0, @(-H'2000,R4)
+
+secondary_value_table_candidate H'E400-H'E7FF (negative H'1C00; direct H'F940-H'F95F)
+  accesses=8 reads=6 writes=2 dynamic=8
+  functions: loc_1A35:2, loc_1A9C:2, <no function>:1, loc_19A2:1, loc_4075:1, loc_BBAB:1
+  - H'19AA read index dynamic via R3 operand @(-H'1C00,R3); loc_19A2; MOV:G.W @(-H'1C00,R3), R0
+  - H'1A4B read index dynamic via R3 operand @(-H'1C00,R3); loc_1A35; MOV:G.W @(-H'1C00,R3), R1
+  - H'1A5B read index dynamic via R3 operand @(-H'1C00,R3); loc_1A35; MOV:G.W @(-H'1C00,R3), R1
+  - H'1A81 read index dynamic via R3 operand @(-H'1C00,R3); <no function>; AND.W @(-H'1C00,R3), R1
+  - H'1AB4 read index dynamic via R3 operand @(-H'1C00,R3); loc_1A9C; BTST.W R0, @(-H'1C00,R3)
+  - H'1AC1 read index dynamic via R3 operand @(-H'1C00,R3); loc_1A9C; BTST.W R0, @(-H'1C00,R3)
+  - H'407B write index dynamic via R0 operand @(-H'1C00,R0); loc_4075; CLR.W @(-H'1C00,R0)
+  - H'BDE5 write index dynamic via R4 operand @(-H'1C00,R4); loc_BBAB; MOV:G.W R0, @(-H'1C00,R4)
+
+current_value_table_candidate H'E800-H'EBFF (negative H'1800; direct H'F920-H'F93F)
+  accesses=14 reads=1 writes=13 dynamic=8
+  static offsets: H'0000, H'0006, H'0080, H'0102, H'0124, H'01EC
+  functions: loc_4096:3, loc_BBAB:3, <no function>:1, loc_15E0:1, loc_19DB:1, loc_1A35:1, loc_2650:1, loc_4075:1, loc_48FA:1, loc_BAF2:1
+  - H'15ED write offset H'0102 selector 0x081 -> H'E902; loc_15E0; MOV:G.W R1, @H'E902
+  - H'1A09 write index dynamic via R3 operand @(-H'1800,R3); loc_19DB; MOV:G.W R1, @(-H'1800,R3)
+  - H'1A71 write index dynamic via R3 operand @(-H'1800,R3); loc_1A35; MOV:G.W R0, @(-H'1800,R3)
+  - H'2691 write offset H'0124 selector 0x092 -> H'E924; loc_2650; MOV:G.W R0, @H'E924
+  - H'3F90 write index dynamic via R0 operand @(-H'1800,R0); <no function>; CLR.W @(-H'1800,R0)
+  - H'407F write index dynamic via R0 operand @(-H'1800,R0); loc_4075; CLR.W @(-H'1800,R0)
+  - H'40A8 write offset H'0000 selector 0x000 -> H'E800; loc_4096; MOV:G.W #H'0080, @H'E800
+  - H'40AE write offset H'0006 selector 0x003 -> H'E806; loc_4096; MOV:G.W #H'8000, @H'E806
+  - H'40B4 write offset H'0080 selector 0x040 -> H'E880; loc_4096; MOV:G.W #H'FFFF, @H'E880
+  - H'491D write offset H'01EC selector 0x0F6 -> H'E9EC; loc_48FA; MOV:G.W R0, @H'E9EC
+  - H'BB35 read index dynamic via R0 operand @(-H'1800,R0); loc_BAF2; MOV:G.W @(-H'1800,R0), R4
+  - H'BC79 write index dynamic via R4 operand @(-H'1800,R4); loc_BBAB; MOV:G.W R0, @(-H'1800,R4)
+  - H'BC99 write index dynamic via R4 operand @(-H'1800,R4); loc_BBAB; MOV:G.W R0, @(-H'1800,R4)
+  - H'BD1E write index dynamic via R4 operand @(-H'1800,R4); loc_BBAB; MOV:G.W R0, @(-H'1800,R4)
+
+flag_table_candidate H'EC00-H'EFFF (negative H'1400; direct H'F980-H'F99F)
+  accesses=6 reads=0 writes=6 dynamic=5
+  static offsets: H'0200
+  functions: loc_BBAB:5, loc_4075:1
+  - H'4088 write offset H'0200 selector 0x000 -> H'EE00; loc_4075; CLR.W @(-H'1400,R0)
+  - H'BC82 write index dynamic via R5 operand @(-H'1400,R5); loc_BBAB; BSET.B #7, @(-H'1400,R5)
+  - H'BC9D write index dynamic via R5 operand @(-H'1400,R5); loc_BBAB; BSET.B #7, @(-H'1400,R5)
+  - H'BD22 write index dynamic via R5 operand @(-H'1400,R5); loc_BBAB; BSET.B #7, @(-H'1400,R5)
+  - H'BD39 write index dynamic via R5 operand @(-H'1400,R5); loc_BBAB; BSET.B #7, @(-H'1400,R5)
+  - H'BDE9 write index dynamic via R5 operand @(-H'1400,R5); loc_BBAB; BSET.B #6, @(-H'1400,R5)

ccu_emulator/README.md

@@ -0,0 +1,86 @@
+# PT2 Fake CCU
+
+This folder contains a small modular fake-CCU runner for the Sony RCP PT2-style serial link.
+
+The first goal is simple:
+
+1. Open the RCP serial link at `38400 8E1`.
+2. Optionally wait for heartbeat.
+3. Seed active selector-zero state.
+4. Listen for complete RCP report frames.
+5. Immediately answer report-looking frames with the neutral command-5 ACK:
+
+```text
+05 00 40 00 00 1F
+```
+
+ROM and emulator evidence says this consumes the outstanding report cursor without triggering COPY or lamp/display side effects.
+
+## Run
+
+Dry-run configuration:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --dry-run
+```
+
+Run against the bench RCP on COM5:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --port COM5 --duration 30 --log captures\ccu-keepalive.txt
+```
+
+Power-cycle first through the COM6 relay:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --port COM5 --power-cycle --relay-port COM6 --duration 30 --log captures\ccu-keepalive-powercycle.txt
+```
+
+Try the older three-frame CONNECT cadence seed instead of the command-0 active seed:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --seed connect-sequence --seed-gap 0.700 --duration 30
+```
+
+Optionally add periodic state refresh traffic:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --refresh-active --refresh-interval 0.600 --duration 30
+```
+
+Enable the bench-proven IRIS/M.BLACK LINK closed-loop module:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\ccu_emulator.py --iris-mblack-link --duration 60 --log captures\ccu-iris-mblack-link.txt
+```
+
+When the RCP reports selector `0x0013` as `0x4000` or `0x0000`, this module sends:
+
+```text
+05 00 13 00 00 4C  ; ACK selector 0x0013
+00 00 13 40 00 09  ; mirror active, or 00 00 13 00 00 49 for clear
+```
+
+That matches the bench-proven IRIS/M.BLACK LINK state machine: the RCP reports local intent, the CCU acknowledges the selector, then the CCU mirrors the accepted state back so the next physical press toggles the other way.
+
+## Layout
+
+- `frames.py`: checksums, built-in frames, and simple host-frame builders.
+- `iris_mblack_link.py`: selector `0x0013` ACK-and-mirror state-machine module.
+- `modules.py`: small protocol-module interface for feature-specific CCU behavior.
+- `policy.py`: decides whether an RCP frame should be ACKed.
+- `refresh.py`: optional periodic state-refresh scheduling.
+- `serial_link.py`: serial read/write plus checksum-resync frame detection.
+- `controller.py`: event loop and stats.
+- `cli.py`: command-line entry point.
+
+## Why Periodic Lamp/Value Writes Help
+
+Repeated button/lamp/status writes probably do play into the normal CCU flow. The ROM reloads the broad `F9C5` session watchdog on every complete six-byte RX frame, and command-0/command-4/command-6 table writes refresh the selector tables that drive lamps, readouts, and menus.
+
+So a real CCU likely does both:
+
+- reactively ACK RCP reports so the report queue advances, and
+- stream or refresh panel state so the visible UI remains current.
+
+The first version keeps those concerns separate: reactive ACKs are always available, while periodic refresh frames are opt-in with `--refresh-frame` or `--refresh-active`.

ccu_emulator/__init__.py

@@ -0,0 +1,30 @@
+"""Small fake-CCU helpers for the Sony RCP PT2-style serial link."""
+
+from .controller import CcuEmulator, CcuStats
+from .frames import (
+    ACTIVE_SEED_COMMAND0,
+    CONNECT_CADENCE_SEQUENCE,
+    HEARTBEAT_FRAME,
+    NEUTRAL_ACK_FRAME,
+    format_frame,
+    frame_checksum,
+    frame_checksum_ok,
+    parse_frame,
+)
+from .iris_mblack_link import IrisMblackLinkModule
+from .policy import AckPolicy
+
+__all__ = [
+    "ACTIVE_SEED_COMMAND0",
+    "CONNECT_CADENCE_SEQUENCE",
+    "CcuEmulator",
+    "CcuStats",
+    "HEARTBEAT_FRAME",
+    "IrisMblackLinkModule",
+    "NEUTRAL_ACK_FRAME",
+    "AckPolicy",
+    "format_frame",
+    "frame_checksum",
+    "frame_checksum_ok",
+    "parse_frame",
+]

ccu_emulator/__main__.py

@@ -0,0 +1,5 @@
+from .cli import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ccu_emulator/cli.py

@@ -0,0 +1,208 @@
+from __future__ import annotations
+
+import argparse
+import sys
+import time
+from datetime import datetime
+from pathlib import Path
+from typing import TextIO
+
+from h8536.bench_connect_lcd import (
+    BenchLogger,
+    _import_serial,
+    _read_relay_lines,
+    _relay_command,
+    _relay_settle,
+    add_serial_format_args,
+    open_device_serial,
+    serial_format_label,
+)
+
+from .controller import CcuConfig, CcuEmulator
+from .frames import ACTIVE_SEED_COMMAND0, CONNECT_CADENCE_SEQUENCE, NEUTRAL_ACK_FRAME, format_frame, parse_frame
+from .iris_mblack_link import IrisMblackLinkModule
+from .modules import CcuModule
+from .policy import AckPolicy
+from .refresh import PeriodicRefresh
+from .serial_link import SerialLink
+
+
+def build_arg_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="Run a small fake CCU for the Sony RCP PT2-style serial link.")
+    parser.add_argument("--port", default="COM5", help="RS232 serial port connected to the RCP")
+    parser.add_argument("--baud", type=int, default=38400, help="RCP serial baud rate")
+    add_serial_format_args(parser)
+    parser.add_argument("--duration", type=float, default=30.0, help="seconds to run the CCU loop")
+    parser.add_argument("--sync", choices=("checksum", "fixed"), default="checksum", help="RX frame sync strategy")
+    parser.add_argument("--log", type=Path, help="capture log path")
+
+    parser.add_argument(
+        "--seed",
+        choices=("command0", "connect-sequence", "none"),
+        default="command0",
+        help="built-in wake-up seed before reactive ACK loop",
+    )
+    parser.add_argument("--seed-frame", action="append", type=parse_frame, help="custom seed frame; repeatable")
+    parser.add_argument("--seed-gap", type=float, default=0.050, help="seconds to listen after each seed frame")
+    parser.add_argument("--ready-heartbeats", type=int, default=1, help="heartbeats to observe before seeding")
+    parser.add_argument("--ready-timeout", type=float, default=10.0, help="seconds to wait for ready heartbeat")
+
+    parser.add_argument("--ack-frame", type=parse_frame, default=NEUTRAL_ACK_FRAME, help="ACK frame to send after RCP reports")
+    parser.add_argument("--ack-delay", type=float, default=0.0, help="seconds to wait after detecting an RCP frame before ACK")
+    parser.add_argument("--no-ack-heartbeats", action="store_true", help="do not ACK heartbeat frames")
+    parser.add_argument("--no-ack-reports", action="store_true", help="do not ACK report-looking frames")
+    parser.add_argument(
+        "--no-ack-unlabeled",
+        action="store_true",
+        help="do not ACK checksum-valid unlabeled frames outside known report command bytes",
+    )
+
+    parser.add_argument("--refresh-frame", action="append", type=parse_frame, help="optional periodic refresh frame")
+    parser.add_argument(
+        "--refresh-active",
+        action="store_true",
+        help="periodically refresh selector zero with command0 0x8080",
+    )
+    parser.add_argument("--refresh-interval", type=float, default=0.0, help="seconds between optional refresh frames")
+    parser.add_argument("--loop-poll", type=float, default=0.001, help="sleep between service loop iterations")
+
+    parser.add_argument(
+        "--iris-mblack-link",
+        action="store_true",
+        help="enable the selector 0x0013 IRIS/M.BLACK LINK ACK-and-mirror module",
+    )
+    parser.add_argument(
+        "--iris-mblack-link-mirror-delay",
+        type=float,
+        default=0.050,
+        help="seconds between the selector 0x0013 ACK and command-0 mirror",
+    )
+
+    parser.add_argument("--power-cycle", action="store_true", help="power-cycle DUT through relay before starting")
+    parser.add_argument("--relay-port", default="COM6", help="Pico relay serial port")
+    parser.add_argument("--relay-baud", type=int, default=115200, help="Pico relay serial baud rate")
+    parser.add_argument("--power-off-command", default="off", help="relay command used to remove DUT power")
+    parser.add_argument("--power-on-command", default="on", help="relay command used to apply DUT power")
+    parser.add_argument("--off-seconds", type=float, default=1.5, help="seconds to hold DUT powered off")
+    parser.add_argument("--relay-settle", type=float, default=2.0, help="seconds to wait after opening relay port")
+
+    parser.add_argument("--dry-run", action="store_true", help="print configuration without opening serial ports")
+    return parser
+
+
+def main(argv: list[str] | None = None, *, stdout: TextIO = sys.stdout) -> int:
+    args = build_arg_parser().parse_args(argv)
+    seed_frames = _seed_frames(args)
+    refresh_frames = _refresh_frames(args)
+    modules = _modules(args)
+    log_path = args.log or _default_log_path()
+
+    if args.dry_run:
+        _print_dry_run(args, seed_frames, refresh_frames, modules, log_path, stdout)
+        return 0
+
+    serial = _import_serial()
+    logger = BenchLogger(log_path, stdout=stdout)
+    relay = None
+    try:
+        logger.emit("PT2 fake CCU")
+        logger.emit(f"device={args.port} {args.baud} {serial_format_label(args)} sync={args.sync}")
+        logger.emit(f"log={log_path}")
+        logger.emit(f"ack_frame={format_frame(args.ack_frame)}")
+        logger.emit("seed_frames=" + (" | ".join(format_frame(frame) for frame in seed_frames) or "none"))
+        if refresh_frames:
+            logger.emit(
+                f"refresh_interval={args.refresh_interval:.3f}s frames="
+                + " | ".join(format_frame(frame) for frame in refresh_frames)
+            )
+        if modules:
+            logger.emit("modules=" + " | ".join(module.name for module in modules))
+
+        with open_device_serial(serial, args) as device:
+            if args.power_cycle:
+                relay = serial.Serial(args.relay_port, args.relay_baud, timeout=0.25)
+                _relay_settle(relay, args.relay_settle, logger)
+                _relay_command(relay, args.power_off_command, logger)
+                time.sleep(max(0.0, args.off_seconds))
+                device.reset_input_buffer()
+                _relay_command(relay, args.power_on_command, logger)
+            else:
+                device.reset_input_buffer()
+
+            link = SerialLink(device, logger, sync_mode=args.sync)
+            config = CcuConfig(
+                seed_frames=tuple(seed_frames),
+                seed_gap=args.seed_gap,
+                ack_delay=args.ack_delay,
+                ready_heartbeats=args.ready_heartbeats,
+                ready_timeout=args.ready_timeout,
+                loop_poll=args.loop_poll,
+            )
+            policy = AckPolicy(
+                ack_frame=args.ack_frame,
+                ack_reports=not args.no_ack_reports,
+                ack_heartbeats=not args.no_ack_heartbeats,
+                ack_unlabeled_checksum_frames=not args.no_ack_unlabeled,
+            )
+            refresh = PeriodicRefresh(frames=refresh_frames, interval=args.refresh_interval)
+            CcuEmulator(link, logger, config=config, ack_policy=policy, refresh=refresh, modules=modules).run(
+                args.duration
+            )
+        return 0
+    finally:
+        if relay is not None:
+            relay.close()
+        logger.close()
+
+
+def _seed_frames(args: argparse.Namespace) -> list[bytes]:
+    if args.seed_frame:
+        return list(args.seed_frame)
+    if args.seed == "none":
+        return []
+    if args.seed == "connect-sequence":
+        return list(CONNECT_CADENCE_SEQUENCE)
+    return [ACTIVE_SEED_COMMAND0]
+
+
+def _refresh_frames(args: argparse.Namespace) -> list[bytes]:
+    frames = list(args.refresh_frame or [])
+    if args.refresh_active:
+        frames.append(ACTIVE_SEED_COMMAND0)
+    return frames
+
+
+def _modules(args: argparse.Namespace) -> tuple[CcuModule, ...]:
+    modules: list[CcuModule] = []
+    if args.iris_mblack_link:
+        modules.append(IrisMblackLinkModule(mirror_delay=max(0.0, args.iris_mblack_link_mirror_delay)))
+    return tuple(modules)
+
+
+def _print_dry_run(
+    args: argparse.Namespace,
+    seed_frames: list[bytes],
+    refresh_frames: list[bytes],
+    modules: tuple[CcuModule, ...],
+    log_path: Path,
+    stdout: TextIO,
+) -> None:
+    print(f"device={args.port} {args.baud} {serial_format_label(args)} sync={args.sync}", file=stdout)
+    print(f"duration={args.duration:.3f}s log={log_path}", file=stdout)
+    print(f"power_cycle={int(args.power_cycle)} relay={args.relay_port} {args.relay_baud}", file=stdout)
+    print(f"ack_frame={format_frame(args.ack_frame)}", file=stdout)
+    print("seed_frames=" + (" | ".join(format_frame(frame) for frame in seed_frames) or "none"), file=stdout)
+    print(
+        f"refresh_interval={args.refresh_interval:.3f}s frames="
+        + (" | ".join(format_frame(frame) for frame in refresh_frames) or "none"),
+        file=stdout,
+    )
+    print("modules=" + (" | ".join(module.name for module in modules) or "none"), file=stdout)
+
+
+def _default_log_path() -> Path:
+    return Path("captures") / f"ccu-emulator-{datetime.now().strftime('%Y%m%d-%H%M%S')}.txt"
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ccu_emulator/controller.py

@@ -0,0 +1,179 @@
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass
+
+from h8536.bench_connect_lcd import BenchLogger, format_frame
+
+from .frames import ACTIVE_SEED_COMMAND0
+from .modules import CcuModule, ModuleDecision
+from .policy import AckPolicy
+from .refresh import PeriodicRefresh
+from .serial_link import RxFrame, SerialLink
+
+
+@dataclass
+class CcuStats:
+    rx_frames: int = 0
+    tx_frames: int = 0
+    ack_frames: int = 0
+    module_frames: int = 0
+    seed_frames: int = 0
+    refresh_frames: int = 0
+    started_at: float = 0.0
+    ended_at: float = 0.0
+
+    @property
+    def elapsed(self) -> float:
+        end = self.ended_at or time.monotonic()
+        return max(0.0, end - self.started_at)
+
+
+@dataclass(frozen=True)
+class CcuConfig:
+    seed_frames: tuple[bytes, ...] = (ACTIVE_SEED_COMMAND0,)
+    seed_gap: float = 0.050
+    ack_delay: float = 0.0
+    ready_heartbeats: int = 1
+    ready_timeout: float = 10.0
+    loop_poll: float = 0.001
+
+
+class CcuEmulator:
+    """Event-driven fake CCU for the PT2-style RCP serial protocol."""
+
+    def __init__(
+        self,
+        link: SerialLink,
+        logger: BenchLogger,
+        *,
+        config: CcuConfig | None = None,
+        ack_policy: AckPolicy | None = None,
+        refresh: PeriodicRefresh | None = None,
+        modules: tuple[CcuModule, ...] = (),
+    ) -> None:
+        self.link = link
+        self.logger = logger
+        self.config = config or CcuConfig()
+        self.ack_policy = ack_policy or AckPolicy()
+        self.refresh = refresh or PeriodicRefresh()
+        self.modules = modules
+        self.stats = CcuStats()
+
+    def run(self, duration: float) -> CcuStats:
+        self.stats = CcuStats(started_at=time.monotonic())
+        self.logger.event(
+            "CCU_START "
+            f"duration={duration:.3f}s seed_frames={len(self.config.seed_frames)} "
+            f"ack={format_frame(self.ack_policy.ack_frame)} modules={len(self.modules)}"
+        )
+        self._wait_ready()
+        self._send_seed_frames()
+        self.refresh.start()
+
+        deadline = time.monotonic() + max(0.0, duration)
+        try:
+            while time.monotonic() < deadline:
+                self._service_rx()
+                self._service_refresh()
+                time.sleep(max(0.0, self.config.loop_poll))
+        except KeyboardInterrupt:
+            self.logger.event("CCU_STOP keyboard_interrupt")
+        finally:
+            self.stats.ended_at = time.monotonic()
+            self._emit_summary()
+        return self.stats
+
+    def _wait_ready(self) -> None:
+        if self.config.ready_heartbeats <= 0:
+            self.logger.event("READY skipped")
+            return
+        self.logger.event(
+            f"READY_WAIT heartbeats={self.config.ready_heartbeats} timeout={self.config.ready_timeout:.3f}s"
+        )
+        start_count = self.link.detector.labels["heartbeat"]
+        deadline = time.monotonic() + max(0.0, self.config.ready_timeout)
+        while time.monotonic() < deadline:
+            for frame in self.link.read_available():
+                self._record_rx(frame)
+            if self.link.detector.labels["heartbeat"] - start_count >= self.config.ready_heartbeats:
+                self.logger.event(f"READY heartbeat_count={self.link.detector.labels['heartbeat']}")
+                return
+            time.sleep(max(0.0, self.config.loop_poll))
+        self.logger.event(f"READY_TIMEOUT heartbeat_count={self.link.detector.labels['heartbeat']}")
+
+    def _send_seed_frames(self) -> None:
+        for index, frame in enumerate(self.config.seed_frames, start=1):
+            self.link.send(frame, f"seed[{index}]")
+            self.stats.seed_frames += 1
+            self.stats.tx_frames += 1
+            self._listen_for(self.config.seed_gap)
+
+    def _listen_for(self, seconds: float) -> None:
+        deadline = time.monotonic() + max(0.0, seconds)
+        while time.monotonic() < deadline:
+            self._service_rx()
+            self._service_refresh()
+            time.sleep(max(0.0, self.config.loop_poll))
+
+    def _service_rx(self) -> None:
+        for item in self.link.read_available():
+            self._record_rx(item)
+            suppress_default_ack = self._service_modules(item)
+            if suppress_default_ack:
+                continue
+            decision = self.ack_policy.decide(item.frame, item.label)
+            if not decision.should_ack:
+                self.logger.event(f"ACK_SKIP reason={decision.reason} frame={format_frame(item.frame)}")
+                continue
+            if self.config.ack_delay > 0:
+                time.sleep(self.config.ack_delay)
+            self.link.send(decision.frame, f"ack reason={decision.reason}")
+            self.stats.ack_frames += 1
+            self.stats.tx_frames += 1
+
+    def _service_modules(self, item: RxFrame) -> bool:
+        suppress_default_ack = False
+        for module in self.modules:
+            decision = module.on_rx(item.frame, item.label)
+            if decision is None:
+                continue
+            if decision.reason:
+                self.logger.event(
+                    f"MODULE {module.name} reason={decision.reason} frame={format_frame(item.frame)}"
+                )
+            self._send_module_decision(decision)
+            suppress_default_ack = suppress_default_ack or decision.suppress_default_ack
+        return suppress_default_ack
+
+    def _send_module_decision(self, decision: ModuleDecision) -> None:
+        for tx in decision.tx:
+            if tx.delay > 0:
+                time.sleep(tx.delay)
+            self.link.send(tx.frame, tx.label)
+            self.stats.module_frames += 1
+            self.stats.tx_frames += 1
+
+    def _service_refresh(self) -> None:
+        for frame in self.refresh.due_frames():
+            self.link.send(frame, "refresh")
+            self.stats.refresh_frames += 1
+            self.stats.tx_frames += 1
+
+    def _record_rx(self, item: RxFrame) -> None:
+        self.stats.rx_frames += 1
+
+    def _emit_summary(self) -> None:
+        self.logger.emit()
+        self.logger.emit("CCU Summary")
+        self.logger.emit(f"elapsed={self.stats.elapsed:.3f}s")
+        self.logger.emit(f"rx_frames={self.stats.rx_frames}")
+        self.logger.emit(f"tx_frames={self.stats.tx_frames}")
+        self.logger.emit(f"ack_frames={self.stats.ack_frames}")
+        self.logger.emit(f"module_frames={self.stats.module_frames}")
+        self.logger.emit(f"seed_frames={self.stats.seed_frames}")
+        self.logger.emit(f"refresh_frames={self.stats.refresh_frames}")
+        self.logger.emit(f"resync_events={self.link.detector.resync_events}")
+        self.logger.emit(f"dropped_bytes={self.link.detector.dropped_bytes}")
+        for label, count in sorted(self.link.detector.labels.items()):
+            self.logger.emit(f"{label}={count}")

ccu_emulator/frames.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+from h8536.bench_connect_lcd import format_frame, frame_checksum, frame_checksum_ok, parse_frame
+
+
+FRAME_LENGTH = 6
+
+HEARTBEAT_FRAME = bytes.fromhex("0000000080DA")
+
+# Command 0, selector 0, value 0x8080. This seeds E000/E800 selector zero.
+ACTIVE_SEED_COMMAND0 = bytes.fromhex("00000080805A")
+
+# The older bench cadence sequence. It is still useful as an optional wake-up
+# strategy because the real panel proved timing-sensitive around these frames.
+CONNECT_CADENCE_SEQUENCE = (
+    bytes.fromhex("04000040001E"),
+    bytes.fromhex("0400008000DE"),
+    bytes.fromhex("040000C0009E"),
+)
+
+# Command 5, selector 0x0040, value ignored. ROM trace shows this is the safest
+# neutral report-consume candidate.
+NEUTRAL_ACK_FRAME = bytes.fromhex("05004000001F")
+
+
+def build_frame(command: int, selector: int, value: int) -> bytes:
+    """Build a six-byte host frame for simple page-0/page-1 selectors.
+
+    This helper covers the selector encodings we currently use in fake-CCU
+    probes. Keep more exotic mapping in one place when we learn it.
+    """
+
+    if not 0 <= command <= 0xFF:
+        raise ValueError("command byte out of range")
+    if not 0 <= selector <= 0x01FF:
+        raise ValueError("selector out of supported range 0x000-0x1FF")
+    if not 0 <= value <= 0xFFFF:
+        raise ValueError("value out of range")
+
+    if selector <= 0x007F:
+        byte1 = 0x00
+        byte2 = selector
+    elif selector <= 0x017F:
+        byte1 = 0x01
+        byte2 = selector - 0x0080
+    else:
+        byte1 = 0x02
+        byte2 = selector - 0x0180
+
+    frame = bytes(
+        [
+            command & 0xFF,
+            byte1 & 0xFF,
+            byte2 & 0xFF,
+            (value >> 8) & 0xFF,
+            value & 0xFF,
+        ]
+    )
+    return frame + bytes([frame_checksum(frame)])

ccu_emulator/iris_mblack_link.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .frames import build_frame, frame_checksum_ok
+from .modules import ModuleDecision, ModuleTx
+
+
+SELECTOR_IRIS_MBLACK_LINK = 0x0013
+IRIS_MBLACK_LINK_CLEAR = 0x0000
+IRIS_MBLACK_LINK_ACTIVE = 0x4000
+
+
+def selector_from_frame(frame: bytes) -> int | None:
+    if len(frame) != 6:
+        return None
+    if frame[1] == 0x00:
+        return frame[2]
+    if frame[1] == 0x01:
+        return 0x0080 + frame[2]
+    if frame[1] == 0x02:
+        return 0x0180 + frame[2]
+    return None
+
+
+def value_from_frame(frame: bytes) -> int | None:
+    if len(frame) != 6:
+        return None
+    return ((frame[3] << 8) | frame[4]) & 0xFFFF
+
+
+@dataclass
+class IrisMblackLinkModule:
+    """Closed-loop CCU side for the IRIS/M.BLACK LINK button/report path."""
+
+    mirror_delay: float = 0.050
+    report_commands: frozenset[int] = frozenset({0x00, 0x01, 0x02})
+    handled_values: frozenset[int] = frozenset({IRIS_MBLACK_LINK_CLEAR, IRIS_MBLACK_LINK_ACTIVE})
+    name: str = "iris_mblack_link"
+
+    def on_rx(self, frame: bytes, label: str = "") -> ModuleDecision | None:
+        if not frame_checksum_ok(frame) or frame[0] not in self.report_commands:
+            return None
+        selector = selector_from_frame(frame)
+        if selector != SELECTOR_IRIS_MBLACK_LINK:
+            return None
+        value = value_from_frame(frame)
+        if value not in self.handled_values:
+            return None
+
+        state = "active" if value == IRIS_MBLACK_LINK_ACTIVE else "clear"
+        ack = build_frame(0x05, SELECTOR_IRIS_MBLACK_LINK, 0x0000)
+        mirror = build_frame(0x00, SELECTOR_IRIS_MBLACK_LINK, value)
+        return ModuleDecision(
+            tx=(
+                ModuleTx(ack, f"{self.name} ack selector=0x0013 value=0x{value:04X}"),
+                ModuleTx(
+                    mirror,
+                    f"{self.name} mirror {state} selector=0x0013 value=0x{value:04X}",
+                    delay=self.mirror_delay,
+                ),
+            ),
+            suppress_default_ack=True,
+            reason=f"{self.name}_{state}_report",
+        )

ccu_emulator/modules.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Protocol
+
+
+@dataclass(frozen=True)
+class ModuleTx:
+    frame: bytes
+    label: str
+    delay: float = 0.0
+
+
+@dataclass(frozen=True)
+class ModuleDecision:
+    tx: tuple[ModuleTx, ...] = ()
+    suppress_default_ack: bool = False
+    reason: str = ""
+
+
+class CcuModule(Protocol):
+    name: str
+
+    def on_rx(self, frame: bytes, label: str = "") -> ModuleDecision | None:
+        """Inspect an RCP frame and optionally provide CCU response frames."""

ccu_emulator/policy.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .frames import HEARTBEAT_FRAME, NEUTRAL_ACK_FRAME, frame_checksum_ok
+
+
+REPORT_COMMAND_BYTES = frozenset({0x00, 0x01, 0x02})
+
+
+@dataclass(frozen=True)
+class AckDecision:
+    should_ack: bool
+    frame: bytes = NEUTRAL_ACK_FRAME
+    reason: str = ""
+
+
+@dataclass(frozen=True)
+class AckPolicy:
+    """Decides whether an RCP-origin frame should get a continuation ACK."""
+
+    ack_frame: bytes = NEUTRAL_ACK_FRAME
+    ack_reports: bool = True
+    ack_heartbeats: bool = True
+    ack_unlabeled_checksum_frames: bool = True
+
+    def decide(self, frame: bytes, label: str = "") -> AckDecision:
+        if not frame_checksum_ok(frame):
+            return AckDecision(False, self.ack_frame, "checksum_bad")
+
+        if frame == HEARTBEAT_FRAME:
+            if self.ack_heartbeats:
+                return AckDecision(True, self.ack_frame, "heartbeat_report")
+            return AckDecision(False, self.ack_frame, "heartbeat_ignored")
+
+        if frame[0] in REPORT_COMMAND_BYTES:
+            if self.ack_reports:
+                return AckDecision(True, self.ack_frame, f"report_cmd_{frame[0]:02X}")
+            return AckDecision(False, self.ack_frame, "reports_disabled")
+
+        if label == "checksum_ok_unlabeled" and self.ack_unlabeled_checksum_frames:
+            return AckDecision(True, self.ack_frame, "unlabeled_checksum_ok")
+
+        return AckDecision(False, self.ack_frame, f"non_report_cmd_{frame[0]:02X}")

ccu_emulator/refresh.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+
+
+@dataclass
+class PeriodicRefresh:
+    """Small scheduler for optional CCU state-refresh frames."""
+
+    frames: list[bytes] = field(default_factory=list)
+    interval: float = 0.0
+    _next_due: float | None = None
+    _index: int = 0
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self.frames) and self.interval > 0
+
+    def start(self, now: float | None = None) -> None:
+        if not self.enabled:
+            self._next_due = None
+            return
+        self._next_due = (time.monotonic() if now is None else now) + self.interval
+
+    def due_frames(self, now: float | None = None) -> list[bytes]:
+        if not self.enabled:
+            return []
+        current = time.monotonic() if now is None else now
+        if self._next_due is None:
+            self._next_due = current + self.interval
+            return []
+        if current < self._next_due:
+            return []
+
+        frame = self.frames[self._index % len(self.frames)]
+        self._index += 1
+
+        while self._next_due <= current:
+            self._next_due += self.interval
+        return [frame]

ccu_emulator/serial_link.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Iterable
+
+from h8536.bench_connect_lcd import BenchLogger, FrameDetector, format_frame, label_frame
+
+
+@dataclass(frozen=True)
+class RxFrame:
+    frame: bytes
+    label: str
+
+
+class SerialLink:
+    """Thin serial-port wrapper with checksum-resync frame detection."""
+
+    def __init__(
+        self,
+        device: Any,
+        logger: BenchLogger,
+        *,
+        sync_mode: str = "checksum",
+    ) -> None:
+        self.device = device
+        self.logger = logger
+        self.detector = FrameDetector(sync_mode=sync_mode)
+
+    def reset_input(self) -> None:
+        self.device.reset_input_buffer()
+        self.detector = FrameDetector(sync_mode=self.detector.sync_mode)
+
+    def read_available(self) -> list[RxFrame]:
+        waiting = getattr(self.device, "in_waiting", 0)
+        data = self.device.read(waiting or 1)
+        if not data:
+            return []
+
+        dropped_before = self.detector.dropped_bytes
+        self.logger.chunk("RX", data)
+        frames = [RxFrame(frame, label) for frame, label in self.detector.feed(data)]
+        for item in frames:
+            self.logger.event(f"DETECT {item.label} {format_frame(item.frame)}")
+        dropped_now = self.detector.dropped_bytes - dropped_before
+        if dropped_now:
+            self.logger.event(
+                f"RESYNC dropped_bytes={dropped_now} total_dropped={self.detector.dropped_bytes} "
+                f"buffered={len(self.detector.buffer)}"
+            )
+        return frames
+
+    def send(self, frame: bytes, label: str) -> None:
+        self.device.write(frame)
+        self.device.flush()
+        self.logger.chunk("TX", frame)
+        self.logger.event(f"SENT {label} {format_frame(frame)}")
+
+    def labels(self) -> dict[str, int]:
+        return dict(self.detector.labels)
+
+
+def label_for_frame(frame: bytes) -> str:
+    return label_frame(frame)
+
+
+def format_frames(frames: Iterable[bytes]) -> str:
+    return " | ".join(format_frame(frame) for frame in frames)

docs/pt2-button-report-bench-plan.md

@@ -0,0 +1,101 @@
+# PT2 Button Report Bench Plan
+
+Date: 2026-05-26
+
+## Question
+
+After the SHUTTER ON/OFF test exposed queued frames:
+
+```text
+02 01 0F 80 00 D6
+01 01 0F 80 00 D5
+```
+
+the next bench question is whether other buttons share the same common queue-service gate, or whether each button/selector needs its own feature gate.
+
+## Current ROM Model
+
+The known button ROM trace says many physical buttons share this front-door path:
+
+```text
+panel byte snapshot -> shadow byte -> dirty bit -> loc_1C0E jump table -> handler -> loc_3E54 report builder
+```
+
+CALL and CAM POWER use this path, and SHUTTER ON/OFF now appears to use it too once the CCU side services the queued report stream.
+
+The handlers diverge after the front door. Some directly build reports. Others depend on session/menu/feature state, especially secondary-table `E400` bits.
+
+## Test Method
+
+Run a no-button baseline first:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\button-report-common-gate-baseline.json --parity E --quiet-console --log captures\button-common-baseline.txt --result-json captures\button-common-baseline-result.json
+```
+
+Then run one physical button candidate through the same common gate:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\button-report-common-gate-press.json --parity E --quiet-console --log captures\button-common-SHORTNAME.txt --result-json captures\button-common-SHORTNAME-result.json
+```
+
+Compare the result JSONs:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario_compare.py captures\button-common-baseline-result.json captures\button-common-SHORTNAME-result.json --show-labels
+```
+
+If the candidate run has extra ACK-target frames, decode their selector/value. That suggests the button shares the common queue-service gate.
+
+## Broad-Gate Fallback
+
+If common-gate produces no extra selector for a button that should plausibly report, try the broader secondary-gate run:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\button-report-broad-gates-press.json --parity E --quiet-console --log captures\button-broad-SHORTNAME.txt --result-json captures\button-broad-SHORTNAME-result.json
+```
+
+Compare it against the same baseline:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario_compare.py captures\button-common-baseline-result.json captures\button-broad-SHORTNAME-result.json --show-labels
+```
+
+If a button only emits in the broad-gate run, it likely needs a selector-specific feature/report gate rather than only the common queue-service gate.
+
+## Practical Candidate Order
+
+Start with known or visually obvious controls:
+
+- SHUTTER ON/OFF: positive control, should reproduce selector `0x008F` value `0x8000`.
+- CAM POWER: known direct selector `0x0007`, useful sanity check.
+- CALL: known direct selector `0x0015`, but it can emit outside active state so treat it as a control.
+- KNEE AUTO, DETAIL, BARS, WHITE BALANCE, BLACK/FLARE, and OTHER: useful unknowns because prior display/lamp tests suggest nearby ROM handlers and selector state.
+
+Run one physical button per capture. The queue emits background reports, so button identity is much easier to recover by comparing against the no-button baseline than by reading one log in isolation.
+
+## First Common-Gate Results
+
+The first common-gate bench set compared each one-button run against `button-common-baseline`.
+
+Positive results:
+
+| Button | Extra queued report(s) | Current meaning |
+| --- | --- | --- |
+| BARS | `01/02 00 17 80 00`, `01/02 00 18 80 00` | BARS shares the common queue-service gate. This matches the ROM handler that emits selectors `0x0017` and `0x0018`. |
+| IRIS AUTO | `01/02 01 1A 08 00` | IRIS AUTO shares the common queue-service gate. This matches selector `0x009A` in the ROM button trace. |
+
+No extra ACK-target frames were found in these common-gate runs:
+
+- STANDARD
+- MASTER
+- SLAVE
+- KNEE AUTO
+- BLACK/FLARE FLARE
+- OTHERS
+
+Interpretation: at least some local controls use the same queue-service gate as SHUTTER ON/OFF, but not every physical button emits through this simple state. The silent candidates may need a different secondary/menu/session gate, may be display-only in this mode, or may not have been captured as a single edge event.
+
+OTHERS is now treated separately in `pt2-menu-state-machine.md` because the ROM evidence points to a local menu/display key rather than a simple report button.
+
+Note: the result JSONs preserved the per-button summaries, but the test log path was reused as `button-common-SHORTNAME.txt` for the candidate runs. For future runs, replace `SHORTNAME` in both `--log` and `--result-json` so the full timeline is preserved per button.

docs/pt2-continuation-command-trace.md

@@ -0,0 +1,209 @@
+# PT2 Continuation Command Trace
+
+This note enumerates the command paths that are active after the ROM sees `FAA2 != 0`.
+
+## Dispatcher Shape
+
+RX command dispatch starts after six-byte frame validation at `H'BBD6-H'BC67`.
+
+Important gates:
+
+- `F9C3 == 6`.
+- SCI/RX physical error latch `FAA4.7 == 0`.
+- Checksum matches `0x5A ^ F860 ^ F861 ^ F862 ^ F863 ^ F864 == F865`.
+- Command number is `F860 & 0x07`.
+- `F861.7` rejects normal command handling.
+- `FAA2 == 0` enters the initial dispatcher.
+- `FAA2 != 0` enters the continuation dispatcher.
+
+Continuation split:
+
+| Incoming command bits | Path | Meaning |
+| --- | --- | --- |
+| `command & 0x04 != 0` | `H'BC3A-H'BC56` | explicit continuation commands `4/5/6/7` |
+| `command & 0x04 == 0`, `FAA2.3 == 0` | `H'BC5C -> H'BE6F` | ignored/returns |
+| `command & 0x04 == 0`, `FAA2.3 == 1` | `H'BC5C-H'BC67 -> H'BC15` | clears queued-report continuation bit and re-enters initial command handling |
+
+That last row is easy to miss: command `0/1/2/3` can consume the report-continuation latch when `FAA2.3` was set by an autonomous report, then command `0/1/2` can run as an initial command. Command `3` still has no recognized initial handler and falls to the clear/return path.
+
+Selector bytes are packed from `F861:F862`, mapped by `loc_622B`, then doubled into `R4 = selector * 2` before the command handlers use the selector as a word-table offset.
+
+## Explicit Continuation Commands
+
+| Command | Handler | Table writes | Queue/report behavior | Cleanup |
+| --- | --- | --- | --- | --- |
+| `4` | `H'BD0E` | writes `E000`; selector zero also writes `E800`; sets `EC00.7` | calls `BE70` to append selector to `F970`; if `FAA2.3` set, advances `F9B5` | clears `FAA3`, clears `FAA2` |
+| `5` | `H'BD80` | none | special selectors may append to `F970` or clear latches; if `FAA2.3` set, advances `F9B5` | clears `FAA3`, clears `FAA2` |
+| `6` | `H'BDDB` | writes `E400`; sets `EC00.6` | does not append to `F970`; if `FAA2.3` set, advances `F9B5` | clears `FAA3`, clears `FAA2` |
+| `7` | `H'BE05` | none | copies previous finalized TX frame from `F858-F85C` to `F850-F854` and retransmits | does not clear `FAA2/FAA3` in this handler |
+
+## `BE70`: Selector Processing Queue Append
+
+`BE70` is the shared helper used by command `0`, command `4`, and selected command-`5` cases.
+
+Path `H'BE70-H'BE9D`:
+
+- Scans the `F970` word ring from consumer cursor `F9B9` to producer cursor `F9B4`.
+- If the selector is already present, returns without appending a duplicate.
+- If absent, writes the selector to `F970 + 2*F9B4`.
+- Increments `F9B4` and clears bit 5, making the queue a 32-entry ring.
+
+Practical meaning:
+
+- `F970` means "process this selector internally".
+- It is separate from the serial-visible report queue at `F870`.
+- Re-sending the same selector may refresh table values without creating another queued selector entry if the old entry has not been consumed yet.
+
+## Command 4: Continuation Primary Write
+
+Selector zero branch:
+
+- `H'BD12-H'BD18`: builds value from `F863` and forces low byte `0x80`.
+- `H'BD1A`: writes `E000[0]`.
+- `H'BD1E`: writes `E800[0]`.
+- `H'BD22`: sets `EC00[0].7`.
+- `H'BD26`: calls `BE70`, appending selector zero to `F970`.
+
+Nonzero selector branch:
+
+- `H'BD2B-H'BD35`: builds value from `F863/F864` and writes `E000[selector]`.
+- `H'BD39`: sets `EC00[selector].7`.
+- `H'BD3D-H'BD45`: if the selector has a mapped shadow slot, writes the value into the `F400` shadow area.
+- `H'BD49-H'BD5F`: if `F76E.7` is set, uses the mapped shadow offset plus the `F76E` page nibble and calls `BFE0`, the EEPROM/persistent-write path.
+- `H'BD64`: calls `BE70`, appending the selector to `F970`.
+
+Persistent-write detail:
+
+- If the selector-to-shadow map entry is zero, the mirror/persist path is skipped.
+- `BFE0` seeds retry timer `F840=0x0A`, writes via the P9/X24164 helper path, reads back for verification, and sets `F841.7` on timeout/failure.
+
+Report consumption:
+
+- `H'BD67-H'BD71`: if `FAA2.3` was set by a queued report, increments `F9B5` and clears `F9B5.7`.
+- `H'BD75-H'BD79`: clears `FAA3` and `FAA2`.
+
+Practical meaning:
+
+- Command `4` is a continuation write/update, not a generic always-live command.
+- Command `4` selector zero can refresh both the primary/current table and queue the CONNECT selector.
+- Nonzero command `4` does not directly refresh `E800`; autonomous report values still come from the older/current `E800` value unless another path updates it.
+
+## Command 5: ACK-Like / Special Selector Command
+
+Command `5` reaches `H'BD80` only from the continuation dispatcher:
+
+- `FAA2 != 0`.
+- `command & 0x04 != 0`.
+- `F861.7 == 0`.
+- `F860 & 0x07 == 5`.
+
+Special enqueue selectors:
+
+| Selector | Branch | Later selector dispatch | Current meaning |
+| --- | --- | --- | --- |
+| `0x006C` | `H'BD80 -> H'BDBF` | `H'2FAF` | COPY completion/exit sibling when copy flags are live |
+| `0x006D` | `H'BD85 -> H'BDBF` | `H'3015` | COPY in-progress/start refresh |
+| `0x006E` | `H'BD8A/H'BD8F -> H'BDBF` | `H'2CA6` | special-accepted but selector dispatch is currently no-op |
+
+The duplicate `0x006E` compare at `H'BD8A` and `H'BD8F` appears redundant in the current decode.
+
+Selector-table math for the special group:
+
+- Table base is `H'28A6`.
+- `0x006C` indexes `H'297E`, whose pointer is `H'2FAF`.
+- `0x006D` indexes `H'2980`, whose pointer is `H'3015`.
+- `0x006E` indexes `H'2982`, whose pointer is `H'2CA6`.
+- `H'2CA6` clears `F769.7` and returns.
+
+Latch-clear selectors:
+
+| Selector | Gate | Effect |
+| --- | --- | --- |
+| `0x006B` | only if `F731.7` set | clears `F731.7` and `F790.7` |
+| `0x0096` | only if `F731.7` set | clears `F731.7` and `F790.7` |
+| `0x0097` | only if `F731.7` set | clears `F731.7` and `F790.7` |
+| `0x00C6` | only if `F731.7` set | clears `F731.7` and `F790.7` |
+| `0x00F8` | only if `F731.7` set | clears `F731.7` and `F790.7` |
+
+Report consumption and cleanup:
+
+- `H'BDC2-H'BDCC`: if `FAA2.3` was set by a queued report, increments `F9B5` and clears `F9B5.7`.
+- `H'BDD0-H'BDD4`: clears `FAA3` and `FAA2`.
+
+Practical meaning:
+
+- Command `5` is the closest thing to an ACK, but only inside the continuation side.
+- Most command-5 selectors do not have selector-specific meaning; they just consume/clear the continuation state if one is live.
+- `0x006C/0x006D/0x006E` are command-5 special cases because they enter the `F970` selector-processing queue.
+- `0x006E` is accepted as special by the command handler, but its current selector-table target is `2CA6`, the no-op return path.
+
+## Command 6: Continuation Secondary Write
+
+Path `H'BDDB-H'BE03`:
+
+- `H'BDDB-H'BDE5`: builds value from `F863/F864` and writes `E400[selector]`.
+- `H'BDE9`: sets `EC00[selector].6`.
+- `H'BDED-H'BDF7`: if `FAA2.3` was set by a queued report, increments `F9B5` and clears `F9B5.7`.
+- `H'BDFB-H'BDFF`: clears `FAA3` and `FAA2`.
+
+Practical meaning:
+
+- Command `6` is the secondary feature/status table write used by menu visibility and gate code.
+- It does not append the selector to `F970`, so it changes later decisions but does not itself force immediate selector dispatch.
+
+## Command 7: Retransmit
+
+Path `H'BE05-H'BE25`:
+
+- Copies previous finalized TX bytes `F858-F85C` into staging bytes `F850-F854`.
+- Loads `F9C0=0x1F`.
+- Calls `BA26` to finalize/send again.
+- `BA26` then waits for `F9C0 == 0`, reloads `F9C0=0x64`, reloads `F9C4=0x07`, copies staging bytes back to `F858-F85C`, recomputes the checksum into `F85D`, and starts SCI1 TX.
+
+Practical meaning:
+
+- Command `7` repeats the previous finalized TX frame.
+- It is valid from both initial and continuation dispatch.
+- It does not acknowledge/consume `F870` report queue entries by itself and does not clear `FAA2/FAA3` in this handler.
+- The copied old checksum byte is not trusted; `BA26` recomputes the checksum.
+
+## Distinct `07` Error Echo Path
+
+The ROM also emits `07...` frames from an error/retry path that is separate from explicit command `7`.
+
+Triggers:
+
+- SCI/RX physical error latched in `FAA4.7`.
+- Checksum mismatch at `H'BBF0`.
+
+Path `H'BE29-H'BE6A`:
+
+- Clears `FAA4.7`.
+- Requires `FAA5.7`; if the session gate is absent, no echo is sent.
+- Increments retry counter `FAA6`.
+- For the first two retry attempts, stages:
+
+```text
+byte0 = 0x07
+byte1 = RX[1]
+byte2 = RX[2]
+byte3 = RX[3]
+byte4 = RX[4]
+```
+
+- Calls `BA26` to send the error echo.
+- After too many retries, loads `F9C0=0x1F` and clears `FAA3/FAA2` instead of sending another echo.
+
+Practical meaning:
+
+- A `07 ...` frame is not automatically a normal command-7 retransmit.
+- Old captures made with the wrong serial parity can easily be retry/error echoes.
+- Valid frames clear `FAA6` at `H'BBF3`.
+
+## Bench Implications
+
+- To update active selector state during a report window, use command `4` or `6` while `FAA2 != 0`.
+- To consume a queued report without changing tables, command `5` is the cleanest continuation ACK shape.
+- To trigger COPY side effects, command `5` with `0x006D` starts/refreshes `COPY IN PROGRESS`, and command `5` with `0x006C` completes/exits only while the copy flags are live.
+- Do not treat command `7` as an ACK. It is a repeat probe.
+- A low command `0/1/2` sent while `FAA2.3` is live may clear the report continuation and then run as an initial command, which can make timing-sensitive bench traces look like an ACK plus a new command in one frame.

docs/pt2-copy-state-machine.md

@@ -0,0 +1,154 @@
+# PT2 Copy State Machine
+
+This is a focused reference for the COPY behavior seen on the RCP LCD and traced in the ROM.
+
+## Known Entry Points
+
+### Serial Start / Progress
+
+Frame:
+
+```text
+05 00 6D 00 00 32
+00 00 6D 00 00 37  ; family-00 set/queue form to test
+```
+
+ROM path:
+
+- Command 5 accepts selector `0x006D` at `BD80-BDBF`.
+- The selector is queued through `BE70`.
+- Selector `0x006D` dispatches to `H'3015`.
+
+Observed effects from forced decode:
+
+- Sets `F731.7`.
+- Sets `F795.6/F795.7`.
+- Loads `F798=H'C8`.
+- Sets display selector `F732=H'1903`.
+- Sets `FB02=H'64`.
+- Calls the display/report bridge at `48FA`.
+- Sets `F76E.6`.
+
+LCD dispatch:
+
+- `F732` high byte `0x19` selects `493E[0x19] -> H'930A`.
+- The local table at `H'931C` maps substate `0x03` to `H'9F6A`.
+- `H'9F6A` builds `COPY` / `IN PROGRESS`.
+
+### Serial Complete / Exit
+
+Frame:
+
+```text
+05 00 6C 00 00 33
+00 00 6C 00 00 36  ; family-00 set/queue form observed during active report drain
+```
+
+ROM path:
+
+- Command 5 accepts selector `0x006C` at `BD80-BDBF`.
+- The selector is queued through `BE70`.
+- Selector `0x006C` dispatches to `H'2FAF`.
+
+Observed effects from forced decode:
+
+- Manipulates `F76E`, `F795`, `F797`, and `F799`.
+- Can set display selector `F732=H'1904`.
+- Sets `FB02=H'14`.
+- Calls the display/report bridge at `48FA`.
+
+LCD dispatch:
+
+- `F732` high byte `0x19` selects `493E[0x19] -> H'930A`.
+- The local table at `H'931C` maps substate `0x04` to `H'9FDA`.
+- `H'9FDA` builds `COPY` / `COMPLETED`.
+
+### RCP-Side Menu Start
+
+ROM path:
+
+- OTHERS menu page: `493E[0x01] -> H'631C`.
+- Local page table: `H'632E`.
+- `COPY TO SLAVES` entry handler: `H'6FF0`.
+
+Required gates:
+
+- The entry descriptor before `H'6FF0` requires `E400[0x0015] != 0`.
+- The local COPY action branch requires `F770.2` and `F791.7`.
+
+Local branch effects:
+
+- Sets `F76E.6`.
+- Sets `F795.7`.
+- Sets `F731.7`.
+- Loads `F798=H'C8`.
+- Sets `F711.7`.
+- Loads `F726=H'64`.
+- Calls `loc_5500`.
+- Displays `COPY TO SLAVES`.
+
+If `F770.2` is set while `F791.7` is clear, the ROM diverts through `H'704C` to a `SET RCP` / `MASTER` display path instead of starting copy.
+
+## Working State Model
+
+| State | Likely indicators | Entry | Exit |
+| --- | --- | --- | --- |
+| Idle / no copy | `F731.7` clear | Boot, timeout, or completion cleanup | `0x006D` or local COPY branch |
+| Copy in progress | `F731.7`, `F795.6/F795.7`, `F798` live, `F732=H'1903` | `05 00 6D 00 00 32` or local COPY branch | `0x006C` in the live window, or timer expiry |
+| Copy completed | `F732=H'1904` | `05 00 6C 00 00 33` while copy flags are live | Display/session timeout or next state update |
+| Timeout / not active | `F731.7` cleared by timer path | `F797` or `F798` reaches zero | Normal CONNECT recovery traffic |
+
+## Bench Results
+
+Observed on the real panel:
+
+```text
+006C alone                      -> CONNECT OK -> blank
+006D alone                      -> CONNECT OK -> COPY IN PROGRESS -> CONNECT NOT ACT
+006D -> 006C after 250 ms       -> COPY IN PROGRESS -> COPY COMPLETED
+006D -> 006C after 1.0-1.5 s    -> COPY IN PROGRESS -> COPY COMPLETED
+006D -> 006C after 2.0-2.5 s    -> COPY IN PROGRESS -> CONNECT NOT ACT
+006D repeated, then 006C        -> COPY IN PROGRESS held longer -> COPY COMPLETED
+006D repeated without 006C      -> COPY IN PROGRESS -> CONNECT NOT ACT
+```
+
+Family-00 comparison run on 2026-05-27:
+
+```text
+00 00 6D 00 00 37 -> 00 00 6C 00 00 36
+  -> immediate 04 00 6D / 04 00 6C table readbacks
+  -> no command-5-like 01 00 02 / 02 00 04 response rhythm
+
+05 00 6D 00 00 32 -> 05 00 6C 00 00 33
+  -> 01 00 02 responses after 006D
+  -> 02 00 04 responses after 006C
+```
+
+Webcam-confirmed LCD results from the same 2026-05-27 run:
+
+```text
+00 00 6D 00 00 37 -> COPY IN PROGRESS
+00 00 6C 00 00 36 -> COPY COMPLETED
+05 00 6D 00 00 32 -> COPY IN PROGRESS
+05 00 6C 00 00 33 -> COPY COMPLETED
+```
+
+The 250 ms and 1000 ms gap variants both produced the same LCD sequence. This
+means the family-00 selector/write form can reach the COPY LCD side effects, even
+though its serial response rhythm is the table-readback rhythm rather than the
+command-5 `01 00 02` / `02 00 04` rhythm.
+
+Current interpretation:
+
+- `0x006D` is a copy-start/progress-window refresh selector.
+- `0x006C` is a completion/exit selector that only behaves cleanly while the copy window is live.
+- The observed `00 00 6C 00 00 36` frame can display `COPY COMPLETED` when it is sent inside a live copy window, but should not be read as a stateless "show completed" command.
+- The copy window is transient and timer-controlled.
+- The panel does not treat `0x006C` as a stateless "show completed" command.
+
+## Open Questions
+
+- What sets `F791.7` during normal CCU/RCP operation?
+- What exact official PT2 name belongs to selectors `0x006C`, `0x006D`, and `0x006E`?
+- Whether `0x006E` is a copy cancel/error sibling or an unrelated special selector.
+- Whether the CCU sends repeated progress refreshes during a real COPY TO SLAVES operation.

docs/pt2-iris-mblack-link-rom-trace.md

@@ -0,0 +1,78 @@
+# PT2 IRIS/M.BLACK LINK ROM Trace
+
+This note records the ROM evidence for the bench-visible
+`IRIS/M.BLACK LINK` lamp.
+
+## Confirmed Host Trigger
+
+The isolated bench trigger is:
+
+```text
+00 00 13 40 00 09  ; command 0, selector 0x0013, value 0x4000
+```
+
+Command 0 mirrors nonzero selector writes into both `E000[selector]` and
+`E800[selector]`, then queues the selector for internal processing. For this
+frame that means:
+
+```text
+E000[0x0013] = 0x4000
+E800[0x0013] = 0x4000
+```
+
+The current-table word is `E800 + 2 * 0x0013 = H'E826`.
+
+## Selector Handler
+
+The selector dispatch table maps selector `0x0013` to `H'2E06`.
+
+Focused linear decode:
+
+```text
+H'2E06  BTST.W #15, @H'E826
+        set/clear F791.6 and F713.4
+
+H'2E1E  BTST.W #14, @H'E826
+        set/clear F791.5 and F716.7
+```
+
+Bench labels:
+
+| Selector value | ROM latch bits | Visible result |
+| --- | --- | --- |
+| `0x8000` | `F791.6`, `F713.4` | far-right `SLAVE` lamp |
+| `0x4000` | `F791.5`, `F716.7` | `IRIS/M.BLACK LINK` lamp |
+| `0x0000` | clears both bit groups through `H'2E06` | both latch groups clear |
+
+## Other Trigger Path
+
+There is also a local panel-input path:
+
+```text
+F006.7 / F6DB.7 -> H'200E -> H'E826 bit14 -> loc_3E54 queues selector 0x0013
+```
+
+At `H'200E`, the ROM checks `F6DB.7` and requires `F731 <= 3`. It then uses
+`F791.5` as a current-state toggle:
+
+- if `F791.5` is clear, it sets `H'E826.14`,
+- if `F791.5` is set, it clears `H'E826.14`,
+- in both cases it calls `loc_3E54` with selector `0x0013`.
+
+This is not a separate lamp driver. It feeds the same `E800[0x0013].14`
+state consumed by the selector handler.
+
+## Practical Meaning
+
+The strongest current model is:
+
+- CCU/host can drive the lamp directly by sending selector `0x0013` value
+  `0x4000` through command 0.
+- The panel can also toggle/report the same state through a local input lane,
+  but only when the relevant session/page gate is open.
+- No other decoded selector currently appears to directly set the same
+  `F791.5` plus `F716.7` latch pair.
+
+Generated semantics now label selector `0x0013`, `E800[0x0013]`, and the
+`IRIS/M.BLACK LINK` / `SLAVE` bit meanings so pseudo-code output does not leave
+this as a generic table write.

docs/pt2-iris-mblack-link-state-machine.md

@@ -0,0 +1,193 @@
+# PT2 IRIS/M.BLACK LINK State Machine
+
+Date: 2026-05-27
+
+This note records the bench-proven closed loop for the `IRIS/M.BLACK LINK`
+button/lamp path.
+
+## Short Answer
+
+There is no current evidence that the CCU first sends a separate
+"this function exists" capability command for `IRIS/M.BLACK LINK`.
+
+The stronger model is:
+
+1. The CCU/RCP session must be awake/active.
+2. The CCU must service the RCP report queue.
+3. The CCU is the authoritative owner of selector state.
+4. When the RCP reports a local button intent, the CCU ACKs the report and
+   mirrors the resulting selector value back to the RCP.
+
+For this control, selector `0x0013` bit `0x4000` is the
+`IRIS/M.BLACK LINK` state.
+
+## Proven Frames
+
+Selector value frames:
+
+```text
+00 00 13 40 00 09  ; command 0, selector 0x0013, value 0x4000, active
+00 00 13 00 00 49  ; command 0, selector 0x0013, value 0x0000, clear
+```
+
+Report ACK:
+
+```text
+05 00 13 00 00 4C  ; command 5 ACK/continuation for selector 0x0013
+```
+
+Readback request:
+
+```text
+01 00 13 00 00 48  ; command 1 read selector 0x0013
+```
+
+Observed readback shapes:
+
+```text
+04 00 13 40 00 0D  ; command-0 write response, selector 0x0013 active
+04 00 13 00 00 4D  ; command-0 write response, selector 0x0013 clear
+04 13 00 40 00 0D  ; command-1 readback response, selector 0x0013 active
+04 13 00 00 00 4D  ; command-1 readback response, selector 0x0013 clear
+```
+
+## Successful Closed Loop
+
+Capture:
+
+```text
+captures/iris-mblack-link-mirror-state-machine.txt
+captures/iris-mblack-link-mirror-state-machine-result.json
+```
+
+Scenario:
+
+```text
+scenarios/iris-mblack-link-mirror-state-machine.json
+```
+
+The visible panel behavior was:
+
+```text
+press 1: lamp on
+press 2: lamp off
+press 3: lamp on
+```
+
+The serial behavior matched that cycle.
+
+### Baseline Clear
+
+```text
+TX 00 00 13 00 00 49
+RX 04 00 13 00 00 4D
+```
+
+### Press 1: Active
+
+```text
+RX 00 00 13 40 00 09
+TX 05 00 13 00 00 4C   ; ACK report
+TX 00 00 13 40 00 09   ; mirror active back
+RX 04 00 13 40 00 0D
+TX 01 00 13 00 00 48   ; readback
+RX 04 13 00 40 00 0D
+```
+
+### Press 2: Clear
+
+```text
+RX 00 00 13 00 00 49
+TX 05 00 13 00 00 4C   ; ACK report
+TX 00 00 13 00 00 49   ; mirror clear back
+RX 04 00 13 00 00 4D
+TX 01 00 13 00 00 48   ; readback
+RX 04 13 00 00 00 4D
+```
+
+### Press 3: Active Again
+
+```text
+RX 00 00 13 40 00 09
+TX 05 00 13 00 00 4C
+TX 00 00 13 40 00 09
+RX 04 00 13 40 00 0D
+TX 01 00 13 00 00 48
+RX 04 13 00 40 00 0D
+```
+
+## Interpretation
+
+The RCP does not appear to treat the local button press as final local state.
+It reports local intent to the CCU.
+
+The CCU then:
+
+1. ACKs the selector report with command `5`.
+2. Applies the chosen state back to the RCP with command `0`.
+
+The RCP uses the mirrored/current selector state to decide the next toggle
+direction. This explains the earlier failed/incomplete behavior:
+
+- Without mirroring `0x0013=0x4000` back, repeated presses could keep reporting
+  active because the RCP still believed the selector was clear.
+- Once the CCU mirrored active back, the next press reported clear.
+- Once the CCU mirrored clear back, the next press reported active again.
+
+## Wakeup Versus Capability
+
+The successful test also had active session traffic:
+
+```text
+00 00 00 80 80 5A  ; active selector-zero keepalive/report
+05 00 00 00 00 5F  ; ACK for selector zero
+```
+
+That traffic looks like general session/connected behavior, not a
+per-function enable for `IRIS/M.BLACK LINK`.
+
+So the current working model is:
+
+- `CONNECT: OK` / active rhythm opens the report path and keeps the panel from
+  falling back to `CONNECT: NOT ACT`.
+- Selector `0x0013` state tells the RCP the current value of this specific
+  control/lamp.
+- There may still be feature-specific gates for other controls, but this test
+  did not require a distinct `IRIS/M.BLACK LINK exists` command.
+
+## ROM Correlation
+
+The ROM trace in `docs/pt2-iris-mblack-link-rom-trace.md` matches the bench
+behavior:
+
+```text
+F006.7 / F6DB.7 -> H'200E -> H'E826 bit14 -> loc_3E54 queues selector 0x0013
+```
+
+At `H'200E`, the ROM reads `F791.5` as the current `IRIS/M.BLACK LINK` state:
+
+- if `F791.5` is clear, the local press queues/set reports `0x0013=0x4000`;
+- if `F791.5` is set, the local press queues/clear reports `0x0013=0x0000`.
+
+The selector handler for `0x0013` updates `F791.5` from `E800[0x0013].14`.
+That is why mirroring command-0 selector state back to the RCP completes the
+toggle loop.
+
+## Implications
+
+For a CCU emulator:
+
+- Maintain an authoritative selector table.
+- Treat RCP button reports as requested state changes, not just notifications.
+- ACK each report with command `5`.
+- Write the accepted selector value back with command `0`.
+- Keep the selector-zero/session rhythm alive separately.
+
+For other latched buttons:
+
+- The same pattern is likely: RCP emits a selector report, then expects the CCU
+  to mirror the accepted state back.
+- A button that only reports "active" repeatedly may not be broken; it may be
+  waiting for the CCU to update the selector state that controls its next
+  toggle direction.
+

docs/pt2-knee-rom-trace.md

@@ -0,0 +1,175 @@
+# PT2 KNEE ROM Trace
+
+Date: 2026-05-26
+
+## Short Version
+
+KNEE is not a simple held selector bit. The ROM has a dedicated local panel-input handler at `loc_1795`, reached when the panel input word at `F104` changes. That handler uses CCU-side selector state as gates, then either shows a short timed KNEE page or reports a KNEE value change on selector `0x00BC`.
+
+This explains the bench pattern where KNEE AUTO can light or flash and then clear even while serial traffic remains healthy: one ROM path is a timed display/page override, not a maintained lamp value.
+
+## Input Path
+
+The local panel path is:
+
+```text
+F104 changes -> F692 updated -> F6F0.1 set -> main dispatcher calls loc_1795
+```
+
+The important code anchors are:
+
+```text
+3B33  MOV:G.W @H'F104, R0
+3B37  CMP:G.W @H'F692, R0
+3B3D  BSET.B #1, @H'F6F0
+3B41  MOV:G.W R0, @H'F692
+
+1630  BCLR.B #1, @H'F6F0
+1636  JSR @loc_1795
+```
+
+So serial writes can prepare the state table, but the main KNEE control branch appears to require the panel-side input lane to change.
+
+## Handler Decision Table
+
+`loc_1795` reads two words from the primary selector table:
+
+| ROM read | Selector meaning |
+| --- | --- |
+| `@H'E172` | `E000[0x00B9]` |
+| `@H'E220` | `E000[0x0110]` |
+
+The branch is:
+
+```text
+1795  if F731 > 2: skip
+179C  if E000[0x00B9].13 == 0: loc_2127()
+17A7  else if E000[0x0110].15 == 1: loc_2127()
+17B2  else:
+        delta = F692 - F6B2
+        report/update selector 0x00BC via loc_19A2
+17C0  F6B2 = F692
+```
+
+Practical interpretation:
+
+| Condition | ROM effect | Current meaning |
+| --- | --- | --- |
+| `0x00B9.13 = 0` | timed KNEE page via `loc_2127` | KNEE value reporting not enabled |
+| `0x00B9.13 = 1`, `0x0110.15 = 1` | timed KNEE page via `loc_2127` | override/inhibit mode |
+| `0x00B9.13 = 1`, `0x0110.15 = 0` | value delta reported as selector `0x00BC` | likely live KNEE control/report lane |
+
+This downgrades the earlier bench label that treated `0x00B9.15` as the main KNEE gate. The ROM gate for the panel-input handler is `0x00B9.13`.
+
+## Timed KNEE Page
+
+`loc_2127` is the timed page path:
+
+```text
+2127  set FB03.7
+212D  save old F732 into F734, if this is a fresh override
+2135  F732 = 0x1C03
+213B  FB02 = 0x14
+2140  call loc_48FA
+```
+
+The timer path later decrements `FB02`; when it expires, `loc_48EF` restores `F732` from `F734` and redraws. That is the likely cause of "lights, then falls away" observations.
+
+The LCD dispatcher confirms `F732=0x1C03` is a KNEE page:
+
+```text
+493E[0x1C] -> 0x92CC
+0x92DE[3] -> 0x95CE
+0x960B prints "KNEE"
+```
+
+On that KNEE page, the second line is selected like this:
+
+```text
+if E000[0x0110].15: "DL"
+else if E000[0x00B9].15: "PRESET"
+else: "AUTO"
+```
+
+So `0x00B9.15` still matters, but it appears to choose the KNEE page label (`PRESET` versus `AUTO`) rather than enabling the report path. `0x0110.15` selects the `DL` label and also forces the timed page path from `loc_1795`.
+
+## Bench Implications
+
+Useful frames to test this model:
+
+| Purpose | Frame |
+| --- | --- |
+| clear `0x00B9` | `00 01 39 00 00 62` |
+| set `0x00B9.13` gate | `00 01 39 20 00 42` |
+| set `0x00B9.15` label bit | `00 01 39 80 00 E2` |
+| set `0x00B9.15` and `.13` | `00 01 39 A0 00 C2` |
+| clear `0x0110` | `00 01 90 00 00 CB` |
+| set `0x0110.15` override | `00 01 90 80 00 4B` |
+| read `0x00BC` | `01 01 3C 00 00 66` |
+
+The most direct live-control test is:
+
+1. Reach `CONNECT: OK`.
+2. Send `00 01 39 20 00 42` to set `0x00B9.13`.
+3. Send `00 01 90 00 00 CB` to clear `0x0110.15`.
+4. Move or exercise the physical KNEE-related control, if available.
+5. Watch for TX/report traffic around selector `0x00BC`.
+
+If no physical KNEE input is moved, the ROM may not enter `loc_1795`, because the trigger is the `F104` panel input change path rather than the serial write itself.
+
+## Bench Observation: DTL / KNEE
+
+The first `knee-rom-gate-and-value-probe` bench run produced a new LCD state with `DTL` on the left and `KNEE` on the right. That is an important confirmation: page `0x1C` contains both a KNEE entry and a DETAIL entry.
+
+Relevant ROM text and page entries:
+
+```text
+0x92DE[3] -> 0x95CE  KNEE page entry
+0x92DE[7] -> 0x97C8  DETAIL page entry
+0x960B prints "KNEE"
+0x9805 prints "DETAIL"
+```
+
+The bench display probably shows the page-0x1C menu neighborhood, with DETAIL abbreviated as `DTL` and KNEE as the selected/right-side item. The log does not encode LCD pixels, but the serial timing around the observation is consistent with the KNEE probe:
+
+```text
+00 01 39 20 00 42  ; set 0x00B9.13 gate
+00 01 39 A0 00 C2  ; set 0x00B9.15 + 0x00B9.13
+00 01 90 80 00 4B  ; set 0x0110.15 timed KNEE/DL override
+```
+
+Next isolation target: determine whether `DTL/KNEE` appears from `0x00B9.13`, `0x00B9.A0`, `0x0110.15`, or only the combined sequence.
+
+## Panel Correlation
+
+The physical panel has both DETAIL and KNEE buttons near the LCD. That matches the ROM page-`0x1C` neighborhood and makes the observed `DTL/KNEE` state likely to be a local menu/button context rather than a generic lamp status.
+
+Practical implication: once the CCU-side selector gates are prepared, pressing the physical DETAIL/KNEE buttons may be the missing `F104` panel-input transition that calls `loc_1795`. If so, the useful evidence should be:
+
+- visible LCD movement between DETAIL and KNEE entries,
+- possible KNEE timed page redraws,
+- TX/report traffic for selector `0x00BC` when KNEE input movement is accepted,
+- or other page-`0x1C` selector reports from neighboring DETAIL/KNEE controls.
+
+## Follow-Up: Lamp Without LCD Movement
+
+The follow-up run after discovering the DETAIL/KNEE buttons did not reproduce an LCD page change. The observed result was:
+
+- only the later KNEE cases/windows illuminated the KNEE AUTO lamp,
+- none of those cases changed the LCD.
+
+Current interpretation:
+
+- `0x0110.15` is still the strongest KNEE AUTO lamp/status source.
+- Serial table writes can light KNEE AUTO without necessarily entering the LCD DETAIL/KNEE page.
+- The LCD path probably needs an additional local-display/menu condition, not just the CCU-side selector bits.
+- The physical DETAIL/KNEE buttons may be scanned by the local panel path, but in this test they did not create a visible LCD transition or new serial report evidence.
+
+This separates two related but distinct paths:
+
+```text
+KNEE AUTO lamp/status:  mostly selector/table driven, strongest source 0x0110.15
+DETAIL/KNEE LCD page:  local page/menu context, likely page 0x1C plus panel/menu state
+```
+
+Next ROM target: trace the DETAIL and KNEE button scan bits through the page-`0x1C` menu dispatcher, not just the `loc_1795` KNEE value handler.

docs/pt2-known-button-rom-trace.md

@@ -0,0 +1,157 @@
+# PT2 Known Button ROM Trace
+
+This trace starts from known serial-visible button reports and walks backward into the panel input scanner.
+
+Known reports:
+
+- `00 00 07 80 00 DD` = selector `0x0007`, value `0x8000`, observed CAM POWER report.
+- `00 00 15 80 00 CF` = selector `0x0015`, value `0x8000`, observed CALL active report.
+- `00 00 15 00 00 4F` = selector `0x0015`, value `0x0000`, observed CALL inactive report.
+
+## Shared Button Path
+
+CALL and CAM POWER both use the same general panel edge machinery:
+
+```text
+external panel byte snapshot
+  -> shadow byte F6D*
+  -> dirty byte F6F2/F6F3
+  -> main scanner loc_15E0
+  -> bit dispatcher loc_1C0E
+  -> table H'2706
+  -> per-button handler
+  -> loc_3E54 serial report queue
+```
+
+That means the lamps and buttons are not just conceptually related. The ROM reads panel byte shadows and drives panel output masks through the same external panel-chip area, then uses per-button handlers to decide whether a press should become a serial report, a local menu action, or nothing.
+
+## CAM POWER
+
+Trace:
+
+```text
+F105 external/panel byte changes
+  -> F6D4 shadow changes
+  -> F6F2.4 dirty
+  -> loc_1BA0
+  -> loc_1C0E table slot H'274C
+  -> handler H'1F40
+  -> writes E80E
+  -> queues selector 0x0007 through loc_3E54
+```
+
+Important handler behavior:
+
+```text
+1F40: tests F6D4.3
+1F4C: tests E000[0x0007] / E00E bit 15
+1F52: writes E800[0x0007] / E80E = 0x8000
+1F61: can write E80E = 0x0000 when already set and page gate allows
+1F68: R3 = 0x0007
+1F6B: BSR loc_3E54
+```
+
+So CAM POWER is a real local button path, not a host-only selector. The handler checks the current button level and local/session gates before emitting.
+
+## CALL
+
+Trace:
+
+```text
+F006 external/panel byte changes
+  -> F6DB shadow changes
+  -> F6F3.3 dirty
+  -> loc_1BF8
+  -> loc_1C0E table slot H'27C0
+  -> handler H'20A1
+  -> writes E82A
+  -> queues selector 0x0015 through loc_3E54
+```
+
+Important handler behavior:
+
+```text
+20A1: reads E000[0x0015] / E02A
+20A5: tests F6DB.5
+20AB: if pressed, sets bit 15
+20AF: if released, clears bit 15
+20B1: writes E800[0x0015] / E82A
+20B7: R3 = 0x0015
+20BA: BSR loc_3E54
+```
+
+This cleanly matches the bench readings: CALL has both active and inactive reports because the handler explicitly sets or clears bit 15 from the current button level.
+
+## Divergence
+
+Other buttons do follow the same input edge path, but many diverge after `loc_1C0E`:
+
+- Some handlers are `H'1C25`, an immediate `RTS`, so that matrix position is ignored.
+- Some handlers only change local menu/page state such as `F731`, `F732`, `FB03`, or `F798`.
+- Some handlers queue reports, but only if session/menu gates like `F731`, `F730`, `F791`, or selector bits in `E000/E400` allow it.
+- Several handlers queue different selectors such as `0x0083`, `0x008F`, `0x0093`, `0x009A`, `0x00B9`, `0x00F8`, etc.
+
+The generated report `build/panel_button_trace.md` lists the current table-derived map.
+
+## Bench Correlation: Common Queue Gate
+
+The first common-gate button-report bench set used the queued-report ACK stream that exposed SHUTTER ON/OFF.
+
+Confirmed positives:
+
+| Physical button | Report selectors/value | ROM match |
+| --- | --- | --- |
+| BARS | `0x0017 = 0x8000`, `0x0018 = 0x8000` | `F105/F6D4.2 -> H'1EDE -> 0x0017/0x0018` |
+| IRIS AUTO | `0x009A = 0x0800` | `F006/F6DB.3 -> H'20BE -> 0x009A` |
+
+Common-gate runs for STANDARD, MASTER, SLAVE, KNEE AUTO, and BLACK/FLARE FLARE did not differ from the no-button baseline. That is evidence against one universal "all buttons emit now" gate. Some controls likely need additional menu/session/secondary-table state, or are not represented as simple edge reports in this mode.
+
+## F109 Shutter/Menu Cluster
+
+A focused trace of the `F109 -> F6D0` input byte found local-key handlers that are close to the OTHERS/shutter/menu machinery:
+
+| Source bit | Handler | Behavior |
+| --- | --- | --- |
+| `F6D0.1` | `H'2390` | Queues selector `0x0083`, unless `E000[0x0088].15` diverts to timed page `F732=0x1C01` |
+| `F6D0.2` | `H'2408` | Queues selector `0x0083`, unless `E000[0x0088].15` diverts to timed page `F732=0x1C01` |
+| `F6D0.3` | `H'24A9` | Queues selector `0x0083`, unless `E000[0x0088].15` diverts to timed page `F732=0x1C01` |
+| `F6D0.7` | `H'24E8` | Queues selector `0x008F` with local mask `0x8000` or `0x0000`; `E000[0x0088].14` diverts to timed page `F732=0x1C01` |
+| `F6D0.6` | `H'252E` | Queues selector `0x008F` with local mask `0x2000` or `0x0000`; `E000[0x0088].14` diverts to timed page `F732=0x1C01` |
+| `F6D0.4/F6D0.5` | `H'2574/H'25D4` | Uses selectors `0x0091/0x0092` and modal byte `F6F6`; `E000[0x0088].14` can divert to timed page `F732=0x1C01` |
+
+This cluster explains why some adjacent controls may look like menu/display keys rather than ordinary reports. A CCU-side bit in selector `0x0088` can retarget them into a timed local page overlay, currently matching the DETAIL/KNEE neighborhood rather than the OTHERS page.
+
+## OTHERS Difference
+
+OTHERS page `0x01` is not driven by one of the simple confirmed report handlers above. The page-1 handlers consume low action bits in `F770`:
+
+- `H'6EE4` consumes `F770.0/F770.1` for OTHERS/SHUTTER local actions.
+- `H'6FF0` consumes `F770.2` for COPY TO SLAVES.
+- No decoded direct writer for these low bits has been found yet.
+
+That is the current best explanation for the bench result where the OTHERS physical press matched the no-button baseline: the shared scanner may see the key, but the useful OTHERS action is gated behind a separate local page/action latch.
+
+## Emulator Probe
+
+The emulator can inject these as ROM-level panel edges:
+
+```powershell
+.\.venv\Scripts\python.exe h8536_emulator_rx_probe.py --wait-heartbeats 1 --panel-press cam-power
+.\.venv\Scripts\python.exe h8536_emulator_rx_probe.py --panel call=press --panel call=release --keep-listening
+.\.venv\Scripts\python.exe h8536_emulator_rx_probe.py --panel F6D4.6=press
+```
+
+This is a post-scan injection model. It sets the external source byte, the `F6D*` shadow byte, the matching `F6E*` previous-shadow byte to the opposite bit level, and the `F6F2/F6F3` dirty bit. The ROM then runs its normal `loc_15E0 -> loc_1C0E -> H'2706` dispatch path, so gates and no-op handlers still behave like firmware rather than like forced serial output.
+
+## Tooling
+
+Regenerate the map with:
+
+```powershell
+.\.venv\Scripts\python.exe h8536_panel_button_trace.py
+```
+
+Outputs:
+
+- `build/panel_button_trace.md`
+- `build/panel_button_trace.json`

docs/pt2-lamp-selector-map.md

@@ -0,0 +1,241 @@
+# PT2 Lamp And Panel Output Selector Map
+
+This note tracks bench-visible lamp/readout effects from CCU-to-RCP selector writes.
+
+## Current Model
+
+The panel lamps and seven-segment displays are driven by selector-table state, not by one monolithic "connected" flag. Command 0 writes into the primary/current tables, and several selectors immediately affect visible panel outputs while `CONNECT: OK` is alive.
+
+Known active-state foundation:
+
+- `E000[0x0000] = 0x8080` wakes/holds `CONNECT: OK`.
+- `E000[0x008F]` drives shutter `EVS`/`OFF` style display state and iris AUTO side effects.
+- `E000[0x0093]` drives at least white-balance and black/flare lamp state.
+
+## Bench Observations 2026-05-26
+
+### `lamp-0093-lowbyte-sweep`
+
+Result: no new visible behavior beyond the already-known `0x0093` family.
+
+Interpretation:
+
+- The earlier `0x0093` mapping still stands.
+- Individual low-byte probes inside a streamed `0x90xx` context did not reveal a new lamp in this run.
+- Keep `0x9020` as a useful manual/baseline context and `0x90FF` / `0xFFFF` as black/flare AUTO positive controls.
+
+### `lamp-known-button-selector-probe`
+
+Visible result:
+
+- CAM button/lamp flashed on/off.
+- CALL lamp flashed on/off.
+- BARS and MASTER lamps flashed on/off.
+- Camera tally changed red, then later green.
+- Each visible output illuminated by itself, not as a broad all-lamps blast.
+
+Serial result:
+
+- The run stayed in normal `CONNECT: OK` response cadence.
+- Each command-0 write produced an immediate `04 ...` readback-style frame and repeated `02 00 02 00 00 5A` active responses.
+
+Candidate mapping:
+
+| Selector/value pair | Current meaning |
+| --- | --- |
+| `0x0007 = 0x8000/0x0000` | CAM POWER lamp blink confirmed by isolated run |
+| `0x0015 = 0x8000/0x0000` | CALL lamp blink confirmed; red tally also blinked in the same phase |
+| `0x0012`, `0x0013`, `0x0016`, `0x0017`, `0x0018`, `0x001A` | ordered candidates for SLAVE, green tally, BARS, MASTER, and neighboring lamp states |
+
+Follow-up `lamp-isolate-cam-call` result:
+
+- First phase blinked CAM POWER.
+- Second phase blinked CALL and red tally.
+
+Follow-up `lamp-isolate-known-neighbors` result:
+
+- Visible order was SLAVE, then green tally, then BARS.
+- The pattern repeated, and at one point SLAVE and BARS were visible together.
+- Treat the ordered mapping as likely but not final until a fresh-boot single-selector run separates latch/persistence effects from the selector under test.
+
+Follow-up `lamp-isolate-neighbor-single-boot` result:
+
+| Fresh-boot candidate | Visible result |
+| --- | --- |
+| `0x0012 = 0x8000/0x0000` | no visible change reported |
+| `0x0013 = 0x8000/0x0000` | SLAVE lamp |
+| `0x0016 = 0x8000/0x0000` | camera tally green |
+| `0x0017 = 0x8000/0x0000` | BARS lamp |
+| `0x0018 = 0x8000/0x0000` | no visible result reported yet |
+| `0x001A = 0x8000/0x0000` | no visible result reported yet |
+
+This confirms that the host/CCU can directly drive panel lamps through selector-table writes. It also validates using the ROM dispatch-neighbor list around `0x0007` and `0x0015` as a high-value lamp map.
+
+Follow-up `panel-atlas-standard-master-*` webcam runs:
+
+- `0x0012`, `0x0013`, and `0x0014` high-nibble/selected-bit sweeps did not
+  produce a clean STANDARD or MASTER lamp trigger. The `0x0013=0x8000` SLAVE
+  positive control still worked.
+- `0x0010`, `0x0011`, `0x0015`, `0x0016`, `0x0017`, `0x0018`, `0x0019`, and
+  `0x001A` high-nibble sweeps did not produce a clean STANDARD or MASTER lamp
+  trigger.
+- `0x0008` through `0x000F` high-nibble sweeps did not produce a clean
+  STANDARD or MASTER lamp trigger.
+- `0x0017=0x4000` lit the same far-right bottom BARS lamp/latch as the known
+  `0x0017=0x8000` family. Later `0x0018` rows in that run were latch-contaminated
+  and need fresh-boot isolation before assigning a separate meaning.
+
+Current implication: STANDARD and MASTER are probably not simple direct
+command-0 high-nibble writes in the `0x0008`-`0x001A` pocket, despite the older
+broad run that made MASTER flash. Treat that older observation as a real
+bench-visible event but not yet an isolated selector mapping.
+
+Later refinement: the ROM-derived fresh-boot output sweep found a clean
+STANDARD trigger at `0x006B = 0x8000` (`00 00 6B 80 00 B1`). It also reclassed
+the formerly vague `0x001A` pocket as the MONITOR selector cluster:
+
+| Selector/value | Visible effect |
+| --- | --- |
+| `0x001A = 0x0808` | MONITOR ENC |
+| `0x001A = 0x2020` | MONITOR B |
+| `0x001A = 0x4040` | MONITOR G |
+| `0x001A = 0x8080` | MONITOR R |
+| `0x006B = 0x8000` | STANDARD |
+
+### `panel-atlas-big-visual-sweep-0001-017f-highbits`
+
+The broad webcam sweep and fresh-boot isolation pass produced these confirmed
+or near-confirmed panel-output mappings:
+
+| Selector/value | Current meaning |
+| --- | --- |
+| `0x0013 = 0x4000` | `IRIS/M.BLACK LINK` lamp |
+| `0x0024 = 0x8000` | LCD selector-button lamp |
+| `0x0024 = 0x0000` | LCD selector-button lamp remained visible at 0.5 s; not a simple clear in this timing window |
+| `0x0082 = 0x8000` | IRIS readout `OP` |
+| `0x0082 = 0x4000` | IRIS readout `1.4` |
+| `0x0082 = 0x0000` | IRIS readout blank |
+| `0x0083 = 0x8000` | MASTER GAIN `-3`, SHUTTER `OFF`, and IRIS AUTO |
+| `0x0083 = 0x0000` | same visible state remained at 0.5 s; likely latched/copied elsewhere |
+| `0x0093 = 0x8000` | BLACK/FLARE MANUAL plus white-balance PRESET |
+| `0x0093 = 0x4000` | BLACK/FLARE MANUAL plus white-balance AUTO |
+| `0x0093 = 0x2000` | BLACK/FLARE MANUAL plus white-balance MANUAL |
+| `0x0093 = 0x0000` | BLACK/FLARE MANUAL plus white-balance MANUAL |
+
+Run health was good: no resync events, no dropped bytes, and command-4
+readbacks appeared for the listed writes.
+
+ROM trace now confirms the `0x0013` bit split:
+
+- `E800[0x0013]` is `H'E826`.
+- Selector `0x0013` dispatches to `H'2E06`.
+- `H'E826.15` sets/clears `F791.6` and `F713.4`, matching SLAVE.
+- `H'E826.14` sets/clears `F791.5` and `F716.7`, matching
+  `IRIS/M.BLACK LINK`.
+- Local handler `H'200E` can also toggle `H'E826.14` from panel input
+  `F006.7/F6DB.7` when its session gate allows it.
+
+Interpretation:
+
+- `0x0082` is the cleanest direct readout lane found so far: set values update
+  the IRIS display and `0x0000` blanks it.
+- `0x0083` appears to be a combined status/display lane rather than only the
+  MASTER GAIN display. Its `0x8000` state also brings up SHUTTER `OFF` and IRIS
+  AUTO, and the clear write did not visually clear it at 0.5 s.
+- `0x0093` selects white-balance mode. In this run, `0x2000` and `0x0000` both
+  presented white-balance MANUAL, so bit 13 may be redundant in this context or
+  may need another gate to show a distinct state.
+
+### `lamp-broad-status-selector-sweep`
+
+Visible result:
+
+- KNEE AUTO lamp flashed a few times.
+- No other new visible result was reported.
+- Follow-up isolation saw KNEE AUTO toward the end of the run, then blinking.
+
+Candidate selectors in that run:
+
+`0x0003`, `0x0040`, `0x0081`, `0x0092`, `0x00A7`, `0x00B7`, `0x00B9`, `0x0110`
+
+Interpretation:
+
+- KNEE AUTO is likely in this broader status cluster.
+- Because the visible change happened toward the end, strongest next candidates are `0x00A7`, `0x00B7`, `0x00B9`, and `0x0110`, with `0x0092` kept as a guard candidate.
+- Exact selector/value still needs isolation because the broad sweep changed several selectors in sequence.
+
+Follow-up `lamp-isolate-knee-tail-single-boot` result:
+
+| Fresh-boot candidate | Visible result |
+| --- | --- |
+| `0x0092` | iris AUTO/OFF behavior |
+| `0x00A7` | no visible result reported |
+| `0x00B7` | no visible result reported |
+| `0x00B9` | KNEE AUTO |
+| `0x0110` | KNEE AUTO |
+
+Interpretation:
+
+- `0x00B9` and `0x0110` are real KNEE-related selectors, but a ROM trace now shows they are not a simple OR-held lamp pair.
+- `loc_1795` is the local KNEE/panel-input handler. It is reached from `F104 -> F692 -> F6F0.1`, then reads `E000[0x00B9]` and `E000[0x0110]`.
+- The ROM gate for the live KNEE value/report branch is `0x00B9.13`, not `0x00B9.15`.
+- `0x0110.15` forces a timed KNEE page/display override. That fits the observed "lights, then clears" behavior.
+- `0x00B9.15` still matters on the timed KNEE LCD page: it selects the `PRESET` label when `0x0110.15` is clear. With both clear, the same page labels KNEE as `AUTO`.
+- When `0x00B9.13` is set and `0x0110.15` is clear, the ROM computes `F692 - F6B2` and reports/updates selector `0x00BC`. That is now the strongest candidate for the KNEE control value lane.
+
+Follow-up `lamp-knee-or-precedence` result:
+
+- Case 1 (`0x00B9.15` set, then `0x0110.15` set, then `0x00B9` cleared) kept KNEE AUTO on until near the end, when `0x0110` was cleared.
+- Case 2 (`0x0110.15` set, then `0x00B9.15` set, then `0x0110` cleared) turned KNEE AUTO off well before the end, even though `0x00B9` had been set.
+- This argues against a simple OR model. Current best interpretation: `0x0110.15` is the stronger live display/control source for KNEE AUTO; `0x00B9.15` is related, but may be a transient, secondary status source, or only meaningful with another gate active.
+
+Follow-up `lamp-knee-sustain-compare` result:
+
+- Repeated `0x00B9.15` refresh never lit KNEE AUTO.
+- Repeated `0x0110.15` refresh lit KNEE AUTO, but it turned off again around the middle of the repeated-refresh window.
+- This makes `0x00B9.15` look like a context-sensitive or stale interpretation rather than a maintained lamp source.
+- `0x0110.15` remains the best KNEE AUTO source, but it is not sufficient by itself to hold the lamp. It likely needs a surrounding CCU status refresh, or another selector periodically clears/rebuilds the visible lamp bank.
+
+Follow-up `lamp-knee-context-hold` result:
+
+- Pairing `0x00B9.15` with the known `0x0093=0x9020` active refresh did not light KNEE AUTO.
+- Pairing `0x0110.15` with `0x0093=0x9020` did light KNEE AUTO, but it still turned off around the middle of the run.
+- The serial log stayed clean: repeated table readbacks and `02 00 02 00 00 5A` active responses continued, with no resync or NOT ACT-style serial collapse.
+- Current best hypothesis: `0x0110.15` behaves more like an edge/pulse or consumed display request than a pure level-held lamp bit. Repeating the same high value may not retrigger it after the display task has consumed the state.
+
+ROM follow-up:
+
+- Detailed notes: `docs/pt2-knee-rom-trace.md`.
+- The timed path sets `F732=0x1C03`, `FB02=0x14`, calls `loc_48FA`, and later restores the previous page through `loc_48EF`.
+- `F732=0x1C03` dispatches to a KNEE LCD page. Its second line is `DL` when `0x0110.15` is set, `PRESET` when `0x0110.15` is clear and `0x00B9.15` is set, otherwise `AUTO`.
+- `knee-rom-gate-and-value-probe` produced a new bench LCD state with `DTL` on the left and `KNEE` on the right. This matches the ROM page-0x1C neighborhood: KNEE entry at `0x95CE`, DETAIL entry at `0x97C8`.
+- The panel physically has DETAIL and KNEE buttons near the LCD, so this is likely a local menu/button context. Pressing those buttons during the prepared gate window may supply the `F104` transition that the ROM needs before it calls `loc_1795`.
+- Follow-up isolation lit KNEE AUTO in the later KNEE cases/windows but did not change the LCD. Treat the KNEE AUTO lamp and the DETAIL/KNEE LCD page as related but separate paths: `0x0110.15` remains the strongest lamp/status source, while LCD movement likely needs an additional local menu/display gate.
+- Next bench retest should include `0x00B9.13` (`00 01 39 20 00 42`) and the `0x00BC` report/read lane, not only the older `0x00B9.15` / `0x0110.15` pair.
+
+## Follow-Up Isolation Scenarios
+
+Run these with the console visible and record the exact label shown when each lamp changes:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-isolate-cam-call.json --parity E --log captures\lamp-isolate-cam-call.txt --result-json captures\lamp-isolate-cam-call-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-isolate-known-neighbors.json --parity E --log captures\lamp-isolate-known-neighbors.txt --result-json captures\lamp-isolate-known-neighbors-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-isolate-knee-status-selectors.json --parity E --log captures\lamp-isolate-knee-status-selectors.txt --result-json captures\lamp-isolate-knee-status-selectors-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-isolate-neighbor-single-boot.json --parity E --log captures\lamp-isolate-neighbor-single-boot.txt --result-json captures\lamp-isolate-neighbor-single-boot-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-isolate-knee-tail-single-boot.json --parity E --log captures\lamp-isolate-knee-tail-single-boot.txt --result-json captures\lamp-isolate-knee-tail-single-boot-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-isolate-knee-bit-scan.json --parity E --log captures\lamp-isolate-knee-bit-scan.txt --result-json captures\lamp-isolate-knee-bit-scan-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-knee-or-precedence.json --parity E --log captures\lamp-knee-or-precedence.txt --result-json captures\lamp-knee-or-precedence-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-knee-sustain-compare.json --parity E --log captures\lamp-knee-sustain-compare.txt --result-json captures\lamp-knee-sustain-compare-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-knee-context-hold.json --parity E --log captures\lamp-knee-context-hold.txt --result-json captures\lamp-knee-context-hold-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\lamp-knee-edge-refresh.json --parity E --log captures\lamp-knee-edge-refresh.txt --result-json captures\lamp-knee-edge-refresh-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\knee-rom-gate-and-value-probe.json --parity E --log captures\knee-rom-gate-and-value-probe.txt --result-json captures\knee-rom-gate-and-value-probe-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\knee-rom-dtl-knee-isolation.json --parity E --log captures\knee-rom-dtl-knee-isolation.txt --result-json captures\knee-rom-dtl-knee-isolation-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\knee-detail-physical-button-watch.json --parity E --log captures\knee-detail-physical-button-watch.txt --result-json captures\knee-detail-physical-button-watch-result.json
+```
+
+Method notes:
+
+- Record visible changes immediately during each labeled hold. Later `CONNECT: NOT ACT` cleanup is not selector evidence.
+- If a selector causes a latch or unexpected mode, stop and keep the log instead of continuing the whole sweep.
+- Prefer exact notes like `selector_0018_high -> tally red`, because the logs already preserve send timestamps and readback frames.
+- For the single-boot follow-ups, each candidate gets a fresh power cycle. That is deliberate: it tests whether a lamp is truly driven by that selector rather than retained from a previous write.