h8-536-decoder/docs/pt2-shutter-display-trace.md

PT2 Shutter Display Trace

This note collects the current ROM evidence for the shutter seven-segment display and related selector traffic.

Confirmed Bench Mapping

The real panel responds to primary selector 0x008F:

Command 0 write	Meaning candidate	Observed panel result
00 01 0F 08 00 5C	E000[0x008F].11	SHUTTER shows observed EUS, likely manual EVS; iris AUTO lamp on
00 01 0F 10 00 44	E000[0x008F].12	SHUTTER shows literal OFF; iris AUTO lamp on
00 01 0F 18 00 4C	bits 11 and 12	likely EVS wins over OFF; iris AUTO lamp on
00 01 0F 00 00 54	live default/clear	in the short clear-control run, SHUTTER swapped to OFF, then back to EVS when bit 11 was restored

Manual correlation:

• The RCP-TX7 manual has OTHERS (1/6: SHUTTER) with an EVS button.
• The RCP-TX7 menu table lists EVS/ECS under OTHERS for DXC-D30/D30P.
• A later CCU/RCP manual says the shutter display shows EVS when EVS is on and OFF when the shutter switch is off.

So 0x008F.11 is currently best labeled shutter_evs_display_or_mode. 0x008F.12 and 0x008F=0 both have OFF display evidence, so treat OFF as the live default/fallback shutter display unless a later bit-isolation run splits forced OFF from default OFF.

Selector 0x008F ROM Path

Primary table address:

selector 0x008F -> E000 + 2 * 0x008F = H'E11E

The OTHERS/SHUTTER menu handler is H'6EE4.

Important instructions:

6F6E: BTST.W #11, @H'E11E
6F74: BSET.B #6, R0
6F76: BTST.W #12, @H'E11E
6F7C: BSET.B #4, R0
6F7E: MOV:G.B R0, @H'F711

This is the direct consumer seen so far. The current decompile does not show another static read of H'E11E outside this handler.

H'6EE4 also programs local descriptor RAM before this:

6EFD: F73E = H'088F
6F09: F74E = H'0800
6F0F: F742 = H'088F
6F1B: F752 = H'1000

Those descriptors match selector 0x008F plus the two observed masks 0x0800 and 0x1000, so the generic panel-output updater also appears to know about the same selector.

Local Panel Trigger Path

H'6EE4 can also generate a selector 0x008F report/update from local OTHERS/SHUTTER controls:

6F26: read F770 local action byte
6F2E: keep low two action bits
6F37: if action bit path and E400[0x008F].11 is enabled, set E800[0x008F] = 0x0800
6F45: if alternate action path and E400[0x008F].12 is enabled, set E800[0x008F] = 0x1000
6F53: R3 = 0x008F
6F64: call 3E54 report/target-frame builder

Practical meaning:

• The CCU can force the display state by writing E000[0x008F].
• The RCP can also try to report local EVS/OFF changes through selector 0x008F, but only when the secondary-table feature bits E400[0x008F].11/.12 allow it.

Adjacent Shutter Value Family

The periodic/control-change scanner at H'15E0 processes changed input words collected by IRQ3 from the external panel chips. Around the shutter path it calls H'19A2, which compares a local delta against the current primary table value and, if changed, writes the E800 current table and calls H'3E54.

Candidate selectors:

Handler	Source RAM	Gate	Selector sent	Meaning candidate
H'17C9	F6AE/F6CE	E000[0x0093].12	0x00A3	clear-scan/shutter value lane
H'17FB	F6AC/F6CC	E000[0x0093].12	0x00A4	clear-scan/shutter value lane
H'182D	F6AA/F6CA	E000[0x0093].5, F717.2 clear	0x00A5	shutter value lane
H'182D	F6AA/F6CA	F717.2 set	0x00D8	alternate/DXC-637 shutter lane
H'1891	F6A8/F6C8	E000[0x0093].5, F717.2 clear	0x0080	shutter value lane
H'1891	F6A8/F6C8	F717.2 set	0x00D9	alternate/DXC-637 shutter lane
H'18E7	F6A6/F6C6	E000[0x0093].5, F717.2 clear	0x00A6	shutter value lane
H'18E7	F6A6/F6C6	F717.2 set	0x00DA	alternate/DXC-637 shutter lane
H'194A	F6A4/F6C4	F731 <= 3	0x0080	shared value lane
H'1979	F6A2/F6C2 plus F68C scale	F731 <= 3	0x0081	scaled analog value lane

This cluster is a strong candidate for the numeric shutter speed / clear-scan frequency side of the display. It is not yet bench-confirmed.

ROM refinement:

• F6AE/F6AC are sampled from the external panel bus in the IRQ3 A8 branch (H'3CCB), from F00C/F00A.
• F6AA/F6A8/F6A6/F6A4/F6A2 are sampled from the IRQ3 A9 branch (H'3C49), from F00C/F00A/F008/F006/F004.
• Those IRQ3 branches set dirty bits in F6F1, then the H'15E0 scanner fans changes into the selector reports above.
• Several lanes can OR bit 14 into the report selector when F791 and F404 feature bits are live. So emitted report traffic may carry a tagged variant of the base selector even though the table readback probes below use the base selector.
• This makes the adjacent selector family more likely to be live local-panel state than a simple CCU-write display latch.

Candidate Probe Frames

Readback:

01 01 0F 00 00 55  ; read 0x008F
01 01 13 00 00 49  ; read 0x0093 gate/status
01 01 23 00 00 79  ; read 0x00A3
01 01 24 00 00 7E  ; read 0x00A4
01 01 25 00 00 7F  ; read 0x00A5
01 01 58 00 00 02  ; read 0x00D8
01 01 00 00 00 5A  ; read 0x0080
01 01 59 00 00 03  ; read 0x00D9
01 01 26 00 00 7C  ; read 0x00A6
01 01 5A 00 00 00  ; read 0x00DA
01 01 01 00 00 5B  ; read 0x0081

Potential display probes after CONNECT: OK:

00 01 0F 00 00 54  ; clear selector 0x008F
00 01 13 80 00 C8  ; set 0x0093 high bit candidate
00 01 13 FF FF 48  ; enable all 0x0093 gates candidate

Use the value-lane selectors cautiously. They may represent shutter/clear-scan numeric values, but they are also part of the local control-report path, so bench probing should change one selector at a time and record LCD, shutter display, iris AUTO, and emitted report frames.

Important methodology caveat:

• CONNECT:NOT ACT globally clears volatile panel presentation. A blank LCD/segment result after a long wait is not evidence that a tested selector cleared the panel.
• For selector-display tests, record the visible state inside the short post-write window, before the session can fall back to NOT ACT.
• Use the timeout-control scenario below to measure the current bench's natural EVS-to-NOT-ACT cleanup time. Treat results after that point as timeout-contaminated.
• Re-seed CONNECT: OK immediately before gate writes when a prior readback sweep may have consumed enough time for the visible state to expire.

Adjacent Selector Bench Scenarios

These JSON scenarios are set up for the current bench runner and default to 38400 8E1:

.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-adjacent-readback.json --parity E --log captures\shutter-adjacent-readback.txt --result-json captures\shutter-adjacent-readback-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-008f-evs-timeout-control.json --parity E --log captures\shutter-008f-evs-timeout-control.txt --result-json captures\shutter-008f-evs-timeout-control-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-008f-evs-clear-control.json --parity E --log captures\shutter-008f-evs-clear-control.txt --result-json captures\shutter-008f-evs-clear-control-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-gate-8000.json --parity E --log captures\shutter-0093-gate-8000.txt --result-json captures\shutter-0093-gate-8000-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-gate-ffff.json --parity E --log captures\shutter-0093-gate-ffff.txt --result-json captures\shutter-0093-gate-ffff-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-bit-isolation.json --parity E --log captures\shutter-0093-bit-isolation.txt --result-json captures\shutter-0093-bit-isolation-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-blackflare-auto-candidates.json --parity E --log captures\shutter-0093-blackflare-auto-candidates.txt --result-json captures\shutter-0093-blackflare-auto-candidates-result.json
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-blackflare-slow-marked.json --parity E --log captures\shutter-0093-blackflare-slow-marked.txt --result-json captures\shutter-0093-blackflare-slow-marked-result.json

Run order:

1. shutter-adjacent-readback.json: read-only baseline for the adjacent shutter cluster after the selector-zero CONNECT: OK seed.
2. shutter-008f-evs-timeout-control.json: measures how long EVS survives before CONNECT:NOT ACT clears it with no explicit clear command.
3. shutter-008f-evs-clear-control.json: checks whether the EVS/OFF display selector can be cleared live inside the safe pre-timeout window.
4. shutter-0093-gate-8000.json: tests the ROM-observed 0x0093 high-bit gate without enabling every unknown bit.
5. shutter-0093-gate-ffff.json: broader gate test if the targeted high-bit run is uneventful.
6. shutter-0093-bit-isolation.json: isolates the 0x0093 bits after bench evidence showed this selector also controls white-balance and black/flare lamps.
7. shutter-0093-blackflare-auto-candidates.json: uses the known 0x9020 black/flare-manual context and adds each remaining bit to hunt for the 0xFFFF black/flare-AUTO effect.
8. shutter-0093-blackflare-slow-marked.json: repeats the hunt without clear/OK resets between candidates, so white-balance should flicker less and black/flare AUTO transitions can be matched to candidate holds.

Bench Observations 2026-05-26

Observed visible effects from the first adjacent-selector run set:

Scenario	Serial evidence	Observed panel result	Current interpretation
shutter-adjacent-readback	all read selectors returned value 0x0000	no specific visible note	baseline cluster was clear
shutter-0093-gate-8000	E000[0x0093] read back as 0x8000	white-balance PRESET lamp on, black/flare MANUAL lamp on	0x0093.15 is a live panel-status/lamp bit, not just a shutter gate
shutter-0093-gate-ffff	E000[0x0093] read back as 0xFFFF	white-balance PRESET lamp on, black/flare AUTO lamp on	another 0x0093 bit overrides/selects black/flare AUTO when all bits are set
shutter-0093-bit-isolation	stepped through 0x1000, 0x0020, 0x1020, 0x8000, 0x8020, 0x9000, 0x9020	white-balance lamps swapped between MANUAL and PRESET; black/flare stayed MANUAL	bit 15 remains the prime white-balance PRESET candidate; black/flare AUTO is likely outside bits 15/12/5
shutter-0093-blackflare-auto-candidates	stepped through 0x9020, 0xFFFF, then 0x9020 plus each remaining bit	black/flare swapped AUTO/MANUAL more slowly than white-balance MANUAL/PRESET	the clear/OK reset before each candidate likely caused extra white-balance flicker; use the slow-marked follow-up to map black/flare transitions to exact bits
shutter-008f-evs-clear-control	0x008F writes acknowledged as 0x0800, 0x0000, 0x0800	SHUTTER swapped between EVS and OFF while iris AUTO lamp stayed on	0x008F is a packed shutter/display status word; clearing it does not simply mean "blank"
shutter-008f-evs-timeout-control	only 0x008F=0x0800 was sent after OK seed	EVS/iris AUTO, then CONNECT:NOT ACT	later blanking is timeout cleanup, not selector-clear evidence

This changes the local naming: the "adjacent shutter" group should be treated as a broader camera-status and panel-output word cluster. 0x008F currently covers shutter EVS/OFF plus iris AUTO side effects; 0x0093 covers at least white-balance manual/preset and black/flare manual/auto side effects, and still gates some ROM-observed shutter/clear-scan report lanes.