Document VPX emulator status and recovery plan

next-analysis-targets.md

@@ -1,5 +1,42 @@
 # Next Analysis Targets
 
+## Priority 0: Native playable acceptance and calibration
+
+The QEMU/HVF Cocoa game path, loopback `spike3-playfield/v1` bridge, safe
+pause/restart synchronization, VPX 10.8.1 controller-plugin rebase, generated
+manifest mapping, dual-mode VPX table, private controller profile, and native
+two-window launcher are implemented; see `native-playable-table.md`. The
+standalone table remains available.
+
+The current native stop point is not yet validation-only. Resolve these two
+blocking integration defects first:
+
+- Replace the undefined VPX `Service1Key` through `Service4Key` variables with
+  the pinned host's supported `VPXActionKey(25)` through `VPXActionKey(28)`
+  expressions and exercise every mapped input in native VPX.
+- Implement power-distribution command `0x15` for active-low Action, Start, and
+  cabinet-door inputs; correct the CPU-SPI `0-SW-23` raw-byte alignment; then
+  identify and complete the genuine factory/pre-play setup flow.
+
+After those blockers, continue acceptance and calibration:
+
+- Complete and preserve a normal three-ball game plus a multiball sequence
+  through the genuine game rules, without dashboard ball-motion shortcuts.
+- Run the configurable native shot suite across shooter lane, both orbits,
+  every ramp, both outlanes/returns, pops, QEMU-authoritative slings, captive
+  ball, Town VUK, Poké Ball hold, gates/posts, and Meowth movement; tune only
+  the transitions that fail.
+- Record input-to-visible-flipper and bridge-output-to-mechanism p95/p99 from
+  live native traces, plus rendered fps/1% low under simultaneous QEMU load.
+- Preserve a full 60-minute inventory soak and explicit QEMU, bridge, and VPX
+  restart logs before declaring the long-run acceptance row complete.
+- Replace `photo_estimate`, `comparable_part`, and `playability_tuned` ramp Z,
+  coil, restitution, and friction values when direct measurements or
+  slow-motion reference footage become available.
+- Test QEMU D-Bus shared-memory scanout only after the two-window release is
+  stable. Retain Cocoa rather than adopting a VNC/browser capture fallback if
+  page-flip, 60 fps, or one-frame latency gates fail.
+
 The current derived-data inventory and confidence boundaries are summarized in `analysis-evidence-map.md`. This page tracks only the work that remains or still needs stronger validation.
 
 ## Priority 1: Main Game Binary
@@ -26,7 +63,8 @@ Suggested first passes:
 
 Follow-up passes:
 
-- Continue from `emulation/`: QEMU now boots the generated rootfs, exposes noVNC/dashboard, uses cached rootfs preparation, loads `virtio_gpu`, creates `/dev/dri/card0` plus `/dev/dri/renderD128`, and reaches `boot-display`, `spike-menu`, and `/games/game`. The generated rootfs includes a display probe, `fbdev` fallback interposer, Mesa surfaceless/pbuffer support, synthetic GLES/GBM/EGLImage fallbacks, GPIO sysfs stubs, framebuffer diagnostic renderer, and null ALSA default. Verified captures include nonblank `emulation/work/boot-display-fbo-wrap.ppm`, `emulation/work/spike-menu-gpio-wrap.ppm`, `emulation/work/game-gl-limits.ppm`, `emulation/work/game-fbdev-real-egl.png`, and the earlier diagnostic screen in `emulation/work/game-diagnostic.png`. The prior black-screen, missing-ALSA-default, boot-display framebuffer retry, SPIKE-menu GPIO 25 spam, Mesa loader dependency, and zero-varying shader blockers are cleared. The current display blocker is the main game's target-created EGLImage/FBO path: `eglMakeCurrent` succeeds with a real pbuffer, but the framebuffer remains incomplete and Mesa reports `GL_INVALID_FRAMEBUFFER_OPERATION`, so VNC still shows fallback color bands instead of a game frame. Other current blockers are TAS/MAX amp register verify reads and bridge/netbridge startup failures (`OpenOCD init failed`, `netbridge image CRC mismatch`, `failed to init bridge thread`). The next pass should fix or fake the FBO attachment path, then decide which bridge/netbridge and audio paths need modeling versus inert stubs.
+- Exercise the new process-level lane documented in `process-level-emulation.md`. Static validation resolves all 51 target runtime libraries and matching `GLIBC_2.39`/`GLIBCXX_3.4.32` nodes; launcher/unit/syntax checks and the Apple Silicon ARM64 container build pass without executing the target. The initial `prepare` run exposed a nested `/games/spike3` alias bug which is now fixed and regression-tested; the post-fix run was blocked by the local Codex Docker approval/usage gate. The next acceptance sequence is `prepare`, `boot-display`, `spike-menu`, then `game`: execute the Mesa FBO smoke test, verify changing noVNC frames on port 6081, nonzero WAV capture, five-minute attract stability, one synthetic-ball Start/flipper/drain cycle from the dashboard, a qemu-user smoke run, and live GDB attachment. Record each failure from the timestamped `emulation/work/runs/` bundle rather than treating source completion as playability.
+- Continue from `emulation/`: QEMU now boots the generated rootfs, exposes noVNC/dashboard, uses cached rootfs preparation, loads `virtio_gpu`, creates `/dev/dri/card0` plus `/dev/dri/renderD128`, and reaches `boot-display`, `spike-menu`, and `/games/game`. The generated rootfs includes a display probe, `fbdev` fallback interposer, Mesa surfaceless/pbuffer support, synthetic GLES/GBM/EGLImage fallbacks, GPIO sysfs stubs, framebuffer diagnostic renderer, and null ALSA default. Verified captures include nonblank `emulation/work/boot-display-fbo-wrap.ppm`, `emulation/work/spike-menu-gpio-wrap.ppm`, `emulation/work/game-gl-limits.ppm`, `emulation/work/game-fbdev-real-egl.png`, and the earlier diagnostic screen in `emulation/work/game-diagnostic.png`. The prior black-screen, missing-ALSA-default, boot-display framebuffer retry, SPIKE-menu GPIO 25 spam, Mesa loader dependency, and zero-varying shader blockers are cleared. The Docker/VNC softpipe path still encounters the target-created EGLImage/FBO issue and fallback color bands. The native macOS HVF/Cocoa path now has a verified complete 1920x1080 game-frame capture with the opt-in Debian Mesa 22.3.6 llvmpipe stack, although it uses about 5.3 host CPU cores and logs rejected page flips. Other current blockers are TAS/MAX amp register verify reads and bridge/netbridge startup failures (`OpenOCD init failed`, `netbridge image CRC mismatch`, `failed to init bridge thread`). The next display pass should measure llvmpipe frame pacing against softpipe and then investigate an Apple-GPU-backed VirtIO/translation path separately from the working CPU-rendered baseline.
 - Validate `analysis/topper-emulator/topper_emulator.py` on live hardware or a nodebus capture.
 - Recover the exact Magikarp topper `IDENTITY_BOARD_PART_ID` expected by command `0xfe`.
 - Confirm physical UART pins, baud, voltage level, and any netbridge timing/break behavior required for a MicroPython node.