J Sync 7/21/26

next-analysis-targets.md

@@ -4,35 +4,65 @@
 
 The QEMU/HVF Cocoa game path, loopback `spike3-playfield/v1` bridge, safe
 pause/restart synchronization, VPX 10.8.1 controller-plugin rebase, generated
-manifest mapping, dual-mode VPX table, private controller profile, and native
-two-window launcher are implemented; see `native-playable-table.md`. The
-standalone table remains available.
+hardware-contract mapping, clean-room dual-mode VPX table, private controller
+profile, and native two-window launcher are implemented; see
+`native-playable-table.md` and `vpx-table-recreation.md`. The default launcher
+now builds and selects
+`emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx`. The deprecated
+`emulation/vpx/PokemonPro_Greybox.vpx` is historical evidence that the clean
+rebuild does not inspect or write; it is not a build input or runtime default.
 
-The current native stop point is not yet validation-only. Resolve these two
-blocking integration defects first:
+The input transport blockers are now repaired and live-checked. The table uses
+`VPXActionKey(25..28)`; power-distribution command `0x15` carries active-low
+Action/Start/door state; CPU-SPI `0-SW-23` is correctly aligned; and service
+Back/Up/Down/Enter use CPU-SPI `0-SW-8/9/10/11`. Immediate host-event ingestion
+replaces the broken dependency on node-bus polling. The genuine display
+accepted service Up/Down/Back, and the guest acknowledged the exact raw states.
 
-- Replace the undefined VPX `Service1Key` through `Service4Key` variables with
-  the pinned host's supported `VPXActionKey(25)` through `VPXActionKey(28)`
-  expressions and exercise every mapped input in native VPX.
-- Implement power-distribution command `0x15` for active-low Action, Start, and
-  cabinet-door inputs; correct the CPU-SPI `0-SW-23` raw-byte alignment; then
-  identify and complete the genuine factory/pre-play setup flow.
+The final clean table now passes the supervised native startup gate: the
+2026-07-20 run reached `Playable cabinet connected`, returned 392 lamp updates,
+7 LED frames, and 1 driver pulse, kept both captive optos stable, and delivered
+QEMU-keyboard coin/Start edges. The launcher now allows 420 seconds because
+normal game initialization can take about five minutes. The next blocking
+integration target is a complete normal game and persistence check. If a fresh
+image enters Guided Setup, complete Save & Exit through the repaired panel,
+trace any subsequent invalid-machine decision, identify the minimum genuine
+NVRAM or conagent-backed setup records, persist them across two reboots, and
+prove the second boot reaches attract mode and accepts Start.
+
+The clean table and geometry-free hardware contract pass their static
+validators. `emulation/vpx-rebuild/qa/runtime-smoke.log` records a bounded VPX
+10.8.1 `CaptureAttract` pass on 2026-07-20: it loaded the table and VBS,
+compiled/started the script, rendered two frames, and closed with exit code 0.
+The final smoke now matches the current distribution SHA-256
+`ddce5d48033ee3c6e67248910a73897293e8b9c36eee29df164160a93572a30e`.
+It is not interactive play or a substitute for the QEMU-connected acceptance
+below.
 
 After those blockers, continue acceptance and calibration:
 
-- Complete and preserve a normal three-ball game plus a multiball sequence
-  through the genuine game rules, without dashboard ball-motion shortcuts.
-- Run the configurable native shot suite across shooter lane, both orbits,
-  every ramp, both outlanes/returns, pops, QEMU-authoritative slings, captive
-  ball, Town VUK, Poké Ball hold, gates/posts, and Meowth movement; tune only
-  the transitions that fail.
+- Complete and preserve a normal game plus a multiball sequence through the
+  genuine rules on the final clean table, without dashboard ball-motion
+  shortcuts.
+- Exercise the shooter lane, both orbits, every ramp, both outlanes/returns,
+  pops, QEMU-authoritative slings, Pokedex captive chain, Town VUK, right-ramp
+  hold/Pikachu post, gates, spinner, targets, and Meowth movement with physical
+  VPX balls. Treat contact injection as transport coverage, not shot proof.
+- Capture exact-address RGB lamp behavior, ordered driver pulses, retained-ball
+  ownership, disconnect fail-safe, and reconnect baselines in one integrated
+  run of the final table.
 - Record input-to-visible-flipper and bridge-output-to-mechanism p95/p99 from
   live native traces, plus rendered fps/1% low under simultaneous QEMU load.
 - Preserve a full 60-minute inventory soak and explicit QEMU, bridge, and VPX
   restart logs before declaring the long-run acceptance row complete.
-- Replace `photo_estimate`, `comparable_part`, and `playability_tuned` ramp Z,
-  coil, restitution, and friction values when direct measurements or
-  slow-motion reference footage become available.
+- Compare `emulation/vpx-rebuild/design/geometry.json` with a physical Pro
+  machine: measure ramp Z/clearance, post and toy footprints, Pikachu post
+  direction/stroke, Meowth crank travel, coil timing, pitch, and ball/rubber
+  behavior. Replace estimated or simulation-tuned values only with recorded
+  evidence.
+- Acquire a licensed stripped/bare-playfield scan to replace the official
+  registered photograph, whose baked-in hardware and lighting remain visible
+  beneath VPX geometry. Re-run visual and runtime QA after that asset change.
 - Test QEMU D-Bus shared-memory scanout only after the two-window release is
   stable. Retain Cocoa rather than adopting a VNC/browser capture fallback if
   page-flip, 60 fps, or one-frame latency gates fail.
@@ -127,7 +157,7 @@ Follow-up passes:
 
 ## Priority 4: Netbridge Debug Path
 
-Status: first-pass strings, ELF program-header review, targeted Ghidra decompilation, host protocol recovery, a Python host-side emulator scaffold, Docker/QEMU optional serial wiring, and a Pico SDK firmware recreation are complete; see `package-image-firmware.md`, `netbridge-re.md`, and `docker-qemu-emulation.md`.
+Status: first-pass strings, ELF program-header review, targeted Ghidra decompilation, host protocol recovery, power-distribution command `0x15` static recovery, a Python host-side emulator scaffold, Docker/QEMU optional serial wiring, and a Pico SDK firmware recreation are complete; see `package-image-firmware.md`, `netbridge-re.md`, and `docker-qemu-emulation.md`.
 
 Targets:
 
@@ -146,6 +176,10 @@ Findings:
 - `netbridge.elf` is a 32-bit ARM static executable with code mapped at `0x10000000` and RAM at `0x20000000`/`0x20040000`.
 - Strings include `uart_node.c`, `NODEBUS_Poll`, `NODEUART_Write`, `UART_NodeRxIrq`, and `WS2812_NodeSetLED`.
 - Ghidra decompilation identifies the Pi-facing host UART as 2,000,000 baud STX/ETX/ESC framed messages on RP2040 GPIO 16/17, with `0x30` returning firmware CRC `0x357f5327` and `0x41` carrying direct nodebus requests.
+- Static disassembly of `powerdist_ext.hex` confirms that command `0x15`
+  returns GPIO P0_8/P0_9/P0_11 in bits 0/1/2 and emits an unsolicited
+  sequence-0 report whenever a debounced cabinet input changes. The Python
+  emulator now reproduces both the poll and asynchronous paths.
 - `analysis/netbridge-emulator/netbridge_emu.py` implements the recovered host frame codec, core bridge commands, CRC response, PTY serving mode, and a stub node at address `0x0a`.
 - `analysis/netbridge-pico-firmware/` implements the same recovered protocol as a Pico SDK firmware recreation with a portable host-core test.
 - Docker/QEMU now has an optional `SPIKE3_NETBRIDGE_EMU=1` path that starts the Python emulator on `emulation/work/netbridge.sock`, attaches it as a second PL011 serial, maps guest `/dev/ttyAMA5` to the real serial, and lets the preload shim pass that path through.
@@ -160,12 +194,12 @@ Follow-up passes:
 
 ## Priority 5: Node Firmware
 
-Status: first-pass Intel HEX range parsing complete for top-level node firmware; see `package-image-firmware.md`.
+Status: first-pass Intel HEX range parsing is complete for top-level node firmware, and the power-distribution `0x15` input path has been disassembled; see `package-image-firmware.md` and `netbridge-re.md`.
 
 Targets:
 
 - All `*-LPC*.hex` files under `/games/pokemon_pro`.
-- `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex`.
+- `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex` (input-report path complete; other commands remain open).
 
 Why: