jordan/pokemon_pinball_wiki
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

J Sync 7/21/26

Browse Source
This commit is contained in:
MrARM
2026-07-21 10:45:59 -05:00
parent 32751448c6
commit 8c6547acbd
8 changed files with 451 additions and 302 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -28,7 +28,7 @@ Static triage of the extracted Raspberry Pi based root filesystem in this worksp
- [Next Analysis Targets](next-analysis-targets.md) - prioritized open work. - [Next Analysis Targets](next-analysis-targets.md) - prioritized open work.
- [Docker/QEMU Emulation](docker-qemu-emulation.md) - Docker/VNC analysis path plus the verified native HVF/Cocoa game-display baseline. - [Docker/QEMU Emulation](docker-qemu-emulation.md) - Docker/VNC analysis path plus the verified native HVF/Cocoa game-display baseline.
- [Process-Level Game Emulation](process-level-emulation.md) - userspace capsule, launcher, software cabinet bridge, debugging, and validation boundary. - [Process-Level Game Emulation](process-level-emulation.md) - userspace capsule, launcher, software cabinet bridge, debugging, and validation boundary.
- [VPX Table Recreation](vpx-table-recreation.md) - evidence-calibrated Pokemon Pro geometry greybox and QA boundary. - [VPX Table Recreation](vpx-table-recreation.md) - clean-room Pokemon Pro table sources, evidence basis, build/runtime validation, and remaining physical-accuracy boundary.
- [Native macOS Playable Table](native-playable-table.md) - QEMU rules/display/audio joined to VPX physics through the supervised playfield bridge. - [Native macOS Playable Table](native-playable-table.md) - QEMU rules/display/audio joined to VPX physics through the supervised playfield bridge.
## System and Software ## System and Software

78
artifact-index.md
View File

@@ -1,5 +1,14 @@
# Artifact Index # Artifact Index
## Target Firmware Evidence
These files are unmodified target-root artifacts used for static protocol
recovery.
| SHA-256 | Target path | Notes |
| --- | --- | --- |
| `f8eb96998a32ff86008663f7f07f2df76c32a9c86200f690c215dc36917391a9` | `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex` | 32,799-byte Intel HEX image; command `0x15` poll and unsolicited sequence-0 cabinet-input report paths are documented in `netbridge-re.md`. |
## Process Emulator Source Artifacts ## Process Emulator Source Artifacts
These are clean-room source files. Their generated capsule, run logs, copied These are clean-room source files. Their generated capsule, run logs, copied
@@ -25,22 +34,59 @@ Generated capsule manifests record hashes for `/games/pokemon_pro/game`, both
Radium `image.bin` files, Godot `main.pck`, the menu/display executables, the Radium `image.bin` files, Godot `main.pck`, the menu/display executables, the
extracted loader, both generated preload DSOs, and the copied Mesa overlay. extracted loader, both generated preload DSOs, and the copied Mesa overlay.
## VPX Geometry Recreation Artifacts ## VPX Clean Rebuild and Historical Recreation Artifacts
These are generated private-use development artifacts. The assembled table now The active clean-room implementation is under `emulation/vpx-rebuild/`. Its
embeds a registered overhead photograph and five private decal assets. It does maintained and generated artifacts are:
not embed game audio, scoring code, or target machine code. The manual,
photographs, extracted graphics, and assembled table must remain within the | Path | Artifact role | Validation and handling caveat |
authorized private-use distribution boundary. | --- | --- | --- |
| `emulation/playfield-contract/pokemon-pro-hardware.json` | Canonical geometry-free contract for 45 switches, 11 sensors, 9 cabinet controls, 13 drivers, and 113 logical lamps. | Static contract/consumer validation is recorded in `emulation/playfield-contract/VALIDATION.md`; it is not live-game proof. |
| `emulation/vpx-rebuild/design/geometry.json` | Clean-room Pro XY/Z, mechanism, collision, and physics source of truth. | Top-down placement is registered to official evidence; installed Z, force, friction, clearance, and timing values still need physical-machine measurement. |
| `emulation/vpx-rebuild/design/lights.json` | Independent 113-lamp trace and confidence records. | Exact-address mapping is statically validated; rendered response still needs final integrated capture. |
| `emulation/vpx-rebuild/design/REFERENCE.md` | Edition scope, official/secondary source URLs, and accuracy boundary. | Official Stern evidence wins over secondary sources. |
| `emulation/vpx-rebuild/assets/playfield/pokemon-pro-official-registered.png` | Deterministically registered 952x2115 private-use base image. | Official photograph contains baked-in hardware/lighting; not a licensed bare-playfield scan and not redistributable by this assessment. |
| `emulation/vpx-rebuild/assets/models/` | Original procedural VPX mechanism and toy meshes. | Simulation models, not production CAD or direct physical scans. |
| `emulation/vpx-rebuild/assets/sounds/` | Original procedural CC0 bank containing 69 mechanical/physics source events. | Contains no copied game samples; QEMU remains the source of licensed music, speech, and game effects. |
| `emulation/vpx-rebuild/script/PokemonPro_Rebuild.vbs.in` | Clean standalone/SPIKE3 table behavior and integration template. | Maintained input; generated `source/script.vbs` and distribution sidecar must not be hand-edited. |
| `emulation/vpx-rebuild/tools/generate_table.py` | Deterministic unpacked-VPX source generator and contract binder. | Generator/source checks do not establish live gameplay. |
| `emulation/vpx-rebuild/source/` | Generated diff-friendly VPX source. | Rebuilt from maintained inputs; do not hand-edit. |
| `emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx` | Active private-use VPX 10.8.1 assembled table selected by the default launcher; 5,902,336 bytes, SHA-256 `ddce5d48033ee3c6e67248910a73897293e8b9c36eee29df164160a93572a30e`. | Generated output; exact current hash also appears in `qa/rebuild-validation.json` and `qa/runtime-smoke.log`. |
| `emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vbs` | Sidecar matching the active assembled table. | Generated output; round-trip script equality is checked by `build.sh`. |
| `emulation/vpx-rebuild/qa/rebuild-validation.json` | Machine-readable current 359-item build, asset, contract, geometry, lamp, and round-trip report. | A `pass` is static/generated-source evidence, not physical-machine calibration or a complete game. |
| `emulation/vpx-rebuild/qa/runtime-smoke.log` | Exact-current-table VPX 10.8.1 runtime-load record: table/VBS load, script compile/start, Metal initialization, two frames, clean close, and exit code 0. | Uses bounded `CaptureAttract`, not interactive `-Play`; it proves runtime/render startup but not a shot or full mechanism sequence. |
| `emulation/vpx-rebuild/qa/vpx-playfield-capture.png` | 1024x1024 frame from the exact-current-table runtime smoke; SHA-256 `5c99e798e467c8475b2c1aa48a4134881d9293d915aafde4e998ed6ebea5871c`. | Render-review evidence; photographed base art still contains baked-in hardware and lighting. |
The registered photograph, service manual, Pokemon/Stern imagery, and assembled
table must remain within the authorized private-use boundary. The table does
not embed target machine code or the game's scoring rules. See
`vpx-table-recreation.md` for the separated static, VPX-runtime, integrated,
and hardware validation states.
The following SHA-256 table is the preserved earlier VPX/bridge milestone.
Entries under `emulation/vpx/` describe the deprecated greybox/manual workflow;
they are retained for audit and are not inputs or defaults for the clean
rebuild. Shared plugin, launcher, guest-helper, and emulator paths may still be
active, but the hashes below are milestone hashes rather than an assertion
that every shared file is unchanged today.
| SHA-256 | Path | Notes | | SHA-256 | Path | Notes |
| --- | --- | --- | | --- | --- | --- |
| `49f132dea4b957d2bd9b2640a69fdc49f4e6f69e3efe473cc0ad1352a4e18fc8` | `emulation/vpx/PokemonPro_Greybox.vpx` | 2,392,064-byte VPX 10.8.1 table; 323 game items, 56 contacts, 13 drivers, 113 logical lamp locations, six trough balls, one captive ball, registered overhead texture, and five private decals. | | `fd64431a28fb08a880acff091dc752301b785a2c93fe3985f9fb316db01026a0` | `emulation/vpx/PokemonPro_Greybox.vpx` | Deprecated historical VPX 10.8.1 greybox milestone hash; the current working copy may differ. The clean rebuild does not inspect or write it, and it is not an input or runtime default. |
| `3dbeb3afbe3b848ec41b072cc736c2034d597e178bbf677a9821114c4d115610` | `emulation/vpx/layout.json` | Versioned 952x2115 manifest with 45 switches, 11 sensors, 13 drivers, 113 lamps expanded to 150 exact channels, physics provenance, ball inventory, and mechanism mappings. | | `652b59cbfa3d38bae9194e096a9a15d6e9e7ea73b077707aced2827a774b8a84` | `emulation/vpx/layout.json` | Historical greybox geometry/mapping manifest; superseded for active electrical mapping by `emulation/playfield-contract/pokemon-pro-hardware.json`. |
| `13f5a89e6487e306e0621d5f4a2914c03324a168a97882fc9f893ee5835c41a3` | `emulation/vpx/PokemonPro_Greybox.vbs` | Standalone/SPIKE3/QA control, plugin bridge, switch/lamp/driver behavior, traps, drains, and deterministic launcher/mechanism tests. Current native stop point: unsupported `Service1Key` through `Service4Key` identifiers. | | `0e5047593cc1b4f6e53fb9324165c08adf8b1c6d1c7ad430281fd581c1278eeb` | `emulation/vpx-plugin/tests/test_bridge.cpp` | VPX bridge protocol fixture with the live-verified Service Back, Up, Down, and Enter CPU-SPI addresses; exercised by the plugin mapping, reconnect, and 10,000-pulse tests. |
| `5881967247f52b1016b4552401c666cb331f1870aaba8328877f043796d1823a` | `emulation/vpx/tools/generate_layout.py` | Deterministic hardware, geometry, physics, asset-registration, and CPU-SPI route manifest generator. | | `18028e0065d4260799264ec255999a8e4ced4c7e4213484379752d360e1f4768` | `emulation/vpx/PokemonPro_Greybox.vbs` | Deprecated historical greybox controller/QA sidecar; not the active clean-table script. |
| `74e978ecdb3b40182ac79adf8c6f93538fa071c316e7a3426c389b1b5b4cb6ca` | `emulation/vpx/tools/generate_table.py` | Rounded collision paths, layered VPX source, balls/mechanisms, private texture/decal registration, controller integration, QA, and overlays. | | `127c653b08aa275afd86141bef1ad7d44a48525f034d1bdd1a0188671d61bd04` | `emulation/vpx/manual/PokemonPro_Manual.vpx` | Historical editor-owned derivative of the greybox workflow; not the active clean-table source of truth. |
| `a195a95b8ddf7a914b87f12dff2d137f543f515a6424900e176a8c2e4a51c076` | `emulation/VPX_EMULATOR_STATUS.md` | Current implementation inventory, reproduced native stop points, ordered recovery plan, and acceptance checklist for branch `vpx-emulator`. | | `560f8108ed1224945a5597f8d960e266fea5feea74f813a17b3a6a7ea2233ad8` | `emulation/vpx/prepare-manual-table.sh` | Creates the protected manual table, refreshes only its generated controller sidecar, and backs up before an explicit reset. |
| `1c9826c3c302b24d66ccce780eb65b75ead20be59dcd062667d921e9effb6f11` | `emulation/vpx/edit-manual-macos.sh` | Opens the manual table in standalone VPX with an isolated preferences path and prints Live Editor save guidance. |
| `ebb09dfb3b708f2b1e363c49f59ca78b7e64067ab50a9d598b4d2d5c07dfa972` | `emulation/vpx/test-manual-macos.sh` | Fast standalone physics launcher for the editor-owned table. |
| `95819aec421da92aa2a6305c0b5e9bebb56ad18f86400212e85d6b42badaedc7` | `emulation/scripts/run-playable-manual-macos.sh` | Full native QEMU/HVF and VPX integration launcher using the editor-owned table. |
| `2777d9a83a42a2ef076e6956bd8c15bfc54e1cff99eddbd012385fd5db90db5b` | `emulation/scripts/run-playable-macos.sh` | Native cabinet supervisor with matching VPX/QEMU-focus control instructions and automatic generated-rootfs guest-helper refresh. |
| `b7a864e250907952e83239a6b3dd69923bca86fed0816a3c5a99a026b92edcf5` | `emulation/scripts/run-macos.sh` | Native QEMU/HVF supervisor with playfield bridge and explicit optional/required conagent backend collision handling. |
| `d08a4f577ed481371d16f734e360553ea19f49c8afab83d2c4d528af51abc270` | `emulation/guest-tools/keyboard-switch-relay.c` | AArch64 guest relay using the cabinet map when QEMU Cocoa has focus: Shift flippers, `1` Start, `5` coin, Return/Space Action, and `7`/`8`/`9`/`0` service controls. Installed binary SHA-256 `55054003950873900b5ce203292846f158b861060dbdd2e04b5be4a8afa1869c` was verified from the rebuilt ext4 image. |
| `732437382c6bc88df080e3a9c1cf66803eb35b1e6f736a76896ab35d8f48c0e2` | `emulation/vpx/tools/generate_layout.py` | Deterministic hardware, geometry, physics, asset-registration, live-corrected service CPU-SPI, and power-distribution route manifest generator. |
| `cedb8d18f491d06c1dde2b5aa2fdee9f4786001ac0be029e672d25204e97f709` | `emulation/vpx/tools/generate_table.py` | Rounded collision paths, layered VPX source, controller integration, QA, and exact cabinet-route validation. |
| `836e26f693990680688780befa5d826c37d656d827f9448f68ececcede777230` | `emulation/VPX_EMULATOR_STATUS.md` | Current implementation inventory, repaired CPU-SPI/powerdist input paths, persistent-provisioning stop point, manual geometry workflow, and acceptance checklist for branch `vpx-emulator`. |
| `e13eb92e99a806ea86625de8cc426876929625190f763bfe93cd2e821efd3f88` | `emulation/vpx/tools/verify_collision_topology.py` | Static assertions for continuous collision/visual rail inventory and runtime/editor flags. | | `e13eb92e99a806ea86625de8cc426876929625190f763bfe93cd2e821efd3f88` | `emulation/vpx/tools/verify_collision_topology.py` | Static assertions for continuous collision/visual rail inventory and runtime/editor flags. |
| `829c929b4ed51d2d7544cfae1aeb0b8571b50e1d71de299bcfdc0535844372e1` | `emulation/vpx/qa/collision-topology.json` | Per-path polygon area, winding, vertex, and self-intersection report. | | `829c929b4ed51d2d7544cfae1aeb0b8571b50e1d71de299bcfdc0535844372e1` | `emulation/vpx/qa/collision-topology.json` | Per-path polygon area, winding, vertex, and self-intersection report. |
| `e3ed8627e92c9175791c6aad0a2868df7dd66ac53602663431c6cd0c7a98a52a` | `emulation/vpx/qa/collision-validation.json` | Passing 13-collision/13-visual topology summary with zero legacy segments and intersections. | | `e3ed8627e92c9175791c6aad0a2868df7dd66ac53602663431c6cd0c7a98a52a` | `emulation/vpx/qa/collision-validation.json` | Passing 13-collision/13-visual topology summary with zero legacy segments and intersections. |
@@ -181,9 +227,9 @@ These files are workspace-local generated artifacts, not target-root files.
| `b5ddb933f125cf6b54b81c56f4e3430ded50d843c045a49f0727a1f7ebc5f66f` | `rootfs-triage-wiki/scripts/harvest_loose_openable_assets.py` | Static loose-asset copier for PNG, TTF, MP4, and MOV files. | | `b5ddb933f125cf6b54b81c56f4e3430ded50d843c045a49f0727a1f7ebc5f66f` | `rootfs-triage-wiki/scripts/harvest_loose_openable_assets.py` | Static loose-asset copier for PNG, TTF, MP4, and MOV files. |
| `257cb2d9ba653385aba63157a3bc143bb479c5188071ef529996d3f5da258b71` | `analysis/topper-emulator/topper_emulator.py` | MicroPython SPIKE node-board emulator for the Magikarp topper serial-key path; 6,452 bytes. | | `257cb2d9ba653385aba63157a3bc143bb479c5188071ef529996d3f5da258b71` | `analysis/topper-emulator/topper_emulator.py` | MicroPython SPIKE node-board emulator for the Magikarp topper serial-key path; 6,452 bytes. |
| `32263b75f49aefba04596c196f85cc4ae4477eb536f767fcdeac7c0d5fc40e9b` | `analysis/topper-emulator/README.md` | Emulator notes and recovered command summary; 5,820 bytes. | | `32263b75f49aefba04596c196f85cc4ae4477eb536f767fcdeac7c0d5fc40e9b` | `analysis/topper-emulator/README.md` | Emulator notes and recovered command summary; 5,820 bytes. |
| `5b510902f4027e364702a61338ff613bde2b77d8441ba2703b343e642cac0453` | `analysis/netbridge-emulator/netbridge_emu.py` | Python host-side emulator for the RP2040 netbridge UART protocol, bridge commands, CRC response, PTY/socket serving, and a stub nodebus device. | | `75c5c40ec0835140c3ee26474144777e69eb0947f57d428b72000470f0a77aaa` | `analysis/netbridge-emulator/netbridge_emu.py` | Live netbridge and `spike3-playfield/v1` service with manifest cabinet aliases, CPU-SPI routing, polled and unsolicited powerdist input reports, ordered output, and safe QEMU synchronization. |
| `542b9835e6b6d8107d68cc6d62bfdfe85995fe61029c36ffcdba3e0295f6d455` | `analysis/netbridge-emulator/test_netbridge_emu.py` | Unit tests for host frame escaping/checksum, version response, firmware CRC response, and node serial-key command. | | `7fcbb6b3752ddf7212d996660871d4b96b3f83666266e82fb027e4478bd46769` | `analysis/netbridge-emulator/test_netbridge_emu.py` | Sixty-eight protocol, routing, active-low wire-state, unsolicited UART, event-pump, output, synchronization, and recovery tests. |
| `b7a05a1f4d3cffc7d163e26afed6fa5402ee1a94df1687447dc1aefe067e03cd` | `analysis/netbridge-emulator/README.md` | Runbook and porting notes for the host-side netbridge emulator. | | `e4e8828d0a0bcf7c533f67d03d69e83fd9bab93278d6ac8f084a2699b12be8f0` | `analysis/netbridge-emulator/README.md` | Runbook and porting notes for the host-side netbridge emulator. |
| `a27f5e00f09a014391418f6822dc6c5481c224ef0cf42786b8b290ecd508d9c3` | `analysis/netbridge-pico-firmware/CMakeLists.txt` | Pico SDK and portable host-test build file for the RP2040 netbridge firmware recreation. | | `a27f5e00f09a014391418f6822dc6c5481c224ef0cf42786b8b290ecd508d9c3` | `analysis/netbridge-pico-firmware/CMakeLists.txt` | Pico SDK and portable host-test build file for the RP2040 netbridge firmware recreation. |
| `d01867dc66873799b966cf24b7574d9e389277f1556d88b92fd61342ea760222` | `analysis/netbridge-pico-firmware/include/netbridge_protocol.h` | Shared host-frame protocol and model API for the Pico firmware recreation. | | `d01867dc66873799b966cf24b7574d9e389277f1556d88b92fd61342ea760222` | `analysis/netbridge-pico-firmware/include/netbridge_protocol.h` | Shared host-frame protocol and model API for the Pico firmware recreation. |
| `918b434ad6c8b4a0455b4eea0bd7ed8c341fb4e709bc6012c0aa43b4c074601e` | `analysis/netbridge-pico-firmware/src/netbridge_protocol.c` | Portable STX/ETX/ESC frame encoder/decoder for the Pico firmware recreation. | | `918b434ad6c8b4a0455b4eea0bd7ed8c341fb4e709bc6012c0aa43b4c074601e` | `analysis/netbridge-pico-firmware/src/netbridge_protocol.c` | Portable STX/ETX/ESC frame encoder/decoder for the Pico firmware recreation. |
@@ -214,7 +260,7 @@ These files are workspace-local generated support artifacts, not target-root evi
| `61f62ec692e91cddcd1dd81d7edb32aaeb7951f80c82f64b472fa54f9009e217` | `emulation/README.md` | User-facing emulator runbook, optional netbridge mode, and current limitations. | | `61f62ec692e91cddcd1dd81d7edb32aaeb7951f80c82f64b472fa54f9009e217` | `emulation/README.md` | User-facing emulator runbook, optional netbridge mode, and current limitations. |
| `239ddcc7b6928582df66273cd557bf939dbc14f792f554c6ee2e6d4844ac00ca` | `rootfs-triage-wiki/docker-qemu-emulation.md` | Wiki page documenting implementation, verified progress, optional netbridge wiring, and the current display and hardware blockers. | | `239ddcc7b6928582df66273cd557bf939dbc14f792f554c6ee2e6d4844ac00ca` | `rootfs-triage-wiki/docker-qemu-emulation.md` | Wiki page documenting implementation, verified progress, optional netbridge wiring, and the current display and hardware blockers. |
| `62eddb1582076ca9e07b3910e71673e7d15e4cd3599d73ce51e3a4148e5b95ad` | `rootfs-triage-wiki/analysis-evidence-map.md` | Cross-reference from durable `analysis/` outputs to wiki findings, confidence boundaries, and open enrichment work. | | `62eddb1582076ca9e07b3910e71673e7d15e4cd3599d73ce51e3a4148e5b95ad` | `rootfs-triage-wiki/analysis-evidence-map.md` | Cross-reference from durable `analysis/` outputs to wiki findings, confidence boundaries, and open enrichment work. |
| `ac568dc027509f7c30475f444490771cdfa37e2510deeb32cda29367ee5ec78a` | `rootfs-triage-wiki/netbridge-re.md` | Wiki page documenting Ghidra-backed netbridge protocol recovery, emulator use, Docker wiring, and Pico firmware recreation. | | `3ec9bb35a9fc74f992f84fc71405b5dda9c8c096312263902dfc850597ff8a98` | `rootfs-triage-wiki/netbridge-re.md` | Wiki page documenting Ghidra-backed netbridge and power-distribution protocol recovery, emulator use, Docker wiring, and Pico firmware recreation. |
## Generated Static Triage Artifacts ## Generated Static Triage Artifacts

185
native-playable-table.md
View File

@@ -2,8 +2,8 @@
## Status ## Status
The first native playable-cabinet implementation lives under `emulation/`. The native playable-cabinet implementation lives under `emulation/`. It
It combines two existing, independently useful runtimes: combines two independently useful runtimes:
- QEMU 11 with HVF runs the generated ARM64 guest and genuine Pokémon Pro game - QEMU 11 with HVF runs the generated ARM64 guest and genuine Pokémon Pro game
code. Its Cocoa window and CoreAudio output are the backbox, game display, code. Its Cocoa window and CoreAudio output are the backbox, game display,
@@ -11,44 +11,71 @@ It combines two existing, independently useful runtimes:
- Visual Pinball X 10.8.1 owns the physical balls, collision geometry, - Visual Pinball X 10.8.1 owns the physical balls, collision geometry,
switches, trough inventory, and moving playfield mechanisms. switches, trough inventory, and moving playfield mechanisms.
The supported first release is deliberately two-window. It does not use VNC, The default VPX frontend is now the clean-room table assembled at
`emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx`. The supported first
release is deliberately two-window. It does not use VNC,
noVNC, browser capture, JPEG screendumps, or the dashboard for gameplay. The noVNC, browser capture, JPEG screendumps, or the dashboard for gameplay. The
dashboard remains an optional diagnostic monitor. This is an dashboard remains an optional diagnostic monitor. This is an
evidence-calibrated development recreation; it is not yet a playable release evidence-calibrated playable development recreation; it is not a
and is not a measurement-validated replica of ramp heights, coil forces, or measurement-validated replica of ramp heights, coil forces, or rebound curves.
rebound curves.
The one-command Finder entry point is `emulation/run-playable.command`; the The one-command Finder entry point is `emulation/run-playable.command`; the
terminal entry point is `emulation/scripts/run-playable-macos.sh`. terminal entry point is `emulation/scripts/run-playable-macos.sh`.
### Current stop points (2026-07-14) ### Clean rebuild workflow
The latest native launch is blocked first by a VPX script error: With no table override, `emulation/scripts/run-playable-macos.sh` runs
`emulation/vpx-rebuild/build.sh` and selects
`emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx`. The maintained sources are
`design/geometry.json`, `design/lights.json`, the VBS template, procedural
assets, and generator under `emulation/vpx-rebuild/`; generated `source/` and
`dist/` files must not be hand-edited. `emulation/vpx-rebuild/run-standalone.sh`
provides the short no-QEMU physics/render path.
```text `SPIKE3_VPX_TABLE` still permits an explicit custom table. If that table needs
Runtime error: Variable is undefined: 'Service1Key' a preparation step, set `SPIKE3_VPX_BUILD`; setting the custom table without a
``` build override prevents the clean rebuild script from modifying it. The
historical `emulation/vpx/PokemonPro_Greybox.vpx` and
`emulation/vpx/manual/PokemonPro_Manual.vpx` are deprecated historical
artifacts. The clean workflow does not inspect or write either file, and
neither is the active geometry source or default.
The table uses the unsupported legacy names `Service1Key` through ### Current stop point (2026-07-20)
`Service4Key`. The pinned VPX host exposes those actions as
`VPXActionKey(25)` through `VPXActionKey(28)`. Since the references are inside
the common key handler, an input event can abort before even non-service input
is forwarded. This must be repaired and exercised in the native host before
the cabinet path can be called playable.
The next confirmed blocker is the power-distribution input model. Start and The bridge now ingests host events immediately and routes service controls over
Action physically enter the power-distribution board and are returned to the active-low CPU-SPI. Start and Action use the installed power-distribution
game by command `0x15`, active-low in bits 1 and 0. Bit 2 is the active-low command `0x15` path, including unsolicited input reports. The genuine display
cabinet-door input. The current generic `0xff` response therefore leaves both has acknowledged service navigation, and protocol tests cover a Start change
buttons released and the door open, which is consistent with the observed without a preceding host poll. Those are transport results, not a completed
factory/pre-play setup screen remaining stuck. Correct idle/Start/Action/both game.
responses are `0x03`, `0x01`, `0x02`, and `0x00` respectively.
Separately, the game's CPU-SPI receive alignment is `00 || rx[0..6]`. The clean table and canonical hardware contract pass their static validators.
`0-SW-23` must therefore be raw byte 1 bit 7 low, making the correct idle raw `emulation/vpx-rebuild/qa/runtime-smoke.log` records a bounded VPX 10.8.1
SPI record `ff7fffffffffffff`. The complete ordered plan and acceptance `CaptureAttract` pass on the exact current table SHA-256
checklist are in `emulation/VPX_EMULATOR_STATUS.md` in the parent emulator `ddce5d48033ee3c6e67248910a73897293e8b9c36eee29df164160a93572a30e`,
repository. with table/VBS load, script compile/start, Metal initialization, two rendered
frames, clean close, and exit code 0. In integrated modes,
the clean script publishes physical contacts, consumes exact-address lamp
components, preserves ordered driver pulses, establishes reconnect baselines,
and releases transients/mechanisms on disconnect. Cabinet edges move the
flippers locally while cabinet/EOS state is still sent to the genuine game.
The final clean table also completed the supervised native QEMU/VPX startup
gate on 2026-07-20. The accepted session reached `Playable cabinet connected`
with synchronized VPX physics, 392 lamp updates, 7 LED frames, 1 driver pulse,
stable captive-ball contacts, and QEMU-keyboard coin/Start press-release
records. The default hardware-output wait is 420 seconds because normal game
initialization can take about five minutes. A transient bridge blip is accepted
only after a later synchronized reconnect; unrecovered disconnects still fail
closed.
The remaining immediate cabinet gate is completing and preserving a genuine
normal game cycle. The generated QEMU disk is writable and persistent, but the
current conagent `data_store` model is memory-only. After that gate, the final clean table still needs a captured normal game,
multiball, full physical shot coverage, integrated RGB/driver/mechanism traces,
restart recovery, and a 60-minute inventory soak. Earlier greybox/manual
runtime logs remain useful historical bridge evidence, but they do not prove
the clean table's geometry or final trajectories.
## Runtime ownership ## Runtime ownership
@@ -62,12 +89,13 @@ repository.
| Mechanical ball/rubber/flipper/gate sounds | VPX only | | Mechanical ball/rubber/flipper/gate sounds | VPX only |
| Window placement and focus | Native macOS helper | | Window placement and focus | Native macOS helper |
`emulation/vpx/layout.json` is the single mapping source. It records 45 `emulation/playfield-contract/pokemon-pro-hardware.json` is the canonical
playfield switches plus 11 sensors, 13 drivers, 113 logical lights expanded to geometry-free mapping. It records 45 playfield switches, 11 sensors, 9 cabinet
150 exact SPIKE channels, six serveable trough balls, and a separate captive controls, 13 drivers, and 113 logical lamps expanded to 176 component bindings
ball. The plugin mapping header is generated from this manifest by at 150 exact SPIKE addresses. The plugin mapping header is generated from this
`emulation/vpx-plugin/generate-layout-mapping.py`; it is not a second contract by `emulation/vpx-plugin/generate-layout-mapping.py`; it is not a
handwritten address map. second handwritten address map. Ball inventory and placement live separately
in the clean geometry/script rather than becoming transport fields.
## Playfield protocol and safe recovery ## Playfield protocol and safe recovery
@@ -116,34 +144,36 @@ counter baseline and cannot become stale physical events.
The table has explicit modes: The table has explicit modes:
- `standalone`: preserves the self-contained greybox rules and mechanisms. - `standalone`: provides local serving, flipper/plunger control, and mechanism
behavior for no-QEMU physics/render checks.
- `spike3`: QEMU is authoritative for lamps and every driver-driven mechanism. - `spike3`: QEMU is authoritative for lamps and every driver-driven mechanism.
- `qa-spike3`: integrated handshake/input/output acceptance without falling - `qa-spike3`: integrated handshake/input/output acceptance without falling
back to standalone behavior. back to standalone behavior.
- Other `qa-*` modes are deterministic native geometry, shot, sling-authority,
plunger, and inventory checks documented in `emulation/vpx/README.md`.
In integrated mode, a missing controller is fail-safe: the table remains in In integrated mode, a missing controller is fail-safe: the table remains in
SPIKE mode, disables standalone serving/GI, de-energizes mechanisms, and logs SPIKE mode, disables standalone serving/GI, de-energizes driver-controlled
the error. It does not silently animate local flippers. Physical flippers, mechanisms, and logs the error. Flippers are the deliberate exception to game
slings, pops, trough eject, auto-launch, posts, gate, Meowth motor, and ejects driver ownership: cabinet buttons actuate them locally and publish their
move only from mapped game driver pulses. cabinet/EOS states to the bridge. Slings, pops, trough eject, auto-launch,
posts, gate, Meowth motor, and ejects move only from mapped game driver pulses.
## Physics and private visual assets ## Physics and private visual assets
The versioned `pokemon-pro-vpx-physics/v1` record in `emulation/vpx-rebuild/design/geometry.json` is the active clean-room geometry
`emulation/vpx/layout.json` fixes the inspected service-manual values at a and physics source. It fixes a 952 by 2115 VPX plane, 6.5-degree pitch, and
6.5-degree pitch, 1-1/16-inch steel ball, and 50 Shore A rubber. Every physics standard 50-unit-diameter ball. XY references follow the full 451 by 998 Pro
or dimension value is tagged `manual`, `photo_estimate`, `comparable_part`, or locator registration; Z paths, clearances, restitution, friction, coil force,
`playability_tuned`. and mechanism timing remain simulation values until measured on a physical Pro
machine. `design/lights.json` independently records lamp placement and
confidence rather than deriving visual coordinates from the transport map.
The registered overhead photograph is the provisional playfield texture; the The deterministically registered official Pro photograph is the provisional
manual locator remains a hidden registration/QA layer. Reconstructed post and playfield texture; it retains photographed hardware, shadows, and lighting
pop meshes sit over simple collision bodies. Extracted Pokémon images are used under the separately rendered VPX geometry. Original procedural meshes provide
only as local toy decals or temporary plastics, and unmeasured toys/wireforms posts, hardware, toys, and mechanisms, and the CC0 mechanical bank supplies
remain labeled proxy geometry. The table, extracted artwork, reference photos, physics audio without copying game samples. The table, official photograph,
manual, and game audio are private-use inputs and are excluded from any Pokemon/Stern imagery, reference manual, and assembled output are private-use
redistributable package. artifacts and are excluded from any redistributable package.
## Controls and native windows ## Controls and native windows
@@ -153,13 +183,33 @@ service bindings. Defaults are:
| Input | Function | | Input | Function |
| --- | --- | | --- | --- |
| Left/Right Shift or LB/RB | Flippers | | Left/Right Shift or LB/RB | Flippers |
| Return, right trigger, or right stick | Plunger/launch | | Return, Space, A, or right trigger | Action/launch |
| `1` or Menu | Start | | `1` or Menu | Start |
| `5` or View | Coin | | `5` or View | Coin |
| Return, Left Option, or A | Action |
| `7`/`8`/`9`/`0` or D-pad | Service back/down/up/enter | | `7`/`8`/`9`/`0` or D-pad | Service back/down/up/enter |
VPX receives focus. On two displays the AppKit/Accessibility helper attempts a The QEMU guest keyboard relay now implements the same map as VPX. Previously,
only Shift was a cabinet control when the Cocoa backbox had focus; Return and
`1` through `9` still used an obsolete diagnostic switch map. That produced the
observed failure where flippers navigated Guided Setup while Start, coin,
Action, and service keys did nothing useful. The corrected relay maps `1`,
`5`, Return/Space, and `7`/`8`/`9`/`0` to the named cabinet inputs above.
The 2026-07-15 generated rootfs was rebuilt with the correction. The installed
AArch64 `/usr/local/spike-emu/bin/keyboard-switch-relay` was extracted from the
ext4 image and matched an independent source build at SHA-256
`55054003950873900b5ce203292846f158b861060dbdd2e04b5be4a8afa1869c`.
A headless QEMU monitor test injected all ten keys and
`emulation/work/logs/keyboard-relay.log` recorded matching press/release pairs
for both flippers, Start, coin, Action twice, and all four service controls.
That event-name check alone was insufficient: CPU and powerdist contacts do
not pass through a node input-bank poll. The playfield bridge now runs a
bounded host-event pump which routes those edges to their real transports
immediately while leaving ordinary node-bus edges queued until the relevant
bank read. The cabinet aliases and routes are loaded from
`emulation/playfield-contract/pokemon-pro-hardware.json`.
VPX normally receives focus. On two displays the AppKit/Accessibility helper attempts a
fullscreen VPX playfield plus fullscreen QEMU backbox. On one display it uses fullscreen VPX playfield plus fullscreen QEMU backbox. On one display it uses
approximately 65% for VPX and 35% for a 16:9 backbox. If Accessibility access approximately 65% for VPX and 35% for a 16:9 backbox. If Accessibility access
is declined or a window does not expose fullscreen through AX, both processes is declined or a window does not expose fullscreen through AX, both processes
@@ -176,13 +226,20 @@ The reproducible checks are split by what they prove:
- `emulation/vpx-plugin/tests/run-tests.sh` verifies the generated mapping, - `emulation/vpx-plugin/tests/run-tests.sh` verifies the generated mapping,
background client, ordered input edges, output records, driver baseline, and background client, ordered input edges, output records, driver baseline, and
reconnect behavior against a loopback server. reconnect behavior against a loopback server.
- `emulation/vpx/build.sh` plus `emulation/vpx/qa.sh` verifies the assembled - `python3 emulation/playfield-contract/validate_contract.py --json` verifies
VPX, source round-trip, exact mapping counts, physics tags, ball inventory, the geometry-free schema, channel counts/routes, manual evidence, consumer
and collision topology. loading, and generated-header parity.
- The native `emulation/vpx/qa-*.sh` launchers exercise VPX itself rather than - `emulation/vpx-rebuild/build.sh` regenerates assets/source, verifies the
only inspecting generated JSON. assembled VPX, compares the round-trip VBS, and runs contract/object,
- A complete cabinet run additionally has to prove the real QEMU game accepts geometry, clearance, lamp-route, audio, and no-ball-teleport checks recorded
inputs/physical switches and drives VPX mechanisms through the live bridge. in `emulation/vpx-rebuild/qa/rebuild-validation.json`.
- `emulation/vpx-rebuild/qa/runtime-smoke.log` records the exact current table
loading, compiling/starting its script, rendering two frames, and closing
with exit code 0 under VPX 10.8.1 `CaptureAttract`. It does not claim
interactive ball or mechanism coverage.
- The accepted live cabinet startup proves the real QEMU game returned lamp,
LED, and driver output through the final table/plugin path and received
QEMU-keyboard coin/Start edges. It does not prove a complete normal game.
Do not infer a normal three-ball game, multiball, measured frame-rate percentile, Do not infer a normal three-ball game, multiball, measured frame-rate percentile,
or 60-minute invariant soak from the static/unit suites. Those acceptance rows or 60-minute invariant soak from the static/unit suites. Those acceptance rows

36
netbridge-re.md
View File

@@ -8,6 +8,7 @@ Target artifacts:
- `/games/pokemon_pro/spike3/netbridge/spike3-swd.cfg` - `/games/pokemon_pro/spike3/netbridge/spike3-swd.cfg`
- `/games/pokemon_pro/spike3/netbridge/rp2040.cfg` - `/games/pokemon_pro/spike3/netbridge/rp2040.cfg`
- `/games/pokemon_pro/spike3/netbridge/version.txt` - `/games/pokemon_pro/spike3/netbridge/version.txt`
- `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex`
Generated artifacts: Generated artifacts:
@@ -160,6 +161,35 @@ CRC32(0, &__logical_binary_start, 0x12a40)
For this ELF, `__logical_binary_start` maps to file offset `0x1100`. A Python `binascii.crc32` over `games/pokemon_pro/spike3/netbridge/netbridge.elf[0x1100:0x1100+0x12a40]` gives `0x357f5327`. For this ELF, `__logical_binary_start` maps to file offset `0x1100`. A Python `binascii.crc32` over `games/pokemon_pro/spike3/netbridge/netbridge.elf[0x1100:0x1100+0x12a40]` gives `0x357f5327`.
## Power-Distribution Cabinet Inputs
Confirmed static facts:
- SHA-256 of `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex` is `f8eb96998a32ff86008663f7f07f2df76c32a9c86200f690c215dc36917391a9`; it is a 32,799-byte Intel HEX file whose decoded address range starts at `0x3800`.
- In `netbridge.elf`, `HOST_Update` at `0x10001210` calls `POWERDIST_IsSpike3`. For a SPIKE 3 controller, commands `0x10..0x1f` are passed to `POWERDIST_SendCmd` at `0x100020b4`; the legacy non-SPIKE-3 command `0x15` fallback is the unrelated one-byte `0xff` response.
- `POWERDIST_Update` at `0x10002174` parses controller frames and forwards their original command, sequence, and payload to the Pi with `HOSTUART_SendMessage`. These frames are not restricted to replies to a Pi request.
- Disassembling the decoded power-distribution image as Thumb code at `0x3800` shows command `0x15` dispatch at `0x427c`. It calls `0x475c` and returns exactly one payload byte.
- Function `0x46b4` composes that byte from raw GPIO P0_8, P0_9, and P0_11 as bits 0, 1, and 2. The installed cabinet map assigns Action to bit 0 and Start to bit 1; bit 2 is the coin-door power interlock state.
- Most importantly, the controller's input-change path at `0x407a` calls the frame sender at `0x3f9c` with command `0x15`, sequence `0`, a one-byte payload, and length `1`. A separate command handler at `0x428a` provides the same state for explicit polls.
The last point explains the VPX failure introduced while adding the first
power-distribution model. The emulator answered explicit `0x15` polls but did
not reproduce the controller's unsolicited change report, so a Start edge
could exist inside the emulator without ever reaching game code. The repaired
UART service queues every changed Start/Action state as command `0x15`,
sequence `0`, and drains those frames independently of incoming host traffic.
An integration test uses a socket pair to prove that a Start transition emits
`15 00 01` at the decoded protocol level without first sending a poll.
Reproduction commands used for the static controller pass:
```sh
arm-none-eabi-objcopy -I ihex -O binary \
games/pokemon_pro/spike3/powerdist/powerdist_ext.hex /tmp/powerdist_ext.bin
arm-none-eabi-objdump -D -b binary -m arm -M force-thumb \
--adjust-vma=0x3800 /tmp/powerdist_ext.bin
```
## Nodebus Layer ## Nodebus Layer
`NODE_Init` configures a mixed PIO/hardware-UART nodebus: `NODE_Init` configures a mixed PIO/hardware-UART nodebus:
@@ -220,6 +250,8 @@ It currently provides:
- Firmware CRC response `0x357f5327`. - Firmware CRC response `0x357f5327`.
- PTY, serial-device, and Unix-socket serving modes for QEMU or host-side serial plumbing. - PTY, serial-device, and Unix-socket serving modes for QEMU or host-side serial plumbing.
- Existing-node stub at address `0x0a` with Magikarp/topper-oriented commands `0xf2`, `0xfc`, `0xfd`, `0xfe`, and `0xff`. - Existing-node stub at address `0x0a` with Magikarp/topper-oriented commands `0xf2`, `0xfc`, `0xfd`, `0xfe`, and `0xff`.
- Power-distribution command `0x15` polling plus unsolicited sequence-0
Start/Action change reports matching the installed controller firmware.
Run: Run:
@@ -243,8 +275,8 @@ Verification performed:
```text ```text
python3 -m unittest discover -s analysis/netbridge-emulator python3 -m unittest discover -s analysis/netbridge-emulator
.... ...................................................................
Ran 4 tests in 0.000s Ran 67 tests
OK OK
python3 -m py_compile analysis/netbridge-emulator/netbridge_emu.py analysis/netbridge-emulator/test_netbridge_emu.py python3 -m py_compile analysis/netbridge-emulator/netbridge_emu.py analysis/netbridge-emulator/test_netbridge_emu.py

80
next-analysis-targets.md
View File

@@ -4,35 +4,65 @@
The QEMU/HVF Cocoa game path, loopback `spike3-playfield/v1` bridge, safe The QEMU/HVF Cocoa game path, loopback `spike3-playfield/v1` bridge, safe
pause/restart synchronization, VPX 10.8.1 controller-plugin rebase, generated pause/restart synchronization, VPX 10.8.1 controller-plugin rebase, generated
manifest mapping, dual-mode VPX table, private controller profile, and native hardware-contract mapping, clean-room dual-mode VPX table, private controller
two-window launcher are implemented; see `native-playable-table.md`. The profile, and native two-window launcher are implemented; see
standalone table remains available. `native-playable-table.md` and `vpx-table-recreation.md`. The default launcher
now builds and selects
`emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx`. The deprecated
`emulation/vpx/PokemonPro_Greybox.vpx` is historical evidence that the clean
rebuild does not inspect or write; it is not a build input or runtime default.
The current native stop point is not yet validation-only. Resolve these two The input transport blockers are now repaired and live-checked. The table uses
blocking integration defects first: `VPXActionKey(25..28)`; power-distribution command `0x15` carries active-low
Action/Start/door state; CPU-SPI `0-SW-23` is correctly aligned; and service
Back/Up/Down/Enter use CPU-SPI `0-SW-8/9/10/11`. Immediate host-event ingestion
replaces the broken dependency on node-bus polling. The genuine display
accepted service Up/Down/Back, and the guest acknowledged the exact raw states.
- Replace the undefined VPX `Service1Key` through `Service4Key` variables with The final clean table now passes the supervised native startup gate: the
the pinned host's supported `VPXActionKey(25)` through `VPXActionKey(28)` 2026-07-20 run reached `Playable cabinet connected`, returned 392 lamp updates,
expressions and exercise every mapped input in native VPX. 7 LED frames, and 1 driver pulse, kept both captive optos stable, and delivered
- Implement power-distribution command `0x15` for active-low Action, Start, and QEMU-keyboard coin/Start edges. The launcher now allows 420 seconds because
cabinet-door inputs; correct the CPU-SPI `0-SW-23` raw-byte alignment; then normal game initialization can take about five minutes. The next blocking
identify and complete the genuine factory/pre-play setup flow. integration target is a complete normal game and persistence check. If a fresh
image enters Guided Setup, complete Save & Exit through the repaired panel,
trace any subsequent invalid-machine decision, identify the minimum genuine
NVRAM or conagent-backed setup records, persist them across two reboots, and
prove the second boot reaches attract mode and accepts Start.
The clean table and geometry-free hardware contract pass their static
validators. `emulation/vpx-rebuild/qa/runtime-smoke.log` records a bounded VPX
10.8.1 `CaptureAttract` pass on 2026-07-20: it loaded the table and VBS,
compiled/started the script, rendered two frames, and closed with exit code 0.
The final smoke now matches the current distribution SHA-256
`ddce5d48033ee3c6e67248910a73897293e8b9c36eee29df164160a93572a30e`.
It is not interactive play or a substitute for the QEMU-connected acceptance
below.
After those blockers, continue acceptance and calibration: After those blockers, continue acceptance and calibration:
- Complete and preserve a normal three-ball game plus a multiball sequence - Complete and preserve a normal game plus a multiball sequence through the
through the genuine game rules, without dashboard ball-motion shortcuts. genuine rules on the final clean table, without dashboard ball-motion
- Run the configurable native shot suite across shooter lane, both orbits, shortcuts.
every ramp, both outlanes/returns, pops, QEMU-authoritative slings, captive - Exercise the shooter lane, both orbits, every ramp, both outlanes/returns,
ball, Town VUK, Poké Ball hold, gates/posts, and Meowth movement; tune only pops, QEMU-authoritative slings, Pokedex captive chain, Town VUK, right-ramp
the transitions that fail. hold/Pikachu post, gates, spinner, targets, and Meowth movement with physical
VPX balls. Treat contact injection as transport coverage, not shot proof.
- Capture exact-address RGB lamp behavior, ordered driver pulses, retained-ball
ownership, disconnect fail-safe, and reconnect baselines in one integrated
run of the final table.
- Record input-to-visible-flipper and bridge-output-to-mechanism p95/p99 from - Record input-to-visible-flipper and bridge-output-to-mechanism p95/p99 from
live native traces, plus rendered fps/1% low under simultaneous QEMU load. live native traces, plus rendered fps/1% low under simultaneous QEMU load.
- Preserve a full 60-minute inventory soak and explicit QEMU, bridge, and VPX - Preserve a full 60-minute inventory soak and explicit QEMU, bridge, and VPX
restart logs before declaring the long-run acceptance row complete. restart logs before declaring the long-run acceptance row complete.
- Replace `photo_estimate`, `comparable_part`, and `playability_tuned` ramp Z, - Compare `emulation/vpx-rebuild/design/geometry.json` with a physical Pro
coil, restitution, and friction values when direct measurements or machine: measure ramp Z/clearance, post and toy footprints, Pikachu post
slow-motion reference footage become available. direction/stroke, Meowth crank travel, coil timing, pitch, and ball/rubber
behavior. Replace estimated or simulation-tuned values only with recorded
evidence.
- Acquire a licensed stripped/bare-playfield scan to replace the official
registered photograph, whose baked-in hardware and lighting remain visible
beneath VPX geometry. Re-run visual and runtime QA after that asset change.
- Test QEMU D-Bus shared-memory scanout only after the two-window release is - Test QEMU D-Bus shared-memory scanout only after the two-window release is
stable. Retain Cocoa rather than adopting a VNC/browser capture fallback if stable. Retain Cocoa rather than adopting a VNC/browser capture fallback if
page-flip, 60 fps, or one-frame latency gates fail. page-flip, 60 fps, or one-frame latency gates fail.
@@ -127,7 +157,7 @@ Follow-up passes:
## Priority 4: Netbridge Debug Path ## Priority 4: Netbridge Debug Path
Status: first-pass strings, ELF program-header review, targeted Ghidra decompilation, host protocol recovery, a Python host-side emulator scaffold, Docker/QEMU optional serial wiring, and a Pico SDK firmware recreation are complete; see `package-image-firmware.md`, `netbridge-re.md`, and `docker-qemu-emulation.md`. Status: first-pass strings, ELF program-header review, targeted Ghidra decompilation, host protocol recovery, power-distribution command `0x15` static recovery, a Python host-side emulator scaffold, Docker/QEMU optional serial wiring, and a Pico SDK firmware recreation are complete; see `package-image-firmware.md`, `netbridge-re.md`, and `docker-qemu-emulation.md`.
Targets: Targets:
@@ -146,6 +176,10 @@ Findings:
- `netbridge.elf` is a 32-bit ARM static executable with code mapped at `0x10000000` and RAM at `0x20000000`/`0x20040000`. - `netbridge.elf` is a 32-bit ARM static executable with code mapped at `0x10000000` and RAM at `0x20000000`/`0x20040000`.
- Strings include `uart_node.c`, `NODEBUS_Poll`, `NODEUART_Write`, `UART_NodeRxIrq`, and `WS2812_NodeSetLED`. - Strings include `uart_node.c`, `NODEBUS_Poll`, `NODEUART_Write`, `UART_NodeRxIrq`, and `WS2812_NodeSetLED`.
- Ghidra decompilation identifies the Pi-facing host UART as 2,000,000 baud STX/ETX/ESC framed messages on RP2040 GPIO 16/17, with `0x30` returning firmware CRC `0x357f5327` and `0x41` carrying direct nodebus requests. - Ghidra decompilation identifies the Pi-facing host UART as 2,000,000 baud STX/ETX/ESC framed messages on RP2040 GPIO 16/17, with `0x30` returning firmware CRC `0x357f5327` and `0x41` carrying direct nodebus requests.
- Static disassembly of `powerdist_ext.hex` confirms that command `0x15`
returns GPIO P0_8/P0_9/P0_11 in bits 0/1/2 and emits an unsolicited
sequence-0 report whenever a debounced cabinet input changes. The Python
emulator now reproduces both the poll and asynchronous paths.
- `analysis/netbridge-emulator/netbridge_emu.py` implements the recovered host frame codec, core bridge commands, CRC response, PTY serving mode, and a stub node at address `0x0a`. - `analysis/netbridge-emulator/netbridge_emu.py` implements the recovered host frame codec, core bridge commands, CRC response, PTY serving mode, and a stub node at address `0x0a`.
- `analysis/netbridge-pico-firmware/` implements the same recovered protocol as a Pico SDK firmware recreation with a portable host-core test. - `analysis/netbridge-pico-firmware/` implements the same recovered protocol as a Pico SDK firmware recreation with a portable host-core test.
- Docker/QEMU now has an optional `SPIKE3_NETBRIDGE_EMU=1` path that starts the Python emulator on `emulation/work/netbridge.sock`, attaches it as a second PL011 serial, maps guest `/dev/ttyAMA5` to the real serial, and lets the preload shim pass that path through. - Docker/QEMU now has an optional `SPIKE3_NETBRIDGE_EMU=1` path that starts the Python emulator on `emulation/work/netbridge.sock`, attaches it as a second PL011 serial, maps guest `/dev/ttyAMA5` to the real serial, and lets the preload shim pass that path through.
@@ -160,12 +194,12 @@ Follow-up passes:
## Priority 5: Node Firmware ## Priority 5: Node Firmware
Status: first-pass Intel HEX range parsing complete for top-level node firmware; see `package-image-firmware.md`. Status: first-pass Intel HEX range parsing is complete for top-level node firmware, and the power-distribution `0x15` input path has been disassembled; see `package-image-firmware.md` and `netbridge-re.md`.
Targets: Targets:
- All `*-LPC*.hex` files under `/games/pokemon_pro`. - All `*-LPC*.hex` files under `/games/pokemon_pro`.
- `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex`. - `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex` (input-report path complete; other commands remain open).
Why: Why:

5
package-image-firmware.md
View File

@@ -131,4 +131,7 @@ Parsed ranges:
| `/games/pokemon_pro/ws2812node-LPC1313-1_33_0.hex` | 900 | 14336 | `0x1000` | `0x47ff` | | `/games/pokemon_pro/ws2812node-LPC1313-1_33_0.hex` | 900 | 14336 | `0x1000` | `0x47ff` |
| `/games/pokemon_pro/ws2812pinnode-LPC1313-1_33_0.hex` | 1157 | 18432 | `0x1000` | `0x57ff` | | `/games/pokemon_pro/ws2812pinnode-LPC1313-1_33_0.hex` | 1157 | 18432 | `0x1000` | `0x57ff` |
`/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex` is present in the `.sidx` package index and remains a separate follow-up target for power-distribution firmware parsing. `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex` is present in the
`.sidx` package index. Its command `0x15` cabinet-input poll and unsolicited
change-report paths have now been recovered; other power-distribution commands
remain follow-up targets. See `netbridge-re.md`.

2
viewer.html
View File

File diff suppressed because one or more lines are too long

365
vpx-table-recreation.md
View File

@@ -1,216 +1,193 @@
# Pokemon Pro VPX Table Recreation # Pokemon Pro VPX Clean Rebuild
## Status ## Status
An evidence-calibrated Visual Pinball X 10.8.1 table is implemented under The active Visual Pinball X implementation is the from-scratch Stern Pokemon
`emulation/vpx/`. The generated `emulation/vpx/PokemonPro_Greybox.vpx` keeps a Pro rebuild under `emulation/vpx-rebuild/`. Its local assembled output is
self-contained `standalone` mode and adds `spike3`, where the genuine game in `emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx`; the default native cabinet
QEMU owns rules, lamps, and mechanism drivers while VPX owns physical balls launcher builds and selects that file through
and contacts. See `native-playable-table.md` for the complete cabinet path. `emulation/scripts/run-playable-macos.sh`.
Confirmed on 2026-07-14 after the continuous-collision rebuild: `emulation/vpx/PokemonPro_Greybox.vpx` is deprecated historical work. The clean
rebuild generator does not inspect or write it, and it is not a generator
input, geometry source, build dependency, or runtime default. The rebuild also
does not import the legacy `emulation/vpx/layout.json`, script, materials,
models, or coordinates.
- `emulation/vpx/build.sh` regenerated the manifest and diff-friendly VPX The clean table targets the **Pro** edition only. VPX owns balls, contacts,
source, assembled the table with `vpxtool 0.33.4`, imported the standalone collision, mechanical motion, rendering, and mechanical sound. The genuine
VBS, and passed `vpxtool verify`. game running in QEMU remains authoritative for rules, scoring, display, music,
- `emulation/vpx/qa.sh` first validated 13 continuous collision polygons and speech, lamp levels, and ordered mechanism-driver pulses. The complete native
13 separate visual rails with zero legacy segment rectangles and zero cabinet path is documented in `native-playable-table.md`.
self-intersections, then re-extracted the assembled table and matched its
configuration, exact VBS, and all 323 named game items, including reusable
mechanical meshes, five private decal planes, and hidden QA/controller
objects. VPX binary float
quantization is compared at 0.01 VPX-unit precision.
- `emulation/vpx/qa-live.sh` loaded the table in the local macOS BGFX player,
compiled its VBS, ran the correctly named table initialization event, served
a ball, and captured a live playfield frame.
- `emulation/vpx/qa-mechanisms.sh` physically launched test balls through the
left and right outlane switch/drain paths and center drain, then exercised
Town VUK capture/eject, Poke Ball hold/release, and shooter-lane service. All
required events are present in `emulation/vpx/qa/mechanism-runtime.log`.
- `emulation/vpx/qa-plunger.sh` served a free ball, pulled and fired the actual
VPX plunger, and detected that same ball after it cleared the shooter-lane
mouth into the main playfield. The old midway-up-lane checkpoint was removed.
The position trace and passing event are preserved in
`emulation/vpx/qa/plunger-runtime.log`.
- `emulation/vpx/qa-sling-authority.sh` proved that both integrated-mode sling
balls remain captured until their mapped QEMU drivers arrive and are safely
released on disconnect.
- `emulation/vpx/qa-shots.sh` exercised physical outlane/center drains, actual
trap/shooter/sling mechanisms, every mapped ramp/orbit contact route, both
pops, captive-ball retention, posts/gate/Meowth motion, and restored physical
inventory to the captive ball. Ramp/orbit coverage in this harness is a
native contact/driver route test, not a claim that a physical ball traversed
every full elevated trajectory.
- `SOAK_SECONDS=8 emulation/vpx/qa-soak.sh` completed eight cycles with the
six-plus-one inventory invariant. The default is 3,600 seconds; that full
soak remains unrun.
For a standalone play test, double-click `emulation/vpx/run.command` or run ## Evidence and edition scope
`emulation/vpx/run.sh`. For the integrated cabinet, use
`emulation/run-playable.command`. The standalone launcher probes the verified
`~/Downloads/vpinball/build/VPinballX_BGFX.app/Contents/MacOS/VPinballX_BGFX`
path and the originally supplied `~/Downloads/vpinballbuild/` path.
## Evidence and registration The design basis and source URLs are recorded in
`emulation/vpx-rebuild/design/REFERENCE.md`. The official product-family page
provided for edition verification is
<https://www.sternpinball.com/game/pokemon/>. Primary evidence is:
The full service manual is preserved as - Stern's official Pokemon Pro product photography and feature information;
`emulation/vpx/reference/Pokemon_Pro_web.pdf` (SHA-256 - the official Pokemon Pro service and game manual, preserved locally as
`50a1906b5c609cd3a84970b6a6e9b0be839b4d0a588d8b27361936ab6537d6bb`). `emulation/vpx/reference/Pokemon_Pro_web.pdf` with SHA-256
Rendered PDF pages 16, 20, 25, 41, 42, 49, 51, 52, and 56 through 62 retain `50a1906b5c609cd3a84970b6a6e9b0be839b4d0a588d8b27361936ab6537d6bb`;
their original page numbers under `emulation/vpx/reference/manual-pages/`. - Stern's Pro/Premium/LE feature matrix and official overview/gameplay video;
and
- the extracted target-root Pro locator
`/games/pokemon_pro/assets/nuk/images/Test/pokemon_playfield_pro.png`.
The primary locator is the target-root asset The 451 by 998 locator is registered to a 952 by 2115 VPX-unit playfield. It is
`/games/pokemon_pro/assets/nuk/images/Test/pokemon_playfield_pro.png`. The used for XY placement, while official manual assemblies and photographs
preserved 451 by 998 grayscale copy has SHA-256 constrain paths and mechanism identities. The table implements the Pro layout:
`09477fe9bd50cfeba34bbff2eac5c272fc79eed6a6ed07fc40da636c5fde977b`. two lower flippers and slings, dual inlanes/outlanes, right shooter lane,
Three user-supplied machine photographs are preserved under Bulbasaur outer-left orbit, Squirtle left ramp, Pikachu right ramp, Charmander
`emulation/vpx/reference/photos/`; their hashes and the inspectable crop used right orbit/spinner, two Tall Grass pops, six BATTLE targets, motorized Meowth,
to register the overhead photograph are recorded in `emulation/vpx/layout.json`. the Pokedex captive/Newton-ball area, Town scoop/VUK, static Pro Poke Ball with
stop post, and the Pro Psyduck stand-up target.
The single locator-to-table transform into the 952 by 2115 VPX plane is: Premium/LE-only moving Poke Ball, animatronic Pikachu, arena magnet, whirlpool,
and Psyduck scoop behavior are excluded. Secondary photographs are useful for
cross-checking, but official Stern evidence controls when sources differ.
```text ## Sources of truth and generated artifacts
VPX x = source x * 952 / 451
VPX y = source y * 2115 / 998 The rebuild is generator-owned. Its maintained inputs are:
| Path | Role |
| --- | --- |
| `emulation/vpx-rebuild/design/geometry.json` | Clean-room XY/Z, collision, mechanism, and physics design with evidence/provenance fields. |
| `emulation/vpx-rebuild/design/lights.json` | Independent trace of 113 logical Pro lamp locations and exact component bindings. |
| `emulation/playfield-contract/pokemon-pro-hardware.json` | Geometry-free switch, sensor, cabinet, driver, and lamp contract. |
| `emulation/vpx-rebuild/script/PokemonPro_Rebuild.vbs.in` | Table behavior and SPIKE 3 integration template. |
| `emulation/vpx-rebuild/assets/` | Registered private playfield image plus original procedural models and mechanical audio. |
| `emulation/vpx-rebuild/tools/generate_table.py` | Deterministic unpacked-VPX source generator. |
`emulation/vpx-rebuild/source/` is generated and must not be hand-edited.
`emulation/vpx-rebuild/dist/PokemonPro_Rebuild.vpx` and its `.vbs` sidecar are
local build outputs. `emulation/vpx-rebuild/qa/` contains the validation report,
round-trip extraction, overlays, captures, and runtime logs. The final verified
2026-07-20 distribution is 5,902,336 bytes with SHA-256
`ddce5d48033ee3c6e67248910a73897293e8b9c36eee29df164160a93572a30e`;
the same value is recorded in `qa/rebuild-validation.json` and the matching
runtime-smoke log.
## Physical and visual implementation
The generator constructs native VPX walls, rails, posts, rubbers, flippers,
slings, targets, spinner, gates, kickers, bumpers, ramps, wireforms, plunger,
lights, and procedural models. Major retained-ball mechanisms have explicit
physical ownership: the Town VUK owns its captured ball, the right-ramp hold
kicker retains its ball until the Pikachu post driver releases it, and the
Pokedex captive chain is bounded by guides, a Newton target, and a one-way
retainer gate. Driver commands are queued briefly for their spatial mechanism
envelope rather than moving an unrelated ball. The validator rejects scripted
ball teleports.
The captive lower/upper optos use circular VPX occupancy volumes and aggregate
`BallCntOver` state across all three retained balls. Their construction kickers
are disabled seed-only loaders. This avoids the custom polygon trigger's z=50
grazing plane, which produced hundreds of thousands of false make/break edges
in the first integrated attempt. The accepted run published one initial state
per opto and no continuing idle chatter.
The current playfield base is deterministically registered from Stern's
official Pro photograph. It preserves authentic visible artwork but is not a
bare playfield scan: photographed rails, toys, shadows, and lamps remain baked
under separately rendered VPX geometry. Provenance and rejected cleanup
experiments are recorded in
`emulation/vpx-rebuild/assets/playfield/PROVENANCE.md`. A licensed, stripped
playfield scan remains necessary before the base art can be called
publication-quality.
The active build has 113 logical lamps expanded through the hardware contract
to 176 component bindings at 150 exact SPIKE addresses, including 30 RGB
logical lamps. Integrated mode consumes exact-address `L` records so separate
red, green, and blue levels are retained; the lossy maximum-component
compatibility getter is not the primary render path. GI, feature lamps, and
flashers are represented by VPX light emitters over the registered trace.
Mechanical and physics audio is an original procedural CC0 bank under
`emulation/vpx-rebuild/assets/sounds/`. Its 69 synthesized source events cover
rolling surfaces and impact, flipper, sling, bumper, target, gate, spinner,
kicker, plunger, drain, and mechanism behavior. The assembled table registers
the variants and aliases needed by the script. It does not copy sound samples
from the game image; QEMU continues to provide licensed music, speech, and game
effects.
## Electrical contract and integration behavior
`emulation/playfield-contract/pokemon-pro-hardware.json` is the canonical
geometry-free mapping. Static validation records 45 switches, 11 sensors, 9
cabinet controls, 13 drivers, and 113 logical lamps. The controller plugin and
netbridge load its compatibility projection directly, while the clean rebuild
uses its richer channel records for VPX object/event bindings.
Physical make/break contacts publish both edges; momentary targets, pops,
slings, and spinner events publish pulses. The Town VUK and right-ramp hold are
real kicker-owned states rather than dummy triggers. Start and Action retain
their installed power-distribution command `0x15` routing, and the service
panel retains its live-corrected CPU-SPI routing.
In `spike3` and `qa-spike3`, one `D` record is one ordered mechanism pulse.
Snapshot driver counts establish reconnect baselines and are never replayed as
new physical actions. Flippers are the documented exception: cabinet edges
move them locally and publish cabinet/EOS state because the live node-board
path does not produce ordinary flipper driver pulses. A disconnected controller
causes transient contacts and energized mechanisms to release; it does not
silently fall back to standalone rules. Reconnect restores stable state and
lamp/driver baselines before new events are accepted.
## Build and run
The deterministic build regenerates the registered playfield, procedural
models, and audio; generates unpacked source; assembles and imports VBS with
`vpxtool`; verifies and round-trip extracts the compound file; compares the
script; and runs the rebuild validator:
```sh
emulation/vpx-rebuild/build.sh
``` ```
`emulation/vpx/qa/layout-overlay.png` places the actual buffered collision Run the table without QEMU for a physics/rendering check:
polygons, their source centerlines, ramp
centerlines, switches, lamps, and coils over the locator.
`emulation/vpx/qa/photo-geometry-overlay.png` applies the same trace to the
registered overhead photograph. The generator retains review tolerances of 4
source pixels for lamp centers, 8 pixels for switch/coil markers, and 6 pixels
for major wall/ramp edges unless explicitly marked approximate.
## Implemented geometry ```sh
emulation/vpx-rebuild/run-standalone.sh
```
`emulation/vpx/layout.json` is the versioned manifest. Its records carry a Run the native QEMU/VPX cabinet path:
stable VPX name, coordinates, evidence page, confidence, dimension provenance,
and Z profile where applicable. The current lower and main playfield includes:
- separate center, left-outlane, and right-outlane drains with open apron ```sh
mouths, registered outlane switches, return guides, inlanes, and a contained emulation/scripts/run-playable-macos.sh
shooter lane; ```
- 13 continuous rail paths, 18 posts, 4 rubber guides, 2 slingshots,
2 flippers, 2 pop bumpers, the apron, drain area, and trough proxy;
- 7 ball paths: jump ramp, left clear return, Pikachu ramp, Poke Ball ramp,
main four-wire return, its attached elevated side branch, and shooter-lane
guide, plus the left and right orbits;
- 20 target areas covering BATTLE, Team Rocket, Berry, Psyduck, lower banks,
arena, spinner, and captive/Newton-ball positions;
- Town right-eject VUK, Poke Ball hold, closed captive-ball enclosure with a
retained ball, three one-way gates, and two functional ramp posts; and
- low, noncollidable envelopes for Meowth, Pikachu, Poke Ball, and the Town
billboard, plus reusable detailed meshes for 18 guide posts and 2 pop-bumper
caps. Mesh appearance is separated from native VPX collision bodies.
The first lower-playfield pass had two confirmed defects: apron walls closed The default controls are left/right Shift for flippers, Return for
the outlane drain mouths, and the right guide post pinched a standard VPX ball plunger/action, `1` for Start, `5` for coin, and the configured VPX nudge keys.
against the shooter wall. The current geometry leaves both drain mouths open The QEMU window relays the same cabinet and service controls through the
and places the right post on the inner guide with verified ball clearance. hardware contract.
The first served-ball pass also left the ball locked in the enabled ## Validation record and remaining acceptance
`BallRelease` cup, so a moving plunger could not affect it. The current script
disables that capture cup immediately after release, the served ball seats 20
VPX units ahead of the resting plunger face, and the shooter guide is a
noncollidable visual guide over the playfield rather than an artificial ramp
surface. The containing shooter walls extend behind the full plunger stroke.
The next shooter pass found two additional confirmed faults. First, the The following claims have different evidence boundaries and must not be
33-source-pixel shooter channel and thick collision walls left only a few VPX collapsed into one "playable" result:
units of side clearance around a 50-unit ball, causing severe rail scrub.
Second, the right wire-ramp side part was incorrectly modeled as a second
playfield-level return. Its low duplicate landing crossed the shooter path at
approximately source y=700. Manual page 41 identifies parts `515-1094-00` and
`515-1094-01` as the main and attached side wire ramps. The side geometry now
merges into the elevated main return at source `(382,530)`, the shooter channel
retains at least 18 VPX units of validated free-running clearance, and a
full-pull plunger speed of 150 reaches the main-playfield checkpoint. The live
trace reached VPX y=1321.1 and logged `plunger launch entered main playfield`.
The base collision layer was then rebuilt rather than patched. The old | Layer | Current evidence | What it does not prove |
generator emitted one closed rectangle for every centerline segment, yielding | --- | --- | --- |
39 independent wall objects with overlapping square ends and internal contact | Hardware contract | `python3 emulation/playfield-contract/validate_contract.py --json` passes schema, counts, routes, evidence, consumer loading, and generated-header parity. | Live bridge traffic, rendered lamps, mechanism motion, or gameplay. |
faces at bends. The replacement buffers each complete centerline into one | Generated table | `emulation/vpx-rebuild/build.sh` passes audio validation, `vpxtool verify`, exact VBS round-trip comparison, contract/object checks, collision/clearance checks, lamp routes, and the no-ball-teleport rule; details are in `qa/rebuild-validation.json`. | Real-machine dimensions, every shot trajectory, long-session behavior, or QEMU rules progression. |
rounded polygon. Connected evidence paths were consolidated before buffering: | VPX runtime load | `emulation/vpx-rebuild/qa/runtime-smoke.log` records a bounded VPX 10.8.1 `CaptureAttract` pass on the exact current table SHA-256 `ddce5d48033ee3c6e67248910a73897293e8b9c36eee29df164160a93572a30e`: table/VBS load, script compile/start, Metal initialization, two captured frames, clean close, and exit code 0. | Interactive ball/shot coverage, audible-output quality, or every mechanism sequence. |
five cabinet/back pieces became one U-shaped perimeter, the shooter sides and | Integrated cabinet | The 2026-07-20 native run reached `Playable cabinet connected` with QEMU authoritative, VPX physics synchronized, 392 lamp updates, 7 LED frames, 1 driver pulse, stable captive contacts, and QEMU-keyboard coin/Start press-release records. Shutdown left the bridge disconnected and the QEMU monitor stopped. Plugin/netbridge suites also cover reconnect baselines and ordered delivery. | A complete normal game, multiball, every mechanism/shot, or long-session performance. |
stop became one U-channel, and the Town VUK back/right walls became one L-shaped | Physical accuracy | Official locator/manual/photo registration supports edition, identities, and top-down placement. | Measured ramp Z, clearances, coil forces, friction/restitution, toy travel, or production-hardware timing. |
perimeter. Runtime collision walls are invisible and visual rails are separate,
non-colliding copies. `qa/collision-topology.json` records polygon vertex count,
winding, area, and intersection count; `qa/collision-validation.json` enforces
13 collision objects, 13 visual objects, zero old segment objects, and zero
self-intersections. Live plunger and mechanism tests passed after this rebuild.
## Construction layers and mechanical assets The next acceptance gate is a complete normal game on this final build,
including trough serve, launch, scoring shots, retained-ball mechanisms,
drain/next ball, and game over, followed by restart/inventory checks. A
multiball sequence, every full ramp/orbit trajectory,
60-minute soak, frame-time percentiles, and direct comparison with a physical
Pokemon Pro remain open. In particular, Meowth crank motion and Pikachu post
travel are evidence-backed simulations whose production-hardware direction,
stroke, and timing still need direct confirmation.
`emulation/vpx/layer-map.json` defines 16 stable editor layers: base playfield, The official photograph, Pokemon/Stern character imagery, service manual, and
cabinet/apron, hidden collision rails, visual guides, mounted hardware, targets, plastics/proxies, assembled private-use table are assessment artifacts. Do not publish them
flat ramps, wireforms, toys/models, switches/sensors, feature lamps, without the relevant rights. The procedural mechanical audio is CC0, but that
GI/flashers, coil markers, script controllers, and QA. Collision, electrical, does not make the complete table redistributable.
script, and QA layers are hidden by default. This separates construction level from
electrical/debug overlays without changing runtime names.
The Pinball Makers Files Section was reviewed as a source of comparable
mechanical references. It warns that community files are untested. Three
original private-development references are preserved under
`emulation/vpx/assets/cad-reference/`: star post `PL-00172-OT`, faceted post
`C-11561-20`, and WPC pop-bumper assembly `B-9414`. Because the files are
SolidWorks documents and no reliable local SolidWorks importer is available,
the embedded OBJ assets are new Blender reconstructions rather than converted
upstream geometry. Hashes, source URL, and the CC BY-NC-SA/noncommercial
boundary are recorded in `emulation/vpx/assets/README.md`.
The hardware layer retains 45 playfield switches, 11 mechanism/trough sensors,
13 coil locations, and 113 physical lamps: 73 feature inserts, 10 flashers,
and 30 GI bulbs. SPIKE addresses remain attached to stable names such as
`sw_right_eject`, `sw_left_ramp_enter`, and `lamp_battle_b_lamp`. The controller
plugin mapping is generated directly from these manifest records.
Five local extracted images are embedded as noncolliding Pikachu, Meowth,
Psyduck, Eevee, and Poké Ball decals on replaceable proxy toys/plastics. The
registered overhead photograph remains the playfield texture. These images,
the photograph, reference manual, and game content are private-use evidence
and must be excluded from a redistributable VPX package.
## Standalone and integrated behavior
The table-side VBS is self-contained. `1` starts or serves, left/right Shift
operate the flippers, holding Return pulls the plunger, releasing Return fires
it, and Escape exits. Pops and
slings use VPX physics; switch hits are logged and pulse corresponding lamps;
ramp posts operate; Town and Poke Ball kickers capture and eject; the captive
ball is loaded at initialization; and all three drains destroy and re-serve a
test ball. A watchdog also recovers a play ball lost outside a legal drain.
In `spike3`, all physical switch make/break states and debounced contacts go to
the pinned native controller plugin. QEMU is authoritative for every lamp and
driver action. Flippers, slings, pops, ejects, trough release, auto-launch,
posts, gate, and Meowth therefore do not animate speculatively. If the plugin
or bridge is absent, the table de-energizes mechanisms and does not silently
fall back. Standalone remains independent and explicitly selectable.
`qa-spike3` waits for synchronization and a short game-settle period, sends
coin and Start, samples 32 alternating left/right press-release cycles through
the real QEMU driver path, then sends action. Six-field driver records preserve
both server-output-to-VPX and matching input-to-VPX drain latency.
## Confidence boundary and next work
Top-down placement and hardware marker counts are evidence-backed. Ramp
heights, clearances, and several hidden collision envelopes are still labeled
as comparable-Stern estimates; no art, script, model, or game-specific
geometry was copied from the comparison table.
The assembled file, initialization, manual-plunger launch onto the main
playfield, all three drains, both outlane switch/drain paths, Town VUK, Poké
Ball hold, captive-ball load, QEMU-authoritative sling release, mapped
mechanism actions, private playfield texture, and short inventory soak are
live-tested in VPX. A combined QEMU+VPX run is separately required to prove the
genuine game's progression and timing.
Full physical traversal of every elevated ramp/orbit, the 60-minute soak,
normal three-ball completion, multiball, and direct physical Z/force
measurement remain follow-up acceptance. The current mechanical meshes are
comparable parts and decal-backed proxies, not measured Pokémon-specific
assemblies. QEMU supplies scoring, display, speech, music, and game effects;
VPX supplies only table physics and mechanical sounds.