Decode the IGC DMA lists + find embedded float coeffs in SEND payloads

The coefficient-copy (0xf0411cd4) writes per-region DMA command lists; captured
from the cap7 death-cam they decode cleanly against DMAENGN.H ({addr,opcode}
pairs, SEND/SENDE/TXDN/TILE/GOTO/FLUSH). Every region references the same
tile-relative payloads and differs only in TILE(id) + the GOTO link.

Dumping the SEND payloads shows they are NOT opaque: they interleave control
words with embedded IEEE floats = the edge/plane/colour coefficients, loaded as
a bit-serial MEMpluseqMEM sweep (regular 4-word instruction: increment float +
length/bit-address control + dest plane). So the micro-code decode is now
extraction + bit-serial execution, not blind ISA reversing -- the remaining
blocker is the control-word field split (igc_opco.h is not in the dump).

Full findings + next steps in MICROCODE-DECODE-NOTES.md; probes coefdump.py
(DMA lists) + payload_dump.py (payload floats), restore from snapv2.pkl.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

emulator/firmware-decomp/coefdump.py

@@ -0,0 +1,58 @@
+"""Dump what the coefficient-copy (0xf0411cd4, fst.d f16) writes into the region queues
+during the death-cam draw. If the payload is recognisable float coefficients (edge/plane
+A,B,C in a sane range) we can reconstruct terrain triangles WITHOUT decoding micro-code.
+If it's integer micro-code words, that confirms the hard path."""
+import sys, time, struct, pickle
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+
+COPY = 0xf0411cd4          # fst.d f16, per session 6e: coefficient/command copy
+writes = []
+orig_w32 = emu860.Mem.w32
+def w32(self, addr, val):
+    if cpu.pc == COPY:
+        writes.append((addr & 0xffffffff, val & 0xffffffff))
+    return orig_w32(self, addr, val)
+emu860.Mem.w32 = w32
+
+t0 = time.time()
+target = r.qi + 1
+while time.time() - t0 < 90:
+    if len(writes) >= 400:
+        break
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+emu860.Mem.w32 = orig_w32
+
+print("captured %d word-writes at the coefficient copy" % len(writes))
+# group into 8-byte doubles (fst.d = two 32-bit stores, addr and addr+4)
+i = 0; n = 0
+while i < len(writes) - 1 and n < 60:
+    a0, w0 = writes[i]; a1, w1 = writes[i + 1]
+    if a1 == a0 + 4:
+        dv = struct.unpack('<d', struct.pack('<II', w0, w1))[0]
+        f0 = struct.unpack('<f', struct.pack('<I', w0))[0]
+        f1 = struct.unpack('<f', struct.pack('<I', w1))[0]
+        note = ""
+        if -1e8 < dv < 1e8 and (abs(dv) > 1e-9 or w0 == 0):
+            note = "dbl=%.5g" % dv
+        print("  @%08x: %08x %08x   %-16s  f=(%.4g, %.4g)" % (a0, w0, w1, note, f0, f1))
+        i += 2; n += 1
+    else:
+        print("  @%08x: %08x (single)" % (a0, w0))
+        i += 1; n += 1