Readout §02: real decoded DMA list + embedded-float payload finding

§02 now shows the actual per-region DMA command list captured from the emulator
(region 0x0801fa40: SEND/SENDE/TXDN/TILE/GOTO) and the real SENDE payload with
its embedded float coefficients (bit-serial MEMpluseqMEM sweep). §05 + the
last-mile list updated: the micro-code is partly decoded (lists clean, payloads
carry recoverable floats), remaining work is the control-word field split.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

emulator/firmware-decomp/render-readout.html

@@ -228,35 +228,38 @@
   <section>
     <h2><span class="idx">02</span> The output, decoded</h2>
     <p class="sub">The firmware DMAs the render to the card as an opcode stream
-    (<span class="mono">DMAENGN.H</span>). Left: a real per-region command list captured
-    from the emulator. Right: where each SEND lands — bit-serial IGC micro-code, not
-    plain floats, which is why final pixels need the array simulator.</p>
+    (<span class="mono">DMAENGN.H</span>). Both panels below are captured verbatim from the
+    emulator. Left: a real per-region command list — every region references the same
+    tile-relative payloads and differs only in its <span class="mono">TILE</span> id and the
+    <span class="mono">GOTO</span> link. Right: inside a SEND — the payload isn't opaque, it
+    interleaves control words with the actual <b>float coefficients</b>, swept bit-plane by
+    bit-plane into pixel memory.</p>
     <div class="cols">
       <div class="term">
         <div class="bar"><span class="d g"></span><span class="d"></span><span class="d"></span>
-          &nbsp;region 0x0801f000 · DMA list</div>
+          &nbsp;region 0x0801fa40 · DMA list</div>
 <pre><span class="cm"># addr            opcode</span>
-<span class="ad">0x08015800</span>  <span class="op">SEND</span>(4)      <span class="cm">; edge coeffs</span>
+<span class="ad">0x08015000</span>  <span class="op">SEND</span>(4)      <span class="cm">; edge coeffs</span>
 <span class="ad">0x00000000</span>  <span class="am">FLUSH</span>
-<span class="ad">0x08015820</span>  <span class="op">SENDE</span>(0x35)  <span class="cm">; z / colour</span>
-<span class="ad">0x080159e0</span>  <span class="op">SEND</span>(0x18)
-<span class="ad">0x08015aa0</span>  <span class="op">SEND</span>(6)
+<span class="ad">0x08015020</span>  <span class="op">SENDE</span>(0x45)  <span class="cm">; z / colour</span>
 <span class="ad">0x00000000</span>  <span class="am">FLUSH</span>
-<span class="ad">0x08015ae0</span>  <span class="op">SENDE</span>(0x5c)
-<span class="ad">0x08015dc0</span>  <span class="op">SEND</span>(9)      <span class="cm">; …binned per 64×128 tile</span></pre>
+<span class="ad">0x08014100</span>  <span class="op">TXDN</span>
+<span class="ad">0x08015260</span>  <span class="op">SEND</span>(0x21)
+<span class="ad">0x08015380</span>  <span class="op">SEND</span>(0x29)
+<span class="ad">0x00000020</span>  <span class="am">TILE</span>     <span class="cm">; tile id</span>
+<span class="ad">0x0801f008</span>  <span class="am">GOTO</span>     <span class="cm">; → next region</span></pre>
       </div>
       <div class="term">
         <div class="bar"><span class="d g"></span><span class="d"></span><span class="d"></span>
-          &nbsp;SEND target 0x0801f100 · IGC micro-code</div>
-<pre><span class="cm"># bit-serial Pixel-Planes program</span>
+          &nbsp;SENDE target 0x08015020 · payload</div>
+<pre><span class="cm"># bit-serial sweep (MEMpluseqMEM)</span>
 +000  <span class="ad">00000100</span>   <span class="cm">; header</span>
-+008  <span class="am">46800000</span>   <span class="cm">; 16384.0 scale</span>
-+01c  <span class="op">0610ff00</span>  <span class="ad">00401000</span>
-+024  <span class="op">0610ff08</span>  <span class="ad">00401081</span>
-+02c  <span class="op">0610ff10</span>  <span class="ad">00401102</span>
-+034  <span class="op">0610ff18</span>  <span class="ad">00401183</span>
-      <span class="cm">; MEM += MEM, bit-serial</span>
-      <span class="cm">; eval Ax+By+C across the tile</span></pre>
++004  <span class="op">3a804834</span>   <span class="cm">; = 9.79e-4  float</span>
++008  <span class="ad">8401213a</span>
++00c  <span class="ad">00000021</span>   <span class="cm">; bit-plane 0x21</span>
++010  <span class="op">ba01253a</span>   <span class="cm">; = −4.93e-4  += A</span>
++018  <span class="ad">8381213a</span>
++01c  <span class="ad">00000022</span>   <span class="cm">; bit-plane 0x22 …</span></pre>
       </div>
     </div>
   </section>
@@ -331,10 +334,13 @@
         </ul>
       </div>
     </div>
-    <p class="sub" style="margin-top:16px">What this is <b>not</b>, yet: a decode of the compiled
-    <b>bit-serial micro-code</b> the DMA actually ships (§02, right). That binary encoding is still
-    undecoded, and it is how the ground and sky — which carry no stored vertices — reach the array.
-    This is the array's <b>computational</b> model: the pixels that micro-code would produce.</p>
+    <p class="sub" style="margin-top:16px">What this is <b>not</b>, yet: execution of the compiled
+    <b>micro-code</b> the DMA actually ships (§02, right) — the form the ground and sky take, since
+    they carry no stored vertices. That stream is now partly decoded: the per-region command lists
+    read cleanly, and the SEND payloads turn out to carry the real <b>float coefficients</b>
+    interleaved with a regular bit-serial sweep — so what remains is pinning the control-word fields
+    and running that sweep, not reversing an opaque binary. This section is the array's
+    <b>computational</b> model: the pixels that micro-code produces.</p>
   </section>
 
   <section>
@@ -369,10 +375,10 @@
       <div>
         <h3>The last mile to pixels</h3>
         <ul class="todo">
-          <li>The array's <b>computational model</b> runs and matches the reference — the piece left is the board's own <b>compiled micro-code</b></li>
-          <li>The DMA's SEND payloads are <b>bit-serial Pixel-Planes micro-code</b>; that binary encoding is still undecoded</li>
-          <li>It is how the <b>ground and sky</b> — which carry no stored vertices — reach the array</li>
-          <li>Cross-referencing the <span class="mono">0x0610ff / 0x00401</span> words against <span class="mono">IGCOPS.C</span> + the PXPL5 assembler is the next decode</li>
+          <li>The array's <b>computational model</b> runs and matches the reference — the piece left is executing the board's own <b>compiled micro-code</b></li>
+          <li>The per-region <b>DMA command lists decode cleanly</b> (§02) — SEND / SENDE / TXDN / TILE / GOTO, tile-relative</li>
+          <li>The SEND payloads carry <b>real float coefficients</b> in a regular bit-serial sweep — recoverable, not opaque</li>
+          <li>What's left: pin the control-word fields, run the sweep per tile → the <b>ground and sky</b> that carry no stored vertices</li>
         </ul>
       </div>
     </div>