Decode the SENDE (z/color) micro-code instruction format

Full SENDE dump (ctrl_split.py) resolves into a regular 4-word instruction, one
per bit-plane: word0 = constant increment float, word1 = [length countdown,
source bit-addr] with op field 0x3a, word2 = the coefficient's place-value (the
x2 chain, -1.009..-0.00788), word3 = destination bit-plane (0x21..0x31 = a
17-bit fixed-point z/color). A MEMpluseqMEM bit-serial accumulation. SEND edge
payloads use the same value encoding with a different (header + 3-word group)
framing. Control-word split for the z/color path is now decoded; from-scratch
render still needs numeric reconstruction + plane mapping + the C term.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

emulator/firmware-decomp/ctrl_split.py

@@ -0,0 +1,48 @@
+"""Dump the full SENDE (z/color) payload with each word broken into byte fields, and
+try to identify the instruction unit: float increment, op, src/dst bit-address, length.
+Goal = the control-word field split for the z/color sweep."""
+import sys, time, struct, pickle
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+t0 = time.time(); startq = r.qi
+while time.time() - t0 < 60:
+    if r.qi >= startq + 2: break
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+def rw(a): return cpu.mem.r32(a & 0xffffffff)
+def asf(w): return struct.unpack('<f', struct.pack('<I', w))[0]
+
+def isfloat(w):
+    f = asf(w); e = (w >> 23) & 0xff
+    return (1e-6 < abs(f) < 1e6) and (1 < e < 254)
+
+for base, n, tag in [(0x08015020, 0x45, 'SENDE z/color'), (0x08015260, 0x21, 'SEND 0x21'),
+                     (0x08015380, 0x29, 'SEND 0x29'), (0x08015000, 4, 'SEND(4) edge')]:
+    print("\n===== %s @ %#010x (%d words) =====" % (tag, base, n))
+    print(" off  word       b3 b2 b1 b0   interpretation")
+    for i in range(n):
+        w = rw(base + i * 4)
+        b = [(w >> 24) & 0xff, (w >> 16) & 0xff, (w >> 8) & 0xff, w & 0xff]
+        note = ""
+        if isfloat(w):
+            note = "FLOAT %.6g" % asf(w)
+        elif w == 0x00000100:
+            note = "<header>"
+        elif w < 0x100:
+            note = "addr/int %d (0x%x)" % (w, w)
+        print("  +%03x %08x  %02x %02x %02x %02x   %s" % (i * 4, w, b[0], b[1], b[2], b[3], note))