Map the full-frame micro-code structure: double-buffered primitives

frame_primitives.py decodes every coeff-copy word over the draw: 1051 SEND,
334 SENDE, 384 TILE, 327 GOTO, 231 STOP across 105 tiles -- but only 2 distinct
SEND payload addresses (0x08015xxx/0x08017xxx). That's double-buffering: the
firmware compiles each primitive into an alternating coeff block and SENDs it,
so the content changes over time while the addresses don't. A from-scratch full
frame must snapshot each primitive's payload at its SEND, then run all of them.
Readout §05 + notes updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md

@@ -155,6 +155,23 @@ the float list. SEND(0x29) is a long single-coefficient sweep (`-0.0626` repeate
 piece for edge reconstruction: A/B slope (float, verified 0.2%) + C (fixed-point
 coord). Remaining is pairing them per triangle + all-regions assembly.
 
+## Full-frame structure: double-buffered primitives across 105 tiles
+
+`scratchpad/frame_primitives.py` captures every coefficient-copy word over the
+draw and decodes the opcode mix: **1051 SEND, 334 SENDE, 384 TILE, 327 GOTO,
+231 STOP** over 105 distinct TILE ids. But only **two** distinct SEND payload
+addresses appear (0x08015xxx and 0x08017xxx), each with the identical 4/69/33/41
+size profile. That is **double-buffering**: the firmware compiles one primitive's
+micro-code into block A, SENDs it to every tile it covers, compiles the next
+primitive into block B, SENDs that, and reuses A for the third — so the *content*
+at those two addresses changes over time while the addresses don't.
+
+Consequence for a from-scratch full frame: enumerating payload *addresses* is not
+enough (only 2). Each primitive must be captured **at the moment its SEND fires**
+(hook the SEND, snapshot the payload before the buffer is overwritten), then all
+of them run tile-by-tile through `igc_array.py`. The frame is many primitives, not
+two — object + terrain, z-buffered across ~105 tiles.
+
 ## What this changes
 
 The micro-code decode is now **extraction + bit-serial execution**, not blind

emulator/firmware-decomp/frame_primitives.py

@@ -0,0 +1,66 @@
+"""Enumerate the death-cam frame's primitives: capture every DMA-list word written by
+the coefficient-copy (0xf0411cd4) across the whole draw, decode {addr,opcode} pairs,
+and collect the distinct SEND/SENDE payload addresses = distinct primitives. Tells us
+how many pieces (object + terrain + sky) a from-scratch full frame must render."""
+import sys, time, struct, pickle
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+
+COPY = 0xf0411cd4
+pairs = []                       # (addr_word, opcode_word) consecutive
+buf = []
+orig = emu860.Mem.w32
+def w32(self, addr, val):
+    if cpu.pc == COPY:
+        buf.append(val & 0xffffffff)
+    return orig(self, addr, val)
+emu860.Mem.w32 = w32
+
+t0 = time.time(); startq = r.qi; seen_copy = False
+while time.time() - t0 < 150:
+    if len(buf) >= 8000: break
+    # stop shortly after the copy activity ends (draw done)
+    if seen_copy and len(buf) and cpu.pc != COPY and (time.time() - t0) > 8 and len(buf) % 2 == 0:
+        pass
+    if len(buf): seen_copy = True
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+emu860.Mem.w32 = orig
+print("(ran to cmd %d)" % r.qi)
+
+OPS = {0x1: 'SEND', 0x9: 'SENDE', 0x2: 'TILE', 0x3: 'TXDN', 0x6: 'FLUSH',
+       0x0: 'GOTO', 0xf: 'STOP', 0x8: 'WAIT', 0x7: 'RETE'}
+sends = {}       # payload addr -> set of sizes
+op_counts = {}
+tiles = set()
+for i in range(0, len(buf) - 1, 2):
+    a, op = buf[i], buf[i + 1]
+    code = (op >> 28) & 0xf
+    name = OPS.get(code, '?%x' % code)
+    op_counts[name] = op_counts.get(name, 0) + 1
+    if name in ('SEND', 'SENDE'):
+        sends.setdefault(a, set()).add(op & 0x7f)
+    if name == 'TILE':
+        tiles.add(a)
+
+print("coeff-copy words captured: %d  (%d pairs)" % (len(buf), len(buf) // 2))
+print("opcode counts:", op_counts)
+print("\ndistinct SEND/SENDE payload addresses (= primitives' coeff blocks): %d" % len(sends))
+for a in sorted(sends):
+    print("  %#010x  sizes=%s" % (a, sorted(sends[a])))
+print("\ndistinct TILE ids referenced: %d  ->" % len(tiles), sorted(hex(t) for t in tiles)[:24])

emulator/firmware-decomp/render-readout.html

@@ -354,8 +354,10 @@
     carry no stored vertices. But that stream is now largely decoded: the command lists read cleanly,
     the <span class="mono">SENDE</span> z-sweep resolves into a regular 4-word instruction, and its
     coefficients are the same ones driving this depth buffer — the array's inputs are
-    <b>cross-validated against the hardware's own compiled stream</b>. What remains is numeric
-    reconstruction across every region, not reversing an opaque binary.</p>
+    <b>cross-validated against the hardware's own compiled stream</b>. The full frame, we now know,
+    cycles its primitives through <b>two double-buffered coefficient blocks</b> — 1051 SENDs, 384
+    TILE ops across <b>105 tiles</b> — so what remains is capturing each primitive as its SEND fires
+    and running them all, not reversing an opaque binary.</p>
   </section>
 
   <section>