S1a

The division of labour is strict. S1 remains the untouched golden engine — fastest, bit-exact, the reference every experiment is measured against. S1a is a full fork (src/AprVisual.S1A/) that trades speed for principled physics, on purpose. Every mechanism lands behind its own switch, and every step is validated against three anchors: the golden checksum, the 141-test AccuracyCoin suite, and the 147-ROM regression.

分工是嚴格的。S1 保持不動,仍是黃金引擎 —— 最快、bit-exact、所有實驗的參考基準。S1a 是完整分支(src/AprVisual.S1A/),刻意用速度換有原理的物理。每個機制都躲在自己的開關後面,每一步都對三個錨驗證:金 checksum、141 顆 AccuracyCoin、147 顆回歸。

Staged, always verified. This is deliberately long-running work, not a big bang. The ritual per package: analysis script → article → (on the user's go) S1A engine mechanism → retire the shim → full gates every single time: golden checksum with the mechanism off, AC 141/141 + the 147-ROM regression with it on. A shim removed without verification didn't happen. Working ledger: MD/S1a/02_解析工具箱_網站專文_shim退役_長期TODOLIST.md.

分段走,步步驗證。這是刻意的長線工作,不是大爆炸。每組工作包的節奏:解析程式 → 專文 →(使用者發令後)S1A 引擎機制 → 拔 shim → 每一次都過完整驗證閘:機制關 = 金 checksum 不變;機制開 = AC 141/141 + 147 回歸不退步。拔了 shim 沒驗證 = 沒發生。工作總帳:MD/S1a/02_解析工具箱_網站專文_shim退役_長期TODOLIST.md。

RETIRED mechanism replaces it, three-arm verified (shim PASS / no-shim FAIL / mechanism PASS).機制取代,三段論證(shim PASS / 拔 shim FAIL / 機制 PASS)。

PROVEN mechanism proven able to replace it (three-arm passes); default-flip pending the broad 141/147 regression.機制已證明可取代(三段論過);預設翻轉待 141/147 廣回歸。

UNDECIDABLE the mechanism expresses it, but no isolated test discriminates (the control passes without the shim) — retirement needs in-suite evidence.機制能表達,但沒有孤立測試能鑑別(對照組拔 shim 也過)—— 退役需套內證據。

CEILING a structural boundary no on-die mechanism can reach; the shim stays, and the reason is documented.晶粒內機制碰不到的結構邊界;shim 留住,理由記錄在案。

ACTIVE still a shim; its mechanism is designed but not yet built or verified.仍是 shim;機制已設計但尚未實作或驗證。

Two special-case fates, outside the retirement pipeline (see Special cases): CALIBRATED the mechanism is already live and in-suite proven — one empirically-tuned constant remains to derive rather than tune; INTRINSIC not a function of the netlist (an initial condition / external stimulus), so no computed mechanism applies — M7 makes it deterministic but cannot supply the value.兩個特殊個案下場,在退役流水線之外(見特殊個案):CALIBRATED 機制已運作、套內已證 —— 只剩一個經驗校準值待「從調變成算」;INTRINSIC 不是網表的函數(初始條件/外部激勵),沒有可計算的機制適用 —— M7 讓它決定論化,但供不出值。

PowerUpState · reset-hold  not a function of the netlist不是網表的函數

A node's power-up value depends on threshold mismatch, parasitic capacitance and the supply ramp — analog and manufacturing-variable. Structure can't give it; physical params give only relative strengths, not the random settling. The real chip itself powers up differently each time (hence the inherently-indeterminate power_up_palette test), and reset-hold is the board's external RESET timing, not a chip-internal property. M7 makes the boot deterministic (it ends the ordering lottery) but does not compute the values — these are an initial condition / external stimulus. The reachable part (2026-07-20 consult): the CPU/PPU divider phase is a verifiable coin-flip — trace the reset pad's fan-out and no gate path reaches the clock-divider latches, so the alignment is simply whatever it powered up as; and a Monte-Carlo initialization (randomize the symmetric cross-coupled loops, settle to quiescence) bounds the physically-reachable power-up set — moving it from "assumed" to "characterized".

節點的開機值取決於閾值失配、寄生電容、電源上升 —— 類比且製程變異。結構給不出;物理參數只給相對強弱、不給隨機沉澱。真晶片自己每次開機都不同(所以有本質不定的 power_up_palette 測試),而 reset-hold 是板子的外部 RESET 時序、不是晶片內部性質。M7 讓開機決定論化(終結排序抽籤)但不算出值 —— 這是初始條件/外部激勵。可達的部分(2026-07-20 諮詢):CPU/PPU divider 相位是可驗證的 coin-flip —— trace reset pad 的 fan-out,沒有閘路徑到 clock-divider latch,所以相位就是開機當下的樣子;而 Monte-Carlo 初始化(把對稱交叉耦合環隨機灌值、settle 到 quiescent)可界定物理可達的開機態集合 —— 把它從「假設」升成「界定」。

OpenBus (last byte)  off-die — a data gap晶粒外 —— 資料缺口

The last byte is held by the parasitic capacitance of the package + board data bus — a node on neither die, absent from our segdefs geometry. Every on-die mechanism (M2 charge, the full M4 latch stack, M3 delay) was tried and failed to reach it. The physical quantity is real but lives outside the netlists we have; it belongs to a board-level bus model (M5e's charter). A documented ceiling — the correct boundary between what the silicon graph knows and what only the board does. Yet the decay is grounded (2026-07-20 consult): a first-principles estimate — C ≈ 20 pF (die pad + DIP40 lead + PCB trace + cart edge + ROM input) discharging through ~100 pA of reverse leakage, C·ΔV/I ≈ 700 ms — lands almost exactly on the empirical ~600 ms M2 decay, confirming behavioral replay as the right abstraction, not a fudge.

last byte 由封裝 + 板子資料匯流排的寄生電容保持 —— 一個不在任何一顆晶粒、我們 segdefs 幾何裡沒有的節點。每個晶粒內機制(M2 電荷、M4 閂鎖全堆疊、M3 延遲)都試過、都碰不到。物理量真實存在,但在我們手上的網表之外;它屬於板級匯流排模型(M5e 立案)。是記錄在案的天花板 —— 「矽電路圖知道的」與「只有主機板知道的」之間正確的邊界。但衰減是有依據的(2026-07-20 諮詢):第一性原理估算 —— C ≈ 20pF(die pad + DIP40 lead + PCB 走線 + 卡帶邊 + ROM 輸入)經 ~100pA 反向漏電放電,C·ΔV/I ≈ 700ms —— 幾乎正中經驗的 ~600ms M2 衰減,證明 behavioral replay 是對的抽象、不是唬弄。

DL (input data latch)  mechanizable, but architectural可機制化,但架構級

DL's glitch is not a property of the chip — the real latch's analog inertia has no glitch. It is a discrete-settle artifact (a node-id ordering lottery, same family as DMC/LAE). Structure does see it (M4 classifies idl as transparent) and physics says the chip is correct; the fix is to stop the simulation producing the artifact — and it has a name (2026-07-20 consult): inertial-delay filtering. The sound general form is a two-phase / delta-cycle settle: evaluate a wave, commit repeatedly to quiescence, then let the latch see its input. That changes the core solver semantics, so it is a hot-path performance and S1A trace/checksum re-baselining project. The cheap localized form is a settle guard — defer just that latch until its input group is stable — which is exactly what the current shim approximates, so it is a standard event-sim technique, not an ad-hoc patch. M7 is complementary, not an alternative: it removes arbitrary id-order variance, but cannot supply inertia or establish which deterministic result matches silicon. Strength-prioritized contention (M1) may even dissolve the transient at the root. It stays a scoped shim as a cost decision, pending the general guard. Not a wall — a bill.

DL 的毛刺不是晶片的性質 —— 真閂鎖的類比慣性沒有毛刺。它是離散 settle 的假象(node-id 排序抽籤，跟 DMC/LAE 同家族)。結構看得到(M4 把 idl 分類成 transparent)、物理上晶片是對的；修法是讓模擬別產生這個假象 —— 而它有個正式名字(2026-07-20 諮詢):inertial-delay filtering(慣性延遲濾波)。可靠的通式是兩階段 / delta-cycle settle：先 evaluate 一波、反覆 commit 到 quiescent，再讓閂鎖看見輸入。這會改核心 solver 語意，因此是熱路徑效能與 S1A trace/checksum 重定基準工程。便宜的局部版是 settle guard —— 只把那顆 latch 延到它的輸入群穩定才取值 —— 這正是現行 shim 在做的，所以它是標準事件模擬技術、不是臨時補丁。M7 是互補項，不是替代方案：它移除任意的 id-order 差異，但不能提供慣性，也不能判定哪個固定結果符合硬體。按驅動強度優先的 contention(M1)甚至可能從根拔掉暫態。目前先當 scoped shim，是成本判斷，等通式 guard。不是牆，是帳單。

ALERead mux  computation-guided calibration計算引導的校準

Here the structure is fully present — the 74LS373 octal latch is real switch-level (M5, 82 transistors), the AD-bus node-split is principled. Only the phase timing MUX_HC=13,13,25,44,52 is empirically calibrated. Elmore delay (M3, composed with the '373 in M5) can validate and anchor those five values — as it did for dot-339 ("0.45% of nets can do 16/18") — but the sharper result is a decomposition (worked example below): only two of the five are physical, one is the phase error itself, and two are architectural — so it is far less "calibrated" than it looks. Required for 141/141; kept opt-in (ALEREAD_MUX) because the node-split is a load-time graph change. The least special of the four — essentially solved, one calibration left to derive rather than tune.

這裡結構完全在 —— 74LS373 八位元閂鎖是真開關級(M5,82 顆電晶體)、AD 匯流排 node-split 有原理。只有相位時序 MUX_HC=13,13,25,44,52 是經驗校準。Elmore 延遲(M3,與 M5 的 '373 合成)能驗證與錨定那 5 個值 —— 就像 dot-339(「0.45% 的 net 做得到 16/18」)—— 把 5 個自由旋鈕壓成 M3 預測的比例 + 一個 scale,但釘不死精確 hc(Elmore ±幾十 %,而 mux 窗是引擎對淨延遲的抽象)。它是 141/141 的必需品;保持 opt-in(ALEREAD_MUX)因為 node-split 是載入期改圖。四個裡最不特殊的 —— 基本解決,只剩一個校準待「從調變成算」。

Worked example — decomposing MUX_HC (verified 2026-07-20)實作範例 —— 拆解 MUX_HC(2026-07-20 驗證)

Are the five tuned constants really irreducible? We checked. First, the engine's half-cycle is pinned from our own run data: a control run logged hc = 1,715,304,000 at simulated second 39.93 → 42.96 MHz = exactly 2× the NTSC master clock, so 1 hc = 23.28 ns (half a master cycle; 1 PPU dot = 8 hc, 1 CPU cycle = 24 hc = 3 dots). With that, the five values stop looking arbitrary:

那五個手調常數真的化約不了嗎?我們查了。先把引擎的半週期從我們自己的 run 資料釘死:一個對照 run 記錄到模擬第 39.93 秒時 hc = 1,715,304,000 → 42.96 MHz = 恰好 2× NTSC master clock,所以 1 hc = 23.28 ns(半個 master;1 PPU dot = 8 hc,1 CPU cycle = 24 hc = 3 dots)。有了它,那五個值就不再任意:

The physics checks out: a weak depletion pull-up (~30 kΩ) into 20 pF crosses the 2.0 V input threshold in 306 ns = 13.2 hc — the 13's are the real AD-bus rising settle (the falling edge, through a strong pull-down, is 18 ns = 0.8 hc, far too fast to be a knob). The 25 is not a delay at all — it is the documented 1-CPU-cycle / 3-dot scheduling misalignment, the very error the mux exists to correct. Only 44 and 52 are genuinely tuned: swallow/replay window extents at the µs scale, expressible as offsets from the phase error rather than derived from RC. So five hand-tuned knobs reduce to two computed-physics values, one known phase constant, and two architectural window extents — not irreducible after all.

物理對得上:弱 depletion 上拉(~30kΩ)驅動 20pF 在 306ns = 13.2 hc 穿越 2.0V 輸入閾值 —— 那兩個 13 就是 AD 匯流排真正的上升 settle(下降沿走強下拉是 18ns = 0.8 hc,快到不可能當旋鈕)。25 根本不是延遲 —— 它是有文件記載的 1 CPU cycle / 3 dot 排程錯位,正是 mux 存在要修的那個誤差。只有 44 和 52 是真的靠調:swallow/replay 窗的範圍,µs 尺度,可表示為相位誤差的 offset 而非 RC 推導。所以五個手調旋鈕化約成 兩個計算物理值、一個已知相位常數、兩個架構窗範圍 —— 終究不是不可約。

Method refined via a mixed-signal timing-expert consult (Gemini, 2026-07-20) and verified against our own run data; full transcript in MD/suggest/2026-07-20-gemini-m3-mux-hc. To fully derive rather than tune, the next step is a boundary micro-SPICE of the PPU AD pad → 20 pF board → '373 → CPU receiver, quantized to hc. → Full deep dive with the worked arithmetic and diagrams.方法經混合訊號時序專家諮詢(Gemini,2026-07-20)精煉、並對我們自己的 run 資料驗證;全文見 MD/suggest/2026-07-20-gemini-m3-mux-hc。要完全推導(而非調),下一步是 PPU AD pad → 20pF 板 → '373 → CPU receiver 的 boundary micro-SPICE,量化成 hc。→ 完整深入專文,含逐步算式與圖。

#1 · The ALERead mux — where does MUX_HC = 13,13,25,44,52 come from?ALERead mux —— MUX_HC = 13,13,25,44,52 從哪來?  2026-07-20

Five hand-tuned constants, reconstructed from first principles: the engine's half-cycle verified as 23.28 ns from its own run log; the 13 computed as a 306 ns RC rising-edge settle (weak depletion pull-up into ~20 pF); the 25 shown to be the 1-CPU-cycle / 3-dot phase error itself; the 44/52 pinned as architectural windows. Four of the five stop being magic numbers. With SVG timing + RC diagrams and every step of the arithmetic.五個手調常數,從第一性原理重建:引擎的半週期從自身 run log 驗證為 23.28 ns;13 算成 306 ns 的 RC 上升沿 settle(弱 depletion 上拉驅 ~20pF);25 證明是 1-CPU-cycle / 3-dot 相位誤差本身;44/52 釘成架構窗。五個裡四個不再是魔術數字。附 SVG 時序 + RC 圖與每一步算式。

#2 · Open bus — the capacitor nobody placedOpen bus —— 沒有人放的電容  CEILING 2026-07-20

The last byte, held on a board node that is on neither die, slowly leaking to 0 over ~600 ms. Derives the decay from first principles and shows it is linear, not RC exponential (constant-current junction leakage: t = C·ΔV / I → ~30 M hc); explains why the byte rots bit-by-bit (the per-line waterfall); gives the full lazy-timestamp implementation and refresh rule; and lays out the path from tuned to computed — with an honest floor (leakage is exponentially temperature-dependent, so there is no single true threshold). SVG diagrams of the off-die node and the per-bit decay.最後那個位元組,保持在一個不在任何一顆晶粒的板子節點上,~600ms 內緩慢漏到 0。從第一性原理推導衰減、證明它是線性、非 RC 指數(定電流 junction 漏電:t = C·ΔV / I → ~30M hc);解釋為什麼位元組一位一位地爛(逐線瀑布);給出完整懶惰時戳實作與 refresh 規則;鋪陳從調到算的路 —— 附誠實地板(漏電溫度指數相關,所以沒有單一真閾值)。附晶粒外節點與逐位元衰減的 SVG 圖。

#3 · Can the NES tell you the room temperature?NES 能告訴你室溫嗎?  SENSOR 2026-07-20

The open-bus decay from #2, run backwards: write a byte, time how long it survives, read the temperature off the decay clock — 7.2 % per °C, huge for a sensor. Covers the one non-obvious trick (you cannot poll a CPU-bus address — instruction fetches refresh it; you must read the PPU internal latch through $2002's low 5 bits); one-point calibration (the E_a slope is a law of physics, only the offset is per-console); and the fatal flaw — the PPU cooks itself +30–40 °C, so it's a die thermometer, and only a cold-boot read in the first few seconds gives the room. With the 6502 log₂ ROM, the DRAM/cold-boot-attack prior art, and an inverse calculator: feed it a decay time, it reads back the temperature.把 #2 的 open-bus 衰減倒著跑:寫一個位元組、量它活多久、從衰減時鐘讀出溫度 —— 每 °C 差 7.2%,對感測器來說很大。涵蓋那個不明顯的訣竅(你不能輪詢 CPU 匯流排位址 —— 指令抓取會刷新它;必須透過 $2002 低 5 位讀 PPU 內部閂鎖);一點校準(E_a 斜率是物理定律,只有 offset 逐台不同);以及致命缺陷 —— PPU 把自己煮熱 +30–40 °C,所以它是晶粒溫度計,只有冷開機最初幾秒的讀值才是室溫。附 6502 log₂ ROM、DRAM/cold-boot-attack 前例,和一個反向計算器:餵它衰減時間,它讀回溫度。

#4 · Running the thermometer — the AprNes tool + test ROM把溫度計跑起來 —— AprNes 工具 + test ROM  BUILT & RUN 2026-07-20

#3 on paper; this one builds it. We gave our fast reference emulator (AprNes) the open-bus decay model with a real temperature knob (--openbus-temp <°C> + --dump-mem), wrote a stock NROM test ROM that primes the PPU latch, tight-polls $2002, counts the decay, and prints 25.0 DEGREE CELSIUS — with the count→°C inversion done with no 6502 multiply/divide/float (a precomputed 0.1 °C lookup table + a 9-step power-of-two binary search + subtraction BCD, per a Gemini consult). Real frame captures at 0/25/50 °C, the round-trip table (exact 0–40 °C), and an honest limits section: warm-end resolution is measurement-limited (43 & 44 °C both read 43.5), range clamps, per-model calibration, die-vs-room. A technical validation, not a precision instrument.#3 在紙上;這篇把它做出來。我們給快速參考模擬器(AprNes)裝上 open-bus 衰減模型與真的溫度旋鈕(--openbus-temp <°C> + --dump-mem),寫了一顆原廠 NROM test ROM:給 PPU 閂鎖充電、緊輪詢 $2002、數衰減、印出 25.0 DEGREE CELSIUS —— 而 count→°C 反推完全不用 6502 乘除法/浮點(預算 0.1 °C 查表 + 9 步 2 冪次二分搜 + 連減 BCD,依 Gemini 諮詢)。附 0/25/50 °C 真實幀截圖、round-trip 表(0–40 °C 精確)、以及誠實極限:暖端解析度受量測限制(43、44 °C 都讀 43.5)、範圍 clamp、逐模型校準、晶粒 vs 室溫。技術驗證,非精密儀器。

#5 · The last mile — 2C02 pixel to picture最後一哩 —— 2C02 像素到畫面  ROADMAP 2026-07-20

A roadmap (not yet built): our switch-level 2C02 stops at palette indices, but a real NES emits an analog composite waveform a 1990 TV turns into a fuzzy, dot-crawling picture. Maps the whole missing stretch — the on-die resistor-ladder video DAC (no R-2R; Pin 21), the 12-phase encoding (6× colourburst, so dot crawl is automatic), emphasis-as-pull-down, the board amp (Q1 2SA937 + Q2 2SC2021), the composite waveform with lidnariq's measured voltages, and the TV decode chain (sync-sep LM1881 · Y/C · burst-PLL demod · YIQ→RGB). Key gotcha: the 2C02 shifts phase 120°/line, so a standard comb filter FAILS — you must use a notch. Lays out doing it ourselves: tap the DAC control nodes, a 21.477 MHz lookup sidecar, and our own NTSC decoder (no borrowed libraries) with a staged MVP. Two hardware-engineer consults; honest that it's a presentation layer, not built.路線圖(還沒做):我們的開關級 2C02 停在調色盤索引,但真 NES 輸出類比 composite 波形、由 1990 年電視變成模糊、點狀蠕動的畫面。標出整段缺的路 —— 晶片內電阻梯視訊 DAC(非 R-2R;Pin 21)、12 相位編碼(colourburst 6 倍,所以 dot crawl 自動產生)、emphasis 即下拉、主機板放大器(Q1 2SA937 + Q2 2SC2021)、含 lidnariq 量測電壓的 composite 波形、以及電視解碼鏈(sync-sep LM1881 · Y/C · burst-PLL 解調 · YIQ→RGB)。關鍵陷阱:2C02 每行偏 120°,標準 comb filter 會壞 —— 必須用 notch。鋪陳自己做:接出 DAC 控制節點、21.477MHz 查表 sidecar、以及自己寫的 NTSC 解碼器(不借用函式庫)+ 分階段 MVP。兩次硬體諮詢;誠實標明它是呈現層、還沒實作。

#6 · The other last mile — channel values to sound另一條最後一哩 —— 聲道值到聲音  ROADMAP 2026-07-20

The audio counterpart to #5 (also a roadmap): our switch-level 2A03 stops at five channel values, but a real NES drains current from two open-drain pins, mixes them through a famously non-linear network, and abuses a 74HCU04 logic inverter as an op-amp to make line-level sound. Maps the whole chain — the on-die non-linear DAC (Blargg's pulse/TND formulas, and why it compresses: paralleled NMOS-to-ground switches in a divider with the 100 Ω pull-ups), the board mix (20 k / 12 k / 1 µF / 74HCU04), the filters (90 / 440 Hz HPF · 14 kHz LPF), cartridge expansion audio, and AV-vs-RF. Lays out doing the DSP ourselves (no Nes_Snd_Emu, no Mesen copy): tap the DAC gate nodes, a 1.789 MHz sidecar, first-order IIRs, and our own band-limited polyphase decimator to 48 kHz (never decimate a square wave raw). Two SVGs (the chain + the non-linear mix curve); honest that it's a not-yet-built presentation layer.#5 的音訊對應(一樣是路線圖):我們的開關級 2A03 停在五個聲道值,但真 NES 從兩支開漏極腳吸電流、經一個著名的非線性網路混音、再把一顆 74HCU04 邏輯反相器當 op-amp 逼出 line-level 聲音。標出整條鏈 —— 晶片內非線性 DAC(Blargg 的 pulse/TND 公式,以及為什麼會壓縮:並聯對地 NMOS 開關 + 100Ω 上拉的分壓)、主機板混音(20k / 12k / 1µF / 74HCU04)、濾波器(90 / 440Hz 高通 · 14kHz 低通)、卡帶擴充音訊、AV vs RF。鋪陳自己寫 DSP(不用 Nes_Snd_Emu、不抄 Mesen):接出 DAC 閘極節點、1.789MHz sidecar、一階 IIR、以及自己寫的帶限 polyphase decimator 到 48kHz(方波絕不能生抽)。兩張 SVG(鏈 + 非線性混音曲線);誠實標明是還沒做的呈現層。

Planned write-ups (the working queue): the 16/18 rise-fall parity audit (a falsifiable prediction from the geometry consult); building the per-net Elmore binner and what the die's histogram looks like; auto-detecting every transparent latch on two dies; how a ratioed NMOS fight actually resolves; the board as a circuit; and a running lab-notebook series as each mechanism lands.

已排隊的專文(工作佇列):16/18 rise-fall 奇偶稽核(幾何諮詢給出的可證偽預言);打造 per-net Elmore 分級器、看看晶粒的直方圖長什麼樣;自動偵測兩顆晶粒上的每一個透明閂鎖;比例式 NMOS 對抗實際怎麼分勝負;把主機板當電路;以及每個機制落地時的實驗筆記系列。