romdevtools 0.26.0 → 0.28.0

package/src/platforms/atari7800/MENTAL_MODEL.md

@@ -237,10 +237,23 @@ read:
 
 ```c
 uint8_t pad = ~SWCHA;
-if (pad & JOY_UP)    /* P1 up */
-if (pad & JOY_DOWN)  /* P1 down */
-if (pad & JOY_LEFT)  /* P1 left */
 if (pad & JOY_RIGHT) /* P1 right */
+if (pad & JOY_LEFT)  /* P1 left */
+if (pad & JOY_DOWN)  /* P1 down */
+if (pad & JOY_UP)    /* P1 up */
+```
+
+**The bit order is the #1 7800 input footgun.** From bit 7 down the P1 nibble
+is **Right ($80), Left ($40), Down ($20), Up ($10)** — same as the 2600. Defining
+`JOY_UP 0x80 … JOY_RIGHT 0x10` (the "reads naturally" order) is exactly
+REVERSED, and the symptom is bizarre enough to misdiagnose: up/down steer
+left/right and vice versa. Always:
+
+```c
+#define JOY_RIGHT 0x80
+#define JOY_LEFT  0x40
+#define JOY_DOWN  0x20
+#define JOY_UP    0x10
 ```
 
 Fire button on `INPT4` at `$0C`, also active low.
@@ -343,9 +356,17 @@ What you can read:
   P / SP / PC) read from prosystem's `sally` globals.
 - **`background({view:'renderState'})`** — the MARIA CTRL bits, DPP,
   CHARBASE, and the current `dlistPtr`.
-- **`disasm({target:'rom'})`** and **`disasm({target:'references'})`** —
-  both default to the top 16 KB (`$C000-$FFFF`), where the reset vector
-  lands.
+- **`disasm({target:'rom'})`** — defaults to the top 16 KB
+  (`$C000-$FFFF`), where the reset vector lands.
+- **`disasm({target:'references'})`** — scans the WHOLE cart: flat carts
+  (≤48 KB) in one pass at their top-of-space org, SuperGame banked carts
+  (>48 KB) per 16 KB bank (last bank fixed at `$C000`, others at `$8000`),
+  refs tagged `romBank`. A 128-byte `.a78` header is stripped automatically.
+- **`disasm({target:'project'})`** — flat carts rebuild with one flat cc65
+  build; SuperGame carts get per-bank regions + NES-style glue (HEADER
+  segment with the original 128 header bytes, `BANKn` wrappers, multi-bank
+  `.cfg` via `linkerConfigPath`) — a one-call byte-identical
+  `build()` rebuild either way.
 
 Memory regions for **`memory({op:'read'})`**:
 

package/src/platforms/gb/MENTAL_MODEL.md

@@ -68,7 +68,10 @@ returns nothing.
 `disasm({target:'project'})` route through the native binutils z80 `objdump` in
 its `gbz80` machine (WASM, `-m gbz80`) — full CB-prefix coverage plus the
 SM83-specific opcodes (`ld (hl+),a`, `ldh`, `reti`, `ld hl,sp+e8`). One z80-elf
-binutils serves both plain Z80 (SMS/GG/MSX) and the GB CPU.
+binutils serves both plain Z80 (SMS/GG/MSX) and the GB CPU. MBC-banked carts
+(>32 KB) are scanned per 16 KB bank by `references` (bank 0 @ `$0000`, banks
+1+ @ their `$4000` window; refs tagged `romBank`) and split per-bank by
+`disasm({target:'project'})`.
 
 ## Five silent-failure footguns to know before you start (R26 + R27)
 
@@ -103,6 +106,18 @@ check these first. All five have shipped fixes in the bundled runtime
    (volatile-safe by construction) or cast through `volatile uint8_t *`.
    See `gb_runtime/lib/c/SDCC_GOTCHAS.md` § "Writes to VRAM" for detail.
 
+3b. **OAM DMA goes FIRST after `wait_vblank()` — before any staging work.**
+   The vblank window is ~10 scanlines (~1140 cycles) and SDCC call overhead
+   is brutal: even a few dozen `oam_set()` CALLS before the flush push the
+   DMA out of vblank into active display, where it tears the sprites on one
+   FIXED scanline every frame (the "horizontal line a third of the way down"
+   glitch). The robust frame shape is: stage OAM/BG writes into RAM any time
+   during the frame, then `wait_vblank(); oam_dma_flush();` as the very first
+   thing, then a small bounded batch of BG map writes. One frame of sprite
+   latency is imperceptible. Also: statics belong at `dataLoc 0xC200` or
+   above (the project recipe sets this) so they can't collide with
+   `shadow_oam` at $C100.
+
 4. **OAM DMA must run from HRAM.** During the ~160 µs OAM DMA window
    the CPU can ONLY fetch from HRAM ($FF80-$FFFE). The bundled
    `oam_dma_copy()` now installs a 9-byte stub at $FF80 and CALLs it;

package/src/platforms/gb/TROUBLESHOOTING.md

@@ -166,6 +166,48 @@ at $0150. If you see code in that window, either:
   works; don't override it for GB/GBC unless you know what you're
   doing.
 
+## "BG map updates randomly don't stick" / a tile updates one frame late forever
+
+The core (like real hardware mid-frame) DROPS writes to VRAM ($8000-$9FFF)
+that land outside vblank while the LCD is on — silently. A game loop that
+pokes the BG map "whenever the state changes" will have SOME of those pokes
+land mid-frame and vanish: stale cells, a piece that visually lags the
+logical grid, glitches that move around as code timing shifts.
+
+The robust pattern (used by the bundled puzzle scaffolds):
+
+1. **COLLECT** — during the frame, don't touch VRAM. Append (addr, tile)
+   pairs to a small RAM queue whenever game state changes a cell.
+2. **FLUSH** — immediately after `wait_vblank()` (right after the OAM DMA),
+   drain the queue with pure writes. No scanning, no logic — vblank is only
+   ~1140 cycles, so the flush must be writes only and bounded.
+3. **Scrub** — repaint one or two rows per frame round-robin as insurance,
+   so any cell that ever got dropped self-heals within a second.
+
+If you must write outside that structure, turn the LCD off first (only
+acceptable during init/load screens — mid-game it flashes white).
+
+## "BG map updates randomly don't stick" / a tile updates one frame late forever
+
+The core (like real hardware mid-frame) DROPS writes to VRAM ($8000-$9FFF)
+that land outside vblank while the LCD is on — silently. A game loop that
+pokes the BG map "whenever the state changes" will have SOME of those pokes
+land mid-frame and vanish: stale cells, a piece that visually lags the
+logical grid, glitches that move around as code timing shifts.
+
+The robust pattern (used by the bundled puzzle scaffolds):
+
+1. **COLLECT** — during the frame, don't touch VRAM. Append (addr, tile)
+   pairs to a small RAM queue whenever game state changes a cell.
+2. **FLUSH** — immediately after `wait_vblank()` (right after the OAM DMA),
+   drain the queue with pure writes. No scanning, no logic — vblank is only
+   ~1140 cycles, so the flush must be writes only and bounded.
+3. **Scrub** — repaint one or two rows per frame round-robin as insurance,
+   so any cell that ever got dropped self-heals within a second.
+
+If you must write outside that structure, turn the LCD off first (only
+acceptable during init/load screens — mid-game it flashes white).
+
 ## Debug recipes
 
 A few high-leverage tools you might not know exist:

package/src/platforms/gb/lib/c/patch-header.js

@@ -7,10 +7,13 @@
 //
 // WHY: most libretro GB cores (gambatte) refuse to load a ROM whose
 // Nintendo logo at $0104-$0133 doesn't match the canonical bytes or
-// whose header checksum at $014D doesn't validate. RGBDS's `rgbfix`
-// does this in the asm-build path; for SDCC-built C ROMs (which our
-// pipeline does NOT auto-patch — every byte that compiles is yours),
-// this script does the same job.
+// whose header checksum at $014D doesn't validate.
+//
+// NOTE: romdev's own build pipeline DOES auto-patch the header now (it
+// runs a bundled rgbfix after every gb/gbc link — see the
+// "rgbfix (auto header fix)" line in build logs), so you only need this
+// script when rebuilding the project OUTSIDE romdev with stock SDCC and
+// no RGBDS installed. It's what keeps the scaffold self-contained.
 //
 // The bundled gb_crt0.s reserves $0100-$014F for the header window,
 // so the bytes patched in here land on actual cartridge-header

package/src/platforms/gbc/MENTAL_MODEL.md

@@ -31,6 +31,18 @@ the same wall.
    cast through `volatile uint8_t *`. See `lib/c/SDCC_GOTCHAS.md`
    § "Writes to VRAM".
 
+3b. **OAM DMA goes FIRST after `wait_vblank()` — before any staging work.**
+   The vblank window is ~10 scanlines (~1140 cycles) and SDCC call overhead
+   is brutal: even a few dozen `oam_set()` CALLS before the flush push the
+   DMA out of vblank into active display, where it tears the sprites on one
+   FIXED scanline every frame (the "horizontal line a third of the way down"
+   glitch). The robust frame shape is: stage OAM/BG writes into RAM any time
+   during the frame, then `wait_vblank(); oam_dma_flush();` as the very first
+   thing, then a small bounded batch of BG map writes. One frame of sprite
+   latency is imperceptible. Also: statics belong at `dataLoc 0xC200` or
+   above (the project recipe sets this) so they can't collide with
+   `shadow_oam` at $C100.
+
 4. **OAM DMA must run from HRAM.** During the ~160 µs OAM DMA window
    the CPU can ONLY fetch from HRAM ($FF80-$FFFE). The bundled
    `oam_dma_copy()` installs a 9-byte stub at $FF80 and CALLs it; the

package/src/platforms/gbc/TROUBLESHOOTING.md

@@ -120,6 +120,27 @@ in DMG mode. To switch a DMG ROM to CGB:
 2. Run `romPatch({op:'gbHeader', path:"out.gbc"})` — also fixes the global
    checksum that the boot ROM checks
 
+## "BG map updates randomly don't stick" / a tile updates one frame late forever
+
+The core (like real hardware mid-frame) DROPS writes to VRAM ($8000-$9FFF)
+that land outside vblank while the LCD is on — silently. A game loop that
+pokes the BG map "whenever the state changes" will have SOME of those pokes
+land mid-frame and vanish: stale cells, a piece that visually lags the
+logical grid, glitches that move around as code timing shifts.
+
+The robust pattern (used by the bundled puzzle scaffolds):
+
+1. **COLLECT** — during the frame, don't touch VRAM. Append (addr, tile)
+   pairs to a small RAM queue whenever game state changes a cell.
+2. **FLUSH** — immediately after `wait_vblank()` (right after the OAM DMA),
+   drain the queue with pure writes. No scanning, no logic — vblank is only
+   ~1140 cycles, so the flush must be writes only and bounded.
+3. **Scrub** — repaint one or two rows per frame round-robin as insurance,
+   so any cell that ever got dropped self-heals within a second.
+
+If you must write outside that structure, turn the LCD off first (only
+acceptable during init/load screens — mid-game it flashes white).
+
 ## "Sound is the same as DMG"
 
 That's correct — CGB has the **identical** 4-channel APU as DMG. The

package/src/platforms/gbc/lib/c/font.h

@@ -0,0 +1,43 @@
+/* AUTO-GENERATED by gen_font.py — 5x7 font, GB 2bpp, ink=value 3. */
+#ifndef FONT_H
+#define FONT_H
+#define FONT_GLYPHS 36
+static const uint8_t font_data[576] = {
+    0x38, 0x38, 0x44, 0x44, 0x4C, 0x4C, 0x54, 0x54, 0x64, 0x64, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* 0 */
+    0x10, 0x10, 0x30, 0x30, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x38, 0x38, 0x00, 0x00,  /* 1 */
+    0x38, 0x38, 0x44, 0x44, 0x04, 0x04, 0x08, 0x08, 0x10, 0x10, 0x20, 0x20, 0x7C, 0x7C, 0x00, 0x00,  /* 2 */
+    0x7C, 0x7C, 0x08, 0x08, 0x10, 0x10, 0x08, 0x08, 0x04, 0x04, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* 3 */
+    0x08, 0x08, 0x18, 0x18, 0x28, 0x28, 0x48, 0x48, 0x7C, 0x7C, 0x08, 0x08, 0x08, 0x08, 0x00, 0x00,  /* 4 */
+    0x7C, 0x7C, 0x40, 0x40, 0x78, 0x78, 0x04, 0x04, 0x04, 0x04, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* 5 */
+    0x18, 0x18, 0x20, 0x20, 0x40, 0x40, 0x78, 0x78, 0x44, 0x44, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* 6 */
+    0x7C, 0x7C, 0x04, 0x04, 0x08, 0x08, 0x10, 0x10, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00,  /* 7 */
+    0x38, 0x38, 0x44, 0x44, 0x44, 0x44, 0x38, 0x38, 0x44, 0x44, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* 8 */
+    0x38, 0x38, 0x44, 0x44, 0x44, 0x44, 0x3C, 0x3C, 0x04, 0x04, 0x08, 0x08, 0x30, 0x30, 0x00, 0x00,  /* 9 */
+    0x38, 0x38, 0x44, 0x44, 0x44, 0x44, 0x7C, 0x7C, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x00, 0x00,  /* A */
+    0x78, 0x78, 0x44, 0x44, 0x44, 0x44, 0x78, 0x78, 0x44, 0x44, 0x44, 0x44, 0x78, 0x78, 0x00, 0x00,  /* B */
+    0x38, 0x38, 0x44, 0x44, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* C */
+    0x70, 0x70, 0x48, 0x48, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x48, 0x48, 0x70, 0x70, 0x00, 0x00,  /* D */
+    0x7C, 0x7C, 0x40, 0x40, 0x40, 0x40, 0x78, 0x78, 0x40, 0x40, 0x40, 0x40, 0x7C, 0x7C, 0x00, 0x00,  /* E */
+    0x7C, 0x7C, 0x40, 0x40, 0x40, 0x40, 0x78, 0x78, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x00, 0x00,  /* F */
+    0x38, 0x38, 0x44, 0x44, 0x40, 0x40, 0x5C, 0x5C, 0x44, 0x44, 0x44, 0x44, 0x3C, 0x3C, 0x00, 0x00,  /* G */
+    0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x7C, 0x7C, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x00, 0x00,  /* H */
+    0x38, 0x38, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x38, 0x38, 0x00, 0x00,  /* I */
+    0x1C, 0x1C, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x48, 0x48, 0x30, 0x30, 0x00, 0x00,  /* J */
+    0x44, 0x44, 0x48, 0x48, 0x50, 0x50, 0x60, 0x60, 0x50, 0x50, 0x48, 0x48, 0x44, 0x44, 0x00, 0x00,  /* K */
+    0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x7C, 0x7C, 0x00, 0x00,  /* L */
+    0x44, 0x44, 0x6C, 0x6C, 0x54, 0x54, 0x54, 0x54, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x00, 0x00,  /* M */
+    0x44, 0x44, 0x44, 0x44, 0x64, 0x64, 0x54, 0x54, 0x4C, 0x4C, 0x44, 0x44, 0x44, 0x44, 0x00, 0x00,  /* N */
+    0x38, 0x38, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* O */
+    0x78, 0x78, 0x44, 0x44, 0x44, 0x44, 0x78, 0x78, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x00, 0x00,  /* P */
+    0x38, 0x38, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x54, 0x54, 0x48, 0x48, 0x34, 0x34, 0x00, 0x00,  /* Q */
+    0x78, 0x78, 0x44, 0x44, 0x44, 0x44, 0x78, 0x78, 0x50, 0x50, 0x48, 0x48, 0x44, 0x44, 0x00, 0x00,  /* R */
+    0x3C, 0x3C, 0x40, 0x40, 0x40, 0x40, 0x38, 0x38, 0x04, 0x04, 0x04, 0x04, 0x78, 0x78, 0x00, 0x00,  /* S */
+    0x7C, 0x7C, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00,  /* T */
+    0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x38, 0x38, 0x00, 0x00,  /* U */
+    0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x28, 0x28, 0x10, 0x10, 0x00, 0x00,  /* V */
+    0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x54, 0x54, 0x54, 0x54, 0x6C, 0x6C, 0x44, 0x44, 0x00, 0x00,  /* W */
+    0x44, 0x44, 0x44, 0x44, 0x28, 0x28, 0x10, 0x10, 0x28, 0x28, 0x44, 0x44, 0x44, 0x44, 0x00, 0x00,  /* X */
+    0x44, 0x44, 0x44, 0x44, 0x28, 0x28, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00,  /* Y */
+    0x7C, 0x7C, 0x04, 0x04, 0x08, 0x08, 0x10, 0x10, 0x20, 0x20, 0x40, 0x40, 0x7C, 0x7C, 0x00, 0x00,  /* Z */
+};
+#endif

package/src/platforms/gbc/lib/c/patch-header.js

@@ -7,10 +7,13 @@
 //
 // WHY: most libretro GB cores (gambatte) refuse to load a ROM whose
 // Nintendo logo at $0104-$0133 doesn't match the canonical bytes or
-// whose header checksum at $014D doesn't validate. RGBDS's `rgbfix`
-// does this in the asm-build path; for SDCC-built C ROMs (which our
-// pipeline does NOT auto-patch — every byte that compiles is yours),
-// this script does the same job.
+// whose header checksum at $014D doesn't validate.
+//
+// NOTE: romdev's own build pipeline DOES auto-patch the header now (it
+// runs a bundled rgbfix after every gb/gbc link — see the
+// "rgbfix (auto header fix)" line in build logs), so you only need this
+// script when rebuilding the project OUTSIDE romdev with stock SDCC and
+// no RGBDS installed. It's what keeps the scaffold self-contained.
 //
 // The bundled gb_crt0.s reserves $0100-$014F for the header window,
 // so the bytes patched in here land on actual cartridge-header

package/src/platforms/genesis/MENTAL_MODEL.md

@@ -50,9 +50,13 @@ memory({op:'read', region:'system_ram', offset: sym.ramOffset, length:2})
 - **`static` file-local globals resolve too** (SGDK emits per-symbol sections).
   A non-`static` global that's never *read* can be optimised away at -O2 — mark
   game-state vars you inspect `volatile` (you want that anyway).
-- **Genesis WRAM is host-LE word-byte-swapped** in gpgx, so a 16-bit value reads
-  with its two bytes swapped at the offset (0x1234 → bytes `34 12`). Read the
-  word and account for it, or read single bytes.
+- **WRAM (`system_ram`) is normalized to CPU byte order** — offset X is the
+  byte the 68k sees at $FF0000+X, words read big-endian as expected, and
+  offsets line up with disassembly addresses and cheat-DB maps. (gpgx stores
+  work RAM host-LE word-swapped internally; the host un-swaps it. Before
+  0.28.0 the raw swapped layout leaked through — value-search/diff loops were
+  self-consistent, but any offset cross-referenced against a `move.b $FFxxxx`
+  in a disassembly was off-by-XOR-1.)
 - **PC → which function?** `symbols({op:'addr', pc, symbolsText: b.mapText})` maps
   a live `cpu({op:'read'}).pc` to the enclosing C function.
 
@@ -427,10 +431,40 @@ Video is deeply readable; the FM audio chip is only partially exposed:
   `getPsgState` decodes the SN76489 (3 tone + 1 noise channels).
 - **Memory regions:** `memory({op:'read'})` exposes CRAM, VSRAM, VDP_REGS,
   Z80_RAM (the sound CPU's RAM), M68K work RAM, YM2612, PSG, and VRAM.
-  Remember the gpgx byte-swap quirk: VRAM and WRAM read host-LE
+  Remember the gpgx byte-swap quirk for VRAM: it reads host-LE
   word-byte-swapped (a 16-bit value's two bytes are swapped at the offset)
-  — account for it or read single bytes (see "Reading your C globals
-  headlessly").
+  — use tiles({op:'pixels'}) to decode in render order. M68K work RAM
+  (`system_ram`) is NOT affected: it's normalized to CPU byte order (see
+  "Reading your C globals headlessly").
+
+## Break-instant truth: registersAtHit + pure calls (0.28.0)
+
+gpgx schedules its CPUs per scanline, so a `breakpoint` hit mid-frame used to
+leave the LIVE register file hundreds of instructions past the hit by the time
+you could read it — chasing pointer registers read that way burned a real
+session for ~2h. Fixed two ways:
+
+- **`registersAtHit`** — `breakpoint({on:'pc'|'write'|'read'})` hits now carry
+  the FULL register file (d0-d7/a0-a7/pc/sr/sp) frozen by the core at the hit
+  instant. Use it, never a follow-up `cpu({op:'read'})`. The reported `pc` for
+  write/read hits is the EXECUTING instruction's first byte (pre-0.28.0 it was
+  the post-prefetch PC — one instruction late). On a pc-break the 68k also
+  stays FROZEN for the rest of the frame, so even live reads agree.
+- **`cpu({op:'call', pure:true})`** — steps ONLY the 68k: no VDP lines, no
+  Z80, no interrupts raised. Without it, a driven routine that spans frames
+  runs the game's own VBlank logic concurrently — which can stomp the output
+  buffer you're capturing (a real session diffed a CORRECT codec
+  reimplementation against that poisoned "ground truth" for hours). Prefer
+  `pure:true` for every decompressor/codec call; non-pure results carry a ⚠
+  caveat when frame logic ran. (SMS/GG get the same via the shared core; the
+  OTHER platforms get the same guarantee via interrupt blocking —
+  `pureMode:'irq-blocked'` — so the technique transfers everywhere.)
+- **`watch({on:'copy'})`** — the CPU-port complement of `watch({on:'dma'})`:
+  logs every data-port write landing in a VRAM window with the executing
+  instruction's PC. Use `dma` when the upload is DMA'd (most Genesis
+  graphics), `copy` when the game pokes the data port directly (the
+  "video_ram writes don't reach the renderer" class of confusion — `copy`
+  shows you who's writing and where).
 
 ## ROM layout
 

package/src/platforms/genesis/lib/c/genesis_sfx.c

@@ -32,6 +32,42 @@ void sfx_noise(u8 length_frames) {
     sfx_remaining[3] = length_frames;
 }
 
+/* ── background music: a 16-step melody loop on PSG channel 2 ───────
+ * Ticked from sfx_update(), so every scaffold that already calls
+ * sfx_init() + sfx_update() gets continuous music for free ("no sound"
+ * was the #1 playtest complaint — a lone 6-frame blip on a rare event
+ * reads as silence). sfx_music(0) turns it off. SFX own channels 0-1 +
+ * noise, so effects always cut through. */
+static const u16 music_hz[16] = {
+    262, 330, 392, 523, 392, 330, 262, 0,     /* C4 E4 G4 C5 G4 E4 C4 -  */
+    220, 262, 330, 440, 330, 262, 220, 0,     /* A3 C4 E4 A4 E4 C4 A3 -  */
+};
+static u8 music_enabled = 1;
+static u8 music_step, music_timer;
+
+void sfx_music(u8 on) {
+    music_enabled = on;
+    music_step = 0;
+    music_timer = 0;
+    if (!on) PSG_setEnvelope(2, PSG_ENVELOPE_MIN);
+}
+
+static void music_tick(void) {
+    if (!music_enabled) return;
+    if (music_timer == 0) {
+        u16 hz = music_hz[music_step & 15];
+        if (hz) {
+            PSG_setFrequency(2, hz);
+            PSG_setEnvelope(2, 5);            /* moderate, under the SFX */
+        } else {
+            PSG_setEnvelope(2, PSG_ENVELOPE_MIN);
+        }
+        music_step++;
+    }
+    music_timer++;
+    if (music_timer >= 9) music_timer = 0;    /* ~6.6 notes/sec */
+}
+
 void sfx_update(void) {
     for (u8 i = 0; i < 4; i++) {
         if (sfx_remaining[i] > 0) {
@@ -41,6 +77,7 @@ void sfx_update(void) {
             }
         }
     }
+    music_tick();
 }
 
 void sfx_off(void) {

package/src/platforms/genesis/lib/c/genesis_sfx.h

@@ -42,6 +42,7 @@ void sfx_noise(u8 length_frames);
  * decrement the auto-silence countdown. Without this, notes never
  * stop ringing. */
 void sfx_update(void);
+void sfx_music(u8 on);   /* background melody loop on PSG ch2 — ON by default; 0 = off */
 
 /* Power down all PSG channels immediately. */
 void sfx_off(void);

package/src/platforms/gg/TROUBLESHOOTING.md

@@ -92,20 +92,16 @@ the P2 read + force `p2 = 0` so the AI fallback always engages.
 The bundled GG `sports.c` already does this — copy that pattern when
 porting other SMS multiplayer code.
 
-## "Build errors mention 'TMR SEGA' or ROM header"
-
-Same magic as SMS — gpgx accepts headerless ROMs fine for development.
-For real-hardware ROM-burning include a header at $7FF0:
-
-```
-db "TMR SEGA"
-dw 0                  ; reserved
-dw 0                  ; checksum (gpgx ignores)
-db 0x00, 0x00, 0x00   ; product code BCD
-db 0x00               ; product code high + version
-db 0x40               ; region (0x40 = GG)
-db 0x4C               ; ROM size (0x4C = 32 KB)
-```
-
-The bundled scaffolds build without a header — sufficient for the
-emulator-driven workflow. Add one before shipping to a cartridge.
+## "TMR SEGA" header / ROM boots in the wrong video mode
+
+The build pipeline now stamps the 16-byte header at `$7FF0` automatically
+("TMR SEGA" + checksum + the region/size byte at `$7FFF`) and pads every
+image to 32 KB — you never hand-write it for romdev builds.
+
+The byte that matters is `$7FFF`: **high nibble = region, low nibble = ROM
+size**. romdev writes `$7C` (GG international, 32 KB) on `.gg` builds.
+If you patch a ROM by hand and leave an SMS region nibble there (`$4C` =
+SMS export), gpgx boots the `.gg` file in **SMS compatibility mode** —
+256×192 timing, SMS palette depth — and everything renders dark and
+mis-cropped even though your code is fine. Check `$7FFF` first when a GG
+ROM suddenly looks like an SMS ROM.

package/src/platforms/gg/lib/c/gg_crt0.s

@@ -37,10 +37,13 @@
 ;; ─── Reset vector at $0000 ────────────────────────────────────────
         .area _HEADER (ABS)
         .org    0x0000
+        ;; ONLY 8 BYTES fit before the RST $08 vector. The old block here
+        ;; (di/im 1/ld sp/jp = 9 bytes) overflowed into .org 0x0008, whose
+        ;; `ret` stomped the jp's high target byte -> boot jumped into
+        ;; garbage. di+im 1+jp = 6 bytes; SP setup moved to _boot below.
         di                          ; interrupts off until we're ready
         im      1                   ; mode 1 — IRQs jump to $0038
-        ld      sp, #0xDFF0         ; GG/SMS stack (top of WRAM minus 16)
-        jp      gsinit              ; skip the interrupt vector table
+        jp      _boot               ; continue past the vector table
 
 ;; ─── RST handlers (default = return) ──────────────────────────────
         .org    0x0008
@@ -80,6 +83,15 @@
         .org    0x0066
         retn
 
+;; ─── Boot continuation (right after the NMI vector) ───────────────
+;; SP first, then the C runtime init. Lives in the ABS header area so
+;; it exists at a known address regardless of where _CODE is linked
+;; (_CODE must start at >= $0100 so it can't overwrite this table).
+        .org    0x0068
+_boot:
+        ld      sp, #0xDFF0         ; stack at top of WRAM minus 16
+        jp      gsinit
+
 ;; ─── crt0 body ────────────────────────────────────────────────────
 ;; Standard SDCC pattern: jump to a code area, run initializers, then
 ;; call main. The initializer area is filled by sdcc when it sees

package/src/platforms/lynx/lib/c/lynx_sfx.c

@@ -103,21 +103,57 @@ static void sfx_flush_pending(void) {
       POKE(VOICE_BASE(i) + 1, 0x80);     /* feedback off */
       POKE(VOICE_BASE(i) + 4, sfx_pending_period[i]);
       POKE(VOICE_BASE(i) + 5, 0x18);     /* RELOAD + COUNT + 16us clock */
-      POKE(VOICE_BASE(i) + 0, 64);       /* volume */
+      POKE(VOICE_BASE(i) + 0, 100);      /* volume (was 64 — read as near-silent on hardware) */
     } else if (sfx_pending_kind[i] == 2) {
       /* Noise on voice 3. */
       POKE(VOICE_BASE(i) + 7, 0x01);     /* 12-bit LFSR */
       POKE(VOICE_BASE(i) + 1, 0x95);     /* classic noise feedback */
       POKE(VOICE_BASE(i) + 4, 40);
       POKE(VOICE_BASE(i) + 5, 0x18);
-      POKE(VOICE_BASE(i) + 0, 64);
+      POKE(VOICE_BASE(i) + 0, 100);
     }
     sfx_pending_kind[i] = 0;
   }
 }
 
+/* ── background music: 16-step melody loop on voice 1 ───────────────
+ * Ticked from sfx_update() through the SAME staged-write path (R57),
+ * so every scaffold that already calls sfx_init() + sfx_update() gets
+ * continuous music for free — "no sound at all" was the Lynx playtest
+ * verdict. sfx_music(0) turns it off. SFX use voice 0 (+ noise on 3).
+ * MIKEY period at the 16us clock: freq ~= 31250 / period. */
+static const uint8_t music_period[16] = {
+    119, 95, 80, 60, 80, 95, 119, 0,    /* C4 E4 G4 C5 G4 E4 C4 -  */
+    142, 119, 95, 71, 95, 119, 142, 0,  /* A3 C4 E4 A4 E4 C4 A3 -  */
+};
+static uint8_t music_enabled = 1;
+static uint8_t music_step, music_timer;
+
+void sfx_music(uint8_t on) {
+  music_enabled = on;
+  music_step = 0;
+  music_timer = 0;
+}
+
+static void music_tick(void) {
+  uint8_t p;
+  if (!music_enabled) return;
+  if (music_timer == 0) {
+    p = music_period[music_step & 15];
+    if (p) {
+      sfx_pending_kind[1] = 1;          /* staged like any tone (R57-safe) */
+      sfx_pending_period[1] = p;
+      sfx_remaining[1] = 8;             /* hold 8 of 9 frames — articulated */
+    }
+    music_step++;
+  }
+  music_timer++;
+  if (music_timer >= 9) music_timer = 0;
+}
+
 void sfx_update(void) {
   uint8_t i;
+  music_tick();
   /* R57: flush any sfx_tone/sfx_noise requests from THIS frame. The
    * caller is expected to have just returned from tgi_updatedisplay
    * (or wait_vblank), so the synchronous timer-event sweep that handy

package/src/platforms/lynx/lib/c/lynx_sfx.h

@@ -54,6 +54,7 @@ void sfx_init(void);
 void sfx_tone(uint8_t channel, uint8_t period, uint8_t length_frames);
 void sfx_noise(uint8_t length_frames);
 void sfx_update(void);
+void sfx_music(uint8_t on);  /* background melody on voice 1 — ON by default; 0 = off */
 void sfx_off(void);
 
 #endif

package/src/platforms/msx/MENTAL_MODEL.md

@@ -117,6 +117,12 @@ exactly this.
   generator + the envelope (period + shape bits).
 - `memory({op:'read'})` regions: `msx_vram`, `msx_vdp_regs`, `msx_vdp_status`,
   `msx_palette`, `msx_cpu_regs`, `msx_psg_regs`, plus `system_ram` (work RAM).
+- `disasm({target:'rom'|'references'|'project'})` — native binutils z80
+  `objdump`. MegaROMs (>32 KB) are handled per 16 KB bank: `references` scans
+  bank 0 at `$4000` (after the "AB" header) and banks 1+ at `$8000` (an
+  assumed ASCII16-style window), refs tagged `romBank`;
+  `disasm({target:'project'})` splits the header into its own data region and
+  emits a bank-by-bank native rebuild recipe in `BUILD.md`.
 
 ## MCP debug & inspection tooling
 

package/src/platforms/msx/TROUBLESHOOTING.md

@@ -66,3 +66,24 @@ fixed hardware colors — you choose indices, not RGB.
 The build worker pool can transiently fail. Re-run the build. If it fails
 consistently, read the `log` — SDCC's C89 parser errors are terse; common causes
 are `//` comments, mid-block declarations, or file-scope inline asm (see above).
+
+
+## PSG writes get eaten — sound code "runs" but the chip stays silent
+
+The BIOS KEYINT interrupt fires every frame and reads PSG register 14 (the
+joystick row) — and it CLOBBERS the PSGADDR latch. If an interrupt lands
+between your `PSGADDR = n` and the matching `PSGWRITE`, your byte goes into
+R14 instead of the register you selected. Symptom: the mixer looks right but
+periods/volumes stay 0 — total silence even though your code clearly ran.
+
+**Rule: wrap every PSGADDR/PSGWRITE sequence in `__asm__("di")` /
+`__asm__("ei")`.** The bundled `msx_psg_tone`/`msx_psg_off` (and the music
+ticker) already do this; copy the pattern for any direct PSG access you write.
+
+## A `static x = 5;` boots as 0 (historical — fixed in the bundled crt0)
+
+The old `msx_crt0.s` placed the SDCC `_INITIALIZER` area in RAM, so the boot
+copy duplicated uninitialised RAM onto itself: every value-initialised static
+read 0 and BSS was never zeroed. The bundled crt0 has been fixed (ROM-placed
+`_INITIALIZER` + a BSS-zero loop). If a project scaffolded before 2026-06-09
+shows ghost zeros, refresh its `msx_crt0.s` from a new scaffold.

package/src/platforms/msx/lib/c/msx_crt0.s

@@ -27,6 +27,8 @@
         .globl  _main
         .globl  l__INITIALIZER
         .globl  s__INITIALIZER
+        .globl  s__DATA
+        .globl  l__DATA
         .globl  s__INITIALIZED
 
 ;; ─── Cartridge ROM header at $4000 ────────────────────────────────
@@ -44,7 +46,15 @@
 ;; ─── crt0 body ────────────────────────────────────────────────────
 ;; Standard SDCC area order so the linker fills _GSINIT with the global
 ;; initializer fragments sdcc emits, then _GSFINAL.
+        ;; AREA ORDERING IS LOAD-BEARING (same bug class fixed in the SMS/GG
+        ;; crt0s 2026-06-08): `_INITIALIZER` (the ROM image of every value-
+        ;; initialised static) MUST be declared in the ROM group — otherwise
+        ;; sdld places it in RAM after `_INITIALIZED` and the init copy below
+        ;; copies uninitialised RAM onto itself, so every `static x = N;`
+        ;; boots as 0. On MSX that silenced ALL scaffold audio (the PSG
+        ;; music/sfx state booted zeroed) among other ghosts.
         .area   _HOME
+        .area   _INITIALIZER
         .area   _CODE
         .area   _GSINIT
         .area   _GSFINAL
@@ -59,6 +69,23 @@
 
 ;; INIT entry — the BIOS CALLs here with interrupts on and a valid stack.
 init:
+        ;; ── Zero the BSS segment (`_DATA`) ── every uninitialised static
+        ;; must read back 0 at boot (power-on RAM is garbage).
+        ld      bc, #l__DATA
+        ld      a, b
+        or      a, c
+        jr      Z, bss_done
+        ld      hl, #s__DATA
+        ld      (hl), #0x00
+        ld      d, h
+        ld      e, l
+        inc     de
+        dec     bc
+        ld      a, b
+        or      a, c
+        jr      Z, bss_done
+        ldir
+bss_done:
         ;; Copy initialized-data image from ROM to RAM (SDCC global inits).
         ld      bc, #l__INITIALIZER
         ld      a, b

package/src/platforms/msx/lib/c/msx_hw.h

@@ -87,6 +87,8 @@ void    msx_clear_sprites(void);
 void    msx_vblank_wait(void);
 uint8_t msx_read_joystick(uint8_t stick);
 void    msx_psg_tone(uint8_t chan, uint16_t period, uint8_t vol);
+void    msx_music(uint8_t on);   /* background melody on channel C — ON by default; 0 = off */
+void    msx_music_tick(void);    /* call once per frame (scaffolds do) */
 void    msx_psg_off(uint8_t chan);
 
 #endif /* MSX_HW_H */