diff --git a/.gitignore b/.gitignore
index b61ae38..f7f02ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,3 +69,13 @@ ghidra/vt1200.lock
tools/tms34010-sdk/Docs/
tools/tms34010-sdk/Patents/
tools/tms34010-sdk/1991-07 TIGA Promo Kit and Art Software/
+
+# termtris build scratch (TI tools + 2ine libs)
+apps/termtris/work/
+apps/termtris/build/*.log
+apps/termtris/build/smoke.*
+apps/termtris/build/fmt.*
+apps/termtris/build/render.*
+apps/termtris/build/input.*
+apps/termtris/build/termtris.*
+apps/termtris/evidence/loader_frame*.png
diff --git a/apps/termtris/COPYING b/apps/termtris/COPYING
new file mode 100644
index 0000000..f288702
--- /dev/null
+++ b/apps/termtris/COPYING
@@ -0,0 +1,674 @@
+ GNU GENERAL PUBLIC LICENSE
+ Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc.
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+ Preamble
+
+ The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+ The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users. We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors. You can apply it to
+your programs, too.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+ To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights. Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+ For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received. You must make sure that they, too, receive
+or can get the source code. And you must show them these terms so they
+know their rights.
+
+ Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+ For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software. For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+ Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so. This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software. The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable. Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products. If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+ Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary. To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+ The precise terms and conditions for copying, distribution and
+modification follow.
+
+ TERMS AND CONDITIONS
+
+ 0. Definitions.
+
+ "This License" refers to version 3 of the GNU General Public License.
+
+ "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+ "The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+ To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy. The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+ A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+ To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+ To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+ An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+ 1. Source Code.
+
+ The "source code" for a work means the preferred form of the work
+for making modifications to it. "Object code" means any non-source
+form of a work.
+
+ A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+ The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+ The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+ The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+ The Corresponding Source for a work in source code form is that
+same work.
+
+ 2. Basic Permissions.
+
+ All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+ You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force. You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright. Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+ Conveying under any other circumstances is permitted solely under
+the conditions stated below. Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+ 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+ No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+ When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+ 4. Conveying Verbatim Copies.
+
+ You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+ You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+ 5. Conveying Modified Source Versions.
+
+ You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified
+ it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is
+ released under this License and any conditions added under section
+ 7. This requirement modifies the requirement in section 4 to
+ "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this
+ License to anyone who comes into possession of a copy. This
+ License will therefore apply, along with any applicable section 7
+ additional terms, to the whole of the work, and all its parts,
+ regardless of how they are packaged. This License gives no
+ permission to license the work in any other way, but it does not
+ invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display
+ Appropriate Legal Notices; however, if the Program has interactive
+ interfaces that do not display Appropriate Legal Notices, your
+ work need not make them do so.
+
+ A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+ 6. Conveying Non-Source Forms.
+
+ You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by the
+ Corresponding Source fixed on a durable physical medium
+ customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by a
+ written offer, valid for at least three years and valid for as
+ long as you offer spare parts or customer support for that product
+ model, to give anyone who possesses the object code either (1) a
+ copy of the Corresponding Source for all the software in the
+ product that is covered by this License, on a durable physical
+ medium customarily used for software interchange, for a price no
+ more than your reasonable cost of physically performing this
+ conveying of source, or (2) access to copy the
+ Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the
+ written offer to provide the Corresponding Source. This
+ alternative is allowed only occasionally and noncommercially, and
+ only if you received the object code with such an offer, in accord
+ with subsection 6b.
+
+ d) Convey the object code by offering access from a designated
+ place (gratis or for a charge), and offer equivalent access to the
+ Corresponding Source in the same way through the same place at no
+ further charge. You need not require recipients to copy the
+ Corresponding Source along with the object code. If the place to
+ copy the object code is a network server, the Corresponding Source
+ may be on a different server (operated by you or a third party)
+ that supports equivalent copying facilities, provided you maintain
+ clear directions next to the object code saying where to find the
+ Corresponding Source. Regardless of what server hosts the
+ Corresponding Source, you remain obligated to ensure that it is
+ available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided
+ you inform other peers where the object code and Corresponding
+ Source of the work are being offered to the general public at no
+ charge under subsection 6d.
+
+ A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+ A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling. In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage. For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product. A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+ "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source. The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+ If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+ The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed. Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+ Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+ 7. Additional Terms.
+
+ "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+ When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+ Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the
+ terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or
+ author attributions in that material or in the Appropriate Legal
+ Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or
+ requiring that modified versions of such material be marked in
+ reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or
+ authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some
+ trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that
+ material by anyone who conveys the material (or modified versions of
+ it) with contractual assumptions of liability to the recipient, for
+ any liability that these contractual assumptions directly impose on
+ those licensors and authors.
+
+ All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+ If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+ Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+ 8. Termination.
+
+ You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+ However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+ Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+ Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+ 9. Acceptance Not Required for Having Copies.
+
+ You are not required to accept this License in order to receive or
+run a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+ 10. Automatic Licensing of Downstream Recipients.
+
+ Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+ An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+ You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+ 11. Patents.
+
+ A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+ A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+ Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+ In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+ If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+ If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+ A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License. You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+ Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+ 12. No Surrender of Others' Freedom.
+
+ If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+ 13. Use with the GNU Affero General Public License.
+
+ Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+ 14. Revised Versions of this License.
+
+ The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time. Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+ Each version is given a distinguishing version number. If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+ If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+ Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+ 15. Disclaimer of Warranty.
+
+ THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. Limitation of Liability.
+
+ IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+ 17. Interpretation of Sections 15 and 16.
+
+ If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+ If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+ Copyright (C)
+ This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+ This is free software, and you are welcome to redistribute it
+ under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License. Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+ You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+.
+
+ The GNU General Public License does not permit incorporating your program
+into proprietary programs. If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library. If this is what you want to do, use the GNU Lesser General
+Public License instead of this License. But first, please read
+.
diff --git a/apps/termtris/HANDOFF.md b/apps/termtris/HANDOFF.md
new file mode 100644
index 0000000..6b8fc65
--- /dev/null
+++ b/apps/termtris/HANDOFF.md
@@ -0,0 +1,134 @@
+# Handoff — termtris running inside the VT1200
+
+Everything here is on branch **`termtris`** of
+`https://git.wut.ee/opencode.energia.arti.ee/vt1200.git` (remote `origin`); any
+checkout of the branch is equivalent.
+
+```sh
+git fetch origin termtris
+git checkout -b termtris origin/termtris
+apps/termtris/verify.sh
+```
+
+`verify.sh` is the whole acceptance run: ROM checksum, toolchain check, MAME
+build (skip with `--skip-mame`), the six tests, the acceptance summary and the
+evidence list. It keeps every test log under
+`apps/termtris/build/verify_.log`, runs all six tests even after a
+failure, and exits non-zero at the end if any failed. `RUNTIME` is roughly 12
+minutes once MAME is built; the MAME build itself is the long part.
+
+## What is done
+
+The upstream game (John Tsiombikas' `termtris`, commit `7c5435d`) builds as a
+native TMS34010 program with the 1990 TI r5.01 C toolchain under 2ine, loads
+into VT1200 RAM through `dwt/loader`, opens a 480×312 window on the terminal's
+own X server through the ROM Xlib, and reads real X11 key events. It is the
+actual game: board, score/level/lines panels, piece preview, help and
+high-score panels, moving/rotating/dropping pieces, and `q` to quit.
+
+| task | state | commit |
+|---|---|---|
+| vendor + toolchain + XG smoke test | done, `smoke.sh` PASS | `a861268` |
+| `sprintf`/stdio compat | done, `fmt.sh` PASS | `a804181` |
+| cell-grid X11 backend | done, `render.sh` PASS | `264b53a` |
+| key map, clock, main loop | done, `input.sh` PASS | `c1945cf` |
+| game integration, scores, COFF | done, `play.sh`/`play_keys.sh` PASS | `41d3cec` |
+| docs + harness report | done | `3e2ddde` |
+| review pass (seed, focus, expose, assertions) | done | `7a2cef5` |
+| handoff script + this note | done | `a12fb47` |
+| qemu-i386 fallback for kernels without 16-bit LDT | done, `verify.sh` PASS | `ce40582` |
+| VR319 re-run, regenerated evidence, updated numbers | done, `verify.sh` PASS | (this commit) |
+
+`VT1200.md` is the port documentation; `harness/mame/TERMTRIS_REPORT.md` is the
+harness-side report; the design and plan are in
+`docs/superpowers/specs/2026-11-03-termtris-vt1200-design.md` and
+`docs/superpowers/plans/2026-11-03-termtris-vt1200.md`.
+
+## The VR319 re-run — done
+
+The screenshots and the acceptance numbers used to come from an **older MAME
+binary** (`/home/arti/code/k-space/mame0289/vt1200d`, 30 Oct) that predates the
+driver's VR319 default. That binary has no `VT1200_MONITOR`, and its frames are
+1024×864, i.e. the old VR150 geometry. The driver in this tree defaults to
+**VR319** (1280×1024 active, 1696×1063 raster), which changes the frame cadence
+and therefore the frame at which the loader and the tests act.
+
+The branch has now been re-run against a fresh MAME 0.289 build of this tree's
+driver at the VR319 default. `apps/termtris/verify.sh --skip-mame` passes all
+six tests, the evidence PNGs were regenerated at **1280×1024**, and the new
+`DIAG` values are in `VT1200.md` and `harness/mame/TERMTRIS_REPORT.md`. The
+behaviour did not change: same events, same window (`focus=00400001`), same
+`quit=1`, board/panels/preview all visible. Only the loop counts moved, because
+the VR319 raster runs at a different emulated frame rate. The loader still acts
+at frame 2500 and the keys at 3095–3190; no re-timing was needed.
+
+## Prerequisites on the new box
+
+* a MAME 0.289 checkout (`MAME_SRC`, default `/home/arti/code/k-space/mame0289`);
+* the 2ine build with `lx_loader` (`NINE=`, default
+ `/home/arti/os2-work/2ine/build`);
+* the r5.01 SDK zips, already in the repo under
+ `tools/tms34010-sdk/1990-11 TMS340 Family SDK/`;
+* `vt1200_v22.bin` in the repo root (the harness ROM dir symlinks to it).
+
+The r5.01 tools are 16-bit OS/2 `NE` programs. If the host kernel was built
+without `CONFIG_X86_16BIT`, `lx_loader` cannot create their 16-bit LDT
+segments and aborts at its first one; `build.sh` detects that and runs the same
+loader under `qemu-i386` (install `qemu-user`), or honours an explicit
+`LX_RUNNER` command prefix. This box's cloud kernel is one of those; the
+generated COFF is unchanged.
+
+`verify.sh` checks the ROM and the 2ine loader before doing anything, and
+`harness/mame/build.sh` re-registers the driver in `mame.lst` and builds the
+single-driver `vt1200` subtarget.
+
+## Expected results
+
+Last full run (MAME 0.289, this tree's driver, **VR319 default**, 1280×1024
+frames; the earlier figures were VR150):
+
+```
+smoke PASS type=2 keycode=194 lookup_n=1 ch=61 ks=0061
+fmt PASS six formats exact
+render PASS flus=464C5553 progress=00FFFFFF
+input PASS bytes 61 9B 41 9B 42 9B 44 9B 43 30 0A 7F 71 70
+ (a/up/down/left/right/0/Return/Delete/q/p)
+play PASS DIAG: tick=887 quit=0
+play_keys PASS move DIAG: loops=650 events=18 last=3 focus=00400001 rev=0 quit=0
+ panels DIAG: loops=648 events=12 last=3 focus=00400001 rev=0 quit=0
+ quit DIAG: loops=555 events=10 last=3 focus=00400001 rev=0 quit=1
+```
+
+`focus=00400001` is the window the process created; `quit=1` is the game's own
+global after `q` — that is the proof the key reached the game and not just the
+window.
+
+## Known failure modes (all seen, all diagnosed)
+
+| symptom | cause | handling |
+|---|---|---|
+| build stage "fails" with exit 139 but produced its file | 2ine-hosted TI tools crash during teardown | `build.sh` retries only when the output is missing; `gspac` needs `-i.` |
+| linker points `cinit` into `.text` | empty `.cinit` section | `build.sh` relinks with the one-word `CINITZ.obj` terminator |
+| `XNextEvent` never returns an event, keycode zero | child's per-process Xlib context is NULL | `src/vt1200/xgfix.c` writes a zeroed 1 KiB block before `XOpenDisplay` (RAM only) |
+| the game exits immediately at startup, sometimes | `XOpenDisplay`/window creation while the display server settles | `main()` retries 40 × 50 ms, then returns 1 |
+| window paints once, then hangs; a debug marker stops mid-flush | per-cell flushing overflowed the X socket / `XSync` per row deadlocked the client | flush repaints whole rows (fill + one 80-char string + inverse spans + one `XFlush`) |
+| playfield is a white block with invisible pieces | the 1-bit raster cannot show colour | backend drops colour and uses bold (`0x80`) as reverse; pieces are `[`/`]` glyphs |
+| blanked well border with stray `X` tiles at the top | `ExposureMask` + map-time Expose runs the game's full redraw before it has a piece | do not select `ExposureMask` (current code); if repainting on expose is ever needed, guard `full_redraw` against `cur_piece < 0` |
+
+## Layout
+
+```
+apps/termtris/
+├── build.sh TI r5.01 -> COFF (OUTNAME=termtris for the game)
+├── run.sh interactive MAME session (lightgun/tablet input)
+├── verify.sh one-command acceptance (see above)
+├── VT1200.md port documentation
+├── src/game.c upstream game; only srand(vt_rand_seed()) differs
+├── src/vt1200/ main.c x11.c xgfix.c compat.c xlib.h scoredb.c *.asm
+├── tests/ smoke fmt render input play play_keys (+ .lua drivers)
+├── evidence/ screenshots
+└── build/termtris.coff the built image (ignored; rebuild with build.sh)
+```
+
+The tests build from source every run (`play.sh`/`play_keys.sh` rebuild
+`termtris.coff`), so an edit cannot silently pass by using a stale binary.
diff --git a/apps/termtris/README.md b/apps/termtris/README.md
new file mode 100644
index 0000000..72a1382
--- /dev/null
+++ b/apps/termtris/README.md
@@ -0,0 +1,156 @@
+Termtris - tetris game for terminals
+====================================
+
+> **VT1200 port:** this tree also builds a native TMS34010 program that runs
+> inside the VT1200 and draws through the terminal's own ROM Xlib. Build it with
+> `apps/termtris/build.sh` (see `apps/termtris/VT1200.md`) and run it with
+> `apps/termtris/run.sh`. The upstream backends (unix/ANSI, DOS, ADM3) are not
+> part of that build.
+
+
+
+About
+-----
+
+Termtris is a text-based tetris game, initially written for UNIX systems and
+ANSI/VT100-compatible terminals, but later extended to support more terminal
+types, operating systems, and text-mode video hardware.
+
+I always liked the GameBoy tetris best. So I made termtris as close as possible
+to that version gameplay-wise.
+
+Termtris can run in color or monochrome mode, and can load custom character sets
+for graphical blocks, if there is support for that.
+
+There are two main flavors of termtris which can be compiled from the same
+source tree:
+
+ 1. The original **UNIX version** which runs on terminals, and can also be
+ compiled for windows using a POSIX emulation layer such as *msys2* or
+ *cygwin*. It has been tested on multiple UNIX systems (GNU/Linux, FreeBSD, IRIX,
+ Solaris, MacOSX), and multiple terminals (VT52, VT100, VT220, VT420,
+ MS 6102), and terminal emulators (xterm, linux console, kermit, iTerm2).
+
+ 2. The **DOS version** which uses the PC BIOS to access display and keyboard,
+ but can also optionally work with the same terminals supported by the UNIX
+ version.
+
+### Links
+ - website: http://nuclear.mutantstargoat.com/sw/termtris
+ - source repository: https://github.com/jtsiomb/termtris
+
+
+Controls
+--------
+ - `A` or *left arrow* moves the block left.
+ - `D` or *right arrow* moves the block right.
+ - `S` or *down arrow* drops the block faster.
+ - `W`, *up arrow*, or *space* rotates the block.
+ - *enter*, *tab*, or `0` drops the block immediately.
+ - `P` pauses and unpauses the game.
+ - *backspace*, or *delete* starts a new game.
+ - `Q` or hitting escape twice, quits immediately.
+ - `H` shows or hides the help panel which lists these keybindings.
+ - `R` shows or hides the high score table.
+
+Additionally on GNU/Linux systems any joystick can be used to control the game.
+The first available joystick is used automatically, or you can specify a
+joystick device with the `-j` commandline option. If you'd rather disable
+joystick control, use the option `-j /dev/null`.
+
+When using a joystick, even axes are mapped to left/right, Odd axes are mapped
+to up/down, the first four buttons rotate, and the rest of the buttons pause
+and unpause.
+
+There is no way to remap the controls without changing the source code at this
+time.
+
+
+Custom character set
+--------------------
+For terminals with support for custom loadable character sets, you can instruct
+termtris to use graphical blocks instead of the bracket characters with the `-g`
+command-line argument. If `TERM` is set to a known supported terminal, graphical
+blocks are enabled automatically, use the `-T` option to disable and inhibit
+auto-detection.
+
+Different terminals have different capabilities when it comes to soft character
+sets. Termtris will try to detect the terminal type and choose the correct soft
+font to load, but if it fails or you want to force a different terminal type,
+make sure to define the `TERM` environent variable. If `TERM` is undefined, or
+an unknown or unsupported terminal type, termtris will try to interrogate the
+terminal itself about its capabilities.
+
+The DOS version of termtris will automatically enable graphical blocks when it
+detects an EGA or VGA/SVGA graphics card. Use `-g` or `-T` to enable or disable
+it explicitly.
+
+
+License
+-------
+Copyright (C) 2019-2023 John Tsiombikas
+
+This program is free software. Feel free to use, modify, and/or redistribute it
+under the terms of the GNU General Public License version 3, or at your option,
+any later version published by the Free Software Foundation. See COPYING for
+details.
+
+
+Download
+--------
+### Source code
+Current release (1.9): http://nuclear.mutantstargoat.com/sw/termtris/termtris-1.9.tar.gz
+
+Releases are also mirrored on github: https://github.com/jtsiomb/termtris/releases
+
+Alternatively you may clone the latest version of the source code from the git
+repository:
+
+ git clone https://github.com/jtsiomb/termtris
+
+### Pre-compiled
+Building from source is highly recommended. If however you want to try a
+pre-compiled binary, you might be able to find something for your system in:
+http://nuclear.mutantstargoat.com/sw/termtris/bin
+Not all releases are compiled for all platforms. Any binaries available here are
+provided purely for convenience. Do not open bug reports about a pre-compiled
+binary not running, or misbehaving on your system; compile it yourself first.
+
+Another source of binaries, is the github automated builds. Head over to the
+"actions" page (https://github.com/jtsiomb/termtris/actions), choose the latest
+successful build for your platform, and download the binary from the "artifacts"
+section at the bottom.
+
+Pre-compiled binaries might also be available in your package management system of
+choice, but please do not submit any bug reports without first trying to build
+termtris yourself from the latest git source code.
+ - Debian/Ubuntu/Mint: `apt-get install termtris`
+
+The latest pre-compiled DOS binary (currently 1.9) is always available at:
+http://nuclear.mutantstargoat.com/sw/termtris/termtris.com
+
+Build (UNIX)
+------------
+There are no external dependencies. Simply type `make` to build, and `make
+install` if you wish to install termtris.
+
+Default installation prefix is `/usr/local`. Change the first line of the
+`Makefile` if you'd rather install somewhere else, or simply invoke the install
+rule like so:
+
+ make PREFIX=/some/other/prefix install
+
+If you don't have GNU make and GCC installed, or you'd rather use the default
+make utility and C compiler on your UNIX system, you can use `Makefile.sgi`:
+
+ make -f Makefile.sgi
+
+(originally included for building on SGI IRIX with MIPSPro and the native make).
+
+
+Build (DOS)
+-----------
+To build the DOS version of termtris you'll need some version of the Watcom or
+OpenWatcom C compiler, and the NASM assembler:
+
+ make -f Makefile.wat
diff --git a/apps/termtris/UPSTREAM b/apps/termtris/UPSTREAM
new file mode 100644
index 0000000..442ef4f
--- /dev/null
+++ b/apps/termtris/UPSTREAM
@@ -0,0 +1 @@
+7c5435dd4e93ffc10f3b5c68fe1ae9718a365258
diff --git a/apps/termtris/VT1200.md b/apps/termtris/VT1200.md
new file mode 100644
index 0000000..a040ec4
--- /dev/null
+++ b/apps/termtris/VT1200.md
@@ -0,0 +1,194 @@
+# termtris on the VT1200
+
+`apps/termtris/` is a port of John Tsiombikas' `termtris`
+(https://github.com/jtsiomb/termtris, commit `7c5435dd4e93ffc10f3b5c68fe1ae9718a365258`)
+that runs **inside the VT1200 as a native TMS34010 program**, drawing through
+the terminal's own ROM Xlib and reading real X11 key events from the local X
+server. There is no host process and no terminal escape output: the COFF is
+loaded into VT1200 RAM and executed by the TMS34010.
+
+
+
+## What runs where
+
+| piece | file | role |
+|---|---|---|
+| game rules | `src/game.c` (upstream) | unchanged logic; one portability edit (`srand(vt_rand_seed())` instead of `time(0)`) |
+| term callbacks | `src/vt1200/x11.c` | 80×24 character-cell grid drawn with `XFillRectangle`/`XDrawString` |
+| event loop | `src/vt1200/main.c` | `XNextEvent` + `XLookupString`, key map, millisecond clock, `sleep()` |
+| scores | `src/vt1200/scoredb.c` | RAM-only high-score table (no filesystem) |
+| libc shims | `src/vt1200/compat.c`, `stdio.h`, `inttypes.h` | `sprintf`/`fflush`/`putchar`, fixed-width types |
+| Xlib | `src/vt1200/xlib.h` | ROM entry points by bit address, called with the TI C ABI |
+| startup | `src/vt1200/entry.asm`, `cinit.asm`, `cinitz.asm` | set `A14 = _cstack`, run the `.cinit` table, `calla _main` |
+| toolchain | `build.sh` | TI TMS340 Family Code Generation Tools r5.01 (1990-11) under 2ine |
+
+## Building
+
+```sh
+cd apps/termtris
+OUTNAME=termtris ./build.sh src/vt1200/main.c src/game.c \
+ src/vt1200/scoredb.c src/vt1200/x11.c src/vt1200/compat.c \
+ src/vt1200/xgfix.c
+```
+
+`build.sh` unpacks the r5.01 SDK zips, runs `gspac`/`gspopt`/`gspcg`/`gspa` and
+`gsplnk` through `lx_loader`, and writes `build/termtris.coff` + `.map` (without
+`OUTNAME` it uses the first source's name). Set `NINE=` to the 2ine build
+directory (default `/home/arti/os2-work/2ine/build`). The 2ine-hosted tools
+routinely segfault *after* producing their output, so the script clears the
+expected output, treats a non-empty file as success, and retries a missing one;
+`gspac` needs `-i.` for the angle-bracket shim headers.
+
+The r5.01 programs are 16-bit OS/2 `NE` executables. `lx_loader` is 32-bit but
+maps them through 16-bit LDT segments, and a Linux kernel built without
+`CONFIG_X86_16BIT` rejects those (`modify_ldt` returns `EINVAL`) — the loader
+then aborts at its first segment even though it starts. On such a host
+`build.sh` probes for that failure and runs the same loader through
+`qemu-i386`, whose linux-user `modify_ldt` does implement 16-bit segments. Set
+`LX_RUNNER=qemu-i386` to force a runner, or install `qemu-user` so the fallback
+is available. The generated COFF is unchanged; only its header timestamp
+differs between builds.
+
+Link map (relevant addresses are **bit** addresses, like everything the
+TMS34010 sees):
+
+```
+.text 018A0000 .data 018A0000 .cinit 018B4A60
+.bss 01A00000
+ENTRY POINT SYMBOL: "_start" address: 018a0000
+```
+
+The `.cinit` address moves when the code changes; this block matches the
+current build's `build/termtris.map`.
+
+An empty `.cinit` makes the linker point `cinit` at `.text`, and the entry
+walker would then read an instruction as a record count; when the map says the
+section is empty `build.sh` relinks with the one-word `CINITZ.obj` terminator.
+
+## The Xlib context (the one thing that had to be discovered)
+
+A freshly `create_process`ed child has `*(*(proc + 0x100)) == NULL`. The ROM
+Xlib's `_XEnq` does `XG = *(*(proc+0x100)); free_list = *(XG + 0x198)`, so
+`XNextEvent` reads low-RAM garbage as queue nodes and delivers nothing. The
+port installs a zeroed 1 KiB block as the per-process Xlib context before
+`XOpenDisplay` (`src/vt1200/xgfix.c`), which is a RAM write only — the ROM is
+untouched. With that in place the smoke test receives a real
+`KeyPress (type=2, keycode=194)` and `XLookupString` returns `a`.
+
+## Rendering
+
+The frame is an 80×24 grid of 6×13 cells (the default GC font, baseline +10),
+so the window is 480×312. The VT1200 raster is **one bit deep**, so the backend
+renders like the game's monochrome mode (colour is dropped) and uses the bold
+bit (`0x80`) as reverse video for emphasis — a choice of this backend, not the
+upstream ANSI convention (which emits SGR bold and leaves the colours alone). The playfield is therefore black
+spaces and the tetrominoes are the `[`/`]` tiles, exactly what a 1-bit terminal
+can show.
+
+`vt_x11_flush()` repaints whole rows rather than cells: one `XFillRectangle`
+for the row background, one `XDrawString` for its 80 characters, plus
+fill/string pairs for reversed spans, then a single `XFlush`. This matters. An
+earlier per-cell version (four requests per cell) filled the X socket faster
+than the in-machine server could drain it, and an `XSync` per row deadlocked
+the client: the debug progress marker stopped at row 20 (`0x00010014`) and the
+game never reached its main loop. Batching the row makes a full 80×24 redraw a
+few hundred bytes of requests and the loop runs (measured at the VR319
+default: 650 iterations between frames 2500 and 3200).
+
+## Timing and input
+
+`now_ms()` accumulates the 16-bit counter at bit `0x1E93C0` into a 32-bit
+millisecond count; `sleep_ms()` calls the ROM `sleep` at `0x3FB33A20` with a
+1–10 ms clamp. The game's own `update()` decides the tick interval (887 ms at
+level 0).
+
+Keys arrive as X11 `KeyPress` events and go through `XLookupString`; letters are
+lower-cased and handed to `game_input()`. Arrows are sent as the game's own CSI
+codes (`0x9b` + `A`/`B`/`C`/`D`), which `game_input` translates back to
+`w`/`s`/`d`/`a`. `0x7F` is Delete (Backspace is `0x08`). `FocusOut` sends `p`
+and `FocusIn` sends `p` again, but the flag only tracks focus, not the game's
+own pause state: pressing `p` and then moving focus away resumes the game while
+it is unfocused.
+
+`ExposureMask` is deliberately **not** selected: the map-time `Expose` arrives
+before the game has a current piece, and the game's full-redraw path then draws
+a non-existent piece over the top row — visible as a blanked border with stray
+`X` tiles. The acceptance run never obscures the window (the Terminal Manager
+sits beside it), so the mask buys nothing there. See `HANDOFF.md`.
+
+## Running it in MAME
+
+The emulator must be built from the driver in this tree; an older
+`/home/arti/code/k-space/mame0289/vt1200` may still carry the pre-VR319
+geometry:
+
+```sh
+harness/mame/build.sh # rebuild the vt1200 subtarget (JOBS=4 on small hosts)
+```
+
+Then:
+
+```sh
+apps/termtris/verify.sh # build MAME + run every test (see HANDOFF.md)
+apps/termtris/tests/play.sh # load, click, snapshot
+apps/termtris/tests/play_keys.sh # move / panels / quit acceptance runs
+apps/termtris/run.sh # same run, interactive session
+```
+
+Under the hood the loader payload is dropped at bit `0x01880000` and the COFF at
+`0x01900000`; at frame 2500 the script enters `dwt/loader/build/loader.bin`,
+which copies the sections to their linked addresses and calls
+`create_process`. The X server is already up because the run uses
+`VT1200_SKIP_LEVEL1=1` to reach the OS.
+
+## Evidence
+
+| file | what it shows |
+|---|---|
+| `evidence/termtris_frame3300.png` | the board, score/level/lines panels, preview and `Toggle (H)elp` |
+| `evidence/termtris_move_3200.png` | after `a d s w 0`: a piece has been moved/rotated/dropped to the bottom-left and a new one spawned |
+| `evidence/termtris_panels_3200.png` | after `h` and `r`: the help text and the high-score list (all `VT1200`) |
+| `evidence/termtris_quit_3200.png` | after `q`: same screen, and the run reports `quit=1` |
+| `evidence/render_frame3400.png` | the cell-grid renderer test pattern |
+
+Acceptance values from the last full run (`play_keys.sh`, MAME 0.289 with this
+tree's driver at the **VR319 default**, 1280×1024 frames). The evidence PNGs
+above were regenerated in the same run; they are 1280×1024, where the earlier
+ones were 1024×864 VR150 captures.
+
+```
+move DIAG: loops=650 events=18 last=3 focus=00400001 rev=0 quit=0
+panels DIAG: loops=648 events=12 last=3 focus=00400001 rev=0 quit=0
+quit DIAG: loops=555 events=10 last=3 focus=00400001 rev=0 quit=1
+```
+
+`focus=00400001` is the window this process created, sampled on the click's
+`ButtonRelease` (it is the only window in the run). It shows the click reached
+the right window, not that each later key did; the key-delivery proof is
+`quit=1`, the game's own global after `q`. The loop counts are higher than the
+old VR150 figures
+(`354`/`346`/`300`) only because the VR319 raster runs at a different emulated
+frame rate; the event counts, window, and quit result are unchanged, and the
+loader/keys still act at frames 2500/3095–3190.
+
+## Limits, stated plainly
+
+* **No sound.** The game's bell is a no-op.
+* **Scores are RAM-only.** `read_scores`/`save_score` keep ten entries in
+ `.bss`; they vanish when the process exits. The VT1200 has no writable
+ filesystem for a child.
+* **Startup is retried.** If `XOpenDisplay`/window creation fails while the
+ display server is still settling, `main()` retries up to 40 times with a
+ 50 ms sleep before giving up. Observed as an intermittent early exit.
+* **`q` ends the game loop but the window stays on screen.** `quit=1` is
+ observable in RAM and `main()` returns; the frame captured about a second
+ later still shows the window, so the X connection is not torn down by process
+ exit in this OS. Treat that as an observation, not a designed behaviour.
+* **The board is text.** Tetrominoes are `[`/`]` tiles, not filled blocks — the
+ only thing a 1-bit cell can show without a custom font.
+* **An occluding window is not repainted.** Because `ExposureMask` is off (the
+ map-time `Expose` bug above), cells covered by another window stay stale until
+ the game next draws them. The acceptance run does not exercise this.
+
+The ROM (`vt1200_v22.bin`, md5 `b46a3e442ccb86134d2356bd70d22fd2`) is never
+modified; the port lives entirely in RAM.
diff --git a/apps/termtris/build.sh b/apps/termtris/build.sh
new file mode 100755
index 0000000..27abea8
--- /dev/null
+++ b/apps/termtris/build.sh
@@ -0,0 +1,199 @@
+#!/bin/sh
+# build.sh -- build a VT1200 COFF with TI TMS34010 r5.01 under 2ine.
+#
+# apps/termtris/build.sh SOURCE.c [SOURCE.c ...] [EXTRA.obj ...]
+#
+# The first .c is the main program; the output is build/.coff. entry.asm
+# and cinit.asm are always assembled and linked. The 2ine loader is outside the
+# repo: point NINE at its build directory (default /home/arti/os2-work/2ine/build).
+set -eu
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/../.." && pwd)
+WORK="$DIR/work"
+OUT="$DIR/build"
+NINE="${NINE:-/home/arti/os2-work/2ine/build}"
+LX="$NINE/lx_loader"
+SDK="$ROOT/tools/tms34010-sdk/1990-11 TMS340 Family SDK"
+Z1="$SDK/1990-11-19 TMS340 Family Code Generation Tools (1 of 2) r5.01 rev2564062-1641.zip"
+Z2="$SDK/1990-11-19 TMS340 Family Code Generation Tools (2 of 2) r5.01 rev2564062-1641.zip"
+
+if [ ! -x "$LX" ]; then
+ echo "build.sh: no 2ine lx_loader at $LX (set NINE=...)" >&2
+ exit 1
+fi
+if [ ! -f "$Z1" ] || [ ! -f "$Z2" ]; then
+ echo "build.sh: r5.01 SDK zips not found under $SDK" >&2
+ exit 1
+fi
+
+mkdir -p "$WORK" "$OUT"
+if [ ! -x "$WORK/gspac.exe" ]; then
+ unzip -oq "$Z1" -d "$WORK"
+ unzip -oq "$Z2" -d "$WORK"
+fi
+
+# The r5.01 tools are 16-bit OS/2 NE programs, which 2ine runs through 16-bit
+# LDT segments. A Linux kernel built without CONFIG_X86_16BIT rejects those
+# (modify_ldt returns EINVAL), so the loader aborts at its first segment even
+# though it is a 32-bit binary. Detect that with a probe run and, when needed,
+# drive the same loader through qemu-i386, whose linux-user emulation does
+# implement the 16-bit LDT. Set LX_RUNNER to a command prefix (for example
+# "qemu-i386") to force one; leave it unset to auto-detect.
+LX_RUNNER=${LX_RUNNER:-}
+if [ -z "$LX_RUNNER" ]; then
+ probe=$( ( cd "$WORK" && "$LX" ./gspac.exe ) 2>&1 || true )
+ case $probe in
+ *failed\ to\ allocate\ LDT\ selector*|*modify_ldt*)
+ if command -v qemu-i386 >/dev/null 2>&1; then
+ LX_RUNNER=qemu-i386
+ else
+ echo "build.sh: this kernel has no 16-bit LDT support and qemu-i386 is not installed" >&2
+ echo "build.sh: install qemu-user, or set LX_RUNNER to a working runner" >&2
+ exit 1
+ fi
+ ;;
+ esac
+fi
+for so in "$NINE"/lib*.so; do
+ [ -e "$so" ] && ln -sf "$so" "$WORK/"
+done
+cp "$DIR/src/vt1200/"*.h "$WORK/" 2>/dev/null || true
+cp "$DIR/src/"*.h "$WORK/" 2>/dev/null || true
+cp "$DIR/src/vt1200/entry.asm" "$DIR/src/vt1200/cinit.asm" "$DIR/src/vt1200/cinitz.asm" "$WORK/"
+
+# Collect objects. C sources are copied under their uppercase basename because
+# the OS/2 tools are case-sensitive on this host.
+OBJS=""
+MAIN=""
+for arg in "$@"; do
+ case "$arg" in
+ *.c)
+ base=$(basename "$arg" .c | tr 'a-z' 'A-Z')
+ [ -n "$MAIN" ] || MAIN="$base"
+ cp "$arg" "$WORK/$base.C"
+ OBJS="$OBJS $base"
+ ;;
+ *.obj)
+ cp "$arg" "$WORK/"
+ OBJS="$OBJS $(basename "$arg")"
+ ;;
+ *.asm)
+ base=$(basename "$arg" .asm | tr 'a-z' 'A-Z')
+ cp "$arg" "$WORK/$base.ASM"
+ OBJS="$OBJS $base"
+ ;;
+ *)
+ echo "build.sh: unsupported input: $arg" >&2
+ exit 1
+ ;;
+ esac
+done
+if [ -z "$MAIN" ]; then
+ echo "build.sh: give at least one .c source" >&2
+ exit 1
+fi
+
+# The 2ine-hosted tools frequently crash during teardown after doing their work
+# (exit 139 / 134). Treat an output file as success, and retry a missing one.
+run() {
+ _out=$1
+ shift
+ i=0
+ _log=
+ while [ "$i" -lt 5 ]; do
+ # A stage that crashed after a partial write must not be mistaken
+ # for success, and an output left by an earlier build must not
+ # hide a failing stage now.
+ rm -f "$WORK/$_out"
+ _log=$( ( cd "$WORK" && ${LX_RUNNER:-} "$LX" "$@" ) 2>&1 || true )
+ if [ -s "$WORK/$_out" ]; then
+ return 0
+ fi
+ i=$((i + 1))
+ done
+ echo "build.sh: stage failed to produce $WORK/$_out: $*" >&2
+ [ -n "$_log" ] && printf '%s\n' "$_log" | tail -10 >&2
+ return 1
+}
+
+compile_c() {
+ base=$1
+ rm -f "$WORK/$base.IF" "$WORK/$base.OPT" "$WORK/$base.ASM" "$WORK/$base.obj"
+ run "$base.IF" ./gspac.exe -k -i. "$base.C" "$base.IF"
+ run "$base.OPT" ./gspopt.exe -k -O2 "$base.IF" "$base.OPT"
+ run "$base.ASM" ./gspcg.exe -m "$base.OPT" "$base.ASM" "$base.TMP"
+ run "$base.obj" ./gspa.exe "$base.ASM"
+}
+
+compile_asm() {
+ base=$1
+ rm -f "$WORK/$base.obj"
+ run "$base.obj" ./gspa.exe "$base.ASM"
+}
+
+
+# Compile every collected object exactly once, in the order given.
+for arg in "$@"; do
+ case "$arg" in
+ *.c) compile_c "$(basename "$arg" .c | tr 'a-z' 'A-Z')" ;;
+ *.asm) compile_asm "$(basename "$arg" .asm | tr 'a-z' 'A-Z')" ;;
+ esac
+done
+compile_asm ENTRY
+compile_asm CINIT
+compile_asm CINITZ
+
+OUTNAME=${OUTNAME:-$(printf '%s' "$MAIN" | tr 'A-Z' 'a-z')}
+CMD="$WORK/$MAIN.CMD"
+{
+ printf '%s\n' '-a'
+ printf '%s\n' "-o $MAIN.out"
+ printf '%s\n' "-m $MAIN.map"
+ printf '%s\n' '-e _start'
+ printf '%s\n' 'CINIT.obj'
+ printf '%s\n' 'ENTRY.obj'
+ for arg in "$@"; do
+ case "$arg" in
+ *.c) printf '%s\n' "$(basename "$arg" .c | tr 'a-z' 'A-Z').obj" ;;
+ *.asm) printf '%s\n' "$(basename "$arg" .asm | tr 'a-z' 'A-Z').obj" ;;
+ *.obj) printf '%s\n' "$(basename "$arg")" ;;
+ esac
+ done
+ printf '%s\n' '-l rts.lib'
+ printf '%s\n' 'MEMORY'
+ printf '%s\n' '{'
+ printf '%s\n' ' prog: origin = 018A0000h, length = 20000h'
+ printf '%s\n' ' ram: origin = 01A00000h, length = 40000h'
+ printf '%s\n' '}'
+ printf '%s\n' 'SECTIONS'
+ printf '%s\n' '{'
+ printf '%s\n' ' .text: {} > prog'
+ printf '%s\n' ' .data: {} > prog'
+ printf '%s\n' ' .cinit: {} > prog'
+ printf '%s\n' ' .bss: {} > ram'
+ printf '%s\n' '}'
+} > "$CMD"
+sed -i 's/$/\r/' "$CMD"
+
+rm -f "$WORK/$MAIN.out" "$WORK/$MAIN.map"
+run "$MAIN.out" ./gsplnk.exe "$MAIN.CMD"
+if [ ! -f "$WORK/$MAIN.map" ]; then
+ echo "build.sh: no link map" >&2
+ exit 1
+fi
+
+# An empty .cinit makes the linker's `cinit` symbol point at .text; the entry's
+# cinit walker would then treat an instruction as a record count. Relink with
+# a one-word terminator when the map says the section is empty.
+CSIZE=$(awk '$1 == ".cinit" {print $4; exit}' "$WORK/$MAIN.map")
+if [ "$CSIZE" = "00000000" ]; then
+ sed -i 's/CINIT\.obj/CINITZ.obj/' "$CMD"
+ rm -f "$WORK/$MAIN.out" "$WORK/$MAIN.map"
+ run "$MAIN.out" ./gsplnk.exe "$MAIN.CMD"
+fi
+
+cp "$WORK/$MAIN.out" "$OUT/$OUTNAME.coff"
+sed 's/\r$//' "$WORK/$MAIN.map" > "$OUT/$OUTNAME.map"
+echo "build.sh: $OUT/$OUTNAME.coff ($(wc -c < "$OUT/$OUTNAME.coff") bytes)"
+sed -n '1,40p' "$OUT/$OUTNAME.map"
diff --git a/apps/termtris/evidence/render_frame3400.png b/apps/termtris/evidence/render_frame3400.png
new file mode 100644
index 0000000..5ced90f
Binary files /dev/null and b/apps/termtris/evidence/render_frame3400.png differ
diff --git a/apps/termtris/evidence/termtris_frame3300.png b/apps/termtris/evidence/termtris_frame3300.png
new file mode 100644
index 0000000..09b0683
Binary files /dev/null and b/apps/termtris/evidence/termtris_frame3300.png differ
diff --git a/apps/termtris/evidence/termtris_move_3200.png b/apps/termtris/evidence/termtris_move_3200.png
new file mode 100644
index 0000000..3f6884b
Binary files /dev/null and b/apps/termtris/evidence/termtris_move_3200.png differ
diff --git a/apps/termtris/evidence/termtris_panels_3200.png b/apps/termtris/evidence/termtris_panels_3200.png
new file mode 100644
index 0000000..e676784
Binary files /dev/null and b/apps/termtris/evidence/termtris_panels_3200.png differ
diff --git a/apps/termtris/evidence/termtris_quit_3200.png b/apps/termtris/evidence/termtris_quit_3200.png
new file mode 100644
index 0000000..98f9897
Binary files /dev/null and b/apps/termtris/evidence/termtris_quit_3200.png differ
diff --git a/apps/termtris/run.sh b/apps/termtris/run.sh
new file mode 100755
index 0000000..b877824
--- /dev/null
+++ b/apps/termtris/run.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+# run.sh -- load termtris into a running VT1200 OS under MAME and play it.
+#
+# apps/termtris/run.sh # click the window active, then play
+# apps/termtris/run.sh --build # rebuild the COFF first
+#
+# The emulated keyboard and tablet are driven by MAME's host input, so the
+# terminal's X cursor follows the host pointer. Quit with Ctrl-C in the
+# terminal running MAME, or press 'q' in the game (it stops the game loop).
+set -eu
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+LOADER="$ROOT/dwt/loader/build/loader.bin"
+COFF="$DIR/build/termtris.coff"
+
+if [ "${1:-}" = "--build" ]; then
+ OUTNAME=termtris "$DIR/build.sh" "$DIR/src/vt1200/main.c" "$DIR/src/game.c" \
+ "$DIR/src/vt1200/scoredb.c" "$DIR/src/vt1200/x11.c" \
+ "$DIR/src/vt1200/compat.c" "$DIR/src/vt1200/xgfix.c"
+fi
+
+if [ ! -f "$COFF" ]; then
+ echo "run.sh: no $COFF (run with --build)" >&2
+ exit 1
+fi
+if [ ! -f "$LOADER" ]; then
+ echo "run.sh: no loader payload at $LOADER" >&2
+ exit 1
+fi
+
+# The game is loaded at frame 2500, once the OS X server is up.
+exec env VT1200_SKIP_LEVEL1=1 \
+ LOADER_AT=2500 LOADER_END=100000000 \
+ LOADER_BIN="$LOADER" LOADER_COFF="$COFF" LOADER_OUT="$DIR/build" \
+ "$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -skip_gameinfo -debug -debugger none \
+ -lightgun -lightgun_device mouse \
+ -autoboot_script "$DIR/tests/play.lua" -autoboot_delay 0
diff --git a/apps/termtris/src/game.c b/apps/termtris/src/game.c
new file mode 100644
index 0000000..6e7fe04
--- /dev/null
+++ b/apps/termtris/src/game.c
@@ -0,0 +1,1116 @@
+/*
+Termtris - a tetris game for ANSI/VT100 terminals
+Copyright (C) 2019-2023 John Tsiombikas
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see .
+*/
+#include
+#include
+#include
+#include
+#include
+#include "game.h"
+#include "pieces.h"
+#include "term.h"
+#include "scoredb.h"
+
+extern unsigned vt_rand_seed(void);
+
+
+int quit;
+long tick_interval;
+int use_bell;
+int monochrome;
+int use_gfxchar;
+int onlyascii;
+int blackpf;
+int rotstep = 1;
+int term_width, term_height;
+
+
+enum { ERASE_PIECE, DRAW_PIECE };
+
+/* dimensions of the whole screen */
+#define SCR_ROWS 20
+#define SCR_COLS 20
+
+/* dimensions of the playfield */
+#define PF_ROWS 18
+#define PF_COLS 10
+/* offset of the playfield from the left side of the screen */
+#define PF_XOFFS 2
+#define PF_YOFFS 0
+
+#define CHAR(c, fg, bg) \
+ ((uint16_t)(c) | ((uint16_t)(fg) << 12) | ((uint16_t)(bg) << 8))
+
+int scr[SCR_COLS * SCR_ROWS];
+
+static void update_cur_piece(void);
+static void addscore(int nlines);
+static void print_numbers(void);
+static void print_help(void);
+static void print_slist(void);
+static void full_redraw(void);
+static int spawn(void);
+static int collision(int piece, const int *pos);
+static void stick(int piece, const int *pos);
+static void erase_completed(void);
+static void draw_piece(int piece, const int *pos, int rot, int mode);
+static void clear(void);
+static void drawbg(void);
+static void drawpf(int start_row);
+static void draw_line(int row, int blink);
+static void wrtile(int tileid);
+
+
+static int pos[2], next_pos[2];
+static int cur_piece, next_piece, prev_piece;
+static int cur_rot, prev_rot;
+static int complines[4];
+static int num_complines;
+static int gameover;
+static int pause;
+static int just_spawned;
+static int show_help, show_highscores;
+
+static struct score_entry *scores;
+static struct score_entry cur_score;
+
+static int term_xoffs = 20, term_yoffs = 0; /* TODO detect terminal size to set offsets */
+
+static const int preview_pos[] = {13, 13};
+
+enum {
+ TILE_BLACK,
+ TILE_PF,
+ TILE_PFSEP,
+ TILE_GAMEOVER,
+ TILE_LPIECE,
+ TILE_JPIECE,
+ TILE_IPIECE,
+ TILE_OPIECE,
+ TILE_ZPIECE,
+ TILE_SPIECE,
+ TILE_TPIECE,
+ TILE_FRM_TL,
+ TILE_FRM_TR,
+ TILE_FRM_BL,
+ TILE_FRM_BR,
+ TILE_FRM_LTEE,
+ TILE_FRM_RTEE,
+ TILE_FRM_HLINE,
+ TILE_FRM_LVLINE,
+ TILE_FRM_RVLINE
+};
+#define FIRST_PIECE_TILE TILE_LPIECE
+
+static uint16_t tiles[][2] = {
+ { CHAR(' ', BLACK, BLACK), CHAR(' ', BLACK, BLACK) }, /* black tile */
+ { CHAR(' ', WHITE, WHITE), CHAR(' ', WHITE, WHITE) }, /* playfield background */
+ { CHAR(G_CHECKER, WHITE, BLACK), CHAR(G_CHECKER, WHITE, BLACK) }, /* well separator */
+ { CHAR(G_CROSS, RED, BLACK), CHAR(G_CROSS, RED, BLACK) }, /* gameover fill */
+ { CHAR('[', WHITE, YELLOW), CHAR(']', WHITE, YELLOW) }, /* L */
+ { CHAR('[', WHITE, GREEN), CHAR(']', WHITE, GREEN) }, /* J */
+ { CHAR('[', WHITE, CYAN), CHAR(']', WHITE, CYAN) }, /* I */
+ { CHAR('[', WHITE, BLUE), CHAR(']', WHITE, BLUE) }, /* O */
+ { CHAR('[', WHITE, RED), CHAR(']', WHITE, RED) }, /* Z */
+ { CHAR('[', WHITE, MAGENTA), CHAR(']', WHITE, MAGENTA) }, /* S */
+ { CHAR('[', WHITE, BLACK), CHAR(']', WHITE, BLACK) }, /* T */
+ /* frame tiles */
+ { CHAR(G_UL_CORNER, WHITE, BLACK), CHAR(G_HLINE, WHITE, BLACK) }, /* top-left corner */
+ { CHAR(G_HLINE, WHITE, BLACK), CHAR(G_UR_CORNER, WHITE, BLACK) }, /* top-right corner */
+ { CHAR(G_LL_CORNER, WHITE, BLACK), CHAR(G_HLINE, WHITE, BLACK) }, /* bottom-left corner */
+ { CHAR(G_HLINE, WHITE, BLACK), CHAR(G_LR_CORNER, WHITE, BLACK) }, /* bottom-right corner */
+ { CHAR(G_L_TEE, WHITE, BLACK), CHAR(G_HLINE, WHITE, BLACK) }, /* left-T */
+ { CHAR(G_HLINE, WHITE, BLACK), CHAR(G_R_TEE, WHITE, BLACK) }, /* right-T */
+ { CHAR(G_HLINE, WHITE, BLACK), CHAR(G_HLINE, WHITE, BLACK) }, /* horizontal line */
+ { CHAR(G_VLINE, WHITE, BLACK), CHAR(' ', WHITE, BLACK) }, /* left vertical line */
+ { CHAR(' ', WHITE, BLACK), CHAR(G_VLINE, WHITE, BLACK) } /* right vertical line */
+};
+
+static const char *bgdata[SCR_ROWS] = {
+ " #..........#{-----}",
+ " #..........#(.....)",
+ " #..........#[-----]",
+ " #..........#.......",
+ " #..........# ",
+ " #..........#{-----}",
+ " #..........#(.....)",
+ " #..........#(.....)",
+ " #..........#>-----<",
+ " #..........#(.....)",
+ " #..........#(.....)",
+ " #..........#[-----]",
+ " #..........# {----}",
+ " #..........# (....)",
+ " #..........# (....)",
+ " #..........# (....)",
+ " #..........# (....)",
+ " #..........# [----]",
+ " ############ ",
+ " "
+};
+
+#define NUM_LEVELS 21
+static const long level_speed[NUM_LEVELS] = {
+ 887, 820, 753, 686, 619, 552, 469, 368, 285, 184,
+ 167, 151, 134, 117, 107, 98, 88, 79, 69, 60, 50
+};
+
+static const char *helpstr[] = {
+ " Toggle (H)elp",
+ "",
+ "left,right,down/asd:",
+ " move piece",
+ " up/w/space: rotate",
+ "enter/tab/0: drop",
+ " backsp/del: restart",
+ " P: pause",
+ " Q: quit",
+ "",
+ " High scores:",
+ " termtris -s"
+};
+
+int init_game(void)
+{
+ int i, j;
+ int *row = scr;
+
+ scores = read_scores(0, 10);
+ memset(&cur_score, 0, sizeof cur_score);
+
+ srand(vt_rand_seed());
+
+ pause = 0;
+ gameover = 0;
+ num_complines = 0;
+ tick_interval = level_speed[0];
+ cur_piece = -1;
+ prev_piece = 0;
+ next_piece = rand() % NUM_PIECES;
+
+ term_init();
+ term_setcolor(WHITE, BLACK);
+ term_clearscr();
+ term_cursor(0);
+
+ if(blackpf) {
+ tiles[TILE_PF][0] = CHAR(' ', BLACK, BLACK);
+ tiles[TILE_PF][1] = CHAR(' ', BLACK, BLACK);
+ tiles[TILE_TPIECE][0] = CHAR('[', BLACK, WHITE);
+ tiles[TILE_TPIECE][1] = CHAR(']', BLACK, WHITE);
+ }
+
+ /* fill the screen buffer, and draw */
+ for(i=0; i':
+ tile = TILE_FRM_LTEE;
+ break;
+ case '<':
+ tile = TILE_FRM_RTEE;
+ break;
+ case '-':
+ tile = TILE_FRM_HLINE;
+ break;
+ case '(':
+ tile = TILE_FRM_LVLINE;
+ break;
+ case ')':
+ tile = TILE_FRM_RVLINE;
+ break;
+ case ' ':
+ default:
+ tile = TILE_BLACK;
+ }
+ row[j] = tile;
+ }
+ row += SCR_COLS;
+ }
+
+ if(onlyascii) {
+ for(i=0; i= 0) {
+ ptr = scr + (row + PF_YOFFS) * SCR_COLS + PF_XOFFS;
+ for(i=0; i> 8;
+
+ if(blink > 6) {
+ erase_completed();
+ wait_display();
+ num_complines = 0;
+ return 0;
+ }
+
+ for(i=0; i= tick_interval) {
+ if(cur_piece >= 0) {
+ just_spawned = 0;
+ next_pos[0] = pos[0] + 1;
+ if(collision(cur_piece, next_pos)) {
+ next_pos[0] = pos[0];
+ stick(cur_piece, next_pos);
+ return 0;
+ }
+ } else {
+ /* respawn */
+ if(spawn() == -1) {
+ gameover = 1;
+ return 0;
+ }
+ }
+
+ dt -= tick_interval;
+ prev_tick = msec;
+ }
+
+ update_cur_piece();
+ return tick_interval - dt;
+}
+
+#define MAX_TILE_OPS 32
+struct tileop {
+ int op;
+ int x, y;
+};
+
+static int diff_piece(int pp, const int *ppos, int prot, int np, const int *npos, int nrot, struct tileop *ops)
+{
+ int i, j, num, inval = 0;
+ unsigned char *p = pieces[pp][prot];
+ struct tileop tmpop, *op = ops;
+
+ for(i=0; i<4; i++) {
+ op->op = ERASE_PIECE;
+ op->x = ppos[1] + BLKX(*p);
+ op->y = ppos[0] + BLKY(*p);
+ if(op->y >= 0) {
+ op++;
+ }
+ p++;
+ }
+ p = pieces[np][nrot];
+ for(i=0; i<4; i++) {
+ op->op = DRAW_PIECE;
+ op->x = npos[1] + BLKX(*p);
+ op->y = npos[0] + BLKY(*p);
+ if(op->y >= 0) {
+ op++;
+ }
+ p++;
+ }
+
+ /* find double-changes to the same tile */
+ num = op - ops;
+ for(i=0; iop == -1) {
+ op++;
+ continue;
+ }
+
+ /* if the new op is not under the cursor, handle cursor movement */
+ if(op->x != x || op->y != y) {
+ term_setcursor(term_yoffs + op->y + PF_YOFFS, term_xoffs +
+ (op->x + PF_XOFFS) * 2);
+ x = op->x;
+ y = op->y;
+ }
+ tile = op->op == ERASE_PIECE ? TILE_PF : FIRST_PIECE_TILE + piece;
+ wrtile(tile);
+ x++;
+ op++;
+ }
+}
+
+static void update_cur_piece(void)
+{
+ int numops;
+ struct tileop ops[MAX_TILE_OPS];
+
+ if(cur_piece < 0) return;
+
+ if((numops = diff_piece(cur_piece, pos, prev_rot, cur_piece, next_pos, cur_rot, ops)) > 0) {
+ draw_tileops(cur_piece, ops, numops);
+
+ /* for terminals which can't hide the cursor, move it out of the way */
+ term_setcursor(0, 0);
+ fflush(stdout);
+
+ memcpy(pos, next_pos, sizeof pos);
+ prev_rot = cur_rot;
+ }
+}
+
+
+static void addscore(int nlines)
+{
+ static const int stab[] = {40, 100, 300, 1200}; /* bonus per line completed */
+
+ cur_score.score += stab[nlines - 1] * (cur_score.level + 1);
+ cur_score.lines += nlines;
+
+ cur_score.level = cur_score.lines / 10;
+ if(cur_score.level > NUM_LEVELS - 1) {
+ cur_score.level = NUM_LEVELS - 1;
+ }
+
+ tick_interval = level_speed[cur_score.level];
+
+ print_numbers();
+
+ if(show_highscores) {
+ print_slist();
+ }
+}
+
+static void print_numbers(void)
+{
+ char buf[16];
+
+ term_setcolor(BLACK, WHITE);
+
+ term_setcursor(term_yoffs + 3, term_xoffs + 14 * 2);
+ sprintf(buf, "%10ld", cur_score.score);
+ term_putstr(buf, 7);
+
+ term_setcursor(term_yoffs + 7, term_xoffs + 17 * 2);
+ sprintf(buf, "%2ld", cur_score.level);
+ term_putstr(buf, 7);
+
+ term_setcursor(term_yoffs + 10, term_xoffs + 14 * 2);
+ sprintf(buf, "%8ld", cur_score.lines);
+ term_putstr(buf, 7);
+}
+
+static void print_help(void)
+{
+ int i;
+
+ for(i=0; i 63) len = 63;
+
+ if(len <= 0) {
+ buf[0] = 0;
+ return buf;
+ }
+
+ if(strlen(s) <= len) {
+ strcpy(buf, s);
+ return buf;
+ }
+
+ if(len < 3) {
+ memset(buf, ' ', len);
+ buf[len] = 0;
+ return buf;
+ }
+
+ for(i=0; i 127) maxlen = 127;
+
+ term_setcursor(1, x);
+ if(maxlen < 15) {
+ term_putstr("Sco(r)es", 0x70);
+ } else {
+ term_putstr("Toggle Sco(r)es", 0x70);
+ }
+
+ sc = scores;
+ for(i=0; i<10; i++) {
+ term_setcursor(i + 3, x);
+ if(!show_highscores) {
+fillblank: memset(fmtbuf, ' ', maxlen);
+ fmtbuf[maxlen] = 0;
+ term_putstr(fmtbuf, 0x70);
+ if(sc) sc = sc->next;
+ continue;
+ }
+
+ color = 0x70;
+ if(!printed_cur) {
+ if(!sc || cur_score.score > sc->score) {
+ cur_score.next = sc;
+ sc = &cur_score;
+ printed_cur = 1;
+ color |= 0x80;
+ }
+ } else {
+ if(!sc) goto fillblank;
+ }
+
+ user = (sc->user && *sc->user) ? sc->user : "***";
+
+ sclen = sprintf(fmtbuf, "%ld", sc->score);
+ if(sclen > maxlen - 5) goto fillblank;
+ namelen = maxlen - sclen - 5;
+
+ if(strlen(user) <= namelen) {
+ sprintf(fmt, "%%2d. %%-%ds %%ld", namelen);
+ len = sprintf(fmtbuf, fmt, i + 1, user, sc->score);
+ } else {
+ len = sprintf(fmtbuf, "%2d. %s %ld", i + 1, clampstr(user, namelen), sc->score);
+ }
+ if(len < maxlen) {
+ memset(fmtbuf + len, ' ', maxlen - len);
+ }
+ fmtbuf[maxlen] = 0;
+ sc = sc->next;
+
+ term_putstr(fmtbuf, color);
+ }
+}
+
+#define C0 0x9b
+#define SS3 0x8f
+
+static void runesc(int csi, char *buf)
+{
+ if(csi != C0) return;
+
+ if(buf[1] == 0) {
+ switch(buf[0]) {
+ case 'A':
+ game_input('w'); /* up */
+ break;
+ case 'B':
+ game_input('s'); /* down */
+ break;
+ case 'C':
+ game_input('d'); /* right */
+ break;
+ case 'D':
+ game_input('a'); /* left */
+ break;
+ default:
+ break;
+ }
+ return;
+ }
+
+ if(strcmp(buf, "28~") == 0) {
+ /* help key */
+ game_input('h');
+ }
+}
+
+void game_input(int c)
+{
+ static int esc, csi;
+ static int esctop;
+ static char escbuf[64];
+
+ if(esc) {
+ esc = 0;
+ if(c == 27) {
+ quit = 1;
+ return;
+ }
+
+ switch(c) {
+ case '[':
+ csi = C0;
+ return;
+ case 'O':
+ csi = SS3;
+ return;
+ default:
+ break;
+ }
+ }
+
+ if(csi) {
+ if(c < 0x20 || c >= 0x80) {
+ csi = 0;
+ esctop = 0;
+ }
+
+ escbuf[esctop++] = c;
+
+ if(c >= 0x40) {
+ int prevcsi = csi;
+ escbuf[esctop] = 0;
+ csi = 0;
+ esctop = 0;
+ runesc(prevcsi, escbuf);
+ }
+ return;
+ }
+
+ switch(c) {
+ case 27:
+ esc = 1;
+ break;
+
+ case C0:
+ esc = 1;
+ csi = C0;
+ break;
+
+ case 'q':
+ quit = 1;
+ break;
+
+ case 'a':
+ if(!pause) {
+ next_pos[1] = pos[1] - 1;
+ if(collision(cur_piece, next_pos)) {
+ next_pos[1] = pos[1];
+ }
+ }
+ break;
+
+ case 'd':
+ if(!pause) {
+ next_pos[1] = pos[1] + 1;
+ if(collision(cur_piece, next_pos)) {
+ next_pos[1] = pos[1];
+ }
+ }
+ break;
+
+ case 'w':
+ case ' ':
+ if(!pause) {
+ prev_rot = cur_rot;
+ cur_rot = (cur_rot + rotstep) & 3;
+ if(collision(cur_piece, next_pos)) {
+ cur_rot = prev_rot;
+ }
+ }
+ break;
+
+ case 's':
+ /* ignore drops until the first update after a spawn */
+ if(cur_piece >= 0 && !just_spawned && !pause && !gameover) {
+ next_pos[0] = pos[0] + 1;
+ if(collision(cur_piece, next_pos)) {
+ next_pos[0] = pos[0];
+ update_cur_piece();
+ stick(cur_piece, next_pos); /* stick immediately */
+ }
+ }
+ break;
+
+ case '\t':
+ case '\n':
+ case '\r':
+ case '0':
+ if(!pause && !gameover && cur_piece >= 0) {
+ next_pos[0] = pos[0] + 1;
+ while(!collision(cur_piece, next_pos)) {
+ next_pos[0]++;
+ }
+ next_pos[0]--;
+ update_cur_piece();
+ stick(cur_piece, next_pos); /* stick immediately */
+ }
+ break;
+
+ case 'p':
+ if(gameover) {
+ init_game();
+ } else {
+ pause ^= 1;
+ }
+ break;
+
+ case '\b':
+ case 127:
+ init_game();
+ break;
+
+ case 'h':
+ show_help ^= 1;
+ print_help();
+ fflush(stdout);
+ break;
+
+ case 'r':
+ show_highscores ^= 1;
+ print_slist();
+ fflush(stdout);
+ break;
+
+ case '`':
+ full_redraw();
+ break;
+
+ default:
+ /*fprintf(stderr, "unhandled input: %x\n", c);*/
+ break;
+ }
+}
+
+static void full_redraw(void)
+{
+ clear();
+ print_help();
+ drawbg();
+ print_slist();
+ print_numbers();
+ drawpf(0);
+ if(!gameover) {
+ draw_piece(next_piece, preview_pos, 0, DRAW_PIECE);
+ draw_piece(cur_piece, next_pos, cur_rot, DRAW_PIECE);
+ term_setcursor(0, 0);
+ fflush(stdout);
+ }
+ wait_display();
+}
+
+static int spawn(void)
+{
+ int r, tries = 2;
+ int numops;
+ struct tileop ops[MAX_TILE_OPS];
+
+ do {
+ r = rand() % NUM_PIECES;
+ } while(tries-- > 0 && (r | prev_piece | next_piece) == prev_piece);
+
+ if((numops = diff_piece(next_piece, preview_pos, 0, r, preview_pos, 0, ops)) > 0) {
+ draw_tileops(r, ops, numops);
+ term_setcursor(0, 0);
+ fflush(stdout);
+ }
+
+ cur_piece = next_piece;
+ next_piece = r;
+
+ prev_rot = cur_rot = 0;
+ pos[0] = piece_spawnpos[cur_piece][0];
+ next_pos[0] = pos[0] + 1;
+ pos[1] = next_pos[1] = PF_COLS / 2 + piece_spawnpos[cur_piece][1];
+
+ if(collision(cur_piece, next_pos)) {
+ return -1;
+ }
+
+ just_spawned = 1;
+ return 0;
+}
+
+static int collision(int piece, const int *pos)
+{
+ int i;
+ unsigned char *p = pieces[piece][cur_rot];
+
+ for(i=0; i<4; i++) {
+ int x = PF_XOFFS + pos[1] + BLKX(*p);
+ int y = PF_YOFFS + pos[0] + BLKY(*p);
+ p++;
+
+ if(y < 0) continue;
+
+ if(scr[y * SCR_COLS + x] != TILE_PF) return 1;
+ }
+
+ return 0;
+}
+
+static void stick(int piece, const int *pos)
+{
+ int i, j, nblank;
+ int *pfline;
+ unsigned char *p = pieces[piece][cur_rot];
+
+ num_complines = 0;
+ prev_piece = cur_piece; /* used by the spawn routine */
+ cur_piece = -1;
+
+ for(i=0; i<4; i++) {
+ int x = pos[1] + BLKX(*p);
+ int y = pos[0] + BLKY(*p);
+ p++;
+
+ pfline = scr + (y + PF_YOFFS) * SCR_COLS + PF_XOFFS;
+ pfline[x] = piece + FIRST_PIECE_TILE;
+
+ nblank = 0;
+ for(j=0; j complines[i]) {
+ int tmp = complines[j];
+ complines[j] = complines[i];
+ complines[i] = tmp;
+ }
+ }
+ }
+
+ toprow = srow = drow = PF_ROWS - 1;
+ dptr = pfstart + drow * SCR_COLS;
+
+ for(i=0; i= sizeof tiles / sizeof *tiles) {
+ return;
+ }
+
+ for(i=0; i<2; i++) {
+ uint16_t c = tiles[tileid][i];
+ unsigned char cc = c & 0xff;
+ unsigned char ca = c >> 8;
+
+ if(use_gfxchar && (cc == '[' || cc == ']')) {
+ ca <<= 4; /* for gfx blocks bg->fg and bg=0 */
+#if defined(MSDOS) || defined(__COM__)
+ if(term_type == TERM_PCBIOS) {
+ if(!ca) ca = 0x80; /* special case for T which has black bg */
+ } else
+#endif
+ if(!ca) ca = 0x70; /* special case for T which has black bg */
+ }
+
+ term_ibmchar(cc, ca);
+ }
+}
diff --git a/apps/termtris/src/game.h b/apps/termtris/src/game.h
new file mode 100644
index 0000000..30139e7
--- /dev/null
+++ b/apps/termtris/src/game.h
@@ -0,0 +1,43 @@
+/*
+Termtris - a tetris game for ANSI/VT100 terminals
+Copyright (C) 2019-2023 John Tsiombikas
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see .
+*/
+#ifndef GAME_H_
+#define GAME_H_
+
+extern int quit;
+extern long tick_interval;
+extern int use_bell;
+extern int monochrome;
+extern int use_gfxchar;
+extern int onlyascii;
+extern int blackpf;
+extern int rotstep;
+
+extern int term_width, term_height;
+
+int init_game(void);
+void cleanup_game(void);
+
+long update(long msec);
+void game_input(int c);
+
+/* wait for any pending drawing to be completed before proceeding
+ * implemented in main.c
+ */
+void wait_display(void);
+
+#endif /* GAME_H_ */
diff --git a/apps/termtris/src/pieces.h b/apps/termtris/src/pieces.h
new file mode 100644
index 0000000..2fec2f0
--- /dev/null
+++ b/apps/termtris/src/pieces.h
@@ -0,0 +1,84 @@
+/*
+Termtris - a tetris game for ANSI/VT100 terminals
+Copyright (C) 2019-2022 John Tsiombikas
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see .
+*/
+#ifndef PIECES_H_
+#define PIECES_H_
+
+#define BLK(x, y) ((x) | ((y) << 4))
+#define BLKX(c) ((unsigned char)(c) & 0xf)
+#define BLKY(c) ((unsigned char)(c) >> 4)
+
+#define NUM_PIECES 7
+
+static unsigned char pieces[NUM_PIECES][4][4] = {
+ /* L block */
+ {
+ {BLK(0, 1), BLK(0, 2), BLK(1, 1), BLK(2, 1)},
+ {BLK(0, 0), BLK(1, 0), BLK(1, 1), BLK(1, 2)},
+ {BLK(0, 1), BLK(1, 1), BLK(2, 1), BLK(2, 0)},
+ {BLK(1, 0), BLK(1, 1), BLK(1, 2), BLK(2, 2)}
+ },
+ /* J block */
+ {
+ {BLK(0, 1), BLK(1, 1), BLK(2, 1), BLK(2, 2)},
+ {BLK(1, 0), BLK(1, 1), BLK(1, 2), BLK(0, 2)},
+ {BLK(0, 0), BLK(0, 1), BLK(1, 1), BLK(2, 1)},
+ {BLK(1, 0), BLK(2, 0), BLK(1, 1), BLK(1, 2)}
+ },
+ /* I block */
+ {
+ {BLK(0, 2), BLK(1, 2), BLK(2, 2), BLK(3, 2)},
+ {BLK(1, 0), BLK(1, 1), BLK(1, 2), BLK(1, 3)},
+ {BLK(0, 2), BLK(1, 2), BLK(2, 2), BLK(3, 2)},
+ {BLK(1, 0), BLK(1, 1), BLK(1, 2), BLK(1, 3)}
+ },
+ /* O block */
+ {
+ {BLK(1, 1), BLK(2, 1), BLK(1, 2), BLK(2, 2)},
+ {BLK(1, 1), BLK(2, 1), BLK(1, 2), BLK(2, 2)},
+ {BLK(1, 1), BLK(2, 1), BLK(1, 2), BLK(2, 2)},
+ {BLK(1, 1), BLK(2, 1), BLK(1, 2), BLK(2, 2)}
+ },
+ /* Z block */
+ {
+ {BLK(0, 1), BLK(1, 1), BLK(1, 2), BLK(2, 2)},
+ {BLK(0, 1), BLK(1, 1), BLK(1, 0), BLK(0, 2)},
+ {BLK(0, 1), BLK(1, 1), BLK(1, 2), BLK(2, 2)},
+ {BLK(0, 1), BLK(1, 1), BLK(1, 0), BLK(0, 2)}
+ },
+ /* S block */
+ {
+ {BLK(1, 1), BLK(2, 1), BLK(0, 2), BLK(1, 2)},
+ {BLK(0, 0), BLK(0, 1), BLK(1, 1), BLK(1, 2)},
+ {BLK(1, 1), BLK(2, 1), BLK(0, 2), BLK(1, 2)},
+ {BLK(0, 0), BLK(0, 1), BLK(1, 1), BLK(1, 2)}
+ },
+ /* T block */
+ {
+ {BLK(0, 1), BLK(1, 1), BLK(2, 1), BLK(1, 2)},
+ {BLK(1, 0), BLK(1, 1), BLK(1, 2), BLK(0, 1)},
+ {BLK(0, 1), BLK(1, 1), BLK(2, 1), BLK(1, 0)},
+ {BLK(1, 0), BLK(1, 1), BLK(1, 2), BLK(2, 1)}
+ }
+};
+
+static int piece_spawnpos[NUM_PIECES][2] = {
+ {-1, -2}, {-1, -2}, {-2, -2}, {-1, -2}, {-1, -2}, {-1, -2}, {-1, -2}
+};
+
+
+#endif /* PIECES_H_ */
diff --git a/apps/termtris/src/scoredb.h b/apps/termtris/src/scoredb.h
new file mode 100644
index 0000000..d9d3706
--- /dev/null
+++ b/apps/termtris/src/scoredb.h
@@ -0,0 +1,45 @@
+/*
+Termtris - a tetris game for ANSI/VT100 terminals
+Copyright (C) 2019-2023 John Tsiombikas
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see .
+*/
+#ifndef SCOREDB_H_
+#define SCOREDB_H_
+
+#include
+
+#if defined(MSDOS) || defined(__COM__)
+/* the DOS version of score_entry is simpler, because scores are embedded in
+ * the executable itself in binary format.
+ */
+#define MAX_NAME 36
+struct score_entry {
+ char user[MAX_NAME];
+ long score, lines, level;
+ struct score_entry *next;
+};
+#else
+struct score_entry {
+ char *user;
+ long score, lines, level;
+ struct score_entry *next;
+};
+#endif
+
+struct score_entry *read_scores(FILE *fp, int max_scores);
+int save_score(struct score_entry *sc);
+int print_scores(int num);
+
+#endif /* SCOREDB_H_ */
diff --git a/apps/termtris/src/term.h b/apps/termtris/src/term.h
new file mode 100644
index 0000000..ddfbf21
--- /dev/null
+++ b/apps/termtris/src/term.h
@@ -0,0 +1,62 @@
+/*
+Termtris - a tetris game for TERM/VT100 terminals
+Copyright (C) 2019-2022 John Tsiombikas
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see .
+*/
+#ifndef TERM_H_
+#define TERM_H_
+
+enum {
+ G_DIAMOND = 0x04,
+ G_CHECKER = 0xb1,
+ G_LR_CORNER = 0xd9,
+ G_UR_CORNER = 0xbf,
+ G_UL_CORNER = 0xda,
+ G_LL_CORNER = 0xc0,
+ G_CROSS = 0xc5,
+ G_HLINE = 0xc4,
+ G_L_TEE = 0xc3,
+ G_R_TEE = 0xb4,
+ G_B_TEE = 0xc1,
+ G_T_TEE = 0xc2,
+ G_VLINE = 0xb3,
+ G_CDOT = 0xf8
+};
+
+enum { BLACK, BLUE, GREEN, CYAN, RED, MAGENTA, YELLOW, WHITE };
+#define BOLD 8
+
+enum {
+ TERM_ANSI,
+ TERM_VT52,
+ TERM_ADM3,
+ TERM_PCBIOS = 0xb105
+};
+
+extern char *termenv;
+extern int term_type;
+
+extern void (*term_reset)(void);
+extern void (*term_clearscr)(void);
+extern void (*term_setcursor)(int row, int col);
+extern void (*term_cursor)(int show);
+extern void (*term_setcolor)(int fg, int bg);
+/* convert a PC cga/ega/vga char+attr to an TERM sequence and write it to stdout */
+extern void (*term_ibmchar)(unsigned char c, unsigned char attr);
+
+void term_init(void);
+void term_putstr(const char *s, unsigned char attr);
+
+#endif /* TERM_H_ */
diff --git a/apps/termtris/src/vt1200/cinit.asm b/apps/termtris/src/vt1200/cinit.asm
new file mode 100644
index 0000000..f3a3a9a
--- /dev/null
+++ b/apps/termtris/src/vt1200/cinit.asm
@@ -0,0 +1,4 @@
+ .sect ".cinit"
+ .globl cinit
+cinit:
+ .end
diff --git a/apps/termtris/src/vt1200/cinitz.asm b/apps/termtris/src/vt1200/cinitz.asm
new file mode 100644
index 0000000..9966837
--- /dev/null
+++ b/apps/termtris/src/vt1200/cinitz.asm
@@ -0,0 +1,5 @@
+ .sect ".cinit"
+ .globl cinit
+cinit:
+ .word 0
+ .end
diff --git a/apps/termtris/src/vt1200/compat.c b/apps/termtris/src/vt1200/compat.c
new file mode 100644
index 0000000..b216082
--- /dev/null
+++ b/apps/termtris/src/vt1200/compat.c
@@ -0,0 +1,137 @@
+/*
+ * compat.c -- the small libc surface termtris needs on the VT1200.
+ *
+ * The TI r5.01 runtime has no stdio and no sprintf. This implements exactly
+ * the decimal/string formats game.c uses. Arguments are walked manually
+ * because the SDK's va_arg macro does not survive the 1990 compiler's
+ * preprocessor here; the TI ABI lays the varargs contiguously below &fmt.
+ */
+#include
+
+FILE *stdout;
+extern int strlen(char *);
+
+int fflush(FILE *fp)
+{
+ (void)fp;
+ return 0;
+}
+
+int putchar(int c)
+{
+ (void)c;
+ return c;
+}
+
+static char *fmt_num(char *out, long v, int width, int zero, int left, int unsig)
+{
+ char tmp[24];
+ int n = 0, neg = 0, pad, i;
+ unsigned long u;
+
+ if(v < 0 && !unsig) {
+ neg = 1;
+ u = (unsigned long)(-v);
+ } else {
+ u = (unsigned long)v;
+ }
+ do {
+ tmp[n++] = (char)('0' + (u % 10UL));
+ u /= 10UL;
+ } while(u);
+
+ pad = width - (n + neg);
+ if(pad < 0) pad = 0;
+
+ if(left) {
+ if(neg) *out++ = '-';
+ while(n) *out++ = tmp[--n];
+ for(i = 0; i < pad; i++) *out++ = ' ';
+ } else if(zero) {
+ if(neg) *out++ = '-';
+ for(i = 0; i < pad; i++) *out++ = '0';
+ while(n) *out++ = tmp[--n];
+ } else {
+ for(i = 0; i < pad; i++) *out++ = ' ';
+ if(neg) *out++ = '-';
+ while(n) *out++ = tmp[--n];
+ }
+ return out;
+}
+
+int sprintf(char *buf, char *fmt, ...)
+{
+ char *out = buf;
+ char *ap = (char *)&fmt;
+
+ while(*fmt) {
+ int left = 0, zero = 0, width = 0, unsig = 0, islong = 0;
+
+ if(*fmt != '%') {
+ *out++ = *fmt++;
+ continue;
+ }
+ fmt++;
+ if(*fmt == '%') {
+ *out++ = '%';
+ fmt++;
+ continue;
+ }
+ if(*fmt == '-') { left = 1; fmt++; }
+ if(*fmt == '0') { zero = 1; fmt++; }
+ while(*fmt >= '0' && *fmt <= '9') {
+ width = width * 10 + (*fmt - '0');
+ fmt++;
+ }
+ if(*fmt == 'l') { islong = 1; fmt++; }
+ if(*fmt == 'u') { unsig = 1; }
+
+ switch(*fmt) {
+ case 'd':
+ case 'u':
+ {
+ long v;
+ ap -= sizeof(long);
+ v = *(long *)ap;
+ (void)islong;
+ out = fmt_num(out, v, width, zero, left, unsig);
+ fmt++;
+ }
+ break;
+
+ case 's':
+ {
+ char *s;
+ int len, i, pad;
+ ap -= sizeof(char *);
+ s = *(char **)ap;
+ if(!s) s = "(null)";
+ len = strlen(s);
+ pad = width - len;
+ if(pad < 0) pad = 0;
+ if(!left) for(i = 0; i < pad; i++) *out++ = ' ';
+ for(i = 0; i < len; i++) *out++ = s[i];
+ if(left) for(i = 0; i < pad; i++) *out++ = ' ';
+ fmt++;
+ }
+ break;
+
+ case 'c':
+ {
+ int c;
+ ap -= sizeof(int);
+ c = *(int *)ap;
+ *out++ = (char)c;
+ fmt++;
+ }
+ break;
+
+ default:
+ *out++ = '%';
+ if(*fmt) *out++ = *fmt++;
+ break;
+ }
+ }
+ *out = 0;
+ return (int)(out - buf);
+}
diff --git a/apps/termtris/src/vt1200/entry.asm b/apps/termtris/src/vt1200/entry.asm
new file mode 100644
index 0000000..a4700ad
--- /dev/null
+++ b/apps/termtris/src/vt1200/entry.asm
@@ -0,0 +1,28 @@
+ .text
+ .globl _start
+ .globl _main
+ .globl cinit
+_start:
+ setf 32,0,1
+ movi _cstack,a14
+ move a14,a13
+
+ ; process the .cinit table: u16 word count, u32 destination, data words
+ movi cinit,a9
+ci_loop:
+ setf 16,0,0
+ move *a9+,a11
+ jrz ci_done
+ move *a9+,a10,1
+ci_copy:
+ move *a9+,*a10+
+ dsjs a11,ci_copy
+ jruc ci_loop
+ci_done:
+ setf 32,0,1
+ move a13,a14
+ calla _main
+ rets
+
+ .bss _cstack,32768,16
+ .end
diff --git a/apps/termtris/src/vt1200/inttypes.h b/apps/termtris/src/vt1200/inttypes.h
new file mode 100644
index 0000000..18189af
--- /dev/null
+++ b/apps/termtris/src/vt1200/inttypes.h
@@ -0,0 +1,13 @@
+/*
+ * inttypes.h -- the fixed-width types game.c uses, for the 1990 TI compiler.
+ */
+#ifndef VT_INTTYPES_H_
+#define VT_INTTYPES_H_
+
+typedef unsigned char uint8_t;
+typedef signed short int16_t;
+typedef unsigned short uint16_t;
+typedef signed long int32_t;
+typedef unsigned long uint32_t;
+
+#endif
diff --git a/apps/termtris/src/vt1200/main.c b/apps/termtris/src/vt1200/main.c
new file mode 100644
index 0000000..a440aa7
--- /dev/null
+++ b/apps/termtris/src/vt1200/main.c
@@ -0,0 +1,171 @@
+/*
+ * main.c -- the VT1200 termtris event loop.
+ *
+ * The game's update()/init_game() draw through the backend's term_* callbacks;
+ * this file owns the X11 event drain, the real-time clock, and the key map.
+ */
+#include "game.h"
+#include "x11.h"
+#include "xlib.h"
+
+extern int init_game(void);
+extern long update(long msec);
+extern void game_input(int c);
+
+extern int vt_install_xg(void);
+
+static vt_u32 evbuf[24];
+static long ms_base;
+static int ms_last = -1;
+static int focused;
+static int vt_paused;
+volatile vt_u32 dbg_loops, dbg_events, dbg_last, dbg_focus, dbg_rev;
+
+long now_ms(void)
+{
+ int now;
+ if(ms_last < 0) {
+ ms_last = *(volatile unsigned short *)0x001E93C0UL;
+ ms_base = 0;
+ return 0;
+ }
+ now = *(volatile unsigned short *)0x001E93C0UL;
+ ms_base += (long)(unsigned short)(now - ms_last);
+ ms_last = now;
+ return ms_base;
+}
+
+/*
+ * Seed for the game's PRNG. now_ms() returns 0 on its first call (it only
+ * latches the counter there), so seeding from it gives a constant; read the
+ * free-running 16-bit tick directly instead.
+ */
+unsigned vt_rand_seed(void)
+{
+ return (unsigned)*(volatile unsigned short *)0x001E93C0UL;
+}
+
+void sleep_ms(int ms)
+{
+ if(ms < 1) ms = 1;
+ if(ms > 10) ms = 10;
+ VT_SLEEP(ms);
+}
+
+int vt_poll_event(void)
+{
+ return *(vt_u32 *)((char *)vt_dpy + 0x54) != 0;
+}
+
+static void map_keysym(vt_u32 ks, char ch, int n)
+{
+ switch(ks) {
+ case 0xFF51UL: /* Left */
+ game_input(0x9b); game_input('D');
+ return;
+ case 0xFF53UL: /* Right */
+ game_input(0x9b); game_input('C');
+ return;
+ case 0xFF52UL: /* Up */
+ game_input(0x9b); game_input('A');
+ return;
+ case 0xFF54UL: /* Down */
+ game_input(0x9b); game_input('B');
+ return;
+ case 0xFF0DUL: /* Return */
+ game_input('\n');
+ return;
+ case 0xFF08UL: /* BackSpace */
+ game_input('\b');
+ return;
+ case 0xFF09UL: /* Tab */
+ game_input('\t');
+ return;
+ case 0xFF1BUL: /* Escape */
+ game_input(27);
+ return;
+ default:
+ break;
+ }
+ if(n > 0) {
+ if(ch >= 'A' && ch <= 'Z') ch = (char)(ch + ('a' - 'A'));
+ game_input((int)(unsigned char)ch);
+ }
+}
+
+void vt_handle_event(void)
+{
+ char buf[8];
+ vt_u32 ks;
+ int n;
+
+ VT_XNEXT(vt_dpy, (void *)evbuf);
+ dbg_events = dbg_events + 1;
+ dbg_last = evbuf[0];
+ if(evbuf[0] == 2) { /* KeyPress */
+ ks = 0;
+ n = VT_XLOOKUP((void *)evbuf, buf, 8, &ks, 0);
+ map_keysym(ks, n > 0 ? buf[0] : 0, n);
+ } else if(evbuf[0] == 5) { /* ButtonRelease: sample focus */
+ vt_u32 fw;
+ int rv;
+ VT_XGETFOCUS(vt_dpy, &fw, &rv);
+ dbg_focus = fw;
+ dbg_rev = (vt_u32)rv;
+ } else if(evbuf[0] == 9) { /* FocusIn */
+ focused = 1;
+ if(vt_paused) { /* resume only what we paused */
+ game_input('p');
+ vt_paused = 0;
+ }
+ } else if(evbuf[0] == 10) { /* FocusOut */
+ if(focused && !vt_paused) {
+ game_input('p'); /* 'p' toggles pause in game_input */
+ vt_paused = 1;
+ }
+ focused = 0;
+ }
+}
+
+void wait_display(void)
+{
+ vt_x11_flush();
+}
+
+int main(void)
+{
+ long d;
+
+ /* The display server may still be coming up when this process is
+ * created; retry for a while before giving up. */
+ {
+ int tries;
+ for(tries = 0; tries < 40; tries++) {
+ if(vt_x11_init() == 0) break;
+ VT_SLEEP(50);
+ }
+ if(tries == 40) return 1;
+ }
+ onlyascii = 1;
+ use_gfxchar = 0;
+ monochrome = 1; /* the VT1200 raster is 1 bit deep */
+ if(init_game() == -1)
+ return 2;
+ vt_x11_flush();
+
+ for(;;) {
+ dbg_loops = dbg_loops + 1;
+ VT_XSYNC(vt_dpy, 0);
+ while(vt_poll_event()) {
+ vt_handle_event();
+ }
+ if(quit) {
+ cleanup_game();
+ break;
+ }
+ d = update(now_ms());
+ sleep_ms((int)d);
+ vt_x11_flush();
+ }
+ return 0;
+}
diff --git a/apps/termtris/src/vt1200/scoredb.c b/apps/termtris/src/vt1200/scoredb.c
new file mode 100644
index 0000000..0c227af
--- /dev/null
+++ b/apps/termtris/src/vt1200/scoredb.c
@@ -0,0 +1,76 @@
+/*
+ * scoredb.c -- RAM-only high scores (the VT1200 has no filesystem).
+ */
+#include
+#include
+#include "scoredb.h"
+
+#define NENT 10
+
+char *username = "VT1200";
+
+static struct score_entry list[NENT];
+static char names[NENT][16];
+static int inited;
+
+static void init_list(void)
+{
+ int i;
+ if(inited) return;
+ inited = 1;
+ for(i = 0; i < NENT; i++) {
+ strcpy(names[i], "VT1200");
+ list[i].user = names[i];
+ list[i].score = 0;
+ list[i].lines = 0;
+ list[i].level = 0;
+ list[i].next = (i + 1 < NENT) ? &list[i + 1] : 0;
+ }
+}
+
+struct score_entry *read_scores(FILE *fp, int max_scores)
+{
+ (void)fp;
+ (void)max_scores;
+ init_list();
+ return &list[0];
+}
+
+static void copy_entry(struct score_entry *dst, struct score_entry *src)
+{
+ long sc = src->score, ln = src->lines, lv = src->level;
+ char *u = (src->user && *src->user) ? src->user : username;
+ strncpy(dst->user, u, 15);
+ dst->user[15] = 0;
+ dst->score = sc;
+ dst->lines = ln;
+ dst->level = lv;
+}
+
+int save_score(struct score_entry *sc)
+{
+ int pos, i;
+ if(!sc) return 0;
+ init_list();
+ for(pos = 0; pos < NENT; pos++) {
+ if(sc->score > list[pos].score) break;
+ }
+ if(pos >= NENT) return 0;
+ for(i = NENT - 1; i > pos; i--) {
+ long s = list[i - 1].score, l = list[i - 1].lines, v = list[i - 1].level;
+ char tmp[16];
+ strcpy(tmp, list[i - 1].user);
+ strcpy(list[i].user, tmp);
+ list[i].score = s;
+ list[i].lines = l;
+ list[i].level = v;
+ }
+ copy_entry(&list[pos], sc);
+ return 1;
+}
+
+int print_scores(int num)
+{
+ (void)num;
+ return 0;
+}
diff --git a/apps/termtris/src/vt1200/stdio.h b/apps/termtris/src/vt1200/stdio.h
new file mode 100644
index 0000000..7a3b79c
--- /dev/null
+++ b/apps/termtris/src/vt1200/stdio.h
@@ -0,0 +1,16 @@
+/*
+ * stdio.h -- the tiny subset termtris needs on the VT1200.
+ * There is no stdio in the TI r5.01 runtime; compat.c provides sprintf.
+ */
+#ifndef VT_STDIO_H_
+#define VT_STDIO_H_
+
+typedef int FILE;
+
+extern FILE *stdout;
+
+int sprintf(char *buf, char *fmt, ...);
+int fflush(FILE *fp);
+int putchar(int c);
+
+#endif
diff --git a/apps/termtris/src/vt1200/x11.c b/apps/termtris/src/vt1200/x11.c
new file mode 100644
index 0000000..9d89af5
--- /dev/null
+++ b/apps/termtris/src/vt1200/x11.c
@@ -0,0 +1,207 @@
+/*
+ * x11.c -- a small character-cell terminal that draws through the VT1200 ROM
+ * Xlib. The game's term_* callbacks feed an 80x24 grid; vt_x11_flush() repaints
+ * each dirty row with one XFillRectangle (background) and one XDrawString (the
+ * row's 80 characters), which keeps the request stream small enough for the
+ * in-machine X server to drain.
+ *
+ * Geometry is the default GC's font, measured on the real server: 6x13 cells,
+ * baseline +10. Do not change the cell metrics without re-measuring.
+ */
+#include "xlib.h"
+#include "x11.h"
+#include "term.h"
+#include "game.h"
+
+#define COLS 80
+#define ROWS 24
+#define CELL_W 6
+#define CELL_H 13
+#define BASE_OFF 10
+
+struct vt_cell {
+ unsigned short ch;
+ unsigned char inv, dirty;
+};
+
+static struct vt_cell cells[ROWS * COLS];
+static int cur_row, cur_col;
+static int cur_fg, cur_bg;
+
+void *vt_dpy;
+vt_u32 vt_win;
+vt_u32 vt_gc;
+volatile vt_u32 vt_x11_progress; /* debug: 0xFFFFFF when a flush finished */
+
+/* term.h's callback objects (term.c is not compiled for the VT1200). */
+void (*term_reset)(void);
+void (*term_clearscr)(void);
+void (*term_setcursor)(int row, int col);
+void (*term_cursor)(int show);
+void (*term_setcolor)(int fg, int bg);
+void (*term_ibmchar)(unsigned char c, unsigned char attr);
+char *termenv;
+int term_type = TERM_ANSI;
+
+vt_u32 vt_root_window(void *dpy)
+{
+ vt_u32 screen;
+ screen = *(vt_u32 *)((char *)dpy + 0x90);
+ return *(vt_u32 *)((char *)screen + 8);
+}
+
+int vt_x11_init(void)
+{
+ vt_x11_progress = 11;
+ if(!vt_install_xg())
+ return -1;
+ vt_x11_progress = 12;
+ vt_dpy = VT_XOPEN("0::0");
+ if(!vt_dpy)
+ return -1;
+ vt_x11_progress = 13;
+ vt_win = VT_XCREATE(vt_dpy, vt_root_window(vt_dpy), 80, 80, 480, 312, 2, 1, 0);
+ if(!vt_win)
+ return -1;
+ vt_x11_progress = 14;
+ VT_XSELECT(vt_dpy, vt_win, 0x22000FUL);
+ vt_gc = VT_XGC(vt_dpy, vt_win, 0, 0);
+ if(!vt_gc)
+ return -1;
+ VT_XMAP(vt_dpy, vt_win);
+ VT_XSYNC(vt_dpy, 0);
+ return 0;
+}
+
+void x11_clearscr(void)
+{
+ int i;
+ for(i = 0; i < ROWS * COLS; i++) {
+ cells[i].ch = ' ';
+ cells[i].inv = 0;
+ cells[i].dirty = 1;
+ }
+ cur_row = cur_col = 0;
+}
+
+void x11_reset(void)
+{
+ x11_clearscr();
+}
+
+void x11_cursor(int show)
+{
+ (void)show;
+}
+
+void x11_setcolor(int fg, int bg)
+{
+ cur_fg = fg;
+ cur_bg = bg;
+}
+
+void x11_setcursor(int row, int col)
+{
+ if(row < 0) row = 0;
+ if(row >= ROWS) row = ROWS - 1;
+ if(col < 0) col = 0;
+ if(col >= COLS) col = COLS - 1;
+ cur_row = row;
+ cur_col = col;
+}
+
+void x11_ibmchar(unsigned char c, unsigned char attr)
+{
+ struct vt_cell *p;
+ if(cur_row < 0 || cur_row >= ROWS) return;
+ if(cur_col < 0 || cur_col >= COLS) return;
+ p = &cells[cur_row * COLS + cur_col];
+ p->ch = c;
+ /* The VT1200 raster is one bit deep, so follow the game's monochrome
+ * convention (ansi.c -m): colour is dropped, the bold bit reverses. */
+ p->inv = (attr & 0x80) ? 1 : 0;
+ p->dirty = 1;
+ cur_col++;
+ if(cur_col >= COLS) {
+ cur_col = 0;
+ cur_row++;
+ }
+}
+
+void term_putstr(const char *s, unsigned char attr)
+{
+ while(*s) {
+ x11_ibmchar((unsigned char)*s++, attr);
+ }
+}
+
+void vt_x11_flush(void)
+{
+ int r, c, any = 0;
+ char line[COLS + 1];
+
+ vt_x11_progress = 1;
+ for(r = 0; r < ROWS; r++) {
+ struct vt_cell *row = &cells[r * COLS];
+ int dirty = 0;
+
+ for(c = 0; c < COLS; c++) {
+ if(row[c].dirty) dirty = 1;
+ }
+ if(!dirty) continue;
+
+ vt_x11_progress = 0x100 + (vt_u32)r;
+ any = 1;
+
+ /* repaint the whole row: black background, then the text.
+ * One fill + one string per row keeps the request stream small
+ * enough that the in-machine X server can drain it. */
+ VT_XSETFG(vt_dpy, vt_gc, 0);
+ VT_XFILL(vt_dpy, vt_win, vt_gc, 0, r * CELL_H, COLS * CELL_W, CELL_H);
+
+ for(c = 0; c < COLS; c++) {
+ line[c] = row[c].ch ? (char)row[c].ch : ' ';
+ }
+ line[COLS] = 0;
+
+ VT_XSETFG(vt_dpy, vt_gc, 1);
+ VT_XDRAW(vt_dpy, vt_win, vt_gc, 0, r * CELL_H + BASE_OFF, line, COLS);
+
+ /* inverse (bold) cells: white block with black text */
+ for(c = 0; c < COLS; c++) {
+ int start;
+ if(!row[c].inv) continue;
+ start = c;
+ while(c < COLS && row[c].inv) c++;
+ VT_XSETFG(vt_dpy, vt_gc, 1);
+ VT_XFILL(vt_dpy, vt_win, vt_gc, start * CELL_W,
+ r * CELL_H, (c - start) * CELL_W, CELL_H);
+ VT_XSETFG(vt_dpy, vt_gc, 0);
+ VT_XDRAW(vt_dpy, vt_win, vt_gc, start * CELL_W,
+ r * CELL_H + BASE_OFF, line + start, c - start);
+ }
+
+ for(c = 0; c < COLS; c++) row[c].dirty = 0;
+ }
+ if(any) {
+ VT_XFLUSH(vt_dpy);
+ }
+ vt_x11_progress = 0xFFFFFFUL;
+}
+
+void vt_x11_term_init(void)
+{
+ term_width = COLS;
+ term_height = ROWS;
+ term_reset = x11_reset;
+ term_clearscr = x11_clearscr;
+ term_setcursor = x11_setcursor;
+ term_cursor = x11_cursor;
+ term_setcolor = x11_setcolor;
+ term_ibmchar = x11_ibmchar;
+}
+
+void term_init(void)
+{
+ vt_x11_term_init();
+}
diff --git a/apps/termtris/src/vt1200/x11.h b/apps/termtris/src/vt1200/x11.h
new file mode 100644
index 0000000..023512f
--- /dev/null
+++ b/apps/termtris/src/vt1200/x11.h
@@ -0,0 +1,24 @@
+/*
+ * x11.h -- the VT1200 cell-grid X11 backend.
+ */
+#ifndef VT_X11_H_
+#define VT_X11_H_
+
+#include "xlib.h"
+
+extern void *vt_dpy;
+extern vt_u32 vt_win;
+extern vt_u32 vt_gc;
+
+int vt_x11_init(void);
+void vt_x11_flush(void);
+void vt_x11_term_init(void);
+
+void x11_reset(void);
+void x11_clearscr(void);
+void x11_setcursor(int row, int col);
+void x11_cursor(int show);
+void x11_setcolor(int fg, int bg);
+void x11_ibmchar(unsigned char c, unsigned char attr);
+
+#endif
diff --git a/apps/termtris/src/vt1200/xgfix.c b/apps/termtris/src/vt1200/xgfix.c
new file mode 100644
index 0000000..1a847e4
--- /dev/null
+++ b/apps/termtris/src/vt1200/xgfix.c
@@ -0,0 +1,30 @@
+/*
+ * xgfix.c -- install a per-process Xlib context before XOpenDisplay.
+ *
+ * `create_process` leaves the per-process user word at *(proc+0x100) pointing
+ * at a zeroed cell. The ROM Xlib's _XEnq does
+ *
+ * XG = *(*(proc+0x100));
+ * free_list = *(XG + 0x198 bytes);
+ *
+ * so a loader child with XG == NULL reads low-RAM garbage as a queue-node
+ * pointer and XNextEvent copies unmapped zeros. Giving it a zeroed block
+ * makes the event queue real. This is a RAM write only; the ROM is untouched.
+ */
+typedef unsigned long vt_u32;
+
+static vt_u32 vt_xg[256]; /* 1 KiB: > the 0x198-byte free-list field */
+
+int vt_install_xg(void)
+{
+ vt_u32 proc, pp;
+
+ proc = *(volatile vt_u32 *)0x001B3900UL;
+ if(proc < 0x100UL || proc > 0x01FFFFFFUL)
+ return 0;
+ pp = *(volatile vt_u32 *)(proc + 0x100UL);
+ if(pp < 0x100UL || pp > 0x01FFFFFFUL)
+ return 0;
+ *(volatile vt_u32 *)pp = (vt_u32)vt_xg;
+ return 1;
+}
diff --git a/apps/termtris/src/vt1200/xlib.h b/apps/termtris/src/vt1200/xlib.h
new file mode 100644
index 0000000..342c4c8
--- /dev/null
+++ b/apps/termtris/src/vt1200/xlib.h
@@ -0,0 +1,53 @@
+/*
+ * xlib.h -- the VT1200 ROM Xlib entry points, called with the TI C ABI.
+ *
+ * Addresses are TMS34010 bit addresses. The caller reserves the A14 slot and
+ * pushes arguments last-to-first; the callee `rets 2` restores A14. The C
+ * compiler emits exactly this sequence for a call through a function pointer.
+ */
+#ifndef VT_XLIB_H_
+#define VT_XLIB_H_
+
+typedef unsigned long vt_u32;
+
+typedef void *(*vt_xopen_t)(const char *);
+typedef vt_u32 (*vt_xcreate_t)(void *, vt_u32, int, int, unsigned int,
+ unsigned int, unsigned int, vt_u32, vt_u32);
+typedef int (*vt_xselect_t)(void *, vt_u32, long);
+typedef int (*vt_xmap_t)(void *, vt_u32);
+typedef int (*vt_xsync_t)(void *, int);
+typedef int (*vt_xflush_t)(void *);
+typedef int (*vt_xnext_t)(void *, void *);
+typedef int (*vt_xlookup_t)(void *, char *, int, vt_u32 *, void *);
+typedef vt_u32 (*vt_xgc_t)(void *, vt_u32, vt_u32, vt_u32 *);
+typedef int (*vt_xsetfg_t)(void *, vt_u32, vt_u32);
+typedef int (*vt_xfill_t)(void *, vt_u32, vt_u32, int, int,
+ unsigned int, unsigned int);
+typedef int (*vt_xdraw_t)(void *, vt_u32, vt_u32, int, int,
+ const char *, int);
+typedef int (*vt_sleep_t)(int);
+typedef int (*vt_xgetfocus_t)(void *, vt_u32 *, int *);
+
+#define VT_XOPEN ((vt_xopen_t)0x3F9C2570UL)
+#define VT_XCREATE ((vt_xcreate_t)0x3FD41B90UL)
+#define VT_XSELECT ((vt_xselect_t)0x3FD97D50UL)
+#define VT_XMAP ((vt_xmap_t)0x3FD64F60UL)
+#define VT_XSYNC ((vt_xsync_t)0x3FD9F6B0UL)
+#define VT_XFLUSH ((vt_xflush_t)0x3F9B1030UL)
+#define VT_XNEXT ((vt_xnext_t)0x3F9C1CF0UL)
+#define VT_XLOOKUP ((vt_xlookup_t)0x3F9A9C30UL)
+#define VT_XGC ((vt_xgc_t)0x3F997000UL)
+#define VT_XSETFG ((vt_xsetfg_t)0x3FD99A60UL)
+#define VT_XFILL ((vt_xfill_t)0x3F99E8F0UL)
+#define VT_XDRAW ((vt_xdraw_t)0x3FDA0000UL)
+#define VT_XPENDING ((int (*)(void *))0x3FD67620UL)
+#define VT_SLEEP ((vt_sleep_t)0x3FB33A20UL)
+#define VT_XGETFOCUS ((vt_xgetfocus_t)0x3FD55210UL)
+
+/* display->screens[] is at bit 0x480 / byte 0x90; screen->root at bit 0x40 /
+ * byte 8 (see dwt/notes/GUI_APPS.md and dwt/gui/xhello.asm). */
+vt_u32 vt_root_window(void *dpy);
+
+int vt_install_xg(void);
+
+#endif /* VT_XLIB_H_ */
diff --git a/apps/termtris/tests/fmt.c b/apps/termtris/tests/fmt.c
new file mode 100644
index 0000000..07fe8dd
--- /dev/null
+++ b/apps/termtris/tests/fmt.c
@@ -0,0 +1,18 @@
+/*
+ * fmt.c -- Task 2 acceptance: the exact sprintf formats game.c uses.
+ * Results are NUL-terminated in out[6][16]; tests/fmt.lua prints them.
+ */
+#include
+
+char out[6][16];
+
+int main(void)
+{
+ sprintf(out[0], "%10ld", 12345L);
+ sprintf(out[1], "%2ld", 7L);
+ sprintf(out[2], "%8ld", 42L);
+ sprintf(out[3], "%2d. %s %ld", 1, "ab", 99L);
+ sprintf(out[4], "%-3s", "x");
+ sprintf(out[5], "%%");
+ return 0;
+}
diff --git a/apps/termtris/tests/fmt.lua b/apps/termtris/tests/fmt.lua
new file mode 100644
index 0000000..0af6df3
--- /dev/null
+++ b/apps/termtris/tests/fmt.lua
@@ -0,0 +1,354 @@
+-- loader.lua -- debugger-assisted COFF loader acceptance harness.
+--
+-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
+-- the OS, then at frame LOADER_AT pokes:
+-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
+-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
+-- * the loader descriptor at 0x01882C00
+-- and sets PC = 0x01880000. It does not use the network, the rdebug service
+-- or any firmware transport: this is the debugger-assisted milestone.
+--
+-- The loader itself copies the COFF sections to their linked bit addresses and
+-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
+-- the input and reads the result; it never writes the app's code or markers.
+--
+-- Env:
+-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
+-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
+-- LOADER_BUF COFF buffer bit address (default 0x01900000)
+-- LOADER_AT injection frame (default 2500)
+-- LOADER_END inspection/exit frame (default 2700)
+-- LOADER_OUT evidence directory (default dwt/loader/evidence)
+-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
+-- LOADER_VERBOSE 1 = print the result block every 25 frames
+
+local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
+
+local machine = manager.machine
+local FMT_MARK = tonumber(os.getenv("FMT_MARK") or "0x01A00000")
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+
+if not dbg then
+ print("LOADER: debugger not enabled; pass -debug")
+ machine:exit()
+ return
+end
+
+local AT = tonumber(os.getenv("LOADER_AT") or "2500")
+local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
+local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
+local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
+local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
+local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
+local SNAP = os.getenv("LOADER_SNAP") == "1"
+local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
+local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
+local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
+
+local LOADER_BASE = 0x01880000
+local DESC = 0x01882C00
+local RESULT = 0x01882D00
+local RETURN_STUB = 0x01883100
+local RETURN_SP = 0x01883110
+
+local function rd(p) return io.open(p, "rb") end
+local function slurp(p)
+ local f, err = rd(p)
+ if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
+ local s = f:read("*a")
+ f:close()
+ return s
+end
+
+local function u16(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+end
+
+local function u32(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+ + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
+end
+
+local function parse_coff(d)
+ local c = { data = d }
+ c.magic = u16(d, 0)
+ c.nscns = u16(d, 2)
+ c.opthdr = u16(d, 16)
+ c.sections = {}
+ if c.opthdr > 0 then
+ c.optmagic = u16(d, 20)
+ c.entry = u32(d, 20 + 16)
+ c.textstart = u32(d, 20 + 20)
+ c.datastart = u32(d, 20 + 24)
+ end
+ local base = 20 + c.opthdr
+ for i = 0, c.nscns - 1 do
+ local o = base + i * 40
+ local name = d:sub(o + 1, o + 8):gsub("%z", "")
+ c.sections[#c.sections + 1] = {
+ name = name,
+ paddr = u32(d, o + 8),
+ size = u32(d, o + 16), -- bits
+ scnptr = u32(d, o + 20),
+ flags = u32(d, o + 36),
+ }
+ end
+ return c
+end
+
+local function poke_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ prog:write_u16(bitaddr + i * 16, lo + hi * 256)
+ end
+ return n
+end
+
+local function verify_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ local bad = 0
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
+ bad = bad + 1
+ end
+ end
+ return n, bad
+end
+
+local function w32(a, v) prog:write_u32(a, v) end
+local function r32(a)
+ local ok, v = pcall(function() return prog:read_u32(a) end)
+ if ok then return v end
+ return 0xDEADBEEF
+end
+
+local function rstr(a, n)
+ local t = {}
+ for i = 0, n - 1 do
+ local c = prog:read_u8(a + i * 8)
+ if c == 0 then break end
+ t[#t + 1] = string.char(c)
+ end
+ return table.concat(t)
+end
+
+local loader = slurp(BIN)
+local coff = slurp(COFF)
+local app = parse_coff(coff)
+
+print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
+print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
+print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
+ app.magic, app.nscns, app.opthdr,
+ app.optmagic and string.format("%04X", app.optmagic) or "none",
+ hex(app.entry or 0), hex(app.textstart or 0)))
+for _, s in ipairs(app.sections) do
+ print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
+ s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
+end
+
+local TRACE = os.getenv("LOADER_TRACE") == "1"
+
+local frames = 0
+local injected = false
+local done = false
+local last_count = -1
+
+local function status_name(v)
+ local t = {
+ [0] = "OK",
+ [1] = "bad descriptor",
+ [2] = "truncated COFF / section headers",
+ [3] = "bad COFF magic",
+ [4] = "section size not whole words",
+ [5] = "target outside RAM",
+ [6] = "target overlaps loader page or COFF buffer",
+ [7] = "relocation records present (unsupported)",
+ [8] = "target not in a free-list block",
+ [9] = "no entry point",
+ }
+ return t[v] or ("error " .. tostring(v))
+end
+
+local function result_dump()
+ local st = r32(RESULT + 0x000)
+ print(string.format(
+ "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
+ st, status_name(st), hex(r32(RESULT + 0x020)),
+ hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
+ hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
+ hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
+ r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
+ r32(RESULT + 0x140), r32(RESULT + 0x160)))
+end
+
+local function inject()
+ -- 1. loader itself
+ local n, bad = 0, 0
+ poke_bytes(LOADER_BASE, loader)
+ n, bad = verify_bytes(LOADER_BASE, loader)
+ print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
+ n, bad, hex(LOADER_BASE)))
+
+ -- 2. COFF image
+ poke_bytes(BUF, coff)
+ n, bad = verify_bytes(BUF, coff)
+ print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
+ n, bad, hex(BUF)))
+
+ -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
+ for _, s in ipairs(app.sections) do
+ if s.flags & 0x80 ~= 0 then
+ for i = 0, math.floor(s.size / 16) - 1 do
+ prog:write_u16(s.paddr + i * 16, 0xA5A5)
+ end
+ print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
+ hex(s.paddr), hex(s.paddr + s.size)))
+ end
+ end
+
+ -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
+ w32(DESC + 0x00, 0)
+ prog:write_u16(DESC + 0x00, 0x4C44)
+ prog:write_u16(DESC + 0x10, 0x5231)
+ w32(DESC + 0x20, BUF)
+ w32(DESC + 0x40, #coff)
+ w32(DESC + 0x60, MODE)
+ print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
+ hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
+ hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
+
+ -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
+ -- itself); mode 1 returns here, and the stub resumes the interrupted
+ -- PC so the caller yields and the scheduler can run the child.
+ local orig_pc = cpu.state['PC'].value
+ if MODE == 1 then
+ prog:write_u16(RETURN_STUB, 0xC080) -- jauc
+ prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
+ prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
+ else
+ prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
+ end
+
+ -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
+ -- the return slot so mode=1 would return to the spin stub.
+ -- Leave SP alone for mode 0: the loader pushes onto the current
+ -- process stack, then restores it and resumes at ORIG_PC. (mode 1
+ -- would use the return stub.)
+ w32(0x01882A20, orig_pc) -- LD_ORIG_PC
+ print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
+ cpu.state['A8'].value = A8DESC and DESC or 0
+ if MODE == 1 then
+ -- Simulate a CALLA from the current process: push the return
+ -- address on the *firmware* stack (a real transport would do this).
+ local sp = cpu.state['SP'].value - 0x20
+ w32(sp, RETURN_STUB)
+ cpu.state['SP'].value = sp
+ end
+ cpu.state['PC'].value = LOADER_BASE
+ injected = true
+ print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
+ frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
+end
+
+local function inspect()
+ result_dump()
+
+ -- Verify the placement from RAM: .text/.data must equal the file bytes.
+ for _, s in ipairs(app.sections) do
+ if s.scnptr ~= 0 and s.size > 0 then
+ local nb = math.floor(s.size / 8)
+ local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
+ local _, bad = verify_bytes(s.paddr, bytes)
+ print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
+ s.name, hex(s.paddr), nb, bad))
+ end
+ end
+
+ local base = COFF:match("([^/]+)$") or COFF
+ if base:find("marker") then
+ print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
+ hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
+ hex(r32(0x018E0060)), r32(0x018E0080)))
+ elseif base:find("xhello") then
+ print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
+ r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
+ hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
+ end
+ if base:find("fmt") then
+ for i = 0, 5 do
+ print(string.format("FMT:%d [%s]", i, rstr(FMT_MARK + i * 0x80, 16)))
+ end
+ end
+ print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
+end
+
+emu.register_frame_done(function()
+ frames = frames + 1
+ if frames == AT and not injected then
+ inject()
+ if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
+ end
+ if injected and TRACE and frames == AT + 1 then
+ dbg:command("trace off")
+ print("LOADER: trace written to /tmp/opencode/ld.tr")
+ end
+ if injected and not done then
+ if TRACE and frames <= AT + 40 then
+ print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
+ frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
+ hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
+ hex(r32(RESULT + 0x020))))
+ end
+ local st = r32(RESULT + 0x000)
+ -- status 0 means OK; nonzero is final too once parsing has begun
+ if st ~= 0xFFFFFFFF and not done then
+ -- The loader writes 0 on success. A nonzero status is final
+ -- only after it has been written once (it is 0 from power-on,
+ -- so require the loader to have run: PC no longer at entry or
+ -- the app counter moved).
+ end
+ if VERBOSE and frames % 25 == 0 then
+ result_dump()
+ end
+ if base_contains_marker then
+ local c = r32(0x018E0080)
+ if c ~= last_count then
+ if last_count ~= -1 then
+ print(string.format("LOADER: marker counter %d -> %d (child running)",
+ last_count, c))
+ end
+ last_count = c
+ end
+ end
+ end
+ if frames >= ENDF then
+ if injected then
+ done = true
+ inspect()
+ if SNAP then
+ local screen = nil
+ for _, s in pairs(machine.screens) do screen = s break end
+ if screen then
+ local out = OUT .. "/loader_frame" .. frames .. ".png"
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("LOADER: snapshot %s ok=%s %s",
+ out, tostring(ok), tostring(err or "")))
+ end
+ end
+ end
+ machine:exit()
+ end
+end, "vt1200-loader")
+
+-- (Lua has no forward use of a name defined later; set a small flag here.)
+base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'
diff --git a/apps/termtris/tests/fmt.sh b/apps/termtris/tests/fmt.sh
new file mode 100755
index 0000000..19ff689
--- /dev/null
+++ b/apps/termtris/tests/fmt.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+# fmt.sh -- Task 2 acceptance. Builds tests/fmt.c with compat.c, loads it, and
+# checks the six formatted strings byte-for-byte.
+set -eu
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+APP=$(cd "$DIR/.." && pwd)
+ROOT=$(cd "$APP/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+LOG="$APP/build/fmt.log"
+
+mkdir -p "$APP/build"
+"$APP/build.sh" "$DIR/fmt.c" "$APP/src/vt1200/compat.c" >"$APP/build/fmt-build.log" 2>&1
+
+FMT=$(awk '{for(i=2;i<=NF;i++) if($i=="_out") print $(i-1)}' "$APP/build/fmt.map" | head -1)
+VT1200_SKIP_LEVEL1=1 FMT_MARK="0x$FMT" \
+LOADER_AT=2500 LOADER_END=2700 \
+LOADER_BIN="$ROOT/dwt/loader/build/loader.bin" \
+LOADER_COFF="$APP/build/fmt.coff" \
+LOADER_OUT="$APP/build" \
+"$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -video none -sound none -nothrottle -skip_gameinfo \
+ -debug -debugger none \
+ -autoboot_script "$DIR/fmt.lua" -autoboot_delay 0 \
+ >"$LOG" 2>&1 || true
+
+grep 'FMT:' "$LOG" | tail -8
+for want in 'FMT:0 [ 12345]' 'FMT:1 [ 7]' 'FMT:2 [ 42]' \
+ 'FMT:3 [ 1. ab 99]' 'FMT:4 [x ]' 'FMT:5 [%]'; do
+ grep -Fq "$want" "$LOG" || {
+ echo "fmt.sh: missing: $want (see $LOG)" >&2
+ exit 1
+ }
+done
+echo "fmt: PASS"
diff --git a/apps/termtris/tests/input.c b/apps/termtris/tests/input.c
new file mode 100644
index 0000000..f23231a
--- /dev/null
+++ b/apps/termtris/tests/input.c
@@ -0,0 +1,39 @@
+/*
+ * input.c -- Task 4 acceptance: link main.c against stubs for the game, inject
+ * keys, and record the bytes main.c sends to game_input().
+ */
+#include "game.h"
+#include "x11.h"
+#include "xlib.h"
+
+int term_width, term_height;
+/* game.c globals main.c sets or reads; the real game supplies these */
+int onlyascii, use_gfxchar, monochrome;
+int quit;
+long tick_interval;
+volatile vt_u32 mark[128];
+
+void cleanup_game(void) {}
+void wait_display(void);
+
+int init_game(void)
+{
+ mark[0] = 0x494E5054UL; /* INPT */
+ vt_x11_term_init();
+ x11_clearscr();
+ return 0;
+}
+
+long update(long msec)
+{
+ (void)msec;
+ mark[1] = mark[1] + 1;
+ return 100;
+}
+
+void game_input(int c)
+{
+ int n = (int)mark[2];
+ if(n < 100) mark[3 + n] = (vt_u32)(unsigned char)c;
+ mark[2] = (vt_u32)(n + 1);
+}
diff --git a/apps/termtris/tests/input.lua b/apps/termtris/tests/input.lua
new file mode 100644
index 0000000..fd89e54
--- /dev/null
+++ b/apps/termtris/tests/input.lua
@@ -0,0 +1,387 @@
+-- loader.lua -- debugger-assisted COFF loader acceptance harness.
+--
+-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
+-- the OS, then at frame LOADER_AT pokes:
+-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
+-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
+-- * the loader descriptor at 0x01882C00
+-- and sets PC = 0x01880000. It does not use the network, the rdebug service
+-- or any firmware transport: this is the debugger-assisted milestone.
+--
+-- The loader itself copies the COFF sections to their linked bit addresses and
+-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
+-- the input and reads the result; it never writes the app's code or markers.
+--
+-- Env:
+-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
+-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
+-- LOADER_BUF COFF buffer bit address (default 0x01900000)
+-- LOADER_AT injection frame (default 2500)
+-- LOADER_END inspection/exit frame (default 2700)
+-- LOADER_OUT evidence directory (default dwt/loader/evidence)
+-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
+-- LOADER_VERBOSE 1 = print the result block every 25 frames
+
+local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
+
+local machine = manager.machine
+local INPUT_MARK = tonumber(os.getenv("INPUT_MARK") or "0x01A00000")
+local ports = machine.ioport.ports
+local key_a = ports[":lk401:K26"].fields["A"]
+local key_up = ports[":lk401:K77"].fields["Up"]
+local key_down = ports[":lk401:K76"].fields["Down"]
+local key_left = ports[":lk401:K74"].fields["Left"]
+local key_right = ports[":lk401:K75"].fields["Right"]
+local key_zero = ports[":lk401:K10"].fields["0 )"]
+local key_ret = ports[":lk401:K68"].fields["Return"]
+local key_del = ports[":lk401:K67"].fields["Delete"]
+local key_q = ports[":lk401:K13"].fields["Q"]
+local key_p = ports[":lk401:K22"].fields["P"]
+local tabx = ports[":tablet:TABLET_X"].fields["Tablet X"]
+local taby = ports[":tablet:TABLET_Y"].fields["Tablet Y"]
+local tabb = ports[":tablet:TABLET_BTN"].fields["P1 Button 1"]
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+
+if not dbg then
+ print("LOADER: debugger not enabled; pass -debug")
+ machine:exit()
+ return
+end
+
+local AT = tonumber(os.getenv("LOADER_AT") or "2500")
+local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
+local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
+local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
+local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
+local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
+local SNAP = os.getenv("LOADER_SNAP") == "1"
+local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
+local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
+local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
+
+local LOADER_BASE = 0x01880000
+local DESC = 0x01882C00
+local RESULT = 0x01882D00
+local RETURN_STUB = 0x01883100
+local RETURN_SP = 0x01883110
+
+local function rd(p) return io.open(p, "rb") end
+local function slurp(p)
+ local f, err = rd(p)
+ if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
+ local s = f:read("*a")
+ f:close()
+ return s
+end
+
+local function u16(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+end
+
+local function u32(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+ + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
+end
+
+local function parse_coff(d)
+ local c = { data = d }
+ c.magic = u16(d, 0)
+ c.nscns = u16(d, 2)
+ c.opthdr = u16(d, 16)
+ c.sections = {}
+ if c.opthdr > 0 then
+ c.optmagic = u16(d, 20)
+ c.entry = u32(d, 20 + 16)
+ c.textstart = u32(d, 20 + 20)
+ c.datastart = u32(d, 20 + 24)
+ end
+ local base = 20 + c.opthdr
+ for i = 0, c.nscns - 1 do
+ local o = base + i * 40
+ local name = d:sub(o + 1, o + 8):gsub("%z", "")
+ c.sections[#c.sections + 1] = {
+ name = name,
+ paddr = u32(d, o + 8),
+ size = u32(d, o + 16), -- bits
+ scnptr = u32(d, o + 20),
+ flags = u32(d, o + 36),
+ }
+ end
+ return c
+end
+
+local function poke_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ prog:write_u16(bitaddr + i * 16, lo + hi * 256)
+ end
+ return n
+end
+
+local function verify_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ local bad = 0
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
+ bad = bad + 1
+ end
+ end
+ return n, bad
+end
+
+local function w32(a, v) prog:write_u32(a, v) end
+local function key_step(frames, key)
+ if frames == 3100 then key_a:set_value(1) end
+ if frames == 3110 then key_a:set_value(0) end
+ if frames == 3120 then key_up:set_value(1) end
+ if frames == 3130 then key_up:set_value(0) end
+ if frames == 3140 then key_down:set_value(1) end
+ if frames == 3150 then key_down:set_value(0) end
+ if frames == 3160 then key_left:set_value(1) end
+ if frames == 3170 then key_left:set_value(0) end
+ if frames == 3180 then key_right:set_value(1) end
+ if frames == 3190 then key_right:set_value(0) end
+ if frames == 3200 then key_zero:set_value(1) end
+ if frames == 3210 then key_zero:set_value(0) end
+ if frames == 3220 then key_ret:set_value(1) end
+ if frames == 3230 then key_ret:set_value(0) end
+ if frames == 3240 then key_del:set_value(1) end
+ if frames == 3250 then key_del:set_value(0) end
+ if frames == 3260 then key_q:set_value(1) end
+ if frames == 3270 then key_q:set_value(0) end
+ if frames == 3280 then key_p:set_value(1) end
+ if frames == 3290 then key_p:set_value(0) end
+end
+
+local function r32(a)
+ local ok, v = pcall(function() return prog:read_u32(a) end)
+ if ok then return v end
+ return 0xDEADBEEF
+end
+
+local loader = slurp(BIN)
+local coff = slurp(COFF)
+local app = parse_coff(coff)
+
+print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
+print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
+print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
+ app.magic, app.nscns, app.opthdr,
+ app.optmagic and string.format("%04X", app.optmagic) or "none",
+ hex(app.entry or 0), hex(app.textstart or 0)))
+for _, s in ipairs(app.sections) do
+ print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
+ s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
+end
+
+local TRACE = os.getenv("LOADER_TRACE") == "1"
+
+local frames = 0
+local injected = false
+local done = false
+local last_count = -1
+
+local function status_name(v)
+ local t = {
+ [0] = "OK",
+ [1] = "bad descriptor",
+ [2] = "truncated COFF / section headers",
+ [3] = "bad COFF magic",
+ [4] = "section size not whole words",
+ [5] = "target outside RAM",
+ [6] = "target overlaps loader page or COFF buffer",
+ [7] = "relocation records present (unsupported)",
+ [8] = "target not in a free-list block",
+ [9] = "no entry point",
+ }
+ return t[v] or ("error " .. tostring(v))
+end
+
+local function result_dump()
+ local st = r32(RESULT + 0x000)
+ print(string.format(
+ "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
+ st, status_name(st), hex(r32(RESULT + 0x020)),
+ hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
+ hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
+ hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
+ r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
+ r32(RESULT + 0x140), r32(RESULT + 0x160)))
+end
+
+local function inject()
+ -- 1. loader itself
+ local n, bad = 0, 0
+ poke_bytes(LOADER_BASE, loader)
+ n, bad = verify_bytes(LOADER_BASE, loader)
+ print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
+ n, bad, hex(LOADER_BASE)))
+
+ -- 2. COFF image
+ poke_bytes(BUF, coff)
+ n, bad = verify_bytes(BUF, coff)
+ print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
+ n, bad, hex(BUF)))
+
+ -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
+ for _, s in ipairs(app.sections) do
+ if s.flags & 0x80 ~= 0 then
+ for i = 0, math.floor(s.size / 16) - 1 do
+ prog:write_u16(s.paddr + i * 16, 0xA5A5)
+ end
+ print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
+ hex(s.paddr), hex(s.paddr + s.size)))
+ end
+ end
+
+ -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
+ w32(DESC + 0x00, 0)
+ prog:write_u16(DESC + 0x00, 0x4C44)
+ prog:write_u16(DESC + 0x10, 0x5231)
+ w32(DESC + 0x20, BUF)
+ w32(DESC + 0x40, #coff)
+ w32(DESC + 0x60, MODE)
+ print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
+ hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
+ hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
+
+ -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
+ -- itself); mode 1 returns here, and the stub resumes the interrupted
+ -- PC so the caller yields and the scheduler can run the child.
+ local orig_pc = cpu.state['PC'].value
+ if MODE == 1 then
+ prog:write_u16(RETURN_STUB, 0xC080) -- jauc
+ prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
+ prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
+ else
+ prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
+ end
+
+ -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
+ -- the return slot so mode=1 would return to the spin stub.
+ -- Leave SP alone for mode 0: the loader pushes onto the current
+ -- process stack, then restores it and resumes at ORIG_PC. (mode 1
+ -- would use the return stub.)
+ w32(0x01882A20, orig_pc) -- LD_ORIG_PC
+ print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
+ cpu.state['A8'].value = A8DESC and DESC or 0
+ if MODE == 1 then
+ -- Simulate a CALLA from the current process: push the return
+ -- address on the *firmware* stack (a real transport would do this).
+ local sp = cpu.state['SP'].value - 0x20
+ w32(sp, RETURN_STUB)
+ cpu.state['SP'].value = sp
+ end
+ cpu.state['PC'].value = LOADER_BASE
+ injected = true
+ print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
+ frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
+end
+
+local function inspect()
+ result_dump()
+
+ -- Verify the placement from RAM: .text/.data must equal the file bytes.
+ for _, s in ipairs(app.sections) do
+ if s.scnptr ~= 0 and s.size > 0 then
+ local nb = math.floor(s.size / 8)
+ local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
+ local _, bad = verify_bytes(s.paddr, bytes)
+ print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
+ s.name, hex(s.paddr), nb, bad))
+ end
+ end
+
+ local base = COFF:match("([^/]+)$") or COFF
+ if base:find("marker") then
+ print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
+ hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
+ hex(r32(0x018E0060)), r32(0x018E0080)))
+ elseif base:find("xhello") then
+ print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
+ r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
+ hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
+ end
+ if base:find("input") then
+ local n = r32(INPUT_MARK + 0x40)
+ local t = {}
+ for i = 0, n - 1 do t[#t + 1] = string.format("%02X", r32(INPUT_MARK + (3 + i) * 0x20)) end
+ print(string.format("INPUT: magic=%08X updates=%d n=%d bytes=%s",
+ r32(INPUT_MARK), r32(INPUT_MARK + 0x20), n, table.concat(t, " ")))
+ end
+ print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
+end
+
+emu.register_frame_done(function()
+ frames = frames + 1
+ if frames == 2900 then tabx:set_value(700); taby:set_value(500); print("INPUT: tablet move") end
+ if frames == 3000 then tabb:set_value(1); print("INPUT: click down") end
+ if frames == 3020 then tabb:set_value(0); print("INPUT: click up") end
+ key_step(frames, nil)
+ if frames == AT and not injected then
+ inject()
+ if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
+ end
+ if injected and TRACE and frames == AT + 1 then
+ dbg:command("trace off")
+ print("LOADER: trace written to /tmp/opencode/ld.tr")
+ end
+ if injected and not done then
+ if TRACE and frames <= AT + 40 then
+ print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
+ frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
+ hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
+ hex(r32(RESULT + 0x020))))
+ end
+ local st = r32(RESULT + 0x000)
+ -- status 0 means OK; nonzero is final too once parsing has begun
+ if st ~= 0xFFFFFFFF and not done then
+ -- The loader writes 0 on success. A nonzero status is final
+ -- only after it has been written once (it is 0 from power-on,
+ -- so require the loader to have run: PC no longer at entry or
+ -- the app counter moved).
+ end
+ if VERBOSE and frames % 25 == 0 then
+ result_dump()
+ end
+ if base_contains_marker then
+ local c = r32(0x018E0080)
+ if c ~= last_count then
+ if last_count ~= -1 then
+ print(string.format("LOADER: marker counter %d -> %d (child running)",
+ last_count, c))
+ end
+ last_count = c
+ end
+ end
+ end
+ if frames >= ENDF then
+ if injected then
+ done = true
+ inspect()
+ if SNAP then
+ local screen = nil
+ for _, s in pairs(machine.screens) do screen = s break end
+ if screen then
+ local out = OUT .. "/loader_frame" .. frames .. ".png"
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("LOADER: snapshot %s ok=%s %s",
+ out, tostring(ok), tostring(err or "")))
+ end
+ end
+ end
+ machine:exit()
+ end
+end, "vt1200-loader")
+
+-- (Lua has no forward use of a name defined later; set a small flag here.)
+base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'
diff --git a/apps/termtris/tests/input.sh b/apps/termtris/tests/input.sh
new file mode 100755
index 0000000..c4dd04d
--- /dev/null
+++ b/apps/termtris/tests/input.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+# input.sh -- Task 4 acceptance: main.c's key map against injected keys.
+set -eu
+DIR=$(cd "$(dirname "$0")" && pwd)
+APP=$(cd "$DIR/.." && pwd)
+ROOT=$(cd "$APP/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+LOG="$APP/build/input.log"
+mkdir -p "$APP/build"
+"$APP/build.sh" "$DIR/input.c" "$APP/src/vt1200/main.c" "$APP/src/vt1200/x11.c" "$APP/src/vt1200/xgfix.c" >"$APP/build/input-build.log" 2>&1
+MARK=$(awk '{for(i=2;i<=NF;i++) if($i=="_mark") print $(i-1)}' "$APP/build/input.map" | head -1)
+VT1200_SKIP_LEVEL1=1 INPUT_MARK="0x$MARK" \
+LOADER_AT=2500 LOADER_END=3400 \
+LOADER_BIN="$ROOT/dwt/loader/build/loader.bin" \
+LOADER_COFF="$APP/build/input.coff" \
+LOADER_OUT="$APP/build" \
+"$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -video none -sound none -nothrottle -skip_gameinfo \
+ -debug -debugger none \
+ -autoboot_script "$DIR/input.lua" -autoboot_delay 0 \
+ >"$LOG" 2>&1 || true
+grep 'INPUT:' "$LOG" | tail -3
+grep -q 'INPUT: .*bytes=.*61 9B 41 9B 42 9B 44 9B 43 30 0A 7F 71 70' "$LOG" || {
+ echo "input.sh: mapped key sequence missing (see $LOG)" >&2
+ exit 1
+}
+echo "input: PASS"
diff --git a/apps/termtris/tests/play.lua b/apps/termtris/tests/play.lua
new file mode 100644
index 0000000..9e91d32
--- /dev/null
+++ b/apps/termtris/tests/play.lua
@@ -0,0 +1,350 @@
+-- loader.lua -- debugger-assisted COFF loader acceptance harness.
+--
+-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
+-- the OS, then at frame LOADER_AT pokes:
+-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
+-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
+-- * the loader descriptor at 0x01882C00
+-- and sets PC = 0x01880000. It does not use the network, the rdebug service
+-- or any firmware transport: this is the debugger-assisted milestone.
+--
+-- The loader itself copies the COFF sections to their linked bit addresses and
+-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
+-- the input and reads the result; it never writes the app's code or markers.
+--
+-- Env:
+-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
+-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
+-- LOADER_BUF COFF buffer bit address (default 0x01900000)
+-- LOADER_AT injection frame (default 2500)
+-- LOADER_END inspection/exit frame (default 2700)
+-- LOADER_OUT evidence directory (default dwt/loader/evidence)
+-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
+-- LOADER_VERBOSE 1 = print the result block every 25 frames
+
+local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
+
+local machine = manager.machine
+local PTICK = tonumber(os.getenv("DIAG_TICK") or "0")
+local PQUIT = tonumber(os.getenv("DIAG_QUIT") or "0")
+local ports = machine.ioport.ports
+local tabx = ports[":tablet:TABLET_X"].fields["Tablet X"]
+local taby = ports[":tablet:TABLET_Y"].fields["Tablet Y"]
+local tabb = ports[":tablet:TABLET_BTN"].fields["P1 Button 1"]
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+
+if not dbg then
+ print("LOADER: debugger not enabled; pass -debug")
+ machine:exit()
+ return
+end
+
+local AT = tonumber(os.getenv("LOADER_AT") or "2500")
+local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
+local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
+local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
+local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
+local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
+local SNAP = os.getenv("LOADER_SNAP") == "1"
+local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
+local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
+local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
+
+local LOADER_BASE = 0x01880000
+local DESC = 0x01882C00
+local RESULT = 0x01882D00
+local RETURN_STUB = 0x01883100
+local RETURN_SP = 0x01883110
+
+local function rd(p) return io.open(p, "rb") end
+local function slurp(p)
+ local f, err = rd(p)
+ if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
+ local s = f:read("*a")
+ f:close()
+ return s
+end
+
+local function u16(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+end
+
+local function u32(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+ + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
+end
+
+local function parse_coff(d)
+ local c = { data = d }
+ c.magic = u16(d, 0)
+ c.nscns = u16(d, 2)
+ c.opthdr = u16(d, 16)
+ c.sections = {}
+ if c.opthdr > 0 then
+ c.optmagic = u16(d, 20)
+ c.entry = u32(d, 20 + 16)
+ c.textstart = u32(d, 20 + 20)
+ c.datastart = u32(d, 20 + 24)
+ end
+ local base = 20 + c.opthdr
+ for i = 0, c.nscns - 1 do
+ local o = base + i * 40
+ local name = d:sub(o + 1, o + 8):gsub("%z", "")
+ c.sections[#c.sections + 1] = {
+ name = name,
+ paddr = u32(d, o + 8),
+ size = u32(d, o + 16), -- bits
+ scnptr = u32(d, o + 20),
+ flags = u32(d, o + 36),
+ }
+ end
+ return c
+end
+
+local function poke_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ prog:write_u16(bitaddr + i * 16, lo + hi * 256)
+ end
+ return n
+end
+
+local function verify_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ local bad = 0
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
+ bad = bad + 1
+ end
+ end
+ return n, bad
+end
+
+local function w32(a, v) prog:write_u32(a, v) end
+local function r32(a)
+ local ok, v = pcall(function() return prog:read_u32(a) end)
+ if ok then return v end
+ return 0xDEADBEEF
+end
+
+local loader = slurp(BIN)
+local coff = slurp(COFF)
+local app = parse_coff(coff)
+
+print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
+print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
+print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
+ app.magic, app.nscns, app.opthdr,
+ app.optmagic and string.format("%04X", app.optmagic) or "none",
+ hex(app.entry or 0), hex(app.textstart or 0)))
+for _, s in ipairs(app.sections) do
+ print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
+ s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
+end
+
+local TRACE = os.getenv("LOADER_TRACE") == "1"
+
+local frames = 0
+local injected = false
+local done = false
+local last_count = -1
+
+local function status_name(v)
+ local t = {
+ [0] = "OK",
+ [1] = "bad descriptor",
+ [2] = "truncated COFF / section headers",
+ [3] = "bad COFF magic",
+ [4] = "section size not whole words",
+ [5] = "target outside RAM",
+ [6] = "target overlaps loader page or COFF buffer",
+ [7] = "relocation records present (unsupported)",
+ [8] = "target not in a free-list block",
+ [9] = "no entry point",
+ }
+ return t[v] or ("error " .. tostring(v))
+end
+
+local function result_dump()
+ local st = r32(RESULT + 0x000)
+ print(string.format(
+ "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
+ st, status_name(st), hex(r32(RESULT + 0x020)),
+ hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
+ hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
+ hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
+ r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
+ r32(RESULT + 0x140), r32(RESULT + 0x160)))
+end
+
+local function inject()
+ -- 1. loader itself
+ local n, bad = 0, 0
+ poke_bytes(LOADER_BASE, loader)
+ n, bad = verify_bytes(LOADER_BASE, loader)
+ print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
+ n, bad, hex(LOADER_BASE)))
+
+ -- 2. COFF image
+ poke_bytes(BUF, coff)
+ n, bad = verify_bytes(BUF, coff)
+ print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
+ n, bad, hex(BUF)))
+
+ -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
+ for _, s in ipairs(app.sections) do
+ if s.flags & 0x80 ~= 0 then
+ for i = 0, math.floor(s.size / 16) - 1 do
+ prog:write_u16(s.paddr + i * 16, 0xA5A5)
+ end
+ print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
+ hex(s.paddr), hex(s.paddr + s.size)))
+ end
+ end
+
+ -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
+ w32(DESC + 0x00, 0)
+ prog:write_u16(DESC + 0x00, 0x4C44)
+ prog:write_u16(DESC + 0x10, 0x5231)
+ w32(DESC + 0x20, BUF)
+ w32(DESC + 0x40, #coff)
+ w32(DESC + 0x60, MODE)
+ print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
+ hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
+ hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
+
+ -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
+ -- itself); mode 1 returns here, and the stub resumes the interrupted
+ -- PC so the caller yields and the scheduler can run the child.
+ local orig_pc = cpu.state['PC'].value
+ if MODE == 1 then
+ prog:write_u16(RETURN_STUB, 0xC080) -- jauc
+ prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
+ prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
+ else
+ prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
+ end
+
+ -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
+ -- the return slot so mode=1 would return to the spin stub.
+ -- Leave SP alone for mode 0: the loader pushes onto the current
+ -- process stack, then restores it and resumes at ORIG_PC. (mode 1
+ -- would use the return stub.)
+ w32(0x01882A20, orig_pc) -- LD_ORIG_PC
+ print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
+ cpu.state['A8'].value = A8DESC and DESC or 0
+ if MODE == 1 then
+ -- Simulate a CALLA from the current process: push the return
+ -- address on the *firmware* stack (a real transport would do this).
+ local sp = cpu.state['SP'].value - 0x20
+ w32(sp, RETURN_STUB)
+ cpu.state['SP'].value = sp
+ end
+ cpu.state['PC'].value = LOADER_BASE
+ injected = true
+ print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
+ frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
+end
+
+local function inspect()
+ result_dump()
+
+ -- Verify the placement from RAM: .text/.data must equal the file bytes.
+ for _, s in ipairs(app.sections) do
+ if s.scnptr ~= 0 and s.size > 0 then
+ local nb = math.floor(s.size / 8)
+ local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
+ local _, bad = verify_bytes(s.paddr, bytes)
+ print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
+ s.name, hex(s.paddr), nb, bad))
+ end
+ end
+
+ local base = COFF:match("([^/]+)$") or COFF
+ if base:find("marker") then
+ print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
+ hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
+ hex(r32(0x018E0060)), r32(0x018E0080)))
+ elseif base:find("xhello") then
+ print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
+ r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
+ hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
+ end
+ if PTICK ~= 0 or PQUIT ~= 0 then
+ print(string.format("DIAG: tick=%d quit=%d", PTICK ~= 0 and r32(PTICK) or -1, PQUIT ~= 0 and r32(PQUIT) or -1))
+ end
+ print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
+end
+
+emu.register_frame_done(function()
+ frames = frames + 1
+ if frames == 2900 then tabx:set_value(700); taby:set_value(500); print("PLAY: tablet move") end
+ if frames == 3000 then tabb:set_value(1); print("PLAY: click down") end
+ if frames == 3020 then tabb:set_value(0); print("PLAY: click up") end
+ if frames == AT and not injected then
+ inject()
+ if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
+ end
+ if injected and TRACE and frames == AT + 1 then
+ dbg:command("trace off")
+ print("LOADER: trace written to /tmp/opencode/ld.tr")
+ end
+ if injected and not done then
+ if TRACE and frames <= AT + 40 then
+ print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
+ frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
+ hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
+ hex(r32(RESULT + 0x020))))
+ end
+ local st = r32(RESULT + 0x000)
+ -- status 0 means OK; nonzero is final too once parsing has begun
+ if st ~= 0xFFFFFFFF and not done then
+ -- The loader writes 0 on success. A nonzero status is final
+ -- only after it has been written once (it is 0 from power-on,
+ -- so require the loader to have run: PC no longer at entry or
+ -- the app counter moved).
+ end
+ if VERBOSE and frames % 25 == 0 then
+ result_dump()
+ end
+ if base_contains_marker then
+ local c = r32(0x018E0080)
+ if c ~= last_count then
+ if last_count ~= -1 then
+ print(string.format("LOADER: marker counter %d -> %d (child running)",
+ last_count, c))
+ end
+ last_count = c
+ end
+ end
+ end
+ if frames >= ENDF then
+ if injected then
+ done = true
+ inspect()
+ if SNAP then
+ local screen = nil
+ for _, s in pairs(machine.screens) do screen = s break end
+ if screen then
+ local out = OUT .. "/loader_frame" .. frames .. ".png"
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("LOADER: snapshot %s ok=%s %s",
+ out, tostring(ok), tostring(err or "")))
+ end
+ end
+ end
+ machine:exit()
+ end
+end, "vt1200-loader")
+
+-- (Lua has no forward use of a name defined later; set a small flag here.)
+base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'
diff --git a/apps/termtris/tests/play.sh b/apps/termtris/tests/play.sh
new file mode 100755
index 0000000..7afc6d9
--- /dev/null
+++ b/apps/termtris/tests/play.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+# play.sh -- load termtris, click it active, and snapshot the board.
+set -eu
+DIR=$(cd "$(dirname "$0")" && pwd)
+APP=$(cd "$DIR/.." && pwd)
+ROOT=$(cd "$APP/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+EV="$APP/evidence"
+LOG="$APP/build/play.log"
+mkdir -p "$EV" "$APP/build"
+OUTNAME=termtris "$APP/build.sh" "$APP/src/vt1200/main.c" "$APP/src/game.c" "$APP/src/vt1200/scoredb.c" \
+ "$APP/src/vt1200/x11.c" "$APP/src/vt1200/compat.c" "$APP/src/vt1200/xgfix.c" \
+ >"$APP/build/play-build.log" 2>&1
+rm -f "$EV/loader_frame3300.png"
+TICK=$(awk '{for(i=2;i<=NF;i++) if($i=="_tick_interval") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+QUIT=$(awk '{for(i=2;i<=NF;i++) if($i=="_quit") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+VT1200_SKIP_LEVEL1=1 LOADER_SNAP=1 DIAG_TICK="0x$TICK" DIAG_QUIT="0x$QUIT" \
+LOADER_AT=2500 LOADER_END=3300 \
+LOADER_BIN="$ROOT/dwt/loader/build/loader.bin" \
+LOADER_COFF="$APP/build/termtris.coff" \
+LOADER_OUT="$EV" \
+"$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -video none -sound none -nothrottle -skip_gameinfo \
+ -debug -debugger none \
+ -autoboot_script "$DIR/play.lua" -autoboot_delay 0 \
+ >"$LOG" 2>&1 || true
+grep -E 'PLAY:|DIAG:|LOADER: result|LOADER: snapshot' "$LOG" | tail -6
+grep -q 'LOADER: result status=0' "$LOG" || { echo "play.sh: the game did not start (see $LOG)" >&2; exit 1; }
+DIAG=$(grep -a 'DIAG: tick=' "$LOG" | head -1)
+[ -n "$DIAG" ] || { echo "play.sh: no DIAG line (see $LOG)" >&2; exit 1; }
+TICKVAL=$(printf '%s' "$DIAG" | sed -n 's/.*tick=\([-0-9]*\).*/\1/p')
+QUITVAL=$(printf '%s' "$DIAG" | sed -n 's/.*quit=\([-0-9]*\).*/\1/p')
+[ "$TICKVAL" -gt 0 ] || { echo "play.sh: init_game never ran (tick=$TICKVAL)" >&2; exit 1; }
+[ "$QUITVAL" = 0 ] || { echo "play.sh: game quit by itself" >&2; exit 1; }
+[ -s "$EV/loader_frame3300.png" ] || { echo "play.sh: no snapshot (see $LOG)" >&2; exit 1; }
+cp "$EV/loader_frame3300.png" "$EV/termtris_frame3300.png"
+echo "play: $EV/termtris_frame3300.png"
diff --git a/apps/termtris/tests/play_keys.lua b/apps/termtris/tests/play_keys.lua
new file mode 100644
index 0000000..38f5f77
--- /dev/null
+++ b/apps/termtris/tests/play_keys.lua
@@ -0,0 +1,390 @@
+-- loader.lua -- debugger-assisted COFF loader acceptance harness.
+--
+-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
+-- the OS, then at frame LOADER_AT pokes:
+-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
+-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
+-- * the loader descriptor at 0x01882C00
+-- and sets PC = 0x01880000. It does not use the network, the rdebug service
+-- or any firmware transport: this is the debugger-assisted milestone.
+--
+-- The loader itself copies the COFF sections to their linked bit addresses and
+-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
+-- the input and reads the result; it never writes the app's code or markers.
+--
+-- Env:
+-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
+-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
+-- LOADER_BUF COFF buffer bit address (default 0x01900000)
+-- LOADER_AT injection frame (default 2500)
+-- LOADER_END inspection/exit frame (default 2700)
+-- LOADER_OUT evidence directory (default dwt/loader/evidence)
+-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
+-- LOADER_VERBOSE 1 = print the result block every 25 frames
+
+local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
+
+local machine = manager.machine
+local PLAY_MODE = os.getenv("PLAY_MODE") or "move"
+print("PLAYKEYS: mode="..PLAY_MODE)
+local DL = tonumber(os.getenv("DIAG_LOOPS") or "0")
+local DE = tonumber(os.getenv("DIAG_EVENTS") or "0")
+local DT = tonumber(os.getenv("DIAG_LAST") or "0")
+local DF = tonumber(os.getenv("DIAG_FOCUS") or "0")
+local DR = tonumber(os.getenv("DIAG_REV") or "0")
+local DQ = tonumber(os.getenv("DIAG_QUIT") or "0")
+local DTICK = tonumber(os.getenv("DIAG_TICK") or "0")
+local ports = machine.ioport.ports
+local key_a = ports[":lk401:K26"].fields["A"]
+local key_d = ports[":lk401:K28"].fields["D"]
+local key_s = ports[":lk401:K27"].fields["S"]
+local key_w = ports[":lk401:K14"].fields["W"]
+local key_0 = ports[":lk401:K10"].fields["0 )"]
+local key_p = ports[":lk401:K22"].fields["P"]
+local key_r = ports[":lk401:K16"].fields["R"]
+local key_h = ports[":lk401:K31"].fields["H"]
+local key_q = ports[":lk401:K13"].fields["Q"]
+local tabx = ports[":tablet:TABLET_X"].fields["Tablet X"]
+local taby = ports[":tablet:TABLET_Y"].fields["Tablet Y"]
+local tabb = ports[":tablet:TABLET_BTN"].fields["P1 Button 1"]
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+
+if not dbg then
+ print("LOADER: debugger not enabled; pass -debug")
+ machine:exit()
+ return
+end
+
+local AT = tonumber(os.getenv("LOADER_AT") or "2500")
+local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
+local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
+local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
+local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
+local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
+local SNAP = os.getenv("LOADER_SNAP") == "1"
+local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
+local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
+local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
+
+local LOADER_BASE = 0x01880000
+local DESC = 0x01882C00
+local RESULT = 0x01882D00
+local RETURN_STUB = 0x01883100
+local RETURN_SP = 0x01883110
+
+local function rd(p) return io.open(p, "rb") end
+local function slurp(p)
+ local f, err = rd(p)
+ if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
+ local s = f:read("*a")
+ f:close()
+ return s
+end
+
+local function u16(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+end
+
+local function u32(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+ + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
+end
+
+local function parse_coff(d)
+ local c = { data = d }
+ c.magic = u16(d, 0)
+ c.nscns = u16(d, 2)
+ c.opthdr = u16(d, 16)
+ c.sections = {}
+ if c.opthdr > 0 then
+ c.optmagic = u16(d, 20)
+ c.entry = u32(d, 20 + 16)
+ c.textstart = u32(d, 20 + 20)
+ c.datastart = u32(d, 20 + 24)
+ end
+ local base = 20 + c.opthdr
+ for i = 0, c.nscns - 1 do
+ local o = base + i * 40
+ local name = d:sub(o + 1, o + 8):gsub("%z", "")
+ c.sections[#c.sections + 1] = {
+ name = name,
+ paddr = u32(d, o + 8),
+ size = u32(d, o + 16), -- bits
+ scnptr = u32(d, o + 20),
+ flags = u32(d, o + 36),
+ }
+ end
+ return c
+end
+
+local function poke_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ prog:write_u16(bitaddr + i * 16, lo + hi * 256)
+ end
+ return n
+end
+
+local function verify_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ local bad = 0
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
+ bad = bad + 1
+ end
+ end
+ return n, bad
+end
+
+local function w32(a, v) prog:write_u32(a, v) end
+local function r32(a)
+ local ok, v = pcall(function() return prog:read_u32(a) end)
+ if ok then return v end
+ return 0xDEADBEEF
+end
+
+local loader = slurp(BIN)
+local coff = slurp(COFF)
+local app = parse_coff(coff)
+
+print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
+print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
+print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
+ app.magic, app.nscns, app.opthdr,
+ app.optmagic and string.format("%04X", app.optmagic) or "none",
+ hex(app.entry or 0), hex(app.textstart or 0)))
+for _, s in ipairs(app.sections) do
+ print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
+ s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
+end
+
+local TRACE = os.getenv("LOADER_TRACE") == "1"
+
+local frames = 0
+local injected = false
+local done = false
+local last_count = -1
+
+local function status_name(v)
+ local t = {
+ [0] = "OK",
+ [1] = "bad descriptor",
+ [2] = "truncated COFF / section headers",
+ [3] = "bad COFF magic",
+ [4] = "section size not whole words",
+ [5] = "target outside RAM",
+ [6] = "target overlaps loader page or COFF buffer",
+ [7] = "relocation records present (unsupported)",
+ [8] = "target not in a free-list block",
+ [9] = "no entry point",
+ }
+ return t[v] or ("error " .. tostring(v))
+end
+
+local function result_dump()
+ local st = r32(RESULT + 0x000)
+ print(string.format(
+ "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
+ st, status_name(st), hex(r32(RESULT + 0x020)),
+ hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
+ hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
+ hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
+ r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
+ r32(RESULT + 0x140), r32(RESULT + 0x160)))
+end
+
+local function inject()
+ -- 1. loader itself
+ local n, bad = 0, 0
+ poke_bytes(LOADER_BASE, loader)
+ n, bad = verify_bytes(LOADER_BASE, loader)
+ print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
+ n, bad, hex(LOADER_BASE)))
+
+ -- 2. COFF image
+ poke_bytes(BUF, coff)
+ n, bad = verify_bytes(BUF, coff)
+ print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
+ n, bad, hex(BUF)))
+
+ -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
+ for _, s in ipairs(app.sections) do
+ if s.flags & 0x80 ~= 0 then
+ for i = 0, math.floor(s.size / 16) - 1 do
+ prog:write_u16(s.paddr + i * 16, 0xA5A5)
+ end
+ print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
+ hex(s.paddr), hex(s.paddr + s.size)))
+ end
+ end
+
+ -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
+ w32(DESC + 0x00, 0)
+ prog:write_u16(DESC + 0x00, 0x4C44)
+ prog:write_u16(DESC + 0x10, 0x5231)
+ w32(DESC + 0x20, BUF)
+ w32(DESC + 0x40, #coff)
+ w32(DESC + 0x60, MODE)
+ print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
+ hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
+ hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
+
+ -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
+ -- itself); mode 1 returns here, and the stub resumes the interrupted
+ -- PC so the caller yields and the scheduler can run the child.
+ local orig_pc = cpu.state['PC'].value
+ if MODE == 1 then
+ prog:write_u16(RETURN_STUB, 0xC080) -- jauc
+ prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
+ prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
+ else
+ prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
+ end
+
+ -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
+ -- the return slot so mode=1 would return to the spin stub.
+ -- Leave SP alone for mode 0: the loader pushes onto the current
+ -- process stack, then restores it and resumes at ORIG_PC. (mode 1
+ -- would use the return stub.)
+ w32(0x01882A20, orig_pc) -- LD_ORIG_PC
+ print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
+ cpu.state['A8'].value = A8DESC and DESC or 0
+ if MODE == 1 then
+ -- Simulate a CALLA from the current process: push the return
+ -- address on the *firmware* stack (a real transport would do this).
+ local sp = cpu.state['SP'].value - 0x20
+ w32(sp, RETURN_STUB)
+ cpu.state['SP'].value = sp
+ end
+ cpu.state['PC'].value = LOADER_BASE
+ injected = true
+ print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
+ frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
+end
+
+local function inspect()
+ result_dump()
+
+ -- Verify the placement from RAM: .text/.data must equal the file bytes.
+ for _, s in ipairs(app.sections) do
+ if s.scnptr ~= 0 and s.size > 0 then
+ local nb = math.floor(s.size / 8)
+ local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
+ local _, bad = verify_bytes(s.paddr, bytes)
+ print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
+ s.name, hex(s.paddr), nb, bad))
+ end
+ end
+
+ local base = COFF:match("([^/]+)$") or COFF
+ if base:find("marker") then
+ print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
+ hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
+ hex(r32(0x018E0060)), r32(0x018E0080)))
+ elseif base:find("xhello") then
+ print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
+ r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
+ hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
+ end
+ if DL ~= 0 then
+ print(string.format("DIAG: loops=%d events=%d last=%d focus=%08X rev=%d quit=%d", r32(DL), r32(DE), r32(DT), DF ~= 0 and r32(DF) or 0, DR ~= 0 and r32(DR) or 0, DQ ~= 0 and r32(DQ) or 0))
+ if DTICK ~= 0 then
+ print(string.format("DIAG: tick=%d", r32(DTICK)))
+ end
+ end
+ print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
+end
+
+emu.register_frame_done(function()
+ frames = frames + 1
+ if frames == 2900 then tabx:set_value(700); taby:set_value(500); print("PLAYKEYS: move") end
+ if frames == 3000 then tabb:set_value(1); print("PLAYKEYS: click down") end
+ if frames == 3020 then tabb:set_value(0); print("PLAYKEYS: click up") end
+ if PLAY_MODE == "move" then
+ if frames == 3100 then key_a:set_value(1) end
+ if frames == 3110 then key_a:set_value(0) end
+ if frames == 3120 then key_d:set_value(1) end
+ if frames == 3130 then key_d:set_value(0) end
+ if frames == 3140 then key_s:set_value(1) end
+ if frames == 3150 then key_s:set_value(0) end
+ if frames == 3160 then key_w:set_value(1) end
+ if frames == 3170 then key_w:set_value(0) end
+ if frames == 3180 then key_0:set_value(1) end
+ if frames == 3190 then key_0:set_value(0) end
+ elseif PLAY_MODE == "panels" then
+ if frames == 3100 then key_h:set_value(1) end
+ if frames == 3110 then key_h:set_value(0) end
+ if frames == 3120 then key_r:set_value(1) end
+ if frames == 3130 then key_r:set_value(0) end
+ elseif PLAY_MODE == "quit" then
+ if frames == 3095 then print("PLAYKEYS: quit arm") end
+ if frames == 3100 then print("PLAYKEYS: Q down"); key_q:set_value(1) end
+ if frames == 3110 then print("PLAYKEYS: Q up"); key_q:set_value(0) end
+ end
+ if frames == AT and not injected then
+ inject()
+ if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
+ end
+ if injected and TRACE and frames == AT + 1 then
+ dbg:command("trace off")
+ print("LOADER: trace written to /tmp/opencode/ld.tr")
+ end
+ if injected and not done then
+ if TRACE and frames <= AT + 40 then
+ print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
+ frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
+ hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
+ hex(r32(RESULT + 0x020))))
+ end
+ local st = r32(RESULT + 0x000)
+ -- status 0 means OK; nonzero is final too once parsing has begun
+ if st ~= 0xFFFFFFFF and not done then
+ -- The loader writes 0 on success. A nonzero status is final
+ -- only after it has been written once (it is 0 from power-on,
+ -- so require the loader to have run: PC no longer at entry or
+ -- the app counter moved).
+ end
+ if VERBOSE and frames % 25 == 0 then
+ result_dump()
+ end
+ if base_contains_marker then
+ local c = r32(0x018E0080)
+ if c ~= last_count then
+ if last_count ~= -1 then
+ print(string.format("LOADER: marker counter %d -> %d (child running)",
+ last_count, c))
+ end
+ last_count = c
+ end
+ end
+ end
+ if frames >= ENDF then
+ if injected then
+ done = true
+ inspect()
+ if SNAP then
+ local screen = nil
+ for _, s in pairs(machine.screens) do screen = s break end
+ if screen then
+ local out = OUT .. "/loader_frame" .. frames .. ".png"
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("LOADER: snapshot %s ok=%s %s",
+ out, tostring(ok), tostring(err or "")))
+ end
+ end
+ end
+ machine:exit()
+ end
+end, "vt1200-loader")
+
+-- (Lua has no forward use of a name defined later; set a small flag here.)
+base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'
diff --git a/apps/termtris/tests/play_keys.sh b/apps/termtris/tests/play_keys.sh
new file mode 100755
index 0000000..a7a1fc0
--- /dev/null
+++ b/apps/termtris/tests/play_keys.sh
@@ -0,0 +1,49 @@
+#!/bin/sh
+# play_keys.sh -- run the real game through move, panels and quit paths.
+set -eu
+DIR=$(cd "$(dirname "$0")" && pwd)
+APP=$(cd "$DIR/.." && pwd)
+ROOT=$(cd "$APP/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+EV="$APP/evidence"
+mkdir -p "$EV" "$APP/build"
+OUTNAME=termtris "$APP/build.sh" "$APP/src/vt1200/main.c" "$APP/src/game.c" "$APP/src/vt1200/scoredb.c" \
+ "$APP/src/vt1200/x11.c" "$APP/src/vt1200/compat.c" "$APP/src/vt1200/xgfix.c" \
+ >"$APP/build/play_keys-build.log" 2>&1
+for mode in ${MODES:-move panels quit}; do
+ LOG="$APP/build/play_$mode.log"
+ rm -f "$EV/loader_frame3200.png"
+ DL=$(awk '{for(i=2;i<=NF;i++) if($i=="_dbg_loops") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ DE=$(awk '{for(i=2;i<=NF;i++) if($i=="_dbg_events") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ DT=$(awk '{for(i=2;i<=NF;i++) if($i=="_dbg_last") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ DF=$(awk '{for(i=2;i<=NF;i++) if($i=="_dbg_focus") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ DR=$(awk '{for(i=2;i<=NF;i++) if($i=="_dbg_rev") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ DQ=$(awk '{for(i=2;i<=NF;i++) if($i=="_quit") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ DTICK=$(awk '{for(i=2;i<=NF;i++) if($i=="_tick_interval") print $(i-1)}' "$APP/build/termtris.map" | head -1)
+ VT1200_SKIP_LEVEL1=1 LOADER_SNAP=1 PLAY_MODE=$mode DIAG_LOOPS="0x$DL" DIAG_EVENTS="0x$DE" DIAG_LAST="0x$DT" DIAG_FOCUS="0x$DF" DIAG_REV="0x$DR" DIAG_QUIT="0x$DQ" \
+ DIAG_TICK="0x$DTICK" \
+ LOADER_AT=2500 LOADER_END=3200 \
+ LOADER_BIN="$ROOT/dwt/loader/build/loader.bin" \
+ LOADER_COFF="$APP/build/termtris.coff" \
+ LOADER_OUT="$EV" \
+ "$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -video none -sound none -nothrottle -skip_gameinfo \
+ -debug -debugger none \
+ -autoboot_script "$DIR/play_keys.lua" -autoboot_delay 0 \
+ >"$LOG" 2>&1 || true
+ grep -E 'PLAYKEYS:|LOADER: result|LOADER: snapshot' "$LOG" | tail -5
+ DIAG=$(grep -a 'DIAG: loops' "$LOG" | sed -n 's/.*loops=\([0-9]*\) events=\([0-9]*\).*quit=\([0-9]*\)/\1 \2 \3/p' | head -1)
+ [ -n "$DIAG" ] || { echo "play_keys.sh: no DIAG line for $mode (see $LOG)" >&2; exit 1; }
+ set -- $DIAG
+ LOOPS=$1; EVENTS=$2; QUIT=$3
+ echo "play_keys: $mode loops=$LOOPS events=$EVENTS quit=$QUIT"
+ [ "$LOOPS" -ge 100 ] || { echo "play_keys.sh: $mode main loop barely ran ($LOOPS)" >&2; exit 1; }
+ [ "$EVENTS" -ge 6 ] || { echo "play_keys.sh: $mode got $EVENTS events, expected the click and keys" >&2; exit 1; }
+ case $mode in
+ move|panels) [ "$QUIT" = 0 ] || { echo "play_keys.sh: $mode quit unexpectedly" >&2; exit 1; } ;;
+ quit) [ "$QUIT" = 1 ] || { echo "play_keys.sh: q did not reach the game (quit=$QUIT)" >&2; exit 1; } ;;
+ esac
+ [ -s "$EV/loader_frame3200.png" ] || { echo "play_keys.sh: no $mode snapshot" >&2; exit 1; }
+ cp "$EV/loader_frame3200.png" "$EV/termtris_${mode}_3200.png"
+done
+echo "play_keys: $EV/termtris_move_3200.png $EV/termtris_panels_3200.png $EV/termtris_quit_3200.png"
diff --git a/apps/termtris/tests/render.c b/apps/termtris/tests/render.c
new file mode 100644
index 0000000..1302a8c
--- /dev/null
+++ b/apps/termtris/tests/render.c
@@ -0,0 +1,58 @@
+/*
+ * render.c -- Task 3 acceptance: draw a border, a playfield outline and
+ * TERMTRIS through the cell-grid backend, then keep the window alive so the
+ * loader can snapshot it.
+ */
+#include "xlib.h"
+#include "x11.h"
+
+extern int vt_install_xg(void);
+
+volatile vt_u32 mark[16];
+int term_width, term_height;
+static const char *word = "TERMTRIS";
+
+static void put(int row, int col, const char *s, unsigned char attr)
+{
+ x11_setcursor(row, col);
+ while(*s) x11_ibmchar((unsigned char)*s++, attr);
+}
+
+int main(void)
+{
+ int r, c;
+
+ mark[0] = 0x524E4452UL; /* RNDR */
+ if(vt_x11_init() != 0) return 1;
+ mark[1] = (vt_u32)vt_dpy;
+ mark[2] = vt_win;
+ mark[3] = vt_gc;
+ mark[5] = (vt_u32)VT_XPENDING(vt_dpy);
+
+ x11_clearscr();
+ for(c = 0; c < 80; c++) {
+ x11_setcursor(0, c); x11_ibmchar('#', 0x70);
+ x11_setcursor(23, c); x11_ibmchar('#', 0x70);
+ }
+ for(r = 0; r < 24; r++) {
+ x11_setcursor(r, 0); x11_ibmchar('#', 0x70);
+ x11_setcursor(r, 79); x11_ibmchar('#', 0x70);
+ }
+ for(r = 2; r < 20; r++) {
+ for(c = 4; c <= 13; c++) {
+ int edge = (r == 2 || r == 19 || c == 4 || c == 13);
+ x11_setcursor(r, c);
+ x11_ibmchar(edge ? '#' : '.', edge ? 0x70 : 0x07);
+ }
+ }
+ put(1, 20, word, 0x70);
+ put(21, 20, "0123456789", 0x70);
+ put(22, 20, "ABCDEFGHIJKLMNOPQRSTUVWXYZ", 0x70);
+ vt_x11_flush();
+ mark[4] = 0x464C5553UL; /* FLUS */
+
+ for(;;) {
+ VT_SLEEP(100);
+ }
+ return 0;
+}
diff --git a/apps/termtris/tests/render.lua b/apps/termtris/tests/render.lua
new file mode 100644
index 0000000..2931358
--- /dev/null
+++ b/apps/termtris/tests/render.lua
@@ -0,0 +1,347 @@
+-- loader.lua -- debugger-assisted COFF loader acceptance harness.
+--
+-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
+-- the OS, then at frame LOADER_AT pokes:
+-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
+-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
+-- * the loader descriptor at 0x01882C00
+-- and sets PC = 0x01880000. It does not use the network, the rdebug service
+-- or any firmware transport: this is the debugger-assisted milestone.
+--
+-- The loader itself copies the COFF sections to their linked bit addresses and
+-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
+-- the input and reads the result; it never writes the app's code or markers.
+--
+-- Env:
+-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
+-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
+-- LOADER_BUF COFF buffer bit address (default 0x01900000)
+-- LOADER_AT injection frame (default 2500)
+-- LOADER_END inspection/exit frame (default 2700)
+-- LOADER_OUT evidence directory (default dwt/loader/evidence)
+-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
+-- LOADER_VERBOSE 1 = print the result block every 25 frames
+
+local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
+
+local machine = manager.machine
+local RENDER_MARK = tonumber(os.getenv("RENDER_MARK") or "0x01A08000")
+local X11P = tonumber(os.getenv("X11_PROGRESS") or "0")
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+
+if not dbg then
+ print("LOADER: debugger not enabled; pass -debug")
+ machine:exit()
+ return
+end
+
+local AT = tonumber(os.getenv("LOADER_AT") or "2500")
+local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
+local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
+local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
+local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
+local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
+local SNAP = os.getenv("LOADER_SNAP") == "1"
+local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
+local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
+local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
+
+local LOADER_BASE = 0x01880000
+local DESC = 0x01882C00
+local RESULT = 0x01882D00
+local RETURN_STUB = 0x01883100
+local RETURN_SP = 0x01883110
+
+local function rd(p) return io.open(p, "rb") end
+local function slurp(p)
+ local f, err = rd(p)
+ if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
+ local s = f:read("*a")
+ f:close()
+ return s
+end
+
+local function u16(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+end
+
+local function u32(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+ + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
+end
+
+local function parse_coff(d)
+ local c = { data = d }
+ c.magic = u16(d, 0)
+ c.nscns = u16(d, 2)
+ c.opthdr = u16(d, 16)
+ c.sections = {}
+ if c.opthdr > 0 then
+ c.optmagic = u16(d, 20)
+ c.entry = u32(d, 20 + 16)
+ c.textstart = u32(d, 20 + 20)
+ c.datastart = u32(d, 20 + 24)
+ end
+ local base = 20 + c.opthdr
+ for i = 0, c.nscns - 1 do
+ local o = base + i * 40
+ local name = d:sub(o + 1, o + 8):gsub("%z", "")
+ c.sections[#c.sections + 1] = {
+ name = name,
+ paddr = u32(d, o + 8),
+ size = u32(d, o + 16), -- bits
+ scnptr = u32(d, o + 20),
+ flags = u32(d, o + 36),
+ }
+ end
+ return c
+end
+
+local function poke_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ prog:write_u16(bitaddr + i * 16, lo + hi * 256)
+ end
+ return n
+end
+
+local function verify_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ local bad = 0
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
+ bad = bad + 1
+ end
+ end
+ return n, bad
+end
+
+local function w32(a, v) prog:write_u32(a, v) end
+local function r32(a)
+ local ok, v = pcall(function() return prog:read_u32(a) end)
+ if ok then return v end
+ return 0xDEADBEEF
+end
+
+local loader = slurp(BIN)
+local coff = slurp(COFF)
+local app = parse_coff(coff)
+
+print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
+print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
+print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
+ app.magic, app.nscns, app.opthdr,
+ app.optmagic and string.format("%04X", app.optmagic) or "none",
+ hex(app.entry or 0), hex(app.textstart or 0)))
+for _, s in ipairs(app.sections) do
+ print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
+ s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
+end
+
+local TRACE = os.getenv("LOADER_TRACE") == "1"
+
+local frames = 0
+local injected = false
+local done = false
+local last_count = -1
+
+local function status_name(v)
+ local t = {
+ [0] = "OK",
+ [1] = "bad descriptor",
+ [2] = "truncated COFF / section headers",
+ [3] = "bad COFF magic",
+ [4] = "section size not whole words",
+ [5] = "target outside RAM",
+ [6] = "target overlaps loader page or COFF buffer",
+ [7] = "relocation records present (unsupported)",
+ [8] = "target not in a free-list block",
+ [9] = "no entry point",
+ }
+ return t[v] or ("error " .. tostring(v))
+end
+
+local function result_dump()
+ local st = r32(RESULT + 0x000)
+ print(string.format(
+ "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
+ st, status_name(st), hex(r32(RESULT + 0x020)),
+ hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
+ hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
+ hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
+ r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
+ r32(RESULT + 0x140), r32(RESULT + 0x160)))
+end
+
+local function inject()
+ -- 1. loader itself
+ local n, bad = 0, 0
+ poke_bytes(LOADER_BASE, loader)
+ n, bad = verify_bytes(LOADER_BASE, loader)
+ print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
+ n, bad, hex(LOADER_BASE)))
+
+ -- 2. COFF image
+ poke_bytes(BUF, coff)
+ n, bad = verify_bytes(BUF, coff)
+ print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
+ n, bad, hex(BUF)))
+
+ -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
+ for _, s in ipairs(app.sections) do
+ if s.flags & 0x80 ~= 0 then
+ for i = 0, math.floor(s.size / 16) - 1 do
+ prog:write_u16(s.paddr + i * 16, 0xA5A5)
+ end
+ print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
+ hex(s.paddr), hex(s.paddr + s.size)))
+ end
+ end
+
+ -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
+ w32(DESC + 0x00, 0)
+ prog:write_u16(DESC + 0x00, 0x4C44)
+ prog:write_u16(DESC + 0x10, 0x5231)
+ w32(DESC + 0x20, BUF)
+ w32(DESC + 0x40, #coff)
+ w32(DESC + 0x60, MODE)
+ print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
+ hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
+ hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
+
+ -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
+ -- itself); mode 1 returns here, and the stub resumes the interrupted
+ -- PC so the caller yields and the scheduler can run the child.
+ local orig_pc = cpu.state['PC'].value
+ if MODE == 1 then
+ prog:write_u16(RETURN_STUB, 0xC080) -- jauc
+ prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
+ prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
+ else
+ prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
+ end
+
+ -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
+ -- the return slot so mode=1 would return to the spin stub.
+ -- Leave SP alone for mode 0: the loader pushes onto the current
+ -- process stack, then restores it and resumes at ORIG_PC. (mode 1
+ -- would use the return stub.)
+ w32(0x01882A20, orig_pc) -- LD_ORIG_PC
+ print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
+ cpu.state['A8'].value = A8DESC and DESC or 0
+ if MODE == 1 then
+ -- Simulate a CALLA from the current process: push the return
+ -- address on the *firmware* stack (a real transport would do this).
+ local sp = cpu.state['SP'].value - 0x20
+ w32(sp, RETURN_STUB)
+ cpu.state['SP'].value = sp
+ end
+ cpu.state['PC'].value = LOADER_BASE
+ injected = true
+ print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
+ frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
+end
+
+local function inspect()
+ result_dump()
+
+ -- Verify the placement from RAM: .text/.data must equal the file bytes.
+ for _, s in ipairs(app.sections) do
+ if s.scnptr ~= 0 and s.size > 0 then
+ local nb = math.floor(s.size / 8)
+ local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
+ local _, bad = verify_bytes(s.paddr, bytes)
+ print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
+ s.name, hex(s.paddr), nb, bad))
+ end
+ end
+
+ local base = COFF:match("([^/]+)$") or COFF
+ if base:find("marker") then
+ print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
+ hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
+ hex(r32(0x018E0060)), r32(0x018E0080)))
+ elseif base:find("xhello") then
+ print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
+ r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
+ hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
+ end
+ if base:find("render") then
+ print(string.format("RENDER: magic=%08X dpy=%08X win=%08X gc=%08X flus=%08X progress=%08X",
+ r32(RENDER_MARK), r32(RENDER_MARK + 0x20), r32(RENDER_MARK + 0x40),
+ r32(RENDER_MARK + 0x60), r32(RENDER_MARK + 0x80),
+ X11P ~= 0 and r32(X11P) or 0))
+ print(string.format("RENDER: pending=%d", r32(RENDER_MARK + 0xA0)))
+ end
+ print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
+end
+
+emu.register_frame_done(function()
+ frames = frames + 1
+ if frames == AT and not injected then
+ inject()
+ if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
+ end
+ if injected and TRACE and frames == AT + 1 then
+ dbg:command("trace off")
+ print("LOADER: trace written to /tmp/opencode/ld.tr")
+ end
+ if injected and not done then
+ if TRACE and frames <= AT + 40 then
+ print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
+ frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
+ hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
+ hex(r32(RESULT + 0x020))))
+ end
+ local st = r32(RESULT + 0x000)
+ -- status 0 means OK; nonzero is final too once parsing has begun
+ if st ~= 0xFFFFFFFF and not done then
+ -- The loader writes 0 on success. A nonzero status is final
+ -- only after it has been written once (it is 0 from power-on,
+ -- so require the loader to have run: PC no longer at entry or
+ -- the app counter moved).
+ end
+ if VERBOSE and frames % 25 == 0 then
+ result_dump()
+ end
+ if base_contains_marker then
+ local c = r32(0x018E0080)
+ if c ~= last_count then
+ if last_count ~= -1 then
+ print(string.format("LOADER: marker counter %d -> %d (child running)",
+ last_count, c))
+ end
+ last_count = c
+ end
+ end
+ end
+ if frames >= ENDF then
+ if injected then
+ done = true
+ inspect()
+ if SNAP then
+ local screen = nil
+ for _, s in pairs(machine.screens) do screen = s break end
+ if screen then
+ local out = OUT .. "/loader_frame" .. frames .. ".png"
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("LOADER: snapshot %s ok=%s %s",
+ out, tostring(ok), tostring(err or "")))
+ end
+ end
+ end
+ machine:exit()
+ end
+end, "vt1200-loader")
+
+-- (Lua has no forward use of a name defined later; set a small flag here.)
+base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'
diff --git a/apps/termtris/tests/render.sh b/apps/termtris/tests/render.sh
new file mode 100755
index 0000000..74cb5c8
--- /dev/null
+++ b/apps/termtris/tests/render.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+# render.sh -- Task 3 acceptance: paint the cell-grid test pattern, then
+# snapshot the window. The PNG is the evidence.
+set -eu
+DIR=$(cd "$(dirname "$0")" && pwd)
+APP=$(cd "$DIR/.." && pwd)
+ROOT=$(cd "$APP/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+EV="$APP/evidence"
+LOG="$APP/build/render.log"
+mkdir -p "$EV" "$APP/build"
+"$APP/build.sh" "$DIR/render.c" "$APP/src/vt1200/x11.c" "$APP/src/vt1200/xgfix.c" >"$APP/build/render-build.log" 2>&1
+rm -f "$EV/loader_frame3400.png"
+MARK=$(awk '{for(i=2;i<=NF;i++) if($i=="_mark") print $(i-1)}' "$APP/build/render.map" | head -1)
+PROG=$(awk '{for(i=2;i<=NF;i++) if($i=="_vt_x11_progress") print $(i-1)}' "$APP/build/render.map" | head -1)
+VT1200_SKIP_LEVEL1=1 LOADER_SNAP=1 RENDER_MARK="0x$MARK" X11_PROGRESS="0x$PROG" \
+LOADER_AT=2500 LOADER_END=3400 \
+LOADER_BIN="$ROOT/dwt/loader/build/loader.bin" \
+LOADER_COFF="$APP/build/render.coff" \
+LOADER_OUT="$EV" \
+"$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -video none -sound none -nothrottle -skip_gameinfo \
+ -debug -debugger none \
+ -autoboot_script "$DIR/render.lua" -autoboot_delay 0 \
+ >"$LOG" 2>&1 || true
+grep -E 'LOADER: snapshot|LOADER: result' "$LOG" | tail -4
+grep -q 'RENDER: magic=524E4452 .*flus=464C5553' "$LOG" || {
+ echo "render.sh: the renderer did not finish (see $LOG)" >&2
+ exit 1
+}
+grep -q 'RENDER: .*progress=00FFFFFF' "$LOG" || {
+ echo "render.sh: flush did not complete (see $LOG)" >&2
+ exit 1
+}
+[ -s "$EV/loader_frame3400.png" ] || { echo "render.sh: no snapshot (see $LOG)" >&2; exit 1; }
+cp "$EV/loader_frame3400.png" "$EV/render_frame3400.png"
+echo "render: $EV/render_frame3400.png"
diff --git a/apps/termtris/tests/smoke.c b/apps/termtris/tests/smoke.c
new file mode 100644
index 0000000..74161fc
--- /dev/null
+++ b/apps/termtris/tests/smoke.c
@@ -0,0 +1,53 @@
+/*
+ * smoke.c -- Task 1 acceptance: a local Xlib client installs the per-process
+ * Xlib context, opens the display, maps a window, and receives a real KeyPress.
+ */
+#include "xlib.h"
+
+extern int vt_install_xg(void);
+
+volatile vt_u32 mark[32];
+volatile vt_u32 evbuf[24];
+
+int main(void)
+{
+ void *dpy;
+ vt_u32 root, win;
+ vt_u32 ks;
+ char buf[8];
+ int n;
+
+ mark[0] = 0x534D4F4BUL; /* SMOK */
+ if(!vt_install_xg()) return 1;
+ dpy = VT_XOPEN("0::0");
+ mark[1] = (vt_u32)dpy;
+ if(!dpy) return 2;
+
+ root = *(vt_u32 *)((char *)dpy + 0x90);
+ root = *(vt_u32 *)((char *)root + 8);
+ win = VT_XCREATE(dpy, root, 80, 80, 480, 312, 2, 1, 0);
+ mark[2] = win;
+ if(!win) return 3;
+
+ VT_XSELECT(dpy, win, 0x22000FUL);
+ VT_XMAP(dpy, win);
+ VT_XSYNC(dpy, 0);
+ mark[3] = 0;
+
+ for(;;) {
+ VT_XNEXT(dpy, (void *)evbuf);
+ mark[3] = mark[3] + 1;
+ mark[4] = evbuf[0];
+ mark[5] = evbuf[13];
+ if(evbuf[0] == 2) {
+ ks = 0;
+ n = VT_XLOOKUP((void *)evbuf, buf, 8, &ks, 0);
+ mark[6] = (vt_u32)n;
+ mark[7] = (vt_u32)(unsigned char)buf[0];
+ mark[8] = ks;
+ mark[9] = 0x4B455950UL; /* KEYP */
+ break;
+ }
+ }
+ return 0;
+}
diff --git a/apps/termtris/tests/smoke.lua b/apps/termtris/tests/smoke.lua
new file mode 100644
index 0000000..9e05357
--- /dev/null
+++ b/apps/termtris/tests/smoke.lua
@@ -0,0 +1,355 @@
+-- loader.lua -- debugger-assisted COFF loader acceptance harness.
+--
+-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
+-- the OS, then at frame LOADER_AT pokes:
+-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
+-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
+-- * the loader descriptor at 0x01882C00
+-- and sets PC = 0x01880000. It does not use the network, the rdebug service
+-- or any firmware transport: this is the debugger-assisted milestone.
+--
+-- The loader itself copies the COFF sections to their linked bit addresses and
+-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
+-- the input and reads the result; it never writes the app's code or markers.
+--
+-- Env:
+-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
+-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
+-- LOADER_BUF COFF buffer bit address (default 0x01900000)
+-- LOADER_AT injection frame (default 2500)
+-- LOADER_END inspection/exit frame (default 2700)
+-- LOADER_OUT evidence directory (default dwt/loader/evidence)
+-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
+-- LOADER_VERBOSE 1 = print the result block every 25 frames
+
+local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
+
+local machine = manager.machine
+local MARK = tonumber(os.getenv("SMOKE_MARK") or "0x01A00000")
+local ports = machine.ioport.ports
+local key_a = ports[":lk401:K26"].fields["A"]
+local tabx = ports[":tablet:TABLET_X"].fields["Tablet X"]
+local taby = ports[":tablet:TABLET_Y"].fields["Tablet Y"]
+local tabb = ports[":tablet:TABLET_BTN"].fields["P1 Button 1"]
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+
+if not dbg then
+ print("LOADER: debugger not enabled; pass -debug")
+ machine:exit()
+ return
+end
+
+local AT = tonumber(os.getenv("LOADER_AT") or "2500")
+local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
+local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
+local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
+local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
+local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
+local SNAP = os.getenv("LOADER_SNAP") == "1"
+local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
+local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
+local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
+
+local LOADER_BASE = 0x01880000
+local DESC = 0x01882C00
+local RESULT = 0x01882D00
+local RETURN_STUB = 0x01883100
+local RETURN_SP = 0x01883110
+
+local function rd(p) return io.open(p, "rb") end
+local function slurp(p)
+ local f, err = rd(p)
+ if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
+ local s = f:read("*a")
+ f:close()
+ return s
+end
+
+local function u16(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+end
+
+local function u32(s, o)
+ return s:byte(o + 1) + s:byte(o + 2) * 256
+ + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
+end
+
+local function parse_coff(d)
+ local c = { data = d }
+ c.magic = u16(d, 0)
+ c.nscns = u16(d, 2)
+ c.opthdr = u16(d, 16)
+ c.sections = {}
+ if c.opthdr > 0 then
+ c.optmagic = u16(d, 20)
+ c.entry = u32(d, 20 + 16)
+ c.textstart = u32(d, 20 + 20)
+ c.datastart = u32(d, 20 + 24)
+ end
+ local base = 20 + c.opthdr
+ for i = 0, c.nscns - 1 do
+ local o = base + i * 40
+ local name = d:sub(o + 1, o + 8):gsub("%z", "")
+ c.sections[#c.sections + 1] = {
+ name = name,
+ paddr = u32(d, o + 8),
+ size = u32(d, o + 16), -- bits
+ scnptr = u32(d, o + 20),
+ flags = u32(d, o + 36),
+ }
+ end
+ return c
+end
+
+local function poke_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ prog:write_u16(bitaddr + i * 16, lo + hi * 256)
+ end
+ return n
+end
+
+local function verify_bytes(bitaddr, data)
+ local n = math.floor((#data + 1) / 2)
+ local bad = 0
+ for i = 0, n - 1 do
+ local lo = data:byte(i * 2 + 1) or 0
+ local hi = data:byte(i * 2 + 2) or 0
+ if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
+ bad = bad + 1
+ end
+ end
+ return n, bad
+end
+
+local function w32(a, v) prog:write_u32(a, v) end
+local function r32(a)
+ local ok, v = pcall(function() return prog:read_u32(a) end)
+ if ok then return v end
+ return 0xDEADBEEF
+end
+
+local loader = slurp(BIN)
+local coff = slurp(COFF)
+local app = parse_coff(coff)
+
+print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
+print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
+print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
+ app.magic, app.nscns, app.opthdr,
+ app.optmagic and string.format("%04X", app.optmagic) or "none",
+ hex(app.entry or 0), hex(app.textstart or 0)))
+for _, s in ipairs(app.sections) do
+ print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
+ s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
+end
+
+local TRACE = os.getenv("LOADER_TRACE") == "1"
+
+local frames = 0
+local injected = false
+local done = false
+local last_count = -1
+
+local function status_name(v)
+ local t = {
+ [0] = "OK",
+ [1] = "bad descriptor",
+ [2] = "truncated COFF / section headers",
+ [3] = "bad COFF magic",
+ [4] = "section size not whole words",
+ [5] = "target outside RAM",
+ [6] = "target overlaps loader page or COFF buffer",
+ [7] = "relocation records present (unsupported)",
+ [8] = "target not in a free-list block",
+ [9] = "no entry point",
+ }
+ return t[v] or ("error " .. tostring(v))
+end
+
+local function result_dump()
+ local st = r32(RESULT + 0x000)
+ print(string.format(
+ "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
+ st, status_name(st), hex(r32(RESULT + 0x020)),
+ hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
+ hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
+ hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
+ r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
+ r32(RESULT + 0x140), r32(RESULT + 0x160)))
+end
+
+local function inject()
+ -- 1. loader itself
+ local n, bad = 0, 0
+ poke_bytes(LOADER_BASE, loader)
+ n, bad = verify_bytes(LOADER_BASE, loader)
+ print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
+ n, bad, hex(LOADER_BASE)))
+
+ -- 2. COFF image
+ poke_bytes(BUF, coff)
+ n, bad = verify_bytes(BUF, coff)
+ print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
+ n, bad, hex(BUF)))
+
+ -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
+ for _, s in ipairs(app.sections) do
+ if s.flags & 0x80 ~= 0 then
+ for i = 0, math.floor(s.size / 16) - 1 do
+ prog:write_u16(s.paddr + i * 16, 0xA5A5)
+ end
+ print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
+ hex(s.paddr), hex(s.paddr + s.size)))
+ end
+ end
+
+ -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
+ w32(DESC + 0x00, 0)
+ prog:write_u16(DESC + 0x00, 0x4C44)
+ prog:write_u16(DESC + 0x10, 0x5231)
+ w32(DESC + 0x20, BUF)
+ w32(DESC + 0x40, #coff)
+ w32(DESC + 0x60, MODE)
+ print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
+ hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
+ hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
+
+ -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
+ -- itself); mode 1 returns here, and the stub resumes the interrupted
+ -- PC so the caller yields and the scheduler can run the child.
+ local orig_pc = cpu.state['PC'].value
+ if MODE == 1 then
+ prog:write_u16(RETURN_STUB, 0xC080) -- jauc
+ prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
+ prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
+ else
+ prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
+ end
+
+ -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
+ -- the return slot so mode=1 would return to the spin stub.
+ -- Leave SP alone for mode 0: the loader pushes onto the current
+ -- process stack, then restores it and resumes at ORIG_PC. (mode 1
+ -- would use the return stub.)
+ w32(0x01882A20, orig_pc) -- LD_ORIG_PC
+ print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
+ cpu.state['A8'].value = A8DESC and DESC or 0
+ if MODE == 1 then
+ -- Simulate a CALLA from the current process: push the return
+ -- address on the *firmware* stack (a real transport would do this).
+ local sp = cpu.state['SP'].value - 0x20
+ w32(sp, RETURN_STUB)
+ cpu.state['SP'].value = sp
+ end
+ cpu.state['PC'].value = LOADER_BASE
+ injected = true
+ print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
+ frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
+end
+
+local function inspect()
+ result_dump()
+
+ -- Verify the placement from RAM: .text/.data must equal the file bytes.
+ for _, s in ipairs(app.sections) do
+ if s.scnptr ~= 0 and s.size > 0 then
+ local nb = math.floor(s.size / 8)
+ local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
+ local _, bad = verify_bytes(s.paddr, bytes)
+ print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
+ s.name, hex(s.paddr), nb, bad))
+ end
+ end
+
+ local base = COFF:match("([^/]+)$") or COFF
+ if base:find("marker") then
+ print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
+ hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
+ hex(r32(0x018E0060)), r32(0x018E0080)))
+ elseif base:find("xhello") then
+ print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
+ r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
+ hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
+ end
+ if base:find("smoke") then
+ print(string.format("SMOKE: magic=%08X dpy=%08X win=%08X n=%d type=%d keycode=%d lookup_n=%d ch=%02X ks=%04X keymark=%08X",
+ r32(MARK + 0x00), r32(MARK + 0x20), r32(MARK + 0x40), r32(MARK + 0x60),
+ r32(MARK + 0x80), r32(MARK + 0xA0), r32(MARK + 0xC0), r32(MARK + 0xE0),
+ r32(MARK + 0x100), r32(MARK + 0x120)))
+ end
+ print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
+end
+
+emu.register_frame_done(function()
+ frames = frames + 1
+ if frames == 2900 then tabx:set_value(700); taby:set_value(500); print("SMOKE: tablet move") end
+ if frames == 3000 then tabb:set_value(1); print("SMOKE: click down") end
+ if frames == 3020 then tabb:set_value(0); print("SMOKE: click up") end
+ if frames == 3100 then key_a:set_value(1); print("SMOKE: A down") end
+ if frames == 3120 then key_a:set_value(0); print("SMOKE: A up") end
+ if frames == AT and not injected then
+ inject()
+ if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
+ end
+ if injected and TRACE and frames == AT + 1 then
+ dbg:command("trace off")
+ print("LOADER: trace written to /tmp/opencode/ld.tr")
+ end
+ if injected and not done then
+ if TRACE and frames <= AT + 40 then
+ print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
+ frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
+ hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
+ hex(r32(RESULT + 0x020))))
+ end
+ local st = r32(RESULT + 0x000)
+ -- status 0 means OK; nonzero is final too once parsing has begun
+ if st ~= 0xFFFFFFFF and not done then
+ -- The loader writes 0 on success. A nonzero status is final
+ -- only after it has been written once (it is 0 from power-on,
+ -- so require the loader to have run: PC no longer at entry or
+ -- the app counter moved).
+ end
+ if VERBOSE and frames % 25 == 0 then
+ result_dump()
+ end
+ if base_contains_marker then
+ local c = r32(0x018E0080)
+ if c ~= last_count then
+ if last_count ~= -1 then
+ print(string.format("LOADER: marker counter %d -> %d (child running)",
+ last_count, c))
+ end
+ last_count = c
+ end
+ end
+ end
+ if frames >= ENDF then
+ if injected then
+ done = true
+ inspect()
+ if SNAP then
+ local screen = nil
+ for _, s in pairs(machine.screens) do screen = s break end
+ if screen then
+ local out = OUT .. "/loader_frame" .. frames .. ".png"
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("LOADER: snapshot %s ok=%s %s",
+ out, tostring(ok), tostring(err or "")))
+ end
+ end
+ end
+ machine:exit()
+ end
+end, "vt1200-loader")
+
+-- (Lua has no forward use of a name defined later; set a small flag here.)
+base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'
diff --git a/apps/termtris/tests/smoke.sh b/apps/termtris/tests/smoke.sh
new file mode 100755
index 0000000..af7044e
--- /dev/null
+++ b/apps/termtris/tests/smoke.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+# smoke.sh -- Task 1 acceptance. Builds the local Xlib smoke payload, loads it
+# into the emulated VT1200 RAM, clicks the window, presses A, and requires a
+# real KeyPress + XLookupString('a').
+set -eu
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+APP=$(cd "$DIR/.." && pwd)
+ROOT=$(cd "$APP/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+LOG="$APP/build/smoke.log"
+
+mkdir -p "$APP/build"
+"$APP/build.sh" "$DIR/smoke.c" "$APP/src/vt1200/xgfix.c" >"$APP/build/smoke-build.log" 2>&1
+
+MARK=$(awk '{for(i=2;i<=NF;i++) if($i=="_mark") print $(i-1)}' "$APP/build/smoke.map" | head -1)
+VT1200_SKIP_LEVEL1=1 SMOKE_MARK="0x$MARK" \
+LOADER_AT=2500 LOADER_END=3400 \
+LOADER_BIN="$ROOT/dwt/loader/build/loader.bin" \
+LOADER_COFF="$APP/build/smoke.coff" \
+LOADER_OUT="$APP/build" \
+"$M" vt1200 -rompath "$ROOT/harness/mame/roms" \
+ -video none -sound none -nothrottle -skip_gameinfo \
+ -debug -debugger none \
+ -autoboot_script "$DIR/smoke.lua" -autoboot_delay 0 \
+ >"$LOG" 2>&1 || true
+
+grep 'SMOKE:' "$LOG" | tail -5
+grep -q 'SMOKE: .*type=2 .*keymark=4B455950' "$LOG" || {
+ echo "smoke.sh: no real KeyPress (see $LOG)" >&2
+ exit 1
+}
+grep -q 'SMOKE: .*lookup_n=1 ch=61 ks=0061' "$LOG" || {
+ echo "smoke.sh: XLookupString did not return 'a' (see $LOG)" >&2
+ exit 1
+}
+echo "smoke: PASS"
diff --git a/apps/termtris/verify.sh b/apps/termtris/verify.sh
new file mode 100755
index 0000000..b7bdf5a
--- /dev/null
+++ b/apps/termtris/verify.sh
@@ -0,0 +1,107 @@
+#!/bin/sh
+# verify.sh -- one-command acceptance for the VT1200 termtris port.
+#
+# apps/termtris/verify.sh # build MAME, then run every test
+# apps/termtris/verify.sh --skip-mame # use the emulator already installed
+#
+# Runs every test even after a failure and exits non-zero if any failed. Each
+# test's full output is kept in apps/termtris/build/verify_.log.
+set -eu
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/../.." && pwd)
+M=${MAME:-/home/arti/code/k-space/mame0289/vt1200}
+ROM_MD5=b46a3e442ccb86134d2356bd70d22fd2
+
+skip_mame=0
+for arg in "$@"; do
+ case $arg in
+ --skip-mame) skip_mame=1 ;;
+ -h|--help)
+ sed -n '2,8p' "$0" | sed 's/^# \{0,1\}//'
+ exit 0
+ ;;
+ *)
+ echo "verify.sh: unknown argument: $arg" >&2
+ exit 2
+ ;;
+ esac
+done
+
+mkdir -p "$DIR/build"
+
+echo "== ROM checksum"
+got=$(md5sum "$ROOT/vt1200_v22.bin" | cut -d' ' -f1)
+if [ "$got" != "$ROM_MD5" ]; then
+ echo "FAIL: vt1200_v22.bin md5 is $got, expected $ROM_MD5" >&2
+ exit 1
+fi
+echo "ok: $got"
+
+echo "== 2ine toolchain"
+LX="${NINE:-/home/arti/os2-work/2ine/build}/lx_loader"
+if [ ! -x "$LX" ]; then
+ echo "FAIL: no 2ine lx_loader at $LX (set NINE=/path/to/2ine/build)" >&2
+ exit 1
+fi
+echo "ok: $LX"
+
+echo "== emulator"
+if [ "$skip_mame" -eq 0 ]; then
+ JOBS=${JOBS:-8} "$ROOT/harness/mame/build.sh"
+fi
+if [ ! -x "$M" ]; then
+ echo "FAIL: no vt1200 binary at $M (set MAME=... or drop --skip-mame)" >&2
+ exit 1
+fi
+echo "ok: $M"
+
+export MAME="$M"
+fail=0
+
+run() {
+ name=$1
+ shift
+ printf '== %-9s ' "$name"
+ if "$@" >"$DIR/build/verify_$name.log" 2>&1; then
+ echo "PASS"
+ else
+ echo "FAIL (apps/termtris/build/verify_$name.log)"
+ tail -20 "$DIR/build/verify_$name.log" | sed 's/^/ /'
+ fail=1
+ fi
+}
+
+run smoke "$DIR/tests/smoke.sh"
+run fmt "$DIR/tests/fmt.sh"
+run render "$DIR/tests/render.sh"
+run input "$DIR/tests/input.sh"
+run play "$DIR/tests/play.sh"
+run play_keys "$DIR/tests/play_keys.sh"
+
+echo
+echo "== play acceptance"
+if [ -f "$DIR/build/play_move.log" ]; then
+ for mode in move panels quit; do
+ grep -a -h 'DIAG: loops' "$DIR/build/play_$mode.log" 2>/dev/null |
+ head -1 | sed "s/^/ $mode /"
+ done
+fi
+
+echo
+echo "== evidence"
+ls -1 "$DIR"/evidence/*.png 2>/dev/null | sed 's/^/ /'
+
+echo
+echo "== ROM checksum (after the suite)"
+got=$(md5sum "$ROOT/vt1200_v22.bin" | cut -d' ' -f1)
+[ "$got" = "$ROM_MD5" ] || { echo "FAIL: ROM changed during the run" >&2; exit 1; }
+echo "ok: $got"
+
+if [ "$fail" -ne 0 ]; then
+ echo
+ echo "verify: FAILED" >&2
+ exit 1
+fi
+echo
+echo "verify: PASS"
diff --git a/docs/superpowers/plans/2026-11-03-termtris-vt1200.md b/docs/superpowers/plans/2026-11-03-termtris-vt1200.md
new file mode 100644
index 0000000..606b55a
--- /dev/null
+++ b/docs/superpowers/plans/2026-11-03-termtris-vt1200.md
@@ -0,0 +1,153 @@
+# termtris VT1200 X11 port — implementation plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build a playable `termtris` that runs as a VT1200 `create_process` child, renders through the ROM X11 server, and accepts the real X keyboard events.
+
+**Architecture:** Vendored upstream game logic + a small VT1200 backend. The backend installs a zeroed per-process Xlib context (`XG`), opens `"0::0"`, maps a 480×312 window, and emulates an 80×24 cell terminal with 6×13 cells. `XNextEvent`/`XLookupString` feed `game_input`; `0x1E93C0` + `sleep(0x3FB33A20)` pace `update`. A 1990 r5.01/2ine build produces absolute COFF for `dwt/loader`.
+
+**Tech Stack:** 1990 TI TMS34010 C tools (r5.01) under 2ine; VT1200 ROM Xlib; MAME `vt1200` harness; GSPLNK COFF.
+
+**Spec:** `docs/superpowers/specs/2026-11-03-termtris-vt1200-design.md`
+
+## Global Constraints
+
+- ROM `vt1200_v22.bin` stays byte-identical (`md5 b46a3e442ccb86134d2356bd70d22fd2`); no MAME or ROM edits.
+- The game runs from VT1200 main RAM via `dwt/loader`; no network and no host-side game client.
+- Link `.text`/`.data`/`.cinit` at bit `0x018A0000`, `.bss` at `0x01A00000`; entry `_start` from `entry.asm`; the `cinit` table is processed by our `var_init`.
+- All Xlib calls use the TI C ABI and the addresses in the spec; re-establish the CPU field state after calls if the compiler's generated code requires it.
+- The per-process Xlib context fix is mandatory **before** `XOpenDisplay`:
+ `proc = *(u32 *)0x1B3900; pp = *(u32 *)(proc + 0x100); *(u32 *)pp = (u32)zeroed_xg_block;`
+- Build stages are retried: 2ine exits 139 after producing output; check artifacts, not exit codes.
+- Vendor `termtris` under `apps/termtris/` with `COPYING` and the GPLv3 headers intact.
+- Commit only `apps/termtris/**`, `harness/mame/TERMTRIS_REPORT.md`, and `docs/superpowers/**` in this work.
+
+## Review Focus
+
+- **A late client's event queue:** the XG block must be installed before `XOpenDisplay`; if it is not, KeyPress events are zero. The acceptance test must inject a key and assert `type=2`.
+- **Cell coordinates:** 6×13, baseline +10; a wrong pitch shears the whole board. The screenshot must show aligned columns.
+- **Timer wrap:** `0x1E93C0` is 16-bit; use `(u16)(now-last)` deltas, never a raw monotonic assumption.
+- **Toolchain output loss:** `gspcg`/`gspa` can crash after writing; the build must detect missing artifacts and retry, not treat exit 139 as failure.
+- **No stdio:** `sprintf`/`fflush`/`stdout` are absent; the compat layer must cover every format/use the game actually has.
+
+---
+
+### Task 1: Vendor and smoke-test the toolchain
+
+**Files:**
+- Create: `apps/termtris/` (upstream `src/`, `COPYING`, `README.md`)
+- Create: `apps/termtris/src/vt1200/entry.asm`
+- Create: `apps/termtris/src/vt1200/xlib.h`
+- Create: `apps/termtris/src/vt1200/xgfix.c`
+- Create: `apps/termtris/build.sh`
+- Test: `apps/termtris/tests/smoke.c` + `apps/termtris/tests/smoke.sh`
+
+**Interfaces:**
+- Produces: `vt_install_xg(void)` in `xgfix.c`; `xlib.h` with the ROM addresses and `vt_xopen`, `vt_xcreate`, `vt_xselect`, `vt_xmap`, `vt_xsync`, `vt_xflush`.
+- Produces: `build.sh` usage `build.sh [extra.obj...]` -> `apps/termtris/build/.coff` and `.map`.
+
+- [ ] **Step 1: Copy upstream** `termtris` into `apps/termtris/` (keep `COPYING`, `src/game.c`, `pieces.h`, `game.h`, `term.h`, `scoredb.h`; do not copy the DOS/Windows/unix backends). Record the upstream commit hash in `apps/termtris/UPSTREAM`.
+- [ ] **Step 2: Write `entry.asm`** — set `A14` to `_cstack`, `A13=A14`; run the cinit loop (length word at `*A9++`, destination long at `*A9++`, copy `length` words), then `CALLA _main`, `RETS`; `.bss _cstack, 32768, 16`.
+- [ ] **Step 3: Write `xlib.h`** with the addresses from the spec and TI-ABI prototypes:
+ `XOpenDisplay 0x3F9C2570`, `XCreateSimpleWindow 0x3FD41B90`, `XSelectInput 0x3FD97D50`, `XMapWindow 0x3FD64F60`, `XSync 0x3FD9F6B0`, `XFlush 0x3F9B1030`, `XNextEvent 0x3F9C1CF0`, `XLookupString 0x3F9A9C30`, `XCreateGC 0x3F997000`, `XSetForeground 0x3FD99A60`, `XFillRectangle 0x3F99E8F0`, `XDrawString 0x3FDA0000`, `sleep 0x3FB33A20`.
+- [ ] **Step 4: Write `xgfix.c`** exactly as the spec's fix; return 0 if `proc`/`pp` is outside RAM, else install a static zeroed `u32 xg[256]` and return 1.
+- [ ] **Step 5: Write `build.sh`** — extract the r5.01 tools/libs into `apps/termtris/work/`; run `gspac -k`, `gspopt -k -O2`, `gspcg -m`, `gspa`, `gsplnk`; retry each stage up to 5 times and verify its output before proceeding; `gsplnk` command file with `.text/.data/.cinit` at `018A0000h` and `.bss` at `01A00000h`; fail if `termtris.out`/`.map` absent.
+- [ ] **Step 6: Smoke test** — `tests/smoke.c` calls `vt_install_xg`, `XOpenDisplay("0::0")`, creates/maps a 480×312 window, selects KeyPress, loops `XNextEvent`, stores `type/keycode` in `.bss` markers, and breaks on `type==2`. `tests/smoke.sh` builds it and runs `dwt/loader/loader.lua` with `LOADER_AT=2500 LOADER_END=3400`, injecting a tablet click at 3000 and `A` at 3100 via a copy of the validated input script.
+- [ ] **Step 7: Verify smoke** — the run prints `type=2`, `keycode=194`, `XLookupString` `n=1, ch=0x61, ks=0x0061`. If not, do not proceed.
+- [ ] **Step 8: Commit** `apps/termtris` scaffold + smoke.
+
+### Task 2: Compatibility layer
+
+**Files:**
+- Create: `apps/termtris/src/vt1200/stdio.h`
+- Create: `apps/termtris/src/vt1200/inttypes.h`
+- Create: `apps/termtris/src/vt1200/compat.c`
+- Test: `apps/termtris/tests/fmt.c` + loader run
+
+**Interfaces:**
+- Produces: `int sprintf(char *buf, const char *fmt, ...)` supporting `%d`, `%ld`, `%u`, `%lu`, `%s`, `%c`, `%%`, optional `-`/`0`, decimal width; `int fflush(void *f)` returns 0; `extern void *stdout` is a null pointer; `time_t time(time_t *)` returns `now_ms()/1000`.
+- Produces: `uint16_t`/`uint32_t` typedefs in `inttypes.h`.
+
+- [ ] **Step 1: Write the test** `fmt.c` producing the exact strings used by `game.c`: `"%10ld"` 12345 -> `" 12345"`, `"%2ld"` 7 -> `" 7"`, `"%8ld"` 42 -> `" 42"`, `"%2d. %s %ld"` (1,"ab",99) -> `" 1. ab 99"`, `"%-3s"` "x" -> `"x "`, `"%%"` -> `"%"`. Store a checksum/bytes in markers.
+- [ ] **Step 2: Implement `compat.c`** with a manual varargs walk (`char *ap = (char *)&fmt; ap -= 4;` per argument) and a decimal/string formatter; no `stdio.h` from the SDK.
+- [ ] **Step 3: Write the shims** so `game.c`'s ``/`` resolve to them; `FILE` is an `int`, `stdout` is 0.
+- [ ] **Step 4: Run the loader test** and compare the marker bytes to the expected strings; fix until exact.
+- [ ] **Step 5: Commit** compat + test.
+
+### Task 3: Cell-grid X11 backend
+
+**Files:**
+- Create: `apps/termtris/src/vt1200/x11.c`
+- Create: `apps/termtris/src/vt1200/x11.h`
+- Test: `apps/termtris/tests/render.c` + screenshot
+
+**Interfaces:**
+- Produces: `int vt_x11_init(void)` — open display, install XG, create 480×312 window at (80,80), select input, map, create GC, `XSync`; returns 0 on success.
+- Produces: `void vt_x11_flush(void)` — draw dirty cells.
+- Produces: `term_*` callback implementations: `x11_reset`, `x11_clearscr`, `x11_setcursor(row,col)`, `x11_cursor(show)`, `x11_setcolor(fg,bg)`, `x11_ibmchar(c,attr)`; `term_putstr` loops `x11_ibmchar`.
+- Produces: `vt_x11_key(int *ks, int *ch)`? No — input is in Task 4; this task only exposes the window/display globals via `x11.h`.
+
+- [ ] **Step 1: Write `render.c`** that calls `vt_x11_init`, fills an 80×24 cell buffer with a border pattern and `TERMTRIS` text, marks all cells dirty, flushes, and exits via a marker.
+- [ ] **Step 2: Implement the cell grid** with `unsigned short ch; unsigned char fg, bg;` per cell; `x11_ibmchar` writes at the cursor and advances; `attr` decode `fg=(attr>>4)&0xf`, `bg=attr&0xf`; mono pixel `(fg==0?0:1)`, `(bg==0?0:1)`.
+- [ ] **Step 3: Implement flush** per dirty cell: `XSetForeground(bg)`, `XFillRectangle(x,y,6,13)`, `XSetForeground(fg)`, `XDrawString(x,y+10,ch,1)`; then `XFlush`.
+- [ ] **Step 4: Metrics test** — render a row of `'#'` at columns 0..79, a 20×18 playfield outline, and the word `TERMTRIS`; capture the frame at 3300 with `LOADER_SNAP=1`; visually verify 6-px columns and 13-px rows, no shear.
+- [ ] **Step 5: Commit** backend + screenshot evidence.
+
+### Task 4: Input, timer, and main loop
+
+**Files:**
+- Create: `apps/termtris/src/vt1200/main.c`
+- Test: `apps/termtris/tests/input.c` + loader run with injected keys
+
+**Interfaces:**
+- Produces: `long now_ms(void)` — 32-bit accumulator over the 16-bit `0x1E93C0`; `void sleep_ms(int ms)` — `sleep(0x3FB33A20)`.
+- Produces: `int vt_poll_event(void)` — `XPending` (`0x3FD67620`) > 0; `void vt_handle_event(void)` — `XNextEvent`, `XLookupString`, map to `game_input`.
+- Produces: `int main(void)` — `vt_install_xg`, `vt_x11_init`, `init_game`, loop: drain events, `now=now_ms()`, `next=update(now)`, `sleep_ms(min(next-now,10))`; Expose -> `full_redraw` via `game_input('`')`; FocusOut -> `game_input('p')`.
+
+- [ ] **Step 1: Write `input.c`** that initializes the game/window, then on the first `KeyPress` calls `XLookupString` and stores `keycode`, `keysym`, and the mapped `game_input` byte in markers; inject `A`, Up, Down, Left, Right, `0`, Enter, Backspace.
+- [ ] **Step 2: Implement the key map**: letters lower-cased via `XLookupString`; `XK_Left 0xFF51` -> `game_input(0x9b); game_input('A')`; Right 0xFF53 -> `'D'`; Up 0xFF52 -> `'A'?` (use `'w'`); Down 0xFF54 -> `'B'`? Use the game's CSI codes: `0x9b` + `A/B/C/D` for up/down/right/left. Return/Enter -> `'\n'`; Backspace -> `'\b'`; space -> `' '`; Escape -> `27`; digits/letters direct.
+- [ ] **Step 3: Implement the timer** and idle sleep; test that the game's `update` is called ~every 50–900 ms by recording a counter in markers.
+- [ ] **Step 4: Run with the injected keys**; verify the mapped bytes (A -> 'a', Up -> CSI 'A', etc.) and that the process keeps running.
+- [ ] **Step 5: Commit** main/input.
+
+### Task 5: Game integration, score table, and COFF
+
+**Files:**
+- Modify: `apps/termtris/src/game.c` (only `#ifdef VT1200` includes/compat if needed; game logic unchanged)
+- Create: `apps/termtris/src/vt1200/scoredb.c`
+- Modify: `apps/termtris/build.sh` to compile `game.c`, `pieces` (header), backend, compat, scoredb, entry
+- Test: loader run + screenshot + play
+
+**Interfaces:**
+- Consumes: all Task 2–4 interfaces.
+- Produces: `build/termtris.coff`, `build/termtris.map`.
+- `scoredb.c` implements `read_scores`, `save_score`, `print_scores` with a static 10-entry list; `username` default `"VT1200"`.
+
+- [ ] **Step 1: Compile `game.c`** with the 1990 compiler; fix only portability issues (missing `fflush`/`sprintf` via shims, no `unistd`/`fcntl`); do not change game rules.
+- [ ] **Step 2: Implement `scoredb.c`** with a static array; `read_scores` returns it; `save_score` sorts/inserts; `print_scores` no-op/fills the list.
+- [ ] **Step 3: Build the full COFF**; verify the map: `.text/.data/.cinit` at `018A0000`, `.bss` at `01A00000`, entry `_start`, no undefined symbols.
+- [ ] **Step 4: Load and screenshot** at frame 3000 with `dwt/loader/loader.lua`; the Terminal Manager is replaced/covered by the termtris board window.
+- [ ] **Step 5: Play** — inject `A/D/S/W`, `0`, `P`, `R`, `H`, `Q`; capture frames showing piece movement, score update, help/score panels; verify quit/restart.
+- [ ] **Step 6: Commit** game + scores.
+
+### Task 6: Documentation and real-unit path
+
+**Files:**
+- Create: `harness/mame/TERMTRIS_REPORT.md`
+- Modify: `apps/termtris/README.md` (build/run/real-unit)
+- Maybe: `apps/termtris/run.sh` convenience wrapper
+
+- [ ] **Step 1: Write the report** with the toolchain, the XG root cause/fix, the 6×13/80×24 geometry, the timer, the keyboard map, the loader command, evidence screenshots, and the ROM md5 check.
+- [ ] **Step 2: Document the real unit** — same COFF via `dwt/loader/hostload.py`; the XG fix is required; the X server must accept the local connection (default); click the window to focus.
+- [ ] **Step 3: Add a `run.sh`** that builds (optional) and runs MAME with the loader and a deterministic input script for CI.
+- [ ] **Step 4: Final verification** — `md5sum vt1200_v22.bin` unchanged; no MAME/ROM edits; `git status` only our paths.
+- [ ] **Step 5: Commit** docs/report.
+
+---
+
+## Self-review notes
+
+- Spec coverage: vendoring, build, XG fix, renderer, input, timer, scores, acceptance, docs are each a task.
+- The one open implementation choice left to the builder is the exact `sprintf` formatter internals; the required formats are pinned by Task 2's tests.
+- The XG block size (1 KiB) is a deliberate value; if the Xlib writes beyond it, enlarge the static buffer.
+- The input map uses `XLookupString` for letters/digits and keysyms for arrows/editing keys; the exact game escape codes are the game's existing `game_input` codes.
diff --git a/docs/superpowers/specs/2026-11-03-termtris-vt1200-design.md b/docs/superpowers/specs/2026-11-03-termtris-vt1200-design.md
new file mode 100644
index 0000000..ec35c87
--- /dev/null
+++ b/docs/superpowers/specs/2026-11-03-termtris-vt1200-design.md
@@ -0,0 +1,141 @@
+# termtris for the VT1200 — design
+
+Date: 2026-11-03. Status: ready for implementation (input path proven).
+
+## Intent
+
+Run `jtsiomb/termtris` as a **local VT1200 program**: loaded into main RAM by the
+existing COFF loader, displayed through the terminal's **ROM X11 server**, and
+controlled from the real X keyboard events. End-to-end proof is a playable game in
+MAME, with the real-unit path documented.
+
+## What is already proven (2026-11-03)
+
+- **Compiler**: the 1990 r5.01 OS/2 toolchain under the patched 2ine fork builds
+ ANSI C. Pipeline: `gspac -> gspopt -O2 -> gspcg -> gspa -> gsplnk` -> absolute
+ COFF, linked at bit `0x018A0000` (`.bss` at `0x01A00000`).
+- **Loader**: `dwt/loader` pokes the COFF, `create_process`es the entry, and the
+ program runs. `.cinit` static initialisers run via our own `var_init` in
+ `entry.asm`; the linker's `cinit` symbol is at the start of `.cinit`.
+- **ROM Xlib**: `XOpenDisplay`, `XCreateSimpleWindow`, `XSelectInput`,
+ `XMapWindow` (`0x3FD64F60`; `0x3FD645B0` is `XMapRaised`), `XSync`,
+ `XCreateGC`, `XSetForeground`, `XFillRectangle` (`0x3F99E8F0`),
+ `XDrawString` (`0x3FDA0000`), `XNextEvent` (`0x3F9C1CF0`),
+ `XLookupString` (`0x3F9A9C30`) all work from C with the TI ABI.
+- **Rendering**: the default GC's font is **6×13** (baseline +10); an 80×24 cell
+ grid is 480×312. White rectangle + text were rendered in a WM-framed window.
+- **Input (the blocker, now solved)**: a `create_process` child has an
+ **uninitialised per-process Xlib context**. `create_process` leaves
+ `*(proc+0x100)` pointing at a zeroed word; `_XEnq` derives
+ `XG = *(*(proc+0x100))`, so `XG == NULL` and its event free list at
+ `XG+0xCC0` (bit) reads low-RAM garbage. KeyPress nodes were therefore invalid
+ and `XNextEvent` copied unmapped zeros.
+ **Fix**: before `XOpenDisplay`, set
+ `*(u32 *)(*(u32 *)(proc + 0x100)) = (u32)zeroed_block`, where `proc` is
+ `*(u32 *)0x1B3900` and `zeroed_block` is a static `.bss` buffer (1 KiB is
+ enough). With that, the local client receives real events:
+ KeyPress `type=2`, `keycode=194` (LK401 `C2`), `window=0x00400001`, and
+ `XLookupString` returns `n=1, char='a', keysym=0x61`.
+- **Timing**: `sleep(ms)` at `0x3FB33A20` blocks and yields; the raw millisecond
+ counter is the 16-bit `0x1E93C0` (+17 per display interrupt). Use a 32-bit
+ accumulator with `(u16)(now - last)` to avoid the 84 s wrap.
+- **TCP X** also works (`xdpyinfo`/`xev` against `100.103.100.103:0` with the
+ real unit's NVRAM security settings); it is useful for debugging, but the game
+ uses the local service (`"0::0"`), so it needs no network.
+
+## Goals
+
+- `termtris` game logic (pieces, scoring, levels, spawn, collision) unchanged in
+ behaviour.
+- X11 cell-grid renderer: 80×24 characters, 6×13 cells, monochrome pens.
+- Real X11 input: `KeyPress` -> `XLookupString`/keysym -> `game_input`; arrows
+ mapped to the game's CSI sequences, letters lower-cased.
+- Runs from local RAM under `dwt/loader`, with a screenshot and a playable run.
+- A build script and a short report documenting the toolchain, the leak/loader
+ addresses, the XG fix, and the limits.
+
+## Non-goals
+
+- No host-side X client for the game (the x86 `xev` was a diagnostic only).
+- No terminal/ANSI backend on the VT1200 (the game is X11).
+- No modification of the ROM or MAME. All fixes are runtime RAM writes.
+- No file-backed high-score table (the VT1200 has no filesystem); scores live in
+ RAM for the session.
+
+## Approaches considered
+
+1. **Local Xlib + XG initialisation (chosen).** Proven; uses the terminal's real
+ X server and keyboard; no network; the game is a local `create_process` child.
+2. Local Xlib + OS pointer/keycode polling. Reliable fallback, but the keyboard
+ global is lossy (no release/repeat) and the pointer is an odd controller.
+ Keep as a compile-time fallback only.
+3. Host x86 X client over TCP. Works and was used for diagnosis, but does not
+ satisfy "run from VT1200 RAM".
+4. Terminal/ANSI backend. Not X11 and not the request.
+
+## Architecture / files
+
+```
+apps/termtris/ vendored upstream (GPLv3, COPYING kept)
+ src/game.c, pieces.h upstream, small VT1200 patches
+ src/vt1200/
+ main.c X11 event loop, timer, key mapping
+ x11.c term_* callbacks -> cell grid -> XFillRectangle/XDrawString
+ xlib.h ROM entry-point addresses + TI-ABI prototypes
+ xgfix.c per-process Xlib context installation
+ scoredb.c RAM-only high scores
+ compat.c sprintf subset, fflush/stdout stubs
+ entry.asm _start + cinit var_init + rets
+ build.sh 2ine/r5.01 pipeline with stage retries
+ README.md build/run/real-unit instructions
+```
+
+Rendering is a small virtual terminal: `term_setcursor`/`term_putstr`/
+`term_setcolor`/`term_ibmchar` update a cell buffer; `wait_display()` flushes
+changed cells with `XFillRectangle` (background) and `XDrawString` (glyph).
+The 6×13 metrics are measured, not assumed. A full redraw is 80×24 cells.
+
+Input: `XSelectInput` with `KeyPressMask|KeyReleaseMask|ButtonPressMask|
+StructureNotifyMask|FocusChangeMask`; the event loop drains `XNextEvent`;
+`XLookupString` gives the character/keysym. Arrow keys become `ESC [ A..D` for
+`game_input`; `FocusOut` pauses. **Deviation (implemented):** `ExposureMask`
+was dropped because the map-time `Expose` runs the game's full redraw before a
+piece exists and paints a bogus piece; the consequence is that an occluding
+window is not repainted. See `apps/termtris/HANDOFF.md`.
+
+Timing: `now_ms()` accumulates `0x1E93C0` deltas; the idle path is
+`sleep(min(next_tick - now, 10))`, so the CPU yields to the X server and the OS.
+
+## Build
+
+`entry.asm` supplies the process entry and runs the `cinit` table (the 1990
+runtime's `var_init` is local, so the entry implements the 16-bit-length/32-bit-
+destination copy itself). The linker command file places `.text`/`.data`/`.cinit`
+at `0x018A0000` and `.bss` at `0x01A00000`. The build script retries the 2ine
+stage crashes (they exit 139 after producing output) and checks for outputs, not
+exit codes.
+
+## Acceptance
+
+In MAME, with the loader:
+- the window appears with the termtris board and score panels;
+- `A/D/S/W`, arrows, `0`/Enter, `P`, `R`, `H`, `Q`/Backspace behave as upstream;
+- a screenshot of the playfield and a short play session are captured;
+- the ROM md5 is unchanged.
+
+Real unit: the same COFF can be delivered with `dwt/loader/hostload.py` once the
+OS is up; the document will state that the XG fix is required there too and that
+the real unit's X server supplies the same keycodes (LK401).
+
+## Risks
+
+- The 2ine toolchain intermittently segfaults after writing outputs; the builder
+ retries and verifies every artifact.
+- The per-process XG block size is inferred (we used 1 KiB); if the Xlib uses
+ more, enlarge the buffer. It worked through 9 events in the test.
+- `sprintf` is absent from the 1990 runtime; `compat.c` implements only the
+ formats the game uses (`%d`, `%ld`, `%s`, `%c`, width, left-justify, `%%`).
+- Font metrics are the ROM default GC's 6×13; do not use a different GC/font
+ without re-measuring.
+- GPLv3: the vendored tree keeps `COPYING` and the copyright headers; the repo's
+ own license is unchanged.
diff --git a/harness/mame/README.md b/harness/mame/README.md
index c4b24c7..f1deecb 100644
--- a/harness/mame/README.md
+++ b/harness/mame/README.md
@@ -76,6 +76,7 @@ Reports in this directory:
| `BRINGUP_LOG.md` | the whole bring-up narrative, **including withdrawn claims** — read it sceptically |
| `ROMPATCH_REPORT.md` | runtime ROM patching (debug only — see the caveat) |
| `HELLO_WORLD_REPORT.md` | the TMS34010 SDK assembles an 82-byte payload of **our own** code; it runs, writes RAM markers and paints a VRAM block. Debugger entry, not a delivery mechanism |
+| `TERMTRIS_REPORT.md` | the upstream tetris game built with the 1990 r5.01 C toolchain and run **inside** the terminal: ROM Xlib rendering, real X11 key events, the XG-context fix and the row-batched flush |
## Address model (the important part)
diff --git a/harness/mame/TERMTRIS_REPORT.md b/harness/mame/TERMTRIS_REPORT.md
new file mode 100644
index 0000000..75a5742
--- /dev/null
+++ b/harness/mame/TERMTRIS_REPORT.md
@@ -0,0 +1,136 @@
+# TERMTRIS_REPORT — the upstream tetris game running inside the VT1200
+
+`apps/termtris/` builds **our own TMS34010 program** from John Tsiombikas'
+`termtris` (upstream commit `7c5435dd4e93ffc10f3b5c68fe1ae9718a365258`) with the
+1990 TI r5.01 C toolchain under 2ine, loads it into VT1200 RAM and runs it on
+the emulated terminal's own X server. It draws through the ROM Xlib and reads
+real X11 `KeyPress` events. No host client, no terminal escape output, no ROM
+patches.
+
+Full port documentation: `apps/termtris/VT1200.md`.
+
+## Build
+
+```sh
+cd apps/termtris
+OUTNAME=termtris ./build.sh src/vt1200/main.c src/game.c \
+ src/vt1200/scoredb.c src/vt1200/x11.c src/vt1200/compat.c \
+ src/vt1200/xgfix.c
+```
+
+`build.sh` runs `gspac`/`gspopt`/`gspcg`/`gspa` and `gsplnk` through
+`/home/arti/os2-work/2ine/build/lx_loader` against the r5.01 SDK zips under
+`tools/tms34010-sdk/1990-11 TMS340 Family SDK/`. Those 2ine-hosted tools
+frequently segfault after writing their output, so the wrapper treats an output
+file as success and retries a missing one. A host kernel without
+`CONFIG_X86_16BIT` cannot give the 16-bit OS/2 tools their LDT segments; the
+wrapper detects that and runs the same loader through `qemu-i386`, whose
+linux-user emulation implements them. Two more quirks are handled there:
+
+* `gspac` needs `-i.` for the angle-bracket shim headers;
+* an empty `.cinit` makes `cinit` point at `.text`, whose first instruction the
+ entry walker would read as a record count — when the map reports `.cinit`
+ length 0 the link is repeated with the one-word `CINITZ.obj` terminator.
+
+Result (map):
+
+```
+.text 018A0000 .cinit 018B4A60 .bss 01A00000
+ENTRY POINT SYMBOL: "_start" address: 018a0000
+```
+
+These are **bit** addresses, as everywhere on the TMS34010.
+
+## The one required Xlib fix
+
+A child created by `create_process` has a NULL per-process Xlib context
+(`*(*(proc + 0x100))`). The ROM Xlib's `_XEnq` treats that as the queue head, so
+`XNextEvent` copies unmapped garbage and never returns an event.
+`src/vt1200/xgfix.c` writes a zeroed 1 KiB block into that per-process word
+before `XOpenDisplay`. RAM only; the ROM is unchanged.
+
+Smoke test evidence (`apps/termtris/tests/smoke.sh`):
+`type=2 keycode=194 lookup_n=1 ch=61 ks=0061` — a real `KeyPress` and
+`XLookupString` returning `a`.
+
+## Rendering and the flush deadlock
+
+80×24 cells of 6×13 px (the default GC font, baseline +10) → a 480×312 window.
+The raster is 1 bit deep, so the backend drops colour (like the game's `-m`
+monochrome mode) and treats the bold bit (`0x80`) as reverse video. That
+reversal is this backend's choice; upstream `ansi.c -m` only emits SGR bold. The playfield
+is black spaces; tetrominoes are the `[`/`]` tiles.
+
+`vt_x11_flush()` repaints **whole rows** — one fill for the row background, one
+`XDrawString` for its 80 characters, fill/string pairs for reversed spans, then
+a single `XFlush`. This is not an optimisation for looks:
+
+* the per-cell version (4 requests/cell) outran the in-machine X server;
+* an `XSync` per row **deadlocked the client** — the debug marker
+ `_vt_x11_progress` froze at `0x00010014` (row 20), the main-loop counter
+ stayed 0 and the game window never got a preview piece. Batching a row makes
+ a full redraw a few hundred bytes and `loops` reached 650 between frames
+ 2500 and 3200 (VR319 default).
+
+## Timing and keys
+
+`now_ms()` accumulates the 16-bit counter at bit `0x1E93C0` into 32 bits;
+`sleep_ms()` calls the ROM `sleep` (`0x3FB33A20`) with a 1–10 ms clamp. The
+game's own `update()` picks the tick (887 ms at level 0).
+
+`KeyPress` → `XLookupString` → lower-cased letters to `game_input()`; arrows as
+the game's CSI codes (`0x9b` + `A`/`B`/`C`/`D`), which it maps back to
+`w`/`s`/`d`/`a`; `0x7F` is Backspace/Delete. `ExposureMask` is not selected:
+a map-time `Expose` fires the game's full-redraw before it has a current piece,
+which draws a bogus piece over the top row (blank border plus stray `X` tiles).
+
+## Reproduce
+
+```sh
+apps/termtris/verify.sh # the whole acceptance run
+apps/termtris/tests/play.sh # load, click, snapshot
+apps/termtris/tests/play_keys.sh # move / panels / quit
+apps/termtris/run.sh # interactive MAME session
+```
+
+The run is `VT1200_SKIP_LEVEL1=1 LOADER_AT=2500` with the loader payload at bit
+`0x01880000` and the COFF at `0x01900000`; at frame 2500 the script enters
+`dwt/loader/build/loader.bin`, which places the sections and calls
+`create_process`.
+
+Last full acceptance run — MAME 0.289 built from this tree's driver at the
+**VR319 default** (1280×1024 active), which is the real unit's monitor. The
+earlier figures in this report were VR150 (1024×864):
+
+```
+move DIAG: loops=650 events=18 last=3 focus=00400001 rev=0 quit=0
+panels DIAG: loops=648 events=12 last=3 focus=00400001 rev=0 quit=0
+quit DIAG: loops=555 events=10 last=3 focus=00400001 rev=0 quit=1
+```
+
+`focus=00400001` is the termtris window, sampled on the click's `ButtonRelease`;
+`quit=1` is the game's global after `q`, and that is the proof the key reached
+the game, not just the window. The event counts and
+the `tick=887` are unchanged from the VR150 run; only the loop counts moved,
+because the VR319 raster changes the emulated frame rate. The evidence PNGs
+were regenerated in this run and are now 1280×1024.
+
+| evidence | file |
+|---|---|
+| board, panels, preview | `apps/termtris/evidence/termtris_frame3300.png` |
+| after a/d/s/w/0 | `apps/termtris/evidence/termtris_move_3200.png` |
+| after h and r | `apps/termtris/evidence/termtris_panels_3200.png` |
+| after q (`quit=1`) | `apps/termtris/evidence/termtris_quit_3200.png` |
+| renderer test pattern | `apps/termtris/evidence/render_frame3400.png` |
+
+## Limits
+
+* No sound, no filesystem: scores live in `.bss` and vanish with the process.
+* `q` sets the game's `quit` and the loop exits, but the window stays on screen
+ — the created process does not tear down its X connection.
+* Startup is retried (up to 40 × 50 ms) because `XOpenDisplay`/window creation
+ intermittently fails while the display server settles.
+* Tetrominoes are text tiles; a 1-bit cell has no other shape to offer.
+
+The ROM `vt1200_v22.bin` is never modified — `md5 b46a3e442ccb86134d2356bd70d22fd2`
+before and after.