// retroDE_ps2 — tb_gs_demo_psmct16_swizzle_e2e (Ch129)
//
// Full driver-shaped end-to-end demo with all three PSMCT16
// swizzle gates ENABLED simultaneously — the PSMCT16 counterpart
// to Ch123's PSMCT32 e2e demo. The demo flow exercises only the
// raster (Ch128) + scanout (Ch126) paths; gif_image_xfer_stub is
// instantiated with PSMCT16_SWIZZLE=1 as a smoke check, but no
// TRXDIR/IMAGE packet is delivered — `xfer_writes_seen == 0` is
// asserted to lock that. Ch127's PSMCT16 image-xfer swizzle is
// independently locked end-to-end by the focused
// `tb_gs_image_xfer_swizzle_psmct16` TB; a future "TRXDIR-driven
// PSMCT16 swizzled e2e" chapter (Ch130 candidate, mirrors Ch124)
// would land the image-xfer path under DMAC delivery + EE
// bootlet.
//
// Codex framing for Ch129: "do the driver-shaped PSMCT16 end-to-
// end demo next, mirroring the PSMCT32 path. I'd start with
// raster-driven PSMCT16 swizzled e2e, all relevant gates on, EE
// bootlet + DMAC/GIF PACKED primitive stream if practical. Then
// follow with a TRXDIR-driven PSMCT16 e2e if you want the Ch123/
// Ch124 symmetry."
//
// Topology (mirrors Ch123 — only the PSM and gate parameters
// differ):
//
//   bios_rom_stub  ── ee_core_stub ─┐
//                                   │
//                          ee_memory_map_stub ─── dmac_reg_stub
//                                   │                  │
//                          ee_gs_priv_bridge_stub      │
//                                   │                  ▼
//                                   ▼      ┌── gif_packed_stub ─→ gif_image_xfer_stub#(PSMCT16_SWIZZLE=1)
//                          gs_stub#(PSMCT16_SWIZZLE=1) ┤
//                                   │      └── (raster emit on swizzled PSMCT16 byte addresses)
//                                   ▼
//                                vram_stub
//                                   │
//                          gs_pcrtc_stub#(PSMCT16_SWIZZLE=1) → r/g/b
//
// What's the same as Ch123:
//   - BIOS-resident EE bootlet at 0xBFC0_0000.
//   - EE program does GS-priv bring-up (DISPFB1 / DISPLAY1 lo /
//     DISPLAY1 hi / PMODE.EN1) THEN DMAC kick (MADR / QWC / CHCR)
//     THEN SYSCALL halt — same Ch113/Ch114 sequence.
//   - DMAC ch2 streams a GIF qword payload from RAM through
//     gif_packed_stub into gs_stub (PACKED A+D primitive stream).
//   - 4 SPRITE PACKED packets tile the 16×8 active area into
//     four 8×4 quadrants; per-quadrant unique RGB so every
//     captured pixel can be matched back to its sprite.
//   - vram_stub is the storage; gs_pcrtc_stub drives scanout.
//
// What's new for Ch129:
//   - All three modules instantiated with PSMCT16_SWIZZLE=1
//     (and PSMCT32_SWIZZLE=0 — explicitly OFF, this demo only
//     exercises the PSMCT16 paths). The Ch128 raster gate and
//     the Ch126 scanout gate are LOAD-BEARING here (the demo
//     fails if either is wrong); the Ch127 image-xfer gate is
//     parameter-set but SMOKE-ONLY — `xfer_writes_seen == 0`
//     is asserted because no TRXDIR/IMAGE packet is delivered
//     in this raster-driven demo. Ch127 remains the actual
//     image-xfer-side proof until Ch130 lands the TRXDIR-driven
//     PSMCT16 e2e (mirrors Ch124's PSMCT32 TRXDIR demo).
//   - Framebuffer is PSMCT16 (FRAME_1.PSM=2, DISPFB1.PSM=2).
//     Raster emits write 16-bit RGB5A1 halfwords. The Ch95
//     ABGR→RGB5A1 packing in gs_stub takes the high 5 bits of
//     each channel: R5=R[7:3], G5=G[7:3], B5=B[7:3], A1=A[7].
//     So the per-quadrant RGBAQ is chosen to give 5-bit channel
//     values that DON'T collide between quadrants under 5→8
//     bit-replicate at PCRTC scanout.
//   - Sprites span block (0,0) (x∈[0..7]) AND block (1,0)
//     (x∈[8..15]) of page (0,0) at FBP=0/FBW=1; PSMCT16 block
//     is 16×8, so the 16×8 image touches blockTable16 entries
//     [0][0]=0 (xb=0..7) and [0][0] again (xb=8..15) — wait,
//     PSMCT16 blocks are 16 px wide, so x∈[0..15] is all in
//     block_x_in_page=0. The 16×8 image lives entirely in
//     block (0,0) of page (0,0) — but exercises ALL 16 xb
//     positions × ALL 8 yb positions of `columnTable16`,
//     which is the within-block layout that PSMCT32 didn't
//     have to verify. Linear-only separator picks a byte the
//     linear formula would touch but swizzled doesn't.
//   - Verification has TWO phases: (a) per-pixel SCANOUT
//     readback (Ch126 path) — every (x, y) in the active area
//     reads back its quadrant's RGB after PCRTC's 5→8
//     bit-replicate; (b) per-pixel HALFWORD readback at
//     swizzled addresses (Ch128 path) via vram_stub's 2nd read
//     port — each of the 128 sprite pixels lands at the
//     canonical PCSX2 swizzled byte. Strict linear-vs-swizzled
//     separators at bytes 256 and 384 stay 0: the 16×8 PSMCT16
//     image fills block (0,0) of page 0 entirely (bytes 0..254
//     in steps of 2), and PSMCT16 linear stride at FBW=1 is
//     128 bytes/row → linear y=2 row starts at byte 256 and
//     y=3 at byte 384 — both strictly outside the swizzled
//     write set, so a fall-through to linear would surface
//     immediately at those bytes.
//
// PASS criteria:
//   - 1 EV_DMA_START / 24 EV_DMA_BEAT / 1 EV_DMA_DONE (4 sprites
//     × 6 qwords each = 24).
//   - 4 GIFtag accepts; 20 PACKED A+D dispatches (4 sprites × 5
//     A+D each = 20).
//   - 4 EE-CPU MMIO writes the map decoded as GS-priv (PMODE +
//     DISPFB1 + DISPLAY1 ×2); 4 corresponding gs_stub.reg_wr_*
//     fires from the bridge.
//   - 3 EE-CPU MMIO writes the map decoded as DMAC ch2 (MADR +
//     QWC + CHCR), in that exact (offset, data) order.
//   - 0 image-xfer VRAM writes (no TRXDIR upload).
//   - 128 raster_pixel_emit pulses, all with PSM=PSMCT16 (0x02),
//     be=4'b0011, mask=0xFFFFFFFF.
//   - core_halt asserts exactly once (SYSCALL halt), no trap.
//   - Captured 16×8 frame: each pixel matches its sprite's RGB.
//   - Per-pixel byte readback at swizzled addresses matches the
//     RGBAQ word for that pixel's sprite.
//   - Strict separator at byte 1024 stays 0.
//   - Default-off TBs unchanged: this is a NEW TB; Ch107..Ch118
//     and Ch120..Ch122 demos all keep their parameter defaults.


`timescale 1ns/1ps

module tb_gs_demo_psmct16_swizzle_e2e;

    localparam int PCRTC_H_ACTIVE  = 16;
    localparam int PCRTC_V_ACTIVE  = 8;
    // RAM holds the GIF payload (0x100..0x33F). EE program no
    // longer lives here (Ch114 moved it to BIOS ROM — see below).
    // 4 KiB is enough.
    localparam int RAM_SIZE_BYTES  = 4 * 1024;
    localparam int RAM_ADDR_W      = $clog2(RAM_SIZE_BYTES);

    // Ch114 — EE program lives in BIOS ROM (kseg1 0xBFC00000),
    // NOT in RAM. With a RAM-resident program, EE instruction
    // fetches contend with DMAC GIF-payload reads through the
    // single-ported ee_ram_stub (the map's arbitration gives CPU
    // priority and silently corrupts DMAC data). Putting the
    // program in BIOS makes the EE fetch path go through
    // `bios_rd_*` / `bios_rom_stub` — a different physical
    // memory unit — so EE and DMAC can run truly in parallel.
    // This also matches real PS2: the EE boots out of BIOS ROM.
    localparam int          BIOS_SIZE_BYTES = 4 * 1024;
    localparam int          BIOS_ADDR_W     = $clog2(BIOS_SIZE_BYTES);
    localparam logic [31:0] EE_PROG_VA      = 32'hBFC0_0000;

    logic clk;
    logic rst_n;
    initial clk = 1'b0;
    always #5 clk = ~clk;

    // ----------------------------------------------------------------
    // ee_ram_stub
    // ----------------------------------------------------------------
    logic                  ram_rd_en;
    logic [RAM_ADDR_W-1:0] ram_rd_addr;
    logic [127:0]          ram_rd_data;
    logic                  ram_rd_valid;
    logic                  ram_wr_en;
    logic [RAM_ADDR_W-1:0] ram_wr_addr;
    logic [127:0]          ram_wr_data;
    logic [15:0]           ram_wr_be;
    logic [7:0]            ram_master_id;

    ee_ram_stub #(.SIZE_BYTES(RAM_SIZE_BYTES)) u_ram (
        .clk(clk), .rst_n(rst_n),
        .rd_en(ram_rd_en), .rd_addr(ram_rd_addr),
        .rd_data(ram_rd_data), .rd_valid(ram_rd_valid),
        .wr_en(ram_wr_en), .wr_addr(ram_wr_addr),
        .wr_data(ram_wr_data), .wr_be(ram_wr_be),
        .master_id(ram_master_id),
        .ev_valid(), .ev_subsys(), .ev_event(),
        .ev_arg0(), .ev_arg1(), .ev_arg2(), .ev_arg3(), .ev_flags()
    );
    assign ram_master_id = ram_rd_en ? 8'd1 : 8'd0;

    // ----------------------------------------------------------------
    // bios_rom_stub (Ch114) — holds the EE bootlet at
    // 0xBFC0_0000 / phys 0x1FC0_0000. Wired to the map's
    // bios_rd_* port so EE instruction fetches go through here,
    // NOT through ee_ram_stub. That decouples EE-CPU from the
    // DMAC's RAM read traffic — both run truly in parallel.
    // ----------------------------------------------------------------
    logic                   bios_rd_en;
    logic [BIOS_ADDR_W-1:0] bios_rd_addr_full;
    logic                   bios_rd_valid;
    logic [31:0]            bios_rd_data;
    // The map drives `bios_rd_addr` as a [21:0] byte offset; trim
    // to the BIOS's address width.
    logic [21:0]            bios_rd_addr;
    assign bios_rd_addr_full = bios_rd_addr[BIOS_ADDR_W-1:0];

    bios_rom_stub #(.SIZE_BYTES(BIOS_SIZE_BYTES)) u_bios (
        .clk(clk), .rst_n(rst_n),
        .rd_en(bios_rd_en),
        .rd_addr(bios_rd_addr_full),
        .rd_data(bios_rd_data),
        .rd_valid(bios_rd_valid),
        .ev_valid(), .ev_subsys(), .ev_event(),
        .ev_arg0(), .ev_arg1(), .ev_arg2(), .ev_arg3(), .ev_flags()
    );

    // ----------------------------------------------------------------
    // DMAC + memory map. Ch114 — DMAC reg writes are now driven
    // by the EE-CPU through ee_memory_map_stub's DMAC-ch2 decode
    // (`ee_dmac_ch2_wr_*` outputs), NOT by the TB directly. The
    // signals below are wired through the map.
    // ----------------------------------------------------------------
    logic        dmac_reg_wr_en;
    logic [7:0]  dmac_reg_offset;
    logic [31:0] dmac_reg_wr_data;
    logic        dmac_mem_rd_en;
    logic [31:0] dmac_mem_rd_addr;
    logic         dmac_gif_valid;
    logic [127:0] dmac_gif_data;
    logic         dmac_gif_last;
    logic         dmac_gif_ready;          // = gif_in_ready (xfer backpressure flows through gif_packed_stub.image_data_ready in S_IMAGE only — Ch110)

    logic                dmac_ev_valid;
    trace_pkg::subsys_e  dmac_ev_subsys;
    trace_pkg::event_e   dmac_ev_event;
    logic [63:0]         dmac_ev_arg0, dmac_ev_arg1, dmac_ev_arg2, dmac_ev_arg3;
    logic [31:0]         dmac_ev_flags;

    logic [127:0] map_to_dmac_rd_data;
    logic         map_to_dmac_rd_valid;

    dmac_reg_stub u_dmac (
        .clk(clk), .rst_n(rst_n),
        .reg_wr_en(dmac_reg_wr_en), .reg_offset(dmac_reg_offset),
        .reg_wr_data(dmac_reg_wr_data),
        .reg_rd_en(1'b0), .reg_rd_data(), .reg_rd_valid(),
        .mem_rd_en(dmac_mem_rd_en), .mem_rd_addr(dmac_mem_rd_addr),
        .mem_rd_data(map_to_dmac_rd_data), .mem_rd_valid(map_to_dmac_rd_valid),
        .ep_valid(dmac_gif_valid), .ep_data(dmac_gif_data),
        .ep_last(dmac_gif_last), .ep_ready(dmac_gif_ready),
        .irq_completion_o(),
        .ev_valid(dmac_ev_valid), .ev_subsys(dmac_ev_subsys),
        .ev_event(dmac_ev_event),
        .ev_arg0(dmac_ev_arg0), .ev_arg1(dmac_ev_arg1),
        .ev_arg2(dmac_ev_arg2), .ev_arg3(dmac_ev_arg3),
        .ev_flags(dmac_ev_flags)
    );

    logic         map_ram_rd_en;
    logic [24:0]  map_ram_rd_addr;

    // Ch113 — EE-CPU instruction stream surface into
    // ee_memory_map_stub. ee_core_stub now produces the EE-side
    // reads (instruction fetches) and writes (the SW
    // instructions targeting 0x1200_xxxx). The map's GS-priv
    // decode peels those writes out and routes them to the
    // bridge below.
    logic        ee_cpu_rd_en;
    logic [31:0] ee_cpu_rd_addr;
    logic [31:0] ee_cpu_rd_data;
    logic        ee_cpu_rd_valid;
    logic        ee_cpu_wr_en;
    logic [31:0] ee_cpu_wr_addr;
    logic [31:0] ee_cpu_wr_data;
    logic [3:0]  ee_cpu_wr_be;

    // Outputs of the map's GS-priv decode (Ch112).
    logic        map_gs_priv_wr_en;
    logic [15:0] map_gs_priv_wr_addr;
    logic [31:0] map_gs_priv_wr_data;
    logic [3:0]  map_gs_priv_wr_be;

    // Map trace stream (Ch112-audit observer).
    logic                map_ev_valid;
    trace_pkg::subsys_e  map_ev_subsys;
    trace_pkg::event_e   map_ev_event;
    logic [63:0]         map_ev_arg0, map_ev_arg1, map_ev_arg2, map_ev_arg3;
    logic [31:0]         map_ev_flags;

    ee_memory_map_stub u_map (
        .clk(clk), .rst_n(rst_n),
        .ee_rd_en  (ee_cpu_rd_en),
        .ee_rd_addr(ee_cpu_rd_addr),
        .ee_rd_data(ee_cpu_rd_data),
        .ee_rd_valid(ee_cpu_rd_valid),
        .ee_wr_en  (ee_cpu_wr_en),
        .ee_wr_addr(ee_cpu_wr_addr),
        .ee_wr_data(ee_cpu_wr_data),
        .ee_wr_be  (ee_cpu_wr_be),
        .dmac_rd_en(dmac_mem_rd_en), .dmac_rd_addr(dmac_mem_rd_addr),
        .dmac_rd_data(map_to_dmac_rd_data),
        .dmac_rd_valid(map_to_dmac_rd_valid),
        .bios_rd_en  (bios_rd_en),
        .bios_rd_addr(bios_rd_addr),
        .bios_rd_data(bios_rd_data),
        .bios_rd_valid(bios_rd_valid),
        .ram_rd_en(map_ram_rd_en), .ram_rd_addr(map_ram_rd_addr),
        .ram_rd_data(ram_rd_data), .ram_rd_valid(ram_rd_valid),
        .bridge_wr_en(1'b0), .bridge_wr_addr(32'd0),
        .bridge_wr_data(128'd0), .bridge_wr_be(16'd0),
        .bridge_master_id(8'd0),
        .ram_wr_en(), .ram_wr_addr(), .ram_wr_data(),
        .ram_wr_be(), .ram_master_id(),
        .ee_dmac_ch2_wr_en  (dmac_reg_wr_en),
        .ee_dmac_ch2_wr_addr(dmac_reg_offset),
        .ee_dmac_ch2_wr_data(dmac_reg_wr_data),
        .ee_dmac_ch2_rd_en(), .ee_dmac_ch2_rd_addr(),
        .ee_dmac_ch2_rd_data(32'd0), .ee_dmac_ch2_rd_valid(1'b0),
        .ee_intc_wr_en(), .ee_intc_wr_addr(), .ee_intc_wr_data(),
        .ee_intc_rd_en(), .ee_intc_rd_addr(),
        .ee_intc_rd_data(32'd0), .ee_intc_rd_valid(1'b0),
        .ee_misc_mmio_wr_en(), .ee_misc_mmio_wr_addr(), .ee_misc_mmio_wr_data(), .ee_misc_mmio_wr_be(),
        .ee_misc_mmio_rd_en(), .ee_misc_mmio_rd_addr(),
        .ee_misc_mmio_rd_data(32'd0), .ee_misc_mmio_rd_valid(1'b0),
        .ee_biu_wr_en(), .ee_biu_wr_addr(), .ee_biu_wr_data(), .ee_biu_wr_be(),
        .ee_biu_rd_en(), .ee_biu_rd_addr(),
        .ee_biu_rd_data(32'd0), .ee_biu_rd_valid(1'b0),
        .ee_gs_priv_wr_en  (map_gs_priv_wr_en),
        .ee_gs_priv_wr_addr(map_gs_priv_wr_addr),
        .ee_gs_priv_wr_data(map_gs_priv_wr_data),
        .ee_gs_priv_wr_be  (map_gs_priv_wr_be),
        .ev_valid (map_ev_valid),
        .ev_subsys(map_ev_subsys),
        .ev_event (map_ev_event),
        .ev_arg0  (map_ev_arg0),
        .ev_arg1  (map_ev_arg1),
        .ev_arg2  (map_ev_arg2),
        .ev_arg3  (map_ev_arg3),
        .ev_flags (map_ev_flags)
    );

    assign ram_rd_en   = map_ram_rd_en;
    assign ram_rd_addr = map_ram_rd_addr[RAM_ADDR_W-1:0];

    // ----------------------------------------------------------------
    // Ch113 — ee_core_stub. Fetches MIPS instructions from RAM via
    // ee_memory_map_stub.ee_rd_*; SW instructions write through
    // ee_memory_map_stub.ee_wr_*. The 4 control-plane SWs target
    // 0x1200_xxxx and are routed to ee_gs_priv_bridge_stub by the
    // map's GS-priv decode (Ch112).
    // ----------------------------------------------------------------
    logic        core_go;
    logic        core_halt;
    logic [31:0] core_pc;
    logic        core_trap;
    logic [31:0] core_trap_pc;
    logic [31:0] core_trap_instr;
    logic        core_cpu_irq;
    assign core_cpu_irq = 1'b0;

    logic                core_ev_valid;
    trace_pkg::subsys_e  core_ev_subsys;
    trace_pkg::event_e   core_ev_event;
    logic [63:0]         core_ev_arg0, core_ev_arg1, core_ev_arg2, core_ev_arg3;
    logic [31:0]         core_ev_flags;

    ee_core_stub #(
        .PC_RESET(EE_PROG_VA),
        .STRICT_UNSUPPORTED(1'b0)
    ) u_core (
        .clk(clk), .rst_n(rst_n),
        .go_i(core_go),
        .map_rd_en (ee_cpu_rd_en),
        .map_rd_addr(ee_cpu_rd_addr),
        .map_rd_data(ee_cpu_rd_data),
        .map_rd_valid(ee_cpu_rd_valid),
        .map_wr_en (ee_cpu_wr_en),
        .map_wr_addr(ee_cpu_wr_addr),
        .map_wr_data(ee_cpu_wr_data),
        .map_wr_be (ee_cpu_wr_be),
        .cpu_irq(core_cpu_irq),
        .halt_o(core_halt),
        .pc_o  (core_pc),
        .trap_o(core_trap),
        .trap_pc_o(core_trap_pc),
        .trap_instr_o(core_trap_instr),
        .ev_valid (core_ev_valid),
        .ev_subsys(core_ev_subsys),
        .ev_event (core_ev_event),
        .ev_arg0(core_ev_arg0), .ev_arg1(core_ev_arg1),
        .ev_arg2(core_ev_arg2), .ev_arg3(core_ev_arg3),
        .ev_flags(core_ev_flags)
    );

    // ----------------------------------------------------------------
    // gif_packed_stub — REAL_AD_REG_MAP=1
    // ----------------------------------------------------------------
    logic         gif_in_ready;
    logic         gif_gs_wr_en;
    logic [15:0]  gif_gs_wr_addr;
    logic [63:0]  gif_gs_wr_data;
    logic         gif_gif_reg_wr_en;
    logic [7:0]   gif_gif_reg_num;
    logic [63:0]  gif_gif_reg_data;
    logic         gif_image_data_valid;
    logic [127:0] gif_image_data;
    logic         gif_image_data_last;
    // Forward declaration so u_gif can read it. The signal is
    // driven by gif_image_xfer_stub instantiated further down.
    logic         xfer_data_ready;

    logic                gif_ev_valid;
    trace_pkg::subsys_e  gif_ev_subsys;
    trace_pkg::event_e   gif_ev_event;
    logic [63:0]         gif_ev_arg0, gif_ev_arg1, gif_ev_arg2, gif_ev_arg3;
    logic [31:0]         gif_ev_flags;

    gif_packed_stub #(.REAL_AD_REG_MAP(1'b1)) u_gif (
        .clk(clk), .rst_n(rst_n),
        .in_valid(dmac_gif_valid), .in_data(dmac_gif_data),
        .in_last(dmac_gif_last), .in_ready(gif_in_ready),
        .image_data_valid(gif_image_data_valid),
        .image_data(gif_image_data),
        .image_data_last(gif_image_data_last),
        .image_data_ready(xfer_data_ready),
        .raster_fifo_full(1'b0),
        .gs_wr_en(gif_gs_wr_en), .gs_wr_addr(gif_gs_wr_addr),
        .gs_wr_data(gif_gs_wr_data),
        .gif_reg_wr_en(gif_gif_reg_wr_en),
        .gif_reg_num(gif_gif_reg_num),
        .gif_reg_data(gif_gif_reg_data),
        .ev_valid(gif_ev_valid), .ev_subsys(gif_ev_subsys),
        .ev_event(gif_ev_event),
        .ev_arg0(gif_ev_arg0), .ev_arg1(gif_ev_arg1),
        .ev_arg2(gif_ev_arg2), .ev_arg3(gif_ev_arg3),
        .ev_flags(gif_ev_flags)
    );

    // ----------------------------------------------------------------
    // gs_stub
    // ----------------------------------------------------------------
    // Ch112 — Bridge outputs: 64-bit gs_stub.reg_wr_* drives. The
    // TB no longer declares its own ee_priv_wr_* port; instead it
    // drives ee_cpu_wr_* (declared at the u_map instantiation
    // above) with full 32-bit phys addresses targeting
    // 0x1200_xxxx, and the map's GS-priv decode hands those
    // through to the bridge.
    logic        priv_reg_wr_en;
    logic [15:0] priv_reg_wr_addr;
    logic [63:0] priv_reg_wr_data;

    logic [7:0]          bg_r, bg_g, bg_b;
    logic [63:0]         pmode_q, dispfb1_q, display1_q;
    logic [63:0]         prim_q, rgbaq_q, xyz2_q, xyzf2_q, frame_1_q, zbuf_1_q;
    logic [63:0]         tex0_1_q;
    logic [13:0]         tex0_1_cbp_q;
    logic [3:0]          tex0_1_cpsm_q;
    logic                tex0_1_csm_q;
    logic [4:0]          tex0_1_csa_q;
    logic [2:0]          tex0_1_cld_q;
    logic                tex0_1_wr_q;
    logic [63:0]         bitbltbuf_q, trxpos_q, trxreg_q, trxdir_q;
    logic                trxdir_wr_q;
    logic                prim_complete;
    logic [31:0]         prim_complete_count;
    logic [63:0]         prim_v0_q, prim_v1_q, prim_v2_q;
    logic [63:0]         prim_color_q;
    logic [63:0]         prim_color_v0_q, prim_color_v1_q, prim_color_v2_q;
    trace_pkg::vertex_t  prim_v0_decoded_q, prim_v1_decoded_q, prim_v2_decoded_q;
    trace_pkg::color_t   prim_v0_color_decoded_q, prim_v1_color_decoded_q, prim_v2_color_decoded_q;
    logic                pixel_emit;
    logic [31:0]         pixel_emit_count;
    logic [11:0]         pixel_x_q, pixel_y_q;
    logic [63:0]         pixel_color_q;
    logic [8:0]          pixel_fbp_q;
    logic [5:0]          pixel_fbw_q, pixel_psm_q;
    logic [31:0]         pixel_fb_addr_q;
    logic                raster_pixel_emit;
    logic [31:0]         raster_pixel_emit_count;
    logic [11:0]         raster_pixel_x_q, raster_pixel_y_q;
    logic [63:0]         raster_pixel_color_q;
    logic [31:0]         raster_pixel_fb_addr_q;
    logic [3:0]          raster_pixel_be_q;
    logic [31:0]         raster_pixel_mask_q;
    logic [5:0]          raster_pixel_psm_q;
    logic                raster_active;
    logic                raster_overflow;
    logic                raster_degenerate;
    logic                gs_ev_valid;
    trace_pkg::subsys_e  gs_ev_subsys;
    trace_pkg::event_e   gs_ev_event;
    logic [63:0]         gs_ev_arg0, gs_ev_arg1, gs_ev_arg2, gs_ev_arg3;
    logic [31:0]         gs_ev_flags;

    gs_stub #(
        .PSMCT32_SWIZZLE(1'b0),
        .PSMCT16_SWIZZLE(1'b1)
    ) u_gs (
        .clk(clk), .rst_n(rst_n),
        .reg_wr_en  (priv_reg_wr_en),
        .reg_wr_addr(priv_reg_wr_addr),
        .reg_wr_data(priv_reg_wr_data),
        .gif_reg_wr_en(gif_gif_reg_wr_en),
        .gif_reg_num  (gif_gif_reg_num),
        .gif_reg_data (gif_gif_reg_data),
        .bg_r(bg_r), .bg_g(bg_g), .bg_b(bg_b),
        .pmode_q(pmode_q), .dispfb1_q(dispfb1_q), .display1_q(display1_q),
        .prim_q(prim_q), .rgbaq_q(rgbaq_q),
        .xyz2_q(xyz2_q), .xyzf2_q(xyzf2_q),
        .frame_1_q(frame_1_q), .zbuf_1_q(zbuf_1_q),
        .tex0_1_q(tex0_1_q),
        .tex0_1_cbp_q(tex0_1_cbp_q),
        .tex0_1_cpsm_q(tex0_1_cpsm_q),
        .tex0_1_csm_q(tex0_1_csm_q),
        .tex0_1_csa_q(tex0_1_csa_q),
        .tex0_1_cld_q(tex0_1_cld_q),
        .tex0_1_wr_q(tex0_1_wr_q),
        .bitbltbuf_q(bitbltbuf_q),
        .trxpos_q(trxpos_q),
        .trxreg_q(trxreg_q),
        .trxdir_q(trxdir_q),
        .trxdir_wr_q(trxdir_wr_q),
        .prim_complete(prim_complete),
        .prim_complete_count(prim_complete_count),
        .prim_v0_q(prim_v0_q), .prim_v1_q(prim_v1_q), .prim_v2_q(prim_v2_q),
        .prim_color_q(prim_color_q),
        .prim_color_v0_q(prim_color_v0_q),
        .prim_color_v1_q(prim_color_v1_q),
        .prim_color_v2_q(prim_color_v2_q),
        .prim_v0_decoded_q(prim_v0_decoded_q),
        .prim_v1_decoded_q(prim_v1_decoded_q),
        .prim_v2_decoded_q(prim_v2_decoded_q),
        .prim_v0_color_decoded_q(prim_v0_color_decoded_q),
        .prim_v1_color_decoded_q(prim_v1_color_decoded_q),
        .prim_v2_color_decoded_q(prim_v2_color_decoded_q),
        .pixel_emit(pixel_emit),
        .pixel_emit_count(pixel_emit_count),
        .pixel_x_q(pixel_x_q), .pixel_y_q(pixel_y_q),
        .pixel_color_q(pixel_color_q),
        .pixel_fbp_q(pixel_fbp_q),
        .pixel_fbw_q(pixel_fbw_q),
        .pixel_psm_q(pixel_psm_q),
        .pixel_fb_addr_q(pixel_fb_addr_q),
        .raster_pixel_emit(raster_pixel_emit),
        .raster_pixel_emit_count(raster_pixel_emit_count),
        .raster_pixel_x_q(raster_pixel_x_q),
        .raster_pixel_y_q(raster_pixel_y_q),
        .raster_pixel_color_q(raster_pixel_color_q),
        .raster_pixel_fb_addr_q(raster_pixel_fb_addr_q),
        .raster_pixel_be_q(raster_pixel_be_q),
        .raster_pixel_mask_q(raster_pixel_mask_q),
        .raster_pixel_psm_q(raster_pixel_psm_q),
        .raster_active(raster_active),
        .raster_overflow(raster_overflow),
        .raster_degenerate(raster_degenerate),
        .ev_valid(gs_ev_valid),
        .ev_subsys(gs_ev_subsys),
        .ev_event(gs_ev_event),
        .ev_arg0(gs_ev_arg0), .ev_arg1(gs_ev_arg1),
        .ev_arg2(gs_ev_arg2), .ev_arg3(gs_ev_arg3),
        .ev_flags(gs_ev_flags)
    );

    // ----------------------------------------------------------------
    // Ch111 — ee_gs_priv_bridge_stub: EE-side 32-bit MMIO writes
    // get accumulated per 8-byte slot and fired as 64-bit
    // gs_stub.reg_wr_* pulses. Replaces the Ch110 TB-direct
    // drive_priv() path; the demo's data plane (TRXDIR/IMAGE
    // palette upload + GIF primitive stream) is unchanged.
    // ----------------------------------------------------------------
    ee_gs_priv_bridge_stub u_priv_bridge (
        .clk(clk), .rst_n(rst_n),
        // Ch112 — bridge inputs now come from ee_memory_map_stub's
        // GS-priv decode, not TB-direct. The TB drives ee_cpu_wr_*
        // (above) with full 32-bit phys addresses targeting
        // 0x1200_xxxx; the map peels the 16-bit window offset and
        // hands it to the bridge here.
        .ee_wr_en  (map_gs_priv_wr_en),
        .ee_wr_addr(map_gs_priv_wr_addr),
        .ee_wr_data(map_gs_priv_wr_data),
        .ee_wr_be  (map_gs_priv_wr_be),
        .gs_reg_wr_en  (priv_reg_wr_en),
        .gs_reg_wr_addr(priv_reg_wr_addr),
        .gs_reg_wr_data(priv_reg_wr_data)
    );

    // ----------------------------------------------------------------
    // gif_image_xfer_stub (xfer_data_ready is forward-declared
    // earlier so u_gif can read it as image_data_ready).
    // ----------------------------------------------------------------
    logic        xfer_we;
    logic [31:0] xfer_waddr;
    logic [31:0] xfer_wdata;
    logic [3:0]  xfer_wbe;
    logic [31:0] xfer_wmask;
    logic        xfer_busy;

    gif_image_xfer_stub #(
        .PSMCT32_SWIZZLE(1'b0),
        .PSMCT16_SWIZZLE(1'b1)
    ) u_xfer (
        .clk(clk), .rst_n(rst_n),
        .trxdir_wr_pulse(trxdir_wr_q),
        .trxdir(trxdir_q),
        .bitbltbuf(bitbltbuf_q),
        .trxpos(trxpos_q),
        .trxreg(trxreg_q),
        .data_valid(gif_image_data_valid),
        .data_qword(gif_image_data),
        .data_last (gif_image_data_last),
        .data_ready(xfer_data_ready),
        .vram_we   (xfer_we),
        .vram_waddr(xfer_waddr),
        .vram_wdata(xfer_wdata),
        .vram_wbe  (xfer_wbe),
        .vram_wmask(xfer_wmask),
        .busy      (xfer_busy)
    );

    // DMAC ready follows gif_packed_stub's in_ready directly.
    // gif_packed_stub already gates in_ready by xfer_data_ready
    // when state == S_IMAGE (Ch110), so xfer backpressure
    // propagates upstream via gif_packed_stub. Outside S_IMAGE
    // (e.g., between SPRITE GIFtags), in_ready stays high and the
    // DMAC streams freely — even if xfer is still draining the
    // tail of a previous IMAGE qword's lanes.
    assign dmac_gif_ready = gif_in_ready;

    // ----------------------------------------------------------------
    // VRAM mux: xfer-OWNED when xfer.busy, raster-OWNED otherwise.
    // (Sequenced: palette upload finishes before sprites start.)
    // ----------------------------------------------------------------
    logic        vram_we_mux;
    logic [31:0] vram_waddr_mux;
    logic [31:0] vram_wdata_mux;
    logic [3:0]  vram_wbe_mux;
    logic [31:0] vram_wmask_mux;

    assign vram_we_mux    = xfer_busy ? xfer_we    : raster_pixel_emit;
    assign vram_waddr_mux = xfer_busy ? xfer_waddr : raster_pixel_fb_addr_q;
    assign vram_wdata_mux = xfer_busy ? xfer_wdata : raster_pixel_color_q[31:0];
    assign vram_wbe_mux   = xfer_busy ? xfer_wbe   : raster_pixel_be_q;
    assign vram_wmask_mux = xfer_busy ? xfer_wmask : raster_pixel_mask_q;

    // Defensive collision check: assert xfer and raster never fire
    // the same cycle.
    int collision_count;
    initial collision_count = 0;
    always_ff @(posedge clk) begin
        if (rst_n && xfer_we && raster_pixel_emit) begin
            $error("xfer + raster fired same cycle (sequencing bug)");
            collision_count <= collision_count + 1;
        end
    end

    logic [31:0] vram_raddr;
    logic [31:0] vram_rdata;
    logic [31:0] vram_raddr2;
    logic [31:0] vram_rdata2;

    vram_stub #(.BYTES(8192)) u_vram (
        .clk(clk), .rst_n(rst_n),
        .write_en  (vram_we_mux),
        .write_addr(vram_waddr_mux),
        .write_data(vram_wdata_mux),
        .write_be  (vram_wbe_mux),
        .write_mask(vram_wmask_mux),
        .read_addr (vram_raddr),
        .read_data (vram_rdata),
        .read2_addr(vram_raddr2),
        .read2_data(vram_rdata2)
    );

    // CLUT + loader.
    // Ch129 — no CLUT path. The PSMCT16 framebuffer is direct-color,
    // so clut_stub / clut_loader_stub aren't instantiated and the
    // 2nd VRAM read port (vram_raddr2 / vram_rdata2) is FREED for
    // Phase 2 byte readback in the TB body. Tie loader status off
    // so the legacy `wait (loader_busy)` and counter assertions
    // work without the loader instance.
    logic loader_busy;
    assign loader_busy = 1'b0;

    // PCRTC.
    logic       hsync_o, vsync_o, de_o;
    logic [7:0] r_o, g_o, b_o;
    logic                pcrtc_ev_valid;
    trace_pkg::subsys_e  pcrtc_ev_subsys;
    trace_pkg::event_e   pcrtc_ev_event;
    logic [63:0]         pcrtc_ev_arg0, pcrtc_ev_arg1;
    logic [63:0]         pcrtc_ev_arg2, pcrtc_ev_arg3;
    logic [31:0]         pcrtc_ev_flags;

    gs_pcrtc_stub #(
        .H_ACTIVE(PCRTC_H_ACTIVE), .H_FRONT(1), .H_SYNC(1), .H_BACK(1),
        .V_ACTIVE(PCRTC_V_ACTIVE), .V_FRONT(1), .V_SYNC(1), .V_BACK(1),
        .PSMCT32_SWIZZLE(1'b0),
        .PSMCT16_SWIZZLE(1'b1)
    ) u_pcrtc (
        .clk(clk), .rst_n(rst_n),
        .pmode_q       (pmode_q),
        .dispfb1_q     (dispfb1_q),
        .display1_q    (display1_q),
        .vram_read_addr(vram_raddr),
        .vram_read_data(vram_rdata),
        .clut_enable   (1'b0),
        .clut_csa      (5'd0),
        .clut_read_idx (),
        .clut_read_data(32'd0),
        .hsync(hsync_o), .vsync(vsync_o), .de(de_o),
        .r(r_o), .g(g_o), .b(b_o),
        .ev_valid(pcrtc_ev_valid),
        .ev_subsys(pcrtc_ev_subsys),
        .ev_event(pcrtc_ev_event),
        .ev_arg0(pcrtc_ev_arg0), .ev_arg1(pcrtc_ev_arg1),
        .ev_arg2(pcrtc_ev_arg2), .ev_arg3(pcrtc_ev_arg3),
        .ev_flags(pcrtc_ev_flags)
    );

    // ----------------------------------------------------------------
    // Capture + observers.
    // ----------------------------------------------------------------
    logic [7:0] cap_r [0:PCRTC_V_ACTIVE-1][0:PCRTC_H_ACTIVE-1];
    logic [7:0] cap_g [0:PCRTC_V_ACTIVE-1][0:PCRTC_H_ACTIVE-1];
    logic [7:0] cap_b [0:PCRTC_V_ACTIVE-1][0:PCRTC_H_ACTIVE-1];
    logic       cap_de[0:PCRTC_V_ACTIVE-1][0:PCRTC_H_ACTIVE-1];

    int  errors;
    int  loader_starts;
    int  raster_emits_seen;
    int  giftag_seen;
    int  packed_ad_writes_seen;
    int  xfer_writes_seen;
    int  ee_priv_writes_seen;
    int  priv_bridge_fires_seen;
    int  ee_dmac_writes_seen;     // Ch114 — EE-driven DMAC reg writes
    // Ch114-audit-low — lock the EXACT DMAC reg-write sequence
    // (offset/data/order). Expected:
    //   #0 : MADR (offset 0x10) = PAYLOAD_MADR
    //   #1 : QWC  (offset 0x20) = QWC_TOTAL
    //   #2 : CHCR (offset 0x00) = 0x0000_0001 (start)
    int  dmac_seq_idx;
    int  dmac_seq_errors;
    logic [7:0]  dmac_expected_off  [0:2];
    logic [31:0] dmac_expected_data [0:2];
    int  map_gs_priv_traces_seen;
    int  map_unmapped_traces_seen;
    int  dma_start_count, dma_beat_count, dma_done_count;
    bit  capture_armed;
    bit  dma_done_seen;

    initial begin
        for (int y = 0; y < PCRTC_V_ACTIVE; y++)
            for (int x = 0; x < PCRTC_H_ACTIVE; x++) begin
                cap_r[y][x]  = 8'd0;
                cap_g[y][x]  = 8'd0;
                cap_b[y][x]  = 8'd0;
                cap_de[y][x] = 1'b0;
            end
        errors                = 0;
        loader_starts          = 0;
        raster_emits_seen     = 0;
        giftag_seen            = 0;
        packed_ad_writes_seen  = 0;
        xfer_writes_seen       = 0;
        ee_priv_writes_seen      = 0;
        priv_bridge_fires_seen   = 0;
        ee_dmac_writes_seen      = 0;
        dmac_seq_idx             = 0;
        dmac_seq_errors          = 0;
        dmac_expected_off [0]    = 8'h10;          // MADR
        dmac_expected_data[0]    = PAYLOAD_MADR;
        dmac_expected_off [1]    = 8'h20;          // QWC
        dmac_expected_data[1]    = 32'(QWC_TOTAL);
        dmac_expected_off [2]    = 8'h00;          // CHCR.start
        dmac_expected_data[2]    = 32'h0000_0001;
        map_gs_priv_traces_seen  = 0;
        map_unmapped_traces_seen = 0;
        dma_start_count       = 0;
        dma_beat_count        = 0;
        dma_done_count        = 0;
        capture_armed         = 1'b0;
        dma_done_seen         = 1'b0;
    end

    always_ff @(posedge clk) begin
        if (rst_n && capture_armed && de_o
            && (u_pcrtc.vcnt < PCRTC_V_ACTIVE)
            && (u_pcrtc.hcnt < PCRTC_H_ACTIVE)) begin
            cap_r [u_pcrtc.vcnt][u_pcrtc.hcnt] <= r_o;
            cap_g [u_pcrtc.vcnt][u_pcrtc.hcnt] <= g_o;
            cap_b [u_pcrtc.vcnt][u_pcrtc.hcnt] <= b_o;
            cap_de[u_pcrtc.vcnt][u_pcrtc.hcnt] <= 1'b1;
        end
    end

    always_ff @(posedge clk) begin
        if (rst_n && dmac_ev_valid) begin
            unique case (dmac_ev_event)
                trace_pkg::EV_DMA_START: dma_start_count <= dma_start_count + 1;
                trace_pkg::EV_DMA_BEAT:  dma_beat_count  <= dma_beat_count  + 1;
                trace_pkg::EV_DMA_DONE: begin
                    dma_done_count <= dma_done_count + 1;
                    dma_done_seen  <= 1'b1;
                end
                default: ;
            endcase
        end
    end

    always_ff @(posedge clk) begin
        if (rst_n && gif_ev_valid && gif_ev_event == trace_pkg::EV_GIFTAG)
            giftag_seen <= giftag_seen + 1;
    end

    always_ff @(posedge clk) begin
        if (rst_n && gif_gif_reg_wr_en)
            packed_ad_writes_seen <= packed_ad_writes_seen + 1;
        if (rst_n && xfer_we)
            xfer_writes_seen <= xfer_writes_seen + 1;
        // Counts EE-CPU MMIO writes that the map decoded as
        // GS-priv (i.e., reached the bridge). Equals the number
        // of `ee_priv_write32` calls the program issued.
        if (rst_n && map_gs_priv_wr_en)
            ee_priv_writes_seen <= ee_priv_writes_seen + 1;
        if (rst_n && priv_reg_wr_en)
            priv_bridge_fires_seen <= priv_bridge_fires_seen + 1;
        // Ch114 — EE-CPU `sw` to DMAC ch2 reg window. Incremented
        // by every EE-driven MADR/QWC/CHCR write. Ch114-audit-low:
        // also locks the EXACT (offset, data) sequence so a future
        // accidental aliasing (wrong offset or wrong data flowing
        // into the same dmac_reg_stub port) fails explicitly.
        if (rst_n && dmac_reg_wr_en) begin
            ee_dmac_writes_seen <= ee_dmac_writes_seen + 1;
            if (dmac_seq_idx < 3) begin
                if (dmac_reg_offset !== dmac_expected_off[dmac_seq_idx]) begin
                    $error("DMAC write %0d: offset=0x%02x (expected 0x%02x)",
                           dmac_seq_idx, dmac_reg_offset,
                           dmac_expected_off[dmac_seq_idx]);
                    dmac_seq_errors <= dmac_seq_errors + 1;
                end
                if (dmac_reg_wr_data !== dmac_expected_data[dmac_seq_idx]) begin
                    $error("DMAC write %0d: data=0x%08x (expected 0x%08x)",
                           dmac_seq_idx, dmac_reg_wr_data,
                           dmac_expected_data[dmac_seq_idx]);
                    dmac_seq_errors <= dmac_seq_errors + 1;
                end
                dmac_seq_idx <= dmac_seq_idx + 1;
            end else begin
                $error("DMAC write %0d: unexpected extra (offset=0x%02x data=0x%08x)",
                       dmac_seq_idx, dmac_reg_offset, dmac_reg_wr_data);
                dmac_seq_errors <= dmac_seq_errors + 1;
            end
        end
    end

    // Ch112-audit observer: every EE-CPU write that the map sees
    // for the GS-priv window MUST be classified as REGION_EE_GS_PRIV
    // in the trace, NOT as REGION_UNMAPPED. This is the trace-side
    // counterpart to the ee_gs_priv_wr_en routing — without the
    // Ch112-audit trace branch, valid 0x1200_xxxx writes would
    // surface to consumers as EV_UNMAPPED.
    //
    // REGION_EE_GS_PRIV = 64'd12, REGION_UNMAPPED = 64'hFF (per
    // ee_memory_map_stub.sv).
    always_ff @(posedge clk) begin
        if (rst_n && map_ev_valid && (map_ev_subsys == trace_pkg::SUBSYS_MEM)) begin
            // Filter to EE-CPU write events at the 0x1200_xxxx
            // window (arg0 carries ee_wr_addr; flags[0]=1 marks
            // a write).
            if (map_ev_flags[0] && map_ev_arg0[31:16] == 16'h1200) begin
                if (map_ev_event == trace_pkg::EV_WRITE
                    && map_ev_arg3 == 64'd12) begin
                    map_gs_priv_traces_seen <= map_gs_priv_traces_seen + 1;
                end else if (map_ev_event == trace_pkg::EV_UNMAPPED) begin
                    $error("EE-CPU write to 0x%08x classified as UNMAPPED (expected REGION_EE_GS_PRIV)",
                           map_ev_arg0[31:0]);
                    map_unmapped_traces_seen <= map_unmapped_traces_seen + 1;
                end
            end
        end
    end

    logic loader_busy_d;
    always_ff @(posedge clk) begin
        if (!rst_n) loader_busy_d <= 1'b0;
        else begin
            loader_busy_d <= loader_busy;
            if (loader_busy && !loader_busy_d)
                loader_starts <= loader_starts + 1;
        end
    end

    always_ff @(posedge clk) begin
        if (rst_n && raster_pixel_emit) begin
            raster_emits_seen <= raster_emits_seen + 1;
            // Ch129 — every emit is PSMCT16 (PSM=2), halfword
            // be=4'b1111, mask=0xFFFFFFFF.
            if (raster_pixel_psm_q !== 6'h02) begin
                $error("emit %0d: psm=0x%02x (expected 0x02 PSMCT16)",
                       raster_emits_seen, raster_pixel_psm_q);
                errors <= errors + 1;
            end
            // PSMCT16 emits 2 bytes/pixel via be=4'b0011 plus the
            // halfword-level lane in write_data[15:0]. Mask stays
            // 0xFFFFFFFF (the per-bit mask is unused for full-
            // halfword commits).
            if (raster_pixel_be_q !== 4'b0011) begin
                $error("emit %0d: be=%b (expected 4'b0011 for PSMCT16)",
                       raster_emits_seen, raster_pixel_be_q);
                errors <= errors + 1;
            end
            if (raster_pixel_mask_q !== 32'hFFFF_FFFF) begin
                $error("emit %0d: mask=0x%08x (expected 0xFFFFFFFF)",
                       raster_emits_seen, raster_pixel_mask_q);
                errors <= errors + 1;
            end
        end
    end

    // ----------------------------------------------------------------
    // Helpers.
    // ----------------------------------------------------------------
    // Ch114 — DMAC reg writes now flow through ee_memory_map_stub
    // from EE-CPU `sw` instructions; no TB-direct write_dmac
    // task. No sync-flag poll needed either: the EE program
    // halts via SYSCALL right after kicking the DMAC, so EE and
    // DMAC don't contend for RAM after that point.

    task automatic preload_qword(input logic [RAM_ADDR_W-1:0] addr,
                                 input logic [127:0] data);
        @(negedge clk);
        ram_wr_en   = 1'b1;
        ram_wr_addr = addr;
        ram_wr_data = data;
        ram_wr_be   = 16'hFFFF;
        @(negedge clk);
        ram_wr_en   = 1'b0;
        ram_wr_addr = '0;
        ram_wr_data = 128'd0;
        ram_wr_be   = 16'd0;
    endtask

    // ----------------------------------------------------------------
    // Ch114 — EE-program preload helpers. Writes 32-bit MIPS
    // instruction words into bios_rom_stub.mem[] via hierarchical
    // ref. bios_rom_stub.mem is a flat 32-bit-word array indexed
    // by (byte_offset >> 2). Slot 0 corresponds to phys
    // 0x1FC0_0000 / kseg1 0xBFC0_0000 — the EE reset vector.
    // ----------------------------------------------------------------
    task automatic ee_prog_word(input int byte_off, input logic [31:0] word);
        int slot;
        slot = byte_off >> 2;
        u_bios.mem[slot] = word;
    endtask

    // MIPS encoding helpers. Opcodes match ee_core_stub's localparams.
    function automatic logic [31:0] enc_lui(input int rt, input logic [15:0] imm);
        return {6'h0F, 5'd0, rt[4:0], imm};
    endfunction
    function automatic logic [31:0] enc_ori(input int rt, input int rs,
                                            input logic [15:0] imm);
        return {6'h0D, rs[4:0], rt[4:0], imm};
    endfunction
    function automatic logic [31:0] enc_sw(input int rt, input int rs,
                                           input logic [15:0] imm);
        return {6'h2B, rs[4:0], rt[4:0], imm};
    endfunction
    // Ch114 — LW for the sync-flag poll, BEQ for the loop-back.
    function automatic logic [31:0] enc_lw(input int rt, input int rs,
                                           input logic [15:0] imm);
        return {6'h23, rs[4:0], rt[4:0], imm};
    endfunction
    function automatic logic [31:0] enc_beq(input int rs, input int rt,
                                            input logic signed [15:0] imm);
        return {6'h04, rs[4:0], rt[4:0], imm[15:0]};
    endfunction
    function automatic logic [31:0] enc_syscall();
        return 32'h0000_000C;
    endfunction

    function automatic logic [127:0] giftag(
        input logic [14:0] nloop,
        input logic        eop,
        input logic [1:0]  flg,
        input logic [3:0]  nreg,
        input logic [63:0] regs);
        logic [63:0] lower;
        lower = {nreg, flg, 42'd0, eop, nloop};
        return {regs, lower};
    endfunction

    function automatic logic [127:0] aplusd(input logic [7:0]  reg_num,
                                            input logic [63:0] data64);
        return {56'd0, reg_num, data64};
    endfunction

    function automatic logic [63:0] xyz2_data(input logic [11:0] x_int,
                                              input logic [11:0] y_int);
        return {32'd0, y_int, 4'd0, x_int, 4'd0};
    endfunction

    // (Ch114's tex0_pack / pattern_a / bitbltbuf_pack / trxpos_pack
    // / trxreg_pack / trxdir_pack helpers were removed for Ch123 —
    // this demo has no CLUT path and no TRXDIR upload, so the
    // helpers had no callers.)

    // Maps (x, y) ∈ 16×8 active area to its sprite index 0..3:
    //   spr 0 = top-left  (0,0)..(7,3)
    //   spr 1 = top-right (8,0)..(15,3)
    //   spr 2 = bot-left  (0,4)..(7,7)
    //   spr 3 = bot-right (8,4)..(15,7)
    function automatic int quadrant_idx(input int x, input int y);
        int qx, qy;
        qx = (x < 8) ? 0 : 1;
        qy = (y < 4) ? 0 : 1;
        return qy * 2 + qx;
    endfunction

    // ------------------------------------------------------------
    // Per-quadrant PSMCT16 color tables. Each quadrant has a unique
    // (R5, G5, B5, A1) so the 5→8 bit-replicate at PCRTC scanout
    // produces a unique 8-bit RGB triple, AND the {A1,B5,G5,R5}
    // halfword stored in VRAM is unique. The 8-bit RGBAQ-field
    // values that the GIF stream carries are picked so that
    // gs_stub's ABGR→RGB5A1 truncation (R5=R[7:3] etc.) yields the
    // chosen 5-bit channels.
    //
    //   Quadrant 0 (TL):  R5=0x10, G5=0x18, B5=0x08, A1=0
    //     RGBAQ R/G/B/A = 0x80, 0xC0, 0x40, 0x00 → halfword 0x2310
    //     Expanded RGB at scanout = (0x84, 0xC6, 0x42)
    //   Quadrant 1 (TR):  R5=0x06, G5=0x14, B5=0x1C, A1=0
    //     RGBAQ R/G/B/A = 0x30, 0xA0, 0xE0, 0x00 → halfword 0x7286
    //     Expanded RGB = (0x31, 0xA5, 0xE7)
    //   Quadrant 2 (BL):  R5=0x1F, G5=0x03, B5=0x12, A1=1
    //     RGBAQ R/G/B/A = 0xF8, 0x18, 0x90, 0x80 → halfword 0xC47F
    //     Expanded RGB = (0xFF, 0x18, 0x94)
    //   Quadrant 3 (BR):  R5=0x0E, G5=0x1A, B5=0x05, A1=1
    //     RGBAQ R/G/B/A = 0x70, 0xD0, 0x28, 0x80 → halfword 0x974E
    //     Expanded RGB = (0x73, 0xD6, 0x29)
    // ------------------------------------------------------------
    function automatic logic [7:0] spr_r_at(input int idx);
        case (idx)
            0: return 8'h80;
            1: return 8'h30;
            2: return 8'hF8;
            default: return 8'h70;
        endcase
    endfunction
    function automatic logic [7:0] spr_g_at(input int idx);
        case (idx)
            0: return 8'hC0;
            1: return 8'hA0;
            2: return 8'h18;
            default: return 8'hD0;
        endcase
    endfunction
    function automatic logic [7:0] spr_b_at(input int idx);
        case (idx)
            0: return 8'h40;
            1: return 8'hE0;
            2: return 8'h90;
            default: return 8'h28;
        endcase
    endfunction
    function automatic logic [7:0] spr_a_at(input int idx);
        case (idx)
            0: return 8'h00;
            1: return 8'h00;
            2: return 8'h80;
            default: return 8'h80;
        endcase
    endfunction

    // PSMCT16 halfword in VRAM = {A1, B5, G5, R5} =
    // {A[7], B[7:3], G[7:3], R[7:3]}.
    function automatic logic [15:0] expected_psmct16(
        input logic [7:0] r_, input logic [7:0] g_,
        input logic [7:0] b_, input logic [7:0] a_);
        return {a_[7], b_[7:3], g_[7:3], r_[7:3]};
    endfunction

    // PCRTC 5→8 bit-replicate: top 5 bits + top 3 bits.
    function automatic logic [7:0] exp8_from5(input logic [7:0] ch8);
        logic [4:0] c5;
        c5 = ch8[7:3];
        return {c5, c5[4:2]};
    endfunction

    // ------------------------------------------------------------
    // PSMCT16 swizzle reference — block + column tables verbatim
    // from PCSX2 (Ch125 source-locked). Used by the Phase 2 byte-
    // readback to compute where a given (x, y) should land in VRAM.
    // ------------------------------------------------------------
    function automatic int ref_block_idx16(input int by, input int bx);
        case ({by[2:0], bx[1:0]})
            5'd0:  return 0;   5'd1:  return 2;   5'd2:  return 8;
            5'd3:  return 10;  5'd4:  return 1;   5'd5:  return 3;
            5'd6:  return 9;   5'd7:  return 11;  5'd8:  return 4;
            5'd9:  return 6;   5'd10: return 12;  5'd11: return 14;
            5'd12: return 5;   5'd13: return 7;   5'd14: return 13;
            5'd15: return 15;  5'd16: return 16;  5'd17: return 18;
            5'd18: return 24;  5'd19: return 26;  5'd20: return 17;
            5'd21: return 19;  5'd22: return 25;  5'd23: return 27;
            5'd24: return 20;  5'd25: return 22;  5'd26: return 28;
            5'd27: return 30;  5'd28: return 21;  5'd29: return 23;
            5'd30: return 29;  default: return 31;
        endcase
    endfunction
    function automatic int ref_col_idx16(input int yb, input int xb);
        case ({yb[2:0], xb[3:0]})
            // yb=0
            7'd0:   return 0;   7'd1:   return 2;   7'd2:   return 8;   7'd3:   return 10;
            7'd4:   return 16;  7'd5:   return 18;  7'd6:   return 24;  7'd7:   return 26;
            7'd8:   return 1;   7'd9:   return 3;   7'd10:  return 9;   7'd11:  return 11;
            7'd12:  return 17;  7'd13:  return 19;  7'd14:  return 25;  7'd15:  return 27;
            // yb=1
            7'd16:  return 4;   7'd17:  return 6;   7'd18:  return 12;  7'd19:  return 14;
            7'd20:  return 20;  7'd21:  return 22;  7'd22:  return 28;  7'd23:  return 30;
            7'd24:  return 5;   7'd25:  return 7;   7'd26:  return 13;  7'd27:  return 15;
            7'd28:  return 21;  7'd29:  return 23;  7'd30:  return 29;  7'd31:  return 31;
            // yb=2
            7'd32:  return 32;  7'd33:  return 34;  7'd34:  return 40;  7'd35:  return 42;
            7'd36:  return 48;  7'd37:  return 50;  7'd38:  return 56;  7'd39:  return 58;
            7'd40:  return 33;  7'd41:  return 35;  7'd42:  return 41;  7'd43:  return 43;
            7'd44:  return 49;  7'd45:  return 51;  7'd46:  return 57;  7'd47:  return 59;
            // yb=3
            7'd48:  return 36;  7'd49:  return 38;  7'd50:  return 44;  7'd51:  return 46;
            7'd52:  return 52;  7'd53:  return 54;  7'd54:  return 60;  7'd55:  return 62;
            7'd56:  return 37;  7'd57:  return 39;  7'd58:  return 45;  7'd59:  return 47;
            7'd60:  return 53;  7'd61:  return 55;  7'd62:  return 61;  7'd63:  return 63;
            // yb=4
            7'd64:  return 64;  7'd65:  return 66;  7'd66:  return 72;  7'd67:  return 74;
            7'd68:  return 80;  7'd69:  return 82;  7'd70:  return 88;  7'd71:  return 90;
            7'd72:  return 65;  7'd73:  return 67;  7'd74:  return 73;  7'd75:  return 75;
            7'd76:  return 81;  7'd77:  return 83;  7'd78:  return 89;  7'd79:  return 91;
            // yb=5
            7'd80:  return 68;  7'd81:  return 70;  7'd82:  return 76;  7'd83:  return 78;
            7'd84:  return 84;  7'd85:  return 86;  7'd86:  return 92;  7'd87:  return 94;
            7'd88:  return 69;  7'd89:  return 71;  7'd90:  return 77;  7'd91:  return 79;
            7'd92:  return 85;  7'd93:  return 87;  7'd94:  return 93;  7'd95:  return 95;
            // yb=6
            7'd96:  return 96;  7'd97:  return 98;  7'd98:  return 104; 7'd99:  return 106;
            7'd100: return 112; 7'd101: return 114; 7'd102: return 120; 7'd103: return 122;
            7'd104: return 97;  7'd105: return 99;  7'd106: return 105; 7'd107: return 107;
            7'd108: return 113; 7'd109: return 115; 7'd110: return 121; 7'd111: return 123;
            // yb=7
            7'd112: return 100; 7'd113: return 102; 7'd114: return 108; 7'd115: return 110;
            7'd116: return 116; 7'd117: return 118; 7'd118: return 124; 7'd119: return 126;
            7'd120: return 101; 7'd121: return 103; 7'd122: return 109; 7'd123: return 111;
            7'd124: return 117; 7'd125: return 119; 7'd126: return 125; default: return 127;
        endcase
    endfunction
    function automatic logic [31:0] ref_addr_psmct16(
        input int fbp_v, input int fbw_v, input int x_v, input int y_v);
        int page_x, page_y, page_idx, page_base;
        int by, bx, blk_idx, xb, yb, hw_idx;
        int addr_v;
        page_x   = x_v / 64;
        page_y   = y_v / 64;
        page_idx = page_y * fbw_v + page_x;
        page_base = fbp_v * 2048 + page_idx * 8192;
        by  = (y_v % 64) / 8;
        bx  = (x_v % 64) / 16;
        blk_idx = ref_block_idx16(by, bx);
        xb = x_v % 16;
        yb = y_v % 8;
        hw_idx = ref_col_idx16(yb, xb);
        addr_v = page_base + blk_idx * 256 + hw_idx * 2;
        return addr_v[31:0];
    endfunction

    // ----------------------------------------------------------------
    // Constants.
    // ----------------------------------------------------------------
    // GIF A+D register numbers used by the SPRITE PACKED packets.
    // (Ch114's R_TEX0_1 / R_BITBLTBUF / R_TRXPOS / R_TRXREG /
    // R_TRXDIR localparams were removed for Ch123 — no CLUT, no
    // TRXDIR upload.)
    localparam logic [7:0] R_PRIM    = 8'h00;
    localparam logic [7:0] R_RGBAQ   = 8'h01;
    localparam logic [7:0] R_XYZ2    = 8'h05;
    localparam logic [7:0] R_FRAME_1 = 8'h4C;

    localparam logic [63:0] PRIM_SPRITE     = 64'd6;
    // FRAME_1: FBP[8:0]=0, FBW[5:0]=1 (at bit 16), PSM=PSMCT16(0x02 at bit 24).
    //   FBW=1 → bits[21:16]=0x01 → 0x0001_0000.
    //   PSM=2 → bits[29:24]=0x02 → 0x0200_0000.
    localparam logic [63:0] FRAME_1_PSMCT16 = 64'h0000_0000_0201_0000;

    localparam logic [15:0] PMODE_OFF    = 16'h0000;
    localparam logic [15:0] DISPFB1_OFF  = 16'h0070;
    localparam logic [15:0] DISPLAY1_OFF = 16'h0080;

    // (Ch114's PALETTE_CBP / CSA localparams were removed —
    // PSMCT16 has no CLUT, so neither field is referenced.)

    // DISPFB1: FBP[8:0]=0, FBW[5:0]=1 @bit 9, PSM=PSMCT16(=2) @bit 15.
    localparam logic [63:0] DISPFB1_VAL  = 64'h0000_0000_0001_0200;
    localparam logic [63:0] DISPLAY1_VAL =
          (64'(PCRTC_H_ACTIVE - 1) << 32)
        | (64'(PCRTC_V_ACTIVE - 1) << 44);
    localparam logic [63:0] PMODE_EN1    = 64'h0000_0000_0000_0001;

    localparam logic [7:0] CHCR_OFF = 8'h00;
    localparam logic [7:0] MADR_OFF = 8'h10;
    localparam logic [7:0] QWC_OFF  = 8'h20;

    localparam logic [31:0] PAYLOAD_MADR = 32'h0000_0100;
    // 4 SPRITE PACKED packets only — no TRX setup, no palette
    // upload, no TEX0_1. Each sprite = 1 GIFtag + 5 PACKED A+D
    // (PRIM, FRAME_1, RGBAQ, XYZ2, XYZ2). Total = 4 * 6 = 24 qwords.
    localparam int          QWC_TOTAL    = 24;

    initial begin
        rst_n             = 1'b0;
        core_go           = 1'b0;
        ram_wr_en         = 1'b0;
        ram_wr_addr       = '0;
        ram_wr_data       = 128'd0;
        ram_wr_be         = 16'd0;

        repeat (4) @(posedge clk);
        rst_n = 1'b1;
        repeat (8) @(posedge clk);

        // ------------------------------------------------------------
        // Preload all 24 GIF qwords into ee_ram_stub
        // (4 SPRITE PACKED packets × 6 qwords each).
        // ------------------------------------------------------------
        begin : preload_block
            int q;
            int p;
            logic [31:0]           addr_full;
            logic [RAM_ADDR_W-1:0] addr_q;

            // 4 SPRITE descriptors — 8×4 each, tiling the 16×8
            // active area into 4 quadrants. Each sprite has a
            // unique RGBAQ that, after gs_stub's ABGR→RGB5A1
            // truncation (R5=R[7:3] etc.) and PCRTC's 5→8 bit-
            // replicate at scanout, produces a unique 8-bit RGB
            // triple. All four sprites land in block (0,0) of
            // page (0,0) at FBP=0/FBW=1 (PSMCT16 blocks are
            // 16×8 and the image is 16×8 = exactly one block).
            logic [7:0]  spr_r [0:3];
            logic [7:0]  spr_g [0:3];
            logic [7:0]  spr_b [0:3];
            logic [7:0]  spr_a [0:3];
            logic [11:0] spr_x0 [0:3], spr_y0 [0:3], spr_x1 [0:3], spr_y1 [0:3];
            // Quadrant 0: top-left  (0,0)..(7,3)
            //   RGB5A1=(0x10,0x18,0x08,0) → halfword 0x2310, RGB=(0x84,0xC6,0x42)
            // Quadrant 1: top-right (8,0)..(15,3)
            //   RGB5A1=(0x06,0x14,0x1C,0) → halfword 0x7286, RGB=(0x31,0xA5,0xE7)
            // Quadrant 2: bot-left  (0,4)..(7,7)
            //   RGB5A1=(0x1F,0x03,0x12,1) → halfword 0xC47F, RGB=(0xFF,0x18,0x94)
            // Quadrant 3: bot-right (8,4)..(15,7)
            //   RGB5A1=(0x0E,0x1A,0x05,1) → halfword 0x974E, RGB=(0x73,0xD6,0x29)
            spr_r [0]=8'h80; spr_g [0]=8'hC0; spr_b [0]=8'h40; spr_a [0]=8'h00;
            spr_x0[0]=12'd0; spr_y0[0]=12'd0; spr_x1[0]=12'd7;  spr_y1[0]=12'd3;
            spr_r [1]=8'h30; spr_g [1]=8'hA0; spr_b [1]=8'hE0; spr_a [1]=8'h00;
            spr_x0[1]=12'd8; spr_y0[1]=12'd0; spr_x1[1]=12'd15; spr_y1[1]=12'd3;
            spr_r [2]=8'hF8; spr_g [2]=8'h18; spr_b [2]=8'h90; spr_a [2]=8'h80;
            spr_x0[2]=12'd0; spr_y0[2]=12'd4; spr_x1[2]=12'd7;  spr_y1[2]=12'd7;
            spr_r [3]=8'h70; spr_g [3]=8'hD0; spr_b [3]=8'h28; spr_a [3]=8'h80;
            spr_x0[3]=12'd8; spr_y0[3]=12'd4; spr_x1[3]=12'd15; spr_y1[3]=12'd7;

            q = 0;

            // ---------------------------------------------------------
            // 4 × SPRITE PACKED packets (NREG=5, REGS = PRIM, FRAME_1,
            // RGBAQ, XYZ2, XYZ2). EOP=0 except on the last sprite.
            // ---------------------------------------------------------
            for (p = 0; p < 4; p++) begin
                logic spr_eop;
                spr_eop = (p == 3);
                addr_full = PAYLOAD_MADR + 32'(q * 16);
                addr_q    = addr_full[RAM_ADDR_W-1:0];
                preload_qword(addr_q, giftag(15'd1, spr_eop, 2'd0, 4'd5,
                                             64'h00000000_000E_EEEE));
                q = q + 1;
                addr_full = PAYLOAD_MADR + 32'(q * 16);
                addr_q    = addr_full[RAM_ADDR_W-1:0];
                preload_qword(addr_q, aplusd(R_PRIM, PRIM_SPRITE));
                q = q + 1;
                addr_full = PAYLOAD_MADR + 32'(q * 16);
                addr_q    = addr_full[RAM_ADDR_W-1:0];
                preload_qword(addr_q, aplusd(R_FRAME_1, FRAME_1_PSMCT16));
                q = q + 1;
                addr_full = PAYLOAD_MADR + 32'(q * 16);
                addr_q    = addr_full[RAM_ADDR_W-1:0];
                preload_qword(addr_q, aplusd(R_RGBAQ,
                                             {32'd0, spr_a[p], spr_b[p],
                                              spr_g[p], spr_r[p]}));
                q = q + 1;
                addr_full = PAYLOAD_MADR + 32'(q * 16);
                addr_q    = addr_full[RAM_ADDR_W-1:0];
                preload_qword(addr_q, aplusd(R_XYZ2,
                                             xyz2_data(spr_x0[p], spr_y0[p])));
                q = q + 1;
                addr_full = PAYLOAD_MADR + 32'(q * 16);
                addr_q    = addr_full[RAM_ADDR_W-1:0];
                preload_qword(addr_q, aplusd(R_XYZ2,
                                             xyz2_data(spr_x1[p], spr_y1[p])));
                q = q + 1;
            end

            if (q != QWC_TOTAL)
                $error("preload count mismatch: q=%0d expected %0d", q, QWC_TOTAL);
        end

        // ------------------------------------------------------------
        // Ch114 — EE-program preload. The full bootlet runs from
        // 0xBFC0_0000 (BIOS reset vector) and does both halves
        // of the bring-up: GS-priv writes first (DISPFB1, DISPLAY1
        // lo/hi, PMODE.EN1 last) — these are MMIO writes that
        // don't touch RAM, so no DMAC contention — then DMAC kick
        // (MADR, QWC, CHCR), then SYSCALL halt. After the SYSCALL
        // EE stops fetching → DMAC has unimpeded RAM access for
        // the rest of the transfer.
        //
        // Note on PMODE.EN1 ordering: programmed BEFORE the DMAC
        // kick so the EE-side write order remains
        // DISPFB1→DISPLAY1→PMODE.EN1 (the Ch111 driver-shaped
        // sequence). Real hardware would briefly enable scanout
        // with empty VRAM during DMA — our test's frame capture
        // happens AFTER the data plane settles, so the
        // intermediate state isn't observed.
        // ------------------------------------------------------------
        begin : preload_ee_program
            int off;
            off = 0;
            // --- GS-priv bring-up (Ch111 order, PMODE last) ---
            // r1 = 0x1200_0000 (GS-priv base).
            ee_prog_word(off       , enc_lui(1, 16'h1200));
            // r2 = 0x0001_0200 (DISPFB1: PSM=PSMCT16(2), FBP=0,
            // FBW=1). Ch129 swaps PSMCT32 → PSMCT16.
            //   FBW=1 → bit 9 = 1 → 0x0200
            //   PSM=2 → bits[19:15]=2 → 0x10000
            ee_prog_word(off  +  4 , enc_lui(2, 16'h0001));
            ee_prog_word(off  +  8 , enc_ori(2, 2, 16'h0200));
            // SW DISPFB1.
            ee_prog_word(off  + 12 , enc_sw (2, 1, 16'h0070));
            // SW DISPLAY1 lo = 0.
            ee_prog_word(off  + 16 , enc_sw (0, 1, 16'h0080));
            // r2 = 0x700F (DISPLAY1 hi: DH=7, DW=15).
            ee_prog_word(off  + 20 , enc_ori(2, 0, 16'h700F));
            // SW DISPLAY1 hi.
            ee_prog_word(off  + 24 , enc_sw (2, 1, 16'h0084));
            // r2 = 0x0001 (PMODE.EN1).
            ee_prog_word(off  + 28 , enc_ori(2, 0, 16'h0001));
            // SW PMODE.EN1 — programmed last among GS-priv writes.
            ee_prog_word(off  + 32 , enc_sw (2, 1, 16'h0000));

            // --- DMAC bring-up (Ch114) ---
            // r10 = 0x1000_A000 (DMAC ch2 base).
            ee_prog_word(off  + 36 , enc_lui(10, 16'h1000));
            ee_prog_word(off  + 40 , enc_ori(10, 10, 16'hA000));
            // r11 = MADR = phys 0x100 (GIF payload).
            ee_prog_word(off  + 44 , enc_ori(11, 0, 16'(PAYLOAD_MADR)));
            // SW r11, 0x10(r10) — MADR.
            ee_prog_word(off  + 48 , enc_sw (11, 10, 16'h0010));
            // r11 = QWC = QWC_TOTAL = 24 (4 SPRITE PACKED × 6 qwords).
            ee_prog_word(off  + 52 , enc_ori(11, 0, 16'(QWC_TOTAL)));
            // SW r11, 0x20(r10) — QWC.
            ee_prog_word(off  + 56 , enc_sw (11, 10, 16'h0020));
            // r11 = CHCR.start = 1.
            ee_prog_word(off  + 60 , enc_ori(11, 0, 16'h0001));
            // SW r11, 0x00(r10) — CHCR (kicks DMA).
            ee_prog_word(off  + 64 , enc_sw (11, 10, 16'h0000));

            // --- Halt ---
            ee_prog_word(off  + 68 , enc_syscall());
        end

        // Pulse core_go to start the EE bootlet. The EE will run
        // the full bring-up sequence (GS-priv writes + DMAC kick),
        // then SYSCALL halt. After halt, EE stops fetching → DMAC
        // has unimpeded RAM access for the rest of the transfer.
        @(negedge clk);
        core_go = 1'b1;
        @(negedge clk);
        core_go = 1'b0;

        // Wait for the EE to halt (SYSCALL → halt_o). At this
        // point the DMAC has been kicked and is running.
        wait (core_halt == 1'b1);
        repeat (4) @(posedge clk);

        // Wait for the data plane to settle.
        wait (dma_done_seen == 1'b1);
        repeat (10) @(posedge clk);
        if (xfer_busy == 1'b1)
            wait (xfer_busy == 1'b0);
        if (raster_active == 1'b1)
            wait (raster_active == 1'b0);
        if (loader_busy == 1'b1)
            wait (loader_busy == 1'b0);
        repeat (10) @(posedge clk);

        @(posedge u_pcrtc.end_of_frame);
        @(posedge clk);
        capture_armed = 1'b1;
        @(posedge u_pcrtc.end_of_frame);
        @(posedge clk);
        capture_armed = 1'b0;

        // ------------------------------------------------------------
        // Phase 1 — scanout frame assertion. Every (x, y) in the
        // 16×8 active area should read back its quadrant's RGB
        // after PCRTC's RGB5A1 → RGB888 5→8 bit-replicate. PCRTC
        // reads via the Ch126 swizzled path; raster wrote via the
        // Ch128 swizzled path. Agreement at this layer means
        // both integrations land at the same byte addresses for
        // PSMCT16.
        // ------------------------------------------------------------
        for (int y = 0; y < PCRTC_V_ACTIVE; y++) begin
            for (int x = 0; x < PCRTC_H_ACTIVE; x++) begin
                int          q_idx;
                logic [7:0]  er, eg, eb;
                q_idx = quadrant_idx(x, y);
                er = exp8_from5(spr_r_at(q_idx));
                eg = exp8_from5(spr_g_at(q_idx));
                eb = exp8_from5(spr_b_at(q_idx));
                if (!cap_de[y][x]) begin
                    $error("(%0d,%0d) DE never asserted", x, y);
                    errors = errors + 1;
                end
                if (cap_r[y][x] !== er || cap_g[y][x] !== eg
                    || cap_b[y][x] !== eb) begin
                    $error("[scanout] (%0d,%0d) got (%02x,%02x,%02x) expected (%02x,%02x,%02x) sprite=%0d",
                           x, y, cap_r[y][x], cap_g[y][x], cap_b[y][x],
                           er, eg, eb, q_idx);
                    errors = errors + 1;
                end
            end
        end

        // ------------------------------------------------------------
        // Phase 2 — write-side halfword readback at swizzled bytes.
        // For every (x, y) in 16×8, compute the canonical PCSX2
        // PSMCT16 swizzled byte address via in-TB ref_addr_psmct16()
        // and assert the 16-bit halfword at that byte (selected
        // from the 32-bit word via addr[1]) equals the sprite's
        // RGB5A1 word from gs_stub's ABGR→RGB5A1 packing. This
        // locks the raster Ch128 wiring independent of the scanout
        // Ch126 wiring.
        // ------------------------------------------------------------
        begin : phase2_hw_readback
            for (int y = 0; y < PCRTC_V_ACTIVE; y++) begin
                for (int x = 0; x < PCRTC_H_ACTIVE; x++) begin
                    int          q_idx;
                    logic [31:0] addr;
                    logic [15:0] expected;
                    logic [15:0] got;
                    q_idx    = quadrant_idx(x, y);
                    addr     = ref_addr_psmct16(0, 1, x, y);
                    expected = expected_psmct16(spr_r_at(q_idx),
                                                spr_g_at(q_idx),
                                                spr_b_at(q_idx),
                                                spr_a_at(q_idx));
                    vram_raddr2 = addr & ~32'd3;
                    #1;
                    got = addr[1] ? vram_rdata2[31:16]
                                  : vram_rdata2[15:0];
                    if (got !== expected) begin
                        $error("[hw] (%0d,%0d) @addr 0x%08x got 0x%04x expected 0x%04x sprite=%0d",
                               x, y, addr, got, expected, q_idx);
                        errors = errors + 1;
                    end
                end
            end
        end

        // ------------------------------------------------------------
        // Strict linear-vs-swizzled separator. The 16×8 PSMCT16
        // image at FBP=0/FBW=1 lives entirely in block (0,0) of
        // page 0 under SWIZZLED (PSMCT16 block is 16×8 px = 128
        // halfwords = 256 bytes, and the image is exactly 128
        // pixels). columnTable16 fills bytes [0..254 step 2]
        // inside that block. Under LINEAR the stride is FBW*64*2
        // = 128 bytes, so y=2 starts at byte 256 and y=3 at byte
        // 384 — both strictly outside block (0,0). If raster had
        // silently fallen through to linear, byte 256 would hold
        // sprite-2's halfword. Assert bytes 256 and 384 stay 0.
        // ------------------------------------------------------------
        vram_raddr2 = 32'd256;
        #1;
        if (vram_rdata2 !== 32'd0) begin
            $error("[linear-y2-byte-256] got 0x%08x expected 0", vram_rdata2);
            errors = errors + 1;
        end
        vram_raddr2 = 32'd384;
        #1;
        if (vram_rdata2 !== 32'd0) begin
            $error("[linear-y3-byte-384] got 0x%08x expected 0", vram_rdata2);
            errors = errors + 1;
        end

        // ------------------------------------------------------------
        // Aggregate counts.
        // ------------------------------------------------------------
        if (dma_start_count != 1) begin
            $error("dma_start_count=%0d (expected 1)", dma_start_count);
            errors = errors + 1;
        end
        if (dma_beat_count != QWC_TOTAL) begin
            $error("dma_beat_count=%0d (expected %0d)", dma_beat_count, QWC_TOTAL);
            errors = errors + 1;
        end
        if (dma_done_count != 1) begin
            $error("dma_done_count=%0d (expected 1)", dma_done_count);
            errors = errors + 1;
        end
        if (giftag_seen != 4) begin
            $error("GIFtag accept count=%0d (expected 4: 4×SPRITE)", giftag_seen);
            errors = errors + 1;
        end
        if (packed_ad_writes_seen != 20) begin
            $error("PACKED A+D dispatch count=%0d (expected 20: 4 sprites × 5 A+D)",
                   packed_ad_writes_seen);
            errors = errors + 1;
        end
        if (xfer_writes_seen != 0) begin
            $error("xfer VRAM writes=%0d (expected 0 — no TRXDIR upload in this demo)",
                   xfer_writes_seen);
            errors = errors + 1;
        end
        if (raster_pixel_emit_count != 32'd128) begin
            $error("expected 128 PSMCT16 raster emits, got %0d",
                   raster_pixel_emit_count);
            errors = errors + 1;
        end
        if (raster_emits_seen != 128) begin
            $error("PSMCT16 emit observer count=%0d (expected 128)",
                   raster_emits_seen);
            errors = errors + 1;
        end
        if (loader_starts != 0) begin
            $error("CLUT loader fired %0d times (expected 0 — no PSMT4 path)",
                   loader_starts);
            errors = errors + 1;
        end
        if (ee_priv_writes_seen != 4) begin
            $error("EE priv-MMIO writes=%0d (expected 4: PMODE + DISPFB1 + DISPLAY1×2)",
                   ee_priv_writes_seen);
            errors = errors + 1;
        end
        if (priv_bridge_fires_seen != 4) begin
            $error("priv-bridge gs_reg_wr fires=%0d (expected 4)",
                   priv_bridge_fires_seen);
            errors = errors + 1;
        end
        if (ee_dmac_writes_seen != 3) begin
            $error("EE-driven DMAC reg writes=%0d (expected 3: MADR + QWC + CHCR)",
                   ee_dmac_writes_seen);
            errors = errors + 1;
        end
        if (dmac_seq_idx != 3) begin
            $error("EE DMAC write sequence stopped at idx %0d (expected 3)",
                   dmac_seq_idx);
            errors = errors + 1;
        end
        if (dmac_seq_errors != 0) begin
            $error("EE DMAC write sequence had %0d divergences", dmac_seq_errors);
            errors = errors + dmac_seq_errors;
        end
        if (map_gs_priv_traces_seen != 4) begin
            $error("map trace classified GS-priv writes=%0d (expected 4)",
                   map_gs_priv_traces_seen);
            errors = errors + 1;
        end
        if (map_unmapped_traces_seen != 0) begin
            $error("map trace mis-classified GS-priv writes as UNMAPPED=%0d (expected 0)",
                   map_unmapped_traces_seen);
            errors = errors + 1;
        end
        // Ch113 — EE-CPU halt + trap state.
        if (!core_halt) begin
            $error("EE core did not halt (program should SYSCALL)");
            errors = errors + 1;
        end
        if (core_trap) begin
            $error("EE core trapped: pc=0x%08x instr=0x%08x",
                   core_trap_pc, core_trap_instr);
            errors = errors + 1;
        end
        if (collision_count != 0) begin
            $error("xfer/raster collision count=%0d (expected 0)", collision_count);
            errors = errors + 1;
        end
        if (raster_overflow) begin
            $error("raster_overflow asserted");
            errors = errors + 1;
        end
        if (raster_degenerate) begin
            $error("raster_degenerate asserted");
            errors = errors + 1;
        end

        $display("[tb_gs_demo_psmct16_swizzle_e2e] dma=(%0d,%0d,%0d) ee_dmac_wr=%0d giftags=%0d ad_writes=%0d xfer_writes=%0d ee_priv_wr=%0d bridge_fires=%0d core_halt=%0b core_pc=0x%08x emits=%0d loader_starts=%0d frame=%0dx%0d",
                 dma_start_count, dma_beat_count, dma_done_count,
                 ee_dmac_writes_seen,
                 giftag_seen, packed_ad_writes_seen, xfer_writes_seen,
                 ee_priv_writes_seen, priv_bridge_fires_seen,
                 core_halt, core_pc,
                 raster_pixel_emit_count, loader_starts,
                 PCRTC_H_ACTIVE, PCRTC_V_ACTIVE);

        if (errors == 0) $display("[tb_gs_demo_psmct16_swizzle_e2e] PASS");
        else             $display("[tb_gs_demo_psmct16_swizzle_e2e] FAIL");
        $finish;
    end

    initial begin
        #20000000;
        $error("[tb_gs_demo_psmct16_swizzle_e2e] timeout");
        $finish;
    end

endmodule : tb_gs_demo_psmct16_swizzle_e2e
