PHLEGM v8 checkpoint 45 - SNES ActRaiser audio IPL forensics
Baseline: PHLEGM v8 checkpoint 44 (PET-CBM-EndUser-Package).

EVIDENCE - reproduced against user-provided ActRaiser ROM and 2026-1009 core dump:
- The .sfc has a 512-byte copier header. The runtime correctly removes it.
- LoROM $02:9A63 is the BNE instruction in the ROM's LDA #$BBAA /
  CMP $2140 / BNE loop. This loop waits for both APU IPL readiness bytes.
- The core dump captures A=$BBAA, PBR=$02, PC=$9A63, E=0.
- The APU output port registers contain $50,$BB, not $AA,$BB.
- PPU INIDISP $2100=$80 is forced blank. Its frame is therefore black,
  whether or not the host surface is periodically presented.
- The prior backend uploads data into ARAM but does not execute the uploaded
  SPC700 code. Real programs may rely on replies from that code; fake port
  echoing would conceal that missing co-processor functionality.

CHANGES:
1. Restrict IPL transfer end-of-block decisions to forward signed-range
   jumps (1..127 relative to expected transfer counter). Do not treat a
   stale/duplicate counter as a new block; retain correct $FF->$00 wrap.
2. Record the first 64 and latest 64 APUIO0 write/ack events, including
   opcode-instruction count, CPU->APU port contents, APU->CPU reply, IPL phase,
   expected byte counter, and ARAM transfer address.
3. Add a SNES-specific [SNES-APU-IPL] forensic section in COREDUMP, with
   both port directions, IPL phase, entry point, byte count, expected counter,
   PPU forced-blank register and frames, and complete 64KiB ARAM hex image.
4. Add COREDUMP APU console/GUI command for live read-only diagnostics.
5. No SPC700 opcodes or SNES game-dependent code added to native libraries.

REPRO:
- Select SNES-NTSC, insert actraisr.sfc, let the emulation run.
- Type COREDUMP APU to check phase (0=waiting for CC, 1=IPL transfer,
  2=program uploaded), directional ports, and forced blank.
- Type COREDUMP SAVE actraiser-ipl when stalled; attach the saved core dump.
- Look for [SNES-APU-IPL-FIRST-EVENTS] and [SNES-APU-IPL-RECENT-EVENTS].

LIMITATION:
This checkpoint does NOT implement an executing SPC700, S-SMP timers, or
S-DSP audio and does NOT claim ActRaiser is playable. Proper independent
SPC700 scheduling and per-opcode .phlegm definitions are still required.
The new tracing distinguishes incomplete IPL transfer, CPU repeating the
ready handshake, and game code running without co-processor replies.

BUILD:
Native compiler unavailable in this environment; source/package sanity
and protocol edge-case model checks performed, full compile and real
ActRaiser hands-on run NOT validated here.

CHECKPOINT VALIDATION:
PASS: ActRaiser LoROM PC/BBAA/AUDIO/PPU dump diagnosis
PASS: stale/duplicate count, forward jump, 8-bit rollover, no fake SPC driver ack
PASS: command/help/coredump wiring and CRLF integrity
NOT RUN: native FreeBASIC compile and real SNES runtime (no fbc toolchain installed)
