Introduction

This book describes the timing behaviour of the original Game Boy's SoC — the DMG-CPU B — at the gate and signal level: the clock tree, the PPU's rendering pipeline and mode machinery, the CPU's view of every register boundary, the timer and interrupt-dispatch circuits, and the APU's per-channel counters.

It exists because no current documentation reaches these circuits at this layer:

• gb-ctr — excellent where it reaches, but its coverage is not yet thorough at the time of writing;
• Pan Docs — the console at register granularity;
• pixel-FIFO write-ups — the PPU as an algorithm.

None of them can answer: on which clock edge does Mode 3 actually end? What does the CPU read from STAT during the M-cycle that straddles that edge? Which edge sets IF when TIMA wraps? Emulator authors chasing the last mile of accuracy need answers at exactly that resolution — which flip-flop captures which signal on which edge — and that is the layer this book documents, for every subsystem on the die.

Every claim here is tied to a named gate from the DMG-CPU B netlist. The names (WODU, XYMU, CUPA, MOBA, CARU…) come from the reverse-engineering effort, not the die's designers — but they are stable, globally unique, and shared by the netlist and the simulation: anyone with either can look a cell up and check the claim independently. The dynamic evidence is gate-level simulation, corroborated by test ROMs whose expected results are hardware-verified — no figure here comes from direct electrical measurement of a real unit. Sources and Methodology draws that boundary precisely. Appendix A is the lookup table — every signal named in this book, its role, its connections, and where it is described.

What this book is not

• Not a general Game Boy reference. The console's general hardware and programming model are covered in detail by gb-ctr and Pan Docs; this book does not duplicate them. Where a subsystem's behavioural surface is already well documented (the timer is the clearest example), the relevant chapter summarises it briefly, cites the existing reference, and spends its pages on the gate-level structure underneath.
• Not derived from emulators. No emulator's implementation was used as a source of hardware truth; see Sources and Methodology.
• DMG-CPU B only. Later revisions and the Game Boy Color have no public netlist; their deltas are out of scope.

The shape of the book

• Foundations — the clock tree and the counters and latches that give every other chapter its vocabulary: dots, ALET/MYVO edges, LX/LY, the XYMU rendering-mode latch.
• CPU–PPU Interface — how CPU reads and writes actually reach PPU registers, OAM, and VRAM: the combinational read path, the CUPA write strobe, and OAM DMA's bus arbitration.
• The Rendering Pipeline — Mode 2 OAM scan, the Mode 3 BG/sprite/window machinery, LCD output, mode transitions, STAT interrupts, full scanline and frame timing, and what the CPU observes at every mode boundary.
• CPU-Side Subsystems — the timer, interrupt dispatch, HALT/EI semantics, and the IF register, at the same edge-level resolution.
• Audio Processing Unit — the APU's clock tree, frame sequencer, and per-channel counter cells.
• System State — the complete hardware state at the moment the boot ROM hands control to the cartridge.

The PPU chapters follow one pipeline — the path every rendering scanline runs through Mode 3:

AVAP → NYXU → BG fetch counter → SACU → PX counter → WODU → VOGA → WEGO → XYMU

OAM scan completion (AVAP) starts rendering, the SACU pixel clock pumps pixels through the PX counter, and the terminal-count condition (WODU) propagates through a one-DFF pipeline (VOGA) to set the "not rendering" latch (XYMU). The STAT interrupt cascade hangs off WODU and the LY-comparison match; the CPU reaches PPU registers through a combinational read path and the CUPA write strobe. Every stage of that path has a chapter.

The CPU-side and APU chapters need no shared roadmap — each subsystem is self-contained: the timer is a ripple counter and a two-M-cycle reload sequence, dispatch is a trigger/capture pair against the IF latches, and each APU channel is a divider plus a handful of tick counters.

Reading paths

Few readers need this book cover to cover. Three curated routes:

The emulator-implementor path — building or improving a cycle-accurate core. Read Notation and Conventions, then The Clock Tree and Rendering Mode Control for vocabulary, then go straight to the subsystem you are implementing. The "For implementors" callouts and Appendix B's constants are written for you; finish with Post-Boot State if you skip the boot ROM.

The boundary-behaviour path — chasing a failing timing test. Start at CPU-Visible Mode Boundaries for the PRE/POST framework, then the boundary's owning chapter (Mode transitions, STAT interrupts, Interrupt dispatch, or HALT and EI), then Races if the divergence is sub-dot.

The APU path — self-contained: APU clock tree and frame sequencer first (the re-lock rule and the Δ = 3 boot seed underpin everything), then the channel chapters in any order, then the APU rows of Post-Boot State.

If you are new to gate-level material, read Notation and Conventions first — it is short, and the rest of the book assumes it.

Sources and Methodology

This book was written with substantial AI assistance, under direction and with the verification discipline described in this chapter. The full account is in the project's README.

Everything in this book derives from three primary sources, used in this order:

1. The DMG-CPU B netlist — msinger/dmg-schematics, a transistor-level reverse engineering of the DMG-CPU B die. The netlist supplies the ground truth this book is written in: cell names, cell types, and connectivity. When this book says "WODU = AND2(XENA, XANO)", that is a netlist fact, checkable by opening the schematics.

2. Gate-level simulation — msinger/dmg-sim, a SystemVerilog model generated from that netlist and run under Icarus Verilog — the same logic as the silicon, cell by cell, with modelled propagation delays (tunable parameters, not values extracted from silicon). Every dynamic timing claim in this book was measured from its waveform captures. Test ROMs run under a minimal quickboot stub that reproduces the post-boot state; the real boot ROM was used where boot alignment or residual boot-time state matters, and to validate quickboot itself.

3. Static propagation-delay analysis — gb-propagation-delay-analysis, graph analysis over the netlist (4,102 nodes, 9,458 edges): combinational depth measured in gate equivalents (ge), race-pair identification between converging paths, and critical-path inventories. This is the source for the races chapter and for depth figures quoted elsewhere.

Behavioural documentation — gb-ctr, Pan Docs, TCAGBD, the Mealybug Tearoom PPU notes — is used for cross-checking and for high-level framing, and is cited where it carries a section's behavioural summary. No emulator implementation was used as a source of hardware truth. Hardware test ROMs with hardware-verified expected results corroborate behavioural conclusions but never ground a gate-level claim. Annotations are trusted but not infallible — where a ROM's expected value disagreed with the simulation, the ROM was re-run on real hardware and excluded if the expectation did not hold there. Every cited ROM was measured from a verified local build.

How measurements were made

The measurement workflow behind every "dmg-sim measurement" citation:

1. A small test ROM establishes a precisely-timed scenario — for example, a HALT/NOP loop synchronised to the H-Blank interrupt with SCX=0. Citations name the scenario and its suite (e.g. gbmicrotest int_hblank_nops_scx0), or mark it purpose-built, so a measurement can be reproduced by reconstructing the scenario.
2. dmg-sim runs the ROM and dumps an FST waveform of the full cell-level state (1 ps timescale).
3. Named-signal transitions are read from the waveform with picosecond timestamps, and converted to dots using the simulation's measured dot period.
4. Single observations are never trusted: values are checked for invariance across consecutive scanlines, across scenario variants (different instruction preludes, different SCX values), and against the static netlist structure.

How to read the numbers

Two kinds of numeric values appear in this book, and they carry different weight:

• Dot-denominated figures ("Mode 3 lasts 173.481 dots", "the sprite penalty is exactly 6 dots") are discrete observations: counts of clock edges between two events, with no precision limit. Given comfortable timing margins, the count is set by the clocking structure, not the delay values; the test-ROM corpus corroborates the counts at the resolution it observes (typically the M-cycle). One dot ≈ 238.4 ns on hardware.
• Picosecond figures ("CATU's Q output moves 988 ps after its clock edge") are model propagation values — the simulation's dot period is 244,000 ps against the real ≈238,418 ps. Read them as edge-ordering and phase evidence, not as nanosecond claims about a physical chip.

Fractional-dot figures such as "WODU→XYMU = 0.436 dots" read against the half-dot clock grid. Events in these chains sit at small propagation offsets from clock edges, so an interval's fraction reveals which edge its endpoint belongs to: VOGA captures WODU on the same-dot ALET rising edge, 0.435 dots after WODU↑, and the WEGO→XYMU gate adds the final 0.001 — so XYMU's set lands just after that ALET rising edge. The prose always names the edges; the fraction is how the waveform shows them.

The evidence boundary. Every dynamic measurement here is a simulation measurement. Hardware enters only as test-ROM pass/fail expectations validated on real units and as reference photographs — never as direct electrical measurement of a real DMG. Real units also vary (process, voltage, temperature), so "zero variance" describes the deterministic model, and a small-margin ps ordering is the model's prediction of the likely silicon ordering, not a guarantee. Where unit variation could plausibly flip an ordering, the text says so.

Calibration pin. The dominant delay-tuning constant is kR_nmos_ref in dmg-sim's timing-default.sv. Every ps and fractional-dot figure in this book is stamped to kR_nmos_ref = 3.6e4 (upstream commit e0c8774, the current calibration as of June 2026). Re-tuning that constant rescales the ps figures near-uniformly and leaves edge identities in place — verified across a 3.6× historical re-tuning, with one margin-sensitive exception flagged where it appears (pixel clock). If a build disagrees with this book's ps values by a uniform factor, check that constant first. Integer dot counts are calibration-independent: dot figures are expressed in the simulation's own dot period, so known edge counts (the 4-dot TALU period, the 6-dot sprite fetch) read as exact integers.

Verification

Every numeric figure was re-traced to its measurement evidence during preparation for publication and checked for consistency against every other place it appears; the gate-level measurement always grounds the claim. Nothing unverified is stated silently: residual unknowns are tagged Open question inline and collected in Appendix C.

Some signals are documented structurally but lack a derived semantic role; their concordance entries leave the role cell blank rather than invent one.

Notation and Conventions

This chapter defines the units, naming rules, and recurring table formats used throughout the book. It is reference material — skim it once, then return when a notation needs pinning down.

Timing units

There is no inherent "start" edge within a dot: the master clock is a continuous alternation of edges, and circuits trigger on whichever edge they are wired to. Statements like "X happens 0.436 dots after Y" locate X's edge relative to Y's edge; the prose names both.

Writing positions. Dots measure length; cycle labels name place:

T-cycle and machine-cycle numbering follow gb-ctr. Pan Docs uses dots purely as durations, with the same zero-based counter values.

Signal names

• Gate names come from the DMG-CPU B netlist and are the book's canonical identifiers, UPPERCASE in prose: WODU, XYMU, AVAP. The names are the reverse-engineering effort's, not the designers' — but they are stable and globally unique, so every claim is greppable.
• Lowercase backtick forms refer to netlist cells or simulation wires where the distinction matters: `wodu` (the cell), `byba_n` (a specific output pin).
• A gate's Boolean function is written in netlist style: WODU = AND2(XENA, XANO), NYXU = NOR3(AVAP, MOSU, TEVO).
• A few signals are simulation wire names rather than netlist cells (e.g. `ck1_ck2`, the crystal input); these stay lowercase throughout.

Roles vs names. Each gate has a one-phrase semantic role ("scan-done flag", "Mode 3 ending condition") introduced at first mention in a chapter; after that, the gate name alone is used. The role phrasing is identical everywhere a gate appears, and Appendix A holds the canonical phrasing.

Polarity. Many signals are active-low, and several latches hold inverted semantics — the most important being XYMU, the rendering-mode latch, which reads 0 during Mode 3 (its role phrase is "not rendering"). Polarity quirks are stated explicitly wherever they bite. DFF complementary outputs are written q/q_n; when a consumer takes the q_n pin, the text says so.

Edges

• ↑ = rising edge, ↓ = falling edge: WODU↑ is WODU rising.
• The clock tree produces named edge vocabulary used everywhere: "captures on ALET rising", "XUPY falling". Complementary clock pairs (ALET/MYVO, TALU/SONO, XOTA/XYFY) mean every half-dot boundary has two equivalent names — "MYVO rising" is "ALET falling" — and chapters use whichever matches the flip-flop's clock pin.

Signal paths

Cascades are written as an arrow chain in a blockquote, followed by prose:

WODU → TARU → SUKO → TUVA → VOTY → LALU

The Mode 0 condition (WODU) combines with the STAT enable bit through TARU, joins the other STAT sources at the combining gate (SUKO), and propagates through two inverters to clock the STAT interrupt latch (LALU).

The chain names every stage in order, with no skipped intermediates.

Reference blocks

Chapters that discuss individual gates open with a reference block — a table of the gates the chapter covers:

• Type is the netlist cell type (dffr, nor_latch, and2, dlatch_ee…).
• Clock / Trigger gives clock-and-edge for registered cells, the input list for combinational gates, and set/reset inputs for latches.
• Arrays of identically-clocked cells (shift-register planes, the sprite store) use a family row with a Count column; individual cell names follow in prose.
• A signal whose full description lives in another chapter gets a brief row pointing there. One chapter is primary for every signal; Appendix A records which.

Callout boxes

Seven kinds of callout carry the book's recurring content types:

Inline (dmg-sim measurement, …) tags remain the provenance convention — a Measured callout features a result but never replaces them.

Two markers flag the edges of current knowledge: the Open question callout, and a blank role cell in Appendix A — connectivity documented, semantic role not yet derived, never an invented description.

The Clock Tree

Every timing claim in this book ultimately reduces to "this cell captures on that edge of this clock". This chapter names the clocks. It follows the master clock from the crystal input through the buffer chain to the PPU's per-dot clock pair (ALET/MYVO), down the video divider chain to the per-M-cycle pair (TALU/SONO), and establishes the phase relationships the rest of the book leans on.

The master oscillator

The DMG-CPU B has a single crystal oscillator at 4.194304 MHz connected through the top-level input ck1_ck2 — the master clock from which all on-chip timing derives. Wherever this book says "the master clock" (including the propagation-delay origin used in Races), the referent is ck1_ck2.

One dot covers both edges of the master clock. ALET, the PPU's main 4 MHz clock, tracks the master clock in phase: ALET rising corresponds to ck1_ck2 rising after ~16.3 ge of buffer delay. MYVO = NOT(ALET) is the complementary clock — DFFs clocked by ALET capture on one edge, those clocked by MYVO on the other, both within a single dot. "One ALET half-cycle" and "one ATAL half-cycle" both mean half a dot.

Dot counts in this book are edge counts — independent of the simulation's delay model. Picosecond values come from the gate-level simulation's 244,000 ps dot period — see How to read the numbers.

Crystal to PPU clocks

The crystal feeds a NAND feedback pair (ANOS/AVET) that produces ATAL (the 4 MHz enable) and its complement ADEH. From ATAL the PPU clock tree branches through a buffer chain (AZOF → ZAXY → ZEME) to ALET (4 MHz PPU main clock) and its complements (MYVO, MOXE). A parallel branch (XYVA → XOTA) feeds the WUVU/VENA/WOSU video divider chain; VENA drives TALU (1 MHz LX-counter clock) and its complement SONO. The tree diagram shows the propagation hierarchy; the reference block catalogues each named cell.

ck1_ck2 (4.194 MHz crystal)
└── ANOS (nand2) / AVET (nand2) — feedback pair
    └── ATAL (not_x2) — 4 MHz buffered enable
        ├── ADEH = NOT(ATAL) — complement
        ├── [CPU phase generators: AFUR/ALEF/APUK/ADYK ring]
        └── AZOF (not_x6) = NOT(ATAL) — PPU clock buffer
            └── ZAXY (not_x2) = NOT(AZOF)
                └── ZEME (not_x4) = NOT(ZAXY)
                    ├── ALET (not_x2) = NOT(ZEME) — 4 MHz PPU main clock
                    │   ├── MYVO (not_x1) = NOT(ALET) — complementary to ALET
                    │   └── MOXE (not_x1) = NOT(ALET) — same phase as MYVO
                    └── XYVA (not_x1) = NOT(ZEME)
                        └── XOTA (not_x1) = NOT(XYVA)
                            ├── WUVU (dffr) — toggle, 2 MHz [clk=XOTA]
                            │   ├── VENA (dffr) — toggle, 1 MHz [clk=WUVU.~Q]
                            │   │   ├── TALU (not_x4) = NOT(vena_n) = VENA.q — LX counter clock, 1 MHz
                            │   │   │   └── SONO (not_x1) = NOT(TALU) = vena_n
                            │   │   └── [used as clock for per-dot DFFs]
                            │   └── WOSU (dffr) — samples WUVU on opposite edge [clk=XYFY]
                            └── XYFY (not_x1) = NOT(XOTA) — opposite edge

Phase relationships

These five facts carry most of the book's edge reasoning:

• ALET rising = ck1_ck2 rising (in phase, not inverted). The XTAL pad inverts once (clk_in_n = NOT(ck1_ck2)); the ANOS/AVET feedback pair restores ATAL to crystal phase; four more inversions through AZOF → ZAXY → ZEME → ALET land in phase at 16.3 ge total delay. ADEH = NOT(ATAL) pairs with ATAL in the CPU phase-generator ring.
• ALET and MYVO = NOT(ALET) are complementary clocks at the 4 MHz master rate. ALET is 16.3 ge deep from the crystal; MYVO is 22.2 ge deep (5.9 ge additional from the inverter and wire routing). DFFs clocked by ALET capture on one edge; DFFs clocked by MYVO capture on the opposite edge. This pair drives most per-dot PPU timing.
• TALU and SONO are complementary clocks at 1 MHz (derived from VENA), driving line-level timing.
• WUVU and VENA are toggle DFFs (internal ~Q → D feedback) forming the video clock divider chain. WOSU is a sampler DFF (D input = WUVU) that captures WUVU on XYFY rising to produce a phase-differentiated replica for the LCD-control decode.
• All PPU dividers are held at 0 while VID_RST is asserted (LCD off) and count from zero on deassertion — see Register writes for the deassertion path.

PPU clock domains

Every registered cell in the PPU is clocked by a signal traceable to the crystal. The major clock domains:

Complementary pairs and pipeline relationships

A DFF clocked by A feeding a DFF clocked by NOT(A) forms a half-period pipeline: the downstream cell captures, half a period later, what the upstream cell just captured. Three pairs recur:

Worked through for ALET/MYVO: on ALET rising, the ALET-clocked DFFs (NYKA, LYZU, PYGO, RENE, DOBA, NOPA) capture. On ALET falling — MYVO rising — PORY captures NYKA's new output. PORY therefore always holds the value NYKA captured half a dot earlier.

XUPY-clocked DFFs capture on ALET falling — the opposite edge from the ALET-clocked group. The chain: XOTA is ALET's complement; XOTA clocks WUVU; XUPY = WUVU.q. So BYBA — the scan-done capture (OAM scan) — moves half a dot before DOBA, its ALET-clocked partner in the AVAP edge detector.

TALU / ck1_ck2 half-edge alignment

TALU rises align with ck1_ck2 falling edges (modulo divider-startup phase): WUVU toggles on XOTA↑ = ALET↓ = ck1_ck2↓, VENA captures the toggle on the same edge family, and TALU inverts VENA — so each TALU↑ traces to a ck1_ck2↓ through the divider chain's buffer delays. Measured directly: TALU↑ lands 9,350 ps after its ck1_ck2↓ edge, constant across 51,489 edges (dmg-sim measurement).

Steady-state TALU↑ vs CLK9↑ within one M-cycle

The TALU↑ that opens an M-cycle (clocking NYPE, SAXO, and ROPO) leads the CLK9↑ that opens the same M-cycle (Interrupt dispatch) by 121,110 ps ≈ 0.496 dots (dmg-sim measurement, constant across 51,489 M-cycles). The half-dot offset is structural: the TALU edge comes from the ck1_ck2↓ preceding the boundary (+9,350 ps), the CLK9 edge from T1's ck1_ck2↑ (+8,440 ps): ½ dot − 9,350 + 8,440 = 121,090 ps, matching the measured value to within the edge-asymmetry residual.

The practical reading: "TALU↑ at the M-cycle boundary" fires roughly half a dot before that M-cycle's CLK9↑. The two edges open the same M-cycle but are not co-located.

Line Counters

LX and LY are the PPU's scanline-position and scanline-number counters. Both run on every scanline regardless of mode and are consumed everywhere: Mode 2's sprite Y compare uses LY, Mode 3's window WY/WX compares use LY and the pixel pipeline, and the mode-transition machinery keys off both (LX=113 triggers LINE_END; LY≥144 enters VBlank). LINE_END's distribution via NYPE splits across two TALU edges, driving POPU (Mode 1 capture), MYTA (FRAME_END), and MEDA (LCD vertical sync).

The LX counter

LX is a 7-bit ripple counter clocked by TALU (1 MHz, = VENA.q), counting 0–113: 114 M-cycles × 4 dots = 456 dots per scanline. Each stage's clock comes from the previous stage's ~Q output (the same convention as the BG fetch counter). LINE_END is detected combinationally (SANU) and captured into RUTU on the complementary SONO clock edge.

TALU (1 MHz)
├── SAXO (dffr) [clk=TALU] — LX bit 0
│   └── TYPO (dffr) [clk=SAXO.~Q] — LX bit 1 (ripple)
│       └── VYZO (dffr) [clk=TYPO.~Q] — LX bit 2
│           └── TELU (dffr) [clk=VYZO.~Q] — LX bit 3
│               └── SUDE (dffr) [clk=TELU.~Q] — LX bit 4
│                   └── TAHA (dffr) [clk=SUDE.~Q] — LX bit 5
│                       └── TYRY (dffr) [clk=TAHA.~Q] — LX bit 6

Reset: MUDE = NOR2(LYHA, RUTU) — LINE_END (RUTU=1) or video reset (LYHA) drives MUDE low, resetting the counter. LX counts from 0 to 113, where LINE_END fires.

LINE_END detection

LX[0..6] → SANU → RUTU

SANU = AND4(SAXO, SUDE, TAHA, TYRY) = AND(LX[0], LX[4], LX[5], LX[6]) decodes LX = 113 (binary 1110001). The decode is partial — it ignores bits 1, 2, 3 — but exact within the counter's range: 113 is the smallest value with bits 0, 4, 5, 6 all set, so no earlier count can fire it.

RUTU (dffr, clk=SONO) captures SANU on the SONO edge (= TALU falling). The complementary pair does the settling work: LX increments on TALU rising, RUTU samples on SONO rising — half an M-cycle for SANU to settle (complementary pairs).

The RUTU pulse

RUTU.Q is high for one full TALU cycle = 4 dots: it captures SANU=1 on a SONO rising edge, MUDE = NOR2(LYHA, RUTU) holds the LX counter at 0 (keeping SANU=0), and the next SONO rising edge captures SANU=0, ending the pulse. The pulse is bounded by successive TALU-falling edges.

Measured across 36 consecutive scanline boundaries: pulse width 4.000 dots (one TALU cycle) and inter-rise interval 456 dots (the scanline period), both zero-variance (dmg-sim measurement).

One consequence: the TALU rising edge inside the RUTU pulse does not advance LX (the counter is held at 0), so a steady-state scanline sees 114 TALU rising edges of which 113 increment LX. This matters for the post-LCD-on the first scanline, which has no leading RUTU pulse — see LCD-on power-up.

The LY counter

LY is an 8-bit ripple counter clocked by RUTU. Three combinational decodes detect scanline phase transitions: XYVO (VBlank, LY ≥ 144), NOKO (FRAME_END, LY = 153), and NERU (LY = 0). Each decode is captured by a DFF clocked by NYPE (see LINE_END distribution below).

RUTU (LINE_END)
├── MUWY (dffr) [clk=RUTU] — LY bit 0
│   └── MYRO (dffr) [clk=MUWY.~Q] — LY bit 1 (ripple)
│       └── LEXA (dffr) [clk=MYRO.~Q] — LY bit 2
│           └── LYDO (dffr) [clk=LEXA.~Q] — LY bit 3
│               └── LOVU (dffr) [clk=LYDO.~Q] — LY bit 4
│                   └── LEMA (dffr) [clk=LOVU.~Q] — LY bit 5
│                       └── MATO (dffr) [clk=LEMA.~Q] — LY bit 6
│                           └── LAFO (dffr) [clk=MATO.~Q] — LY bit 7

Reset: LAMA = NOR2(LYHA, MYTA) — FRAME_END or video reset triggers the LY reset.

The three decodes, side by side:

The two AND decodes use SANU's partial-decode trick: 144 and 153 are the smallest values with their bit sets, so the decode is exact within range. MEDA touches no scan or mode-control state — see LCD output for the pad driver and LCD-on power-up for why the first frame after LCD-on emits no pulse.

LINE_END distribution via NYPE

RUTU drives NYPE (dffr, clk=TALU), and NYPE's two outputs split the distribution across two complementary TALU edges: Q clocks POPU; Q_n clocks MYTA and MEDA one TALU period later (the capture table above).

The stagger carries two consequences:

• The LY 153→0 race window. The one-TALU-period gap between POPU and MYTA is when ROPO captures the pre-reset LYC match at the 153→0 boundary — STAT interrupts.
• A modelling constraint — the pitfall below.

Rendering Mode Control

XYMU is the PPU's single mode-state handle — a NOR latch whose polarity (Q=0 during Mode 3, Q=1 elsewhere) drives 23 downstream consumers across fetch control, VRAM/OAM access, STAT mode bits, sprite comparators, and fine-scroll gating. This chapter describes XYMU's structure and the mode lifecycle; Mode transitions describes what drives XYMU's transitions, edge by edge.

Mode lifecycle

The PPU mode is determined by combinational logic from several registered signals:

This table is the behavioural surface that register-level documentation already describes; everything below is the machinery underneath it.

The XYMU latch

XYMU is the PPU's "not rendering" signal. The transition out of Mode 3 propagates through a WODU → VOGA → WEGO → XYMU chain (Mode transitions carries the full chain timing table; this section introduces the signals).

Transitions:

• XYMU↓ (Mode 3 starts) at AVAP↑. AVAP drives XYMU's reset input.
• XYMU↑ (Mode 3 ends) at WEGO↑. WEGO drives XYMU's set input.

Signal path (Mode 3 end): WODU → VOGA → WEGO → XYMU

The WODU condition propagates through VOGA (an ALET-clocked DFF capturing WODU), WEGO (an OR2 combining VOGA with the TOFU video reset), and onto XYMU's set pin — 0.436 dots from WODU↑ to XYMU↑ (dmg-sim measurement): VOGA captures at 0.435, and the WEGO → XYMU gate adds the final 0.001.

Two chain members carry timing weight:

• WODU = AND2(XENA, XANO) — no sprite match active AND the pixel counter at terminal count: the H-Blank condition.
• VOGA captures WODU on the same-dot ALET rising edge: WODU rises during the ALET-low phase, and the rising edge within that same dot latches it (0.435 dots after WODU↑). Mode 3 therefore ends within the dot WODU fires.

WEGO's TOFU arm means an LCD disable also sets XYMU; TADY's ATEJ arm resets VOGA at every scanline boundary.

XYMU's 23 consumers

XYMU is an asynchronous NOR latch — no clock; its consumers see transitions after combinational delay only. The complete consumer set (netlist out-edges):

• Fetch cycle resets — LYZU, PYGO, RENE, PAHO, PUXA, RYFA (XYMU as reset input).
• Fine-scroll match reset — NYZE (XYMU as reset input).
• Rendering-gated paths — LOBY, PAHA (both =1 outside Mode 3; see BG pipeline for the PAHA polarity convention).
• VRAM access control — ROPY, XANE.
• OAM access control — AJON, ASAM, AZEM, BUZA.
• STAT mode bits — SADU, XATY.
• Sprite comparator resets — SEBA, TOBU, VONU.
• Fetch control — LURY, SUVU.
• Sprite Y-compare enable — TEPA.

Signal types in the mode-control web

The mode-control web mixes asynchronous latches with synchronous DFFs, and the distinction carries timing weight:

The latches respond to their inputs with combinational delay only — they do not wait for a clock edge. The DFFs capture on specific edges, introducing pipeline delay. Most one-dot timing subtleties in the mode-transition chapters come down to exactly this split.

Registers

The PPU's CPU-facing registers (LCDC, STAT, SCX, SCY, LY, LYC, BGP, OBP0, OBP1, WX, WY) are accessed via distinct paths for reads and writes:

• Reads: purely combinational — address decode plus the ungated ppu_rd enables tri-state drivers from the underlying DFF Q outputs onto the bus. There is no read strobe; the CPU latches the bus on its own schedule.
• Writes: PPU-side level-sensitive latches, transparent during the CUPA strobe — which fires once per M-cycle at a deterministic position, making every writable register transparent at the same time.

The asymmetry reflects which side is the receiver. Reads just drive the bus combinationally while the CPU requests the address (the CPU is the receiver); writes must strobe the PPU-side register latches closed on specific edges (the PPU is the receiver).

What's where

Reads

CPU reads of PPU registers use a purely combinational path from the underlying DFF Q outputs to the CPU data bus, gated by address decode and the CPU's ungated read signal ppu_rd. There is no PPU-side read strobe analogous to CUPA (writes); the CPU latches the bus on its own schedule via the SM83-internal data_phase signal.

The read path

The $FF44 (LY) read, representative of the pattern:

1. The CPU asserts cpu_rd with address $FF44 on its port.
2. ppu_rd follows cpu_rd through two inverter stages; no phase gating.
3. The address decoders fire: ff4x (high-byte match) combines with the low-nibble decode wyle to drive ff44 active-high.
4. wafu = AND2(ppu_rd, ff44) enables the 8 tri-state drivers from the LY DFFs (through VARO, the drivers' active-low ena_n).
5. Each NOT_IF0 driver presents its bit's current Q output onto the CPU data bus d[0..7] — a single NOT gate plus tri-state driver, all combinational.
6. The CPU samples cpu_port_d (connected to d[] via transmission gates) at the SM83-internal data_phase — which is the phase generator's NOT(ATYP) window, clock-enable gated: BELU = NOR2(ATYP, clk_ena_n), inverted by BYRY and rebuffered by BEVA. It speaks the same AFUR-ring vocabulary as the write path's clk_t4 (writes); its falling edge — the CPU's capture point — is the ATYP rise at the M-cycle boundary.

The STAT family split

$FF41 (STAT) splits across both driver families (netlist-derived): the live status bits read through NOT_IF1 drivers (enabled by TOBE = AND2(ppu_rd, ff41)), the interrupt-enable bits through NOT_IF0 drivers (enabled by VAVE = NOT(TOBE)):

The split matches the driver-cell distinction: the transition-prone status bits carry the bus-settling x-window; the per-frame-stable enable bits read like LY, with none.

The full register read map

Every $FF4x PPU register follows the same chain, netlist-enumerated for all twelve. Per register: a nand5 address decode (ff4x plus the four low-nibble address lines, true or inverted to match the digit) feeds a not_x2 to make the active-high select; an AND2 with ppu_rd forms the read enable; a not_x1 inverts it for the drivers' active-low ena_n; eight NOT_IF0 drivers put the register on the bus. Each driver's input is the latch's inverted output, so the bus receives true polarity. The selects are shared with the write path — the same cell feeds the write enable's AND2 with CUPA (writes).

Two exceptions to the NOT_IF0 rule:

• STAT splits across both families (above).
• DMA ($FF46) reads through eight NOT_IF1 drivers — the same active-high-enable family as STAT's live bits — via a double inversion (MOLU → NYGO → PUSY) and fed by dma_a15…a8, the DMA source-page register. The family membership has no observable consequence: those DFFs change only on an FF46 write, which cannot land inside an FF46 read M-cycle, so no transition can straddle a read. The x-window machinery stays exclusive to STAT bits 0–2.

Timing implications

• No within-dot ordering for reads. Unlike writes — which land at a specific dot position gated by CUPA — reads are continuously enabled while ppu_rd is asserted and the address decoder matches. A read is not an ordered event in the PPU's within-dot sequence.
• No PPU-side sample point. What the CPU reads is the current DFF state at the instant its data_phase fires. Any update to the underlying DFFs (an LY reset via LAMA, a ROPO capture on TALU rising) propagates combinationally through the inverter and tri-state driver within gate delay — well under a dot.
• CPU-side sampling phase. data_phase gates the CPU's internal capture of cpu_port_d. What the CPU observes when a PPU transition lands inside the read M-cycle is worked through, case by case, in CPU-visible timing at mode boundaries.

The structural takeaway: there are no latches or DFFs between a PPU register's DFFs and the CPU data bus on the read side — the PPU drives the bus combinationally while ppu_rd is asserted, and the CPU latches at its own data_phase.

Writes

Reads drive the bus combinationally (reads); writes work the other way around — the PPU is the receiver, so the write must strobe the PPU-side register latches closed on specific edges. Every writable PPU register (LCDC, STAT, SCX, SCY, LYC, BGP, OBP0, OBP1, WX, WY) is a level-sensitive latch, transparent during the CUPA strobe — which fires once per M-cycle at a deterministic position, making every writable register transparent at the same time.

The shared CUPA strobe

All CPU-writable PPU registers are level-sensitive latches (drlatch_ee or dlatch_ee) whose enable is AND(address decode, CUPA):

• LCDC: WARU = AND2(VOCA, CUPA) → XUBO/XURE
• STAT: SEPA = AND2(VARY, CUPA) → RYVE/PUPU
• BGP: VELY = AND2(WERA, CUPA) → TEPO/LYFA
• SCX: ARUR = AND2(XAVY, CUPA)
• SCY: BEDY = AND2(XARO, CUPA)
• …and so on: every writable register shares CUPA, with per-register address decode.

Phase generator derivation

ADAR/ATYP ring decode → AFAS → AREV (with cpu_write) → APOV → UBAL → TAPU → DYKY → CUPA

The phase generator is a 4-stage ring (AFUR/ALEF/APUK/ADYK) driven by ATAL/ADEH, the complementary 4 MHz enables from the clock tree. Each stage output is high for four consecutive ATAL half-cycles — 2 dots — per M-cycle (measured: AFUR 487,713 ps, ADYK 488,188 ps). The AFAS decode is high for three half-cycles per M-cycle — 367,065 ps = 1.504 dots, from the ALET rising edge of dot 2 to the ALET falling edge of dot 3 (dmg-sim measurement) — and CUPA follows it through the five-stage drive chain at 1.493 dots.

CUPA pulse position

Measured across three independent CUPA pulses with identical alignment (dmg-sim measurement):

• Rises at the start of T3, 4,848 ps after T3's ALET rising edge.
• Falls mid-T4, 1,716 ps after its ALET falling edge.
• Width: 364,298 ps = 1.493 dots.

The register latch is transparent for the entire pulse; bus data propagates through combinationally.

Alignment to TALU/SONO. One TALU cycle = one M-cycle = 4 dots. CUPA fires at the start of T3; the LX counter increments on TALU rising. That alignment decides which LX count a write lands on.

Behaviour on the write dot

While CUPA is high (T3–T4): the latch is transparent — combinational consumers and sampling DFFs see the new value as soon as the bus carries it. When CUPA falls (T4's ALET falling edge): the latch closes and holds.

The bus, not the strobe, sets the commit instant. The latch is open for the whole 1.493-dot pulse, but the captured value follows the CPU data bus — which settles ~17 ns in, just past the write-dot SACU↓. The palette write shows the consequence: the BGP dlatch updates ~15.6 ns after that pixel edge, so the pixel shifted on the write dot uses the OLD palette value (palette latches). What a mid-rendering write affects is decided by the bus-settle instant, not by the window edges. (clk_t4, the CPU's bus-drive clock, is the BAPY = NOR3(clk_ena_n, AROV, ATYP) decode — the same ring vocabulary as CUPA.)

VID_RST deassertion

After a CPU write sets LCDC.7=1, the VID_RST signal (XODO) deasserts through a purely combinational chain (dmg-sim measurement):

• CUPA↑ → XONA↑ (+1,003 ps; the LCDC.7 bit captures) → XODO↓ (+2,170 ps further)
• Total CUPA↑ to XODO↓: 3,173 ps (~0.013 dots)

At the instant XODO deasserts, the divider toggle DFFs are in reset (q=0): WUVU = VENA = BOGA = 0, with ATAL = ALET = 1. The combinational complements settle within gate delays of the just-reset q_n outputs: TALU = NOT(vena_n) = 0, XUPY = NOT(wuvu_n) = 0, SONO = NOT(TALU) = 1.

The dividers then count cleanly from zero (dmg-sim measurement):

VID_RST therefore clears within a single dot of the CPU's write; there is no multi-cycle synchroniser delay.

First-scanline consequence

The write's T3 landing plus the divider startup phase make the post-LCD-on first scanline run ≈454 dots instead of 456, the deficit entirely in its Mode 0 — Mode 2 and Mode 3 match steady state. The decomposition, the direct Mode-0-span measurement, and the phase-conservation proof live in LCD-on power-up.

Palette Latches

BGP, OBP0, and OBP1 commit through the same CUPA strobe as every PPU register (writes) — but a palette write landing mid-Mode-3 interacts with the pixel clock, and repeated writes additionally exhibit a below-netlist overlay at the glass (measured on BGP). This page holds the latch cells, the measured write race, and the OR-overlap rule.

The latch cells

24 registered cells (8 per palette: BGP, OBP0, OBP1) hold the palette mappings. Each is a dlatch_ee (level-sensitive latch) that captures CPU data-bus writes via the shared CUPA strobe (register writes); the write enable is a per-register AND of address decode and CUPA — for BGP, VELY = AND2(WERA, CUPA). During normal rendering with no active CPU write, palette values are stable and contribute no per-dot races.

The mid-Mode-3 palette-write race

Measured across 7,621 mid-Mode-3 BGP writes (dmg-sim measurement, purpose-built bgp_steady ROM; zero variance per write direction). Event ordering relative to the CUPA rising edge (the dot's ALET rising edge plus 4,848 ps of phase-generator propagation):

The dlatch output lands ~15.6 ns after the write-dot SACU↓ — not a marginal race: the latch opens early (TEPO↓), but the captured value follows the CPU data bus, which settles in the second half of the CUPA window. The pixel being shifted out on the write dot therefore uses the OLD palette value, structurally; the new value first affects the pixel shifted on the next SACU rising edge, +129,254 ps after CUPA↑.

The LCD-side pixel-emission edge that captures each pixel — cp_pad↑, which lags SACU↑ by 1,019 ps combinationally (LCD output) — frames the same fact from the glass side: the OLD-palette pixel emits at the cp_pad↑ 0.466 dots before the write CUPA↑, and the NEW-palette pixel emits at the cp_pad↑ 0.534 dots after it, within the same ALET cycle as the write. No further latching exists between PERO/RAVO/REMY and the pad.

Outside Mode 3 (LCD off, H-Blank, VBlank, Mode 2), SACU is static and palette changes propagate combinationally with no pixel-clock interaction — the write is immediately visible on the next pixel when rendering resumes.

The BGP OR-overlap rule

The single-write race above is the netlist-level story, and the gate-level simulation reproduces it exactly for isolated mid-Mode-3 writes. At the LCD interface, however, BGP writes additionally exhibit an OR-overlap behaviour that is below the netlist's modelling scope — it was characterised against hardware reference photographs, not by gate-level measurement. The behavioural rule, with its empirically-tightened scope:

When a BGP CUPA↑ satisfies BOTH (a) it is not the first BGP CUPA since the most recent BESU↑ AND (b) at least one visible cp_pad↑ has elapsed since that prior BGP CUPA, the first cp_pad↑ after the new CUPA (the same-dot late-half emission edge at +0.534 dots after CUPA↑) samples a palette value equivalent to BGP_new | BGP_old rather than BGP_new alone. All subsequent cp_pad↑ events sample BGP_new directly. When either clause fails — the CUPA is the first BGP write since BESU↑, or no visible cp_pad↑ has occurred since the prior write — the first cp_pad↑ after the new CUPA samples BGP_new cleanly.

A visible cp_pad↑ fires during ST_pad=0 — it shifts a real LCD column. The POVA-driven pulse at AVAP+6.5 dots and the fine-scroll startup pulses fire under ST_pad=1 (LCD output); neither engages the rule.

The prior-write tracking resets at each BESU↑ (Mode 2 entry, OAM scan) and persists through H-Blank and VBlank — a late-frame write stays primed until the next frame's first Mode 2.

When NEW ⊇ OLD bitwise, OR = NEW and the rule is invisible. When the write clears bits, the first post-write column emits with OLD's cleared bits re-added — a one-column transient before the new palette takes effect.

What the rule predicts

The rule reproduces every hardware reference image across three suites — DMG photographs from the Mealybug Tearoom suite, Gambatte's dmgpalette_during_m3 family, and AGE's m3-bg-bgp (the last hardware-verified on a DMG-CPU C):

Evidence

Mechanism

Per-palette scope

LCDC Structure

LCDC's 8 bits are stored as drlatch_ee cells sharing the CUPA write strobe (writes). Each bit has a distinct consumer path in a distinct mode; this page is the index. LCDC storage lives here — consumer-path detail lives with the mode that consumes the bit.

A CUPA write mid-rendering transitions the latch output within the CUPA pulse window (1.493 dots spanning T3–T4), and consumer effects propagate combinationally. Per-bit sampling cadence within a fetch cycle, and mid-Mode-3 write behaviour, are detailed in the consumer chapters.

LCDC.7 has two distinct consumer paths: the VID_RST gate (reset-and-enable for the PPU's internal machinery) and the CPL/FR mux selector — the AO22 mux that keeps the LCD's column-alternator pins toggling on APU clocks while the LCD is off, protecting the glass from DC bias.

OAM and VRAM Access

The registers chapter covered CPU writes to PPU-internal register latches — all sharing the CUPA strobe. CPU writes to OAM ($FE00–$FE9F) and VRAM ($8000–$9FFF) follow distinct paths, because the storage is not in the PPU register file: OAM is an on-chip dual-port SRAM with its own bus arbitration, and VRAM is off-chip, with address/data/strobe pads driven by the PPU through tri-state enables. Both paths gate the write enable on the rendering-mode signals so that CPU writes during the corresponding lock window never reach the storage.

Which windows are locked is well-trodden behavioural ground (Pan Docs covers the accessibility rules); this chapter documents the gates that enforce them, and what those gates imply at the window boundaries.

What's where

OAM Writes

A CPU write to $FExx with cpu_wr=1 reaches OAM through an on-chip arbitration chain combining the address decode fexx, the rendering-mode signals (dma_run, mode 2, mode 3), and the DMA write-path arm POWU. The combined enable WYJA drives per-byte write strobes — YNYC (B side) and YLYC (A side) — which become the active-low pad outputs oam_b_wr_n / oam_a_wr_n to the OAM SRAM cells.

Lock-window behaviour. The permit AJUJ decides the outcome:

CUPA-vs-mode-edge alignment. A write landing in a stable open window (mode2 = mode3 = 0 across the M-cycle) passes ppu_wr's pulse through WYJA cleanly; one landing in a stable locked window is blocked (AJUJ=0 holds WYJA=0). The narrower case — a mode-bit transition inside the write window — is real and measured: the Mode 2→3 straddle opens the AJUJ permit for a 6,502 ps window during the AVAP cascade, worked through in CPU-visible timing at mode boundaries.

VRAM Writes

VRAM is off-chip; the CPU's address, data, and write-strobe outputs reach the VRAM SRAM through dedicated pads (ma_pad[12:0], md_pad[7:0], mwr_n_pad, mrd_n_pad, mcs_n_pad) whose tri-state enables are gated on mode 3. There is no on-chip "VRAM write enable latch" analogous to OAM's WYJA; the Mode 3 lock is enforced by tri-stating the address bus and write strobe so the off-chip SRAM never sees a valid write cycle.

Lock-window behaviour.

• Outside Mode 3 — ROPY=1, XANE=1, XEDU=1 → address pads driven from the CPU bus; SERE=1 (when CPU drive is active) → data pads driven and SOHY may pulse mwr_n_pad low. The off-chip SRAM sees a valid write cycle.
• During Mode 3 — ROPY=0 → SERE=0 (data pads tri-stated) and SOHY held high (no strobe); independently XANE=0 → XEDU=0 (address pads tri-stated). The SRAM never sees the write: both address and strobe are absent, so there is no "missed write" latch to need — the strobe simply never asserts.

CUPA is not involved here. Unlike the OAM path — whose write window is the CUPA pulse via ppu_wr — the VRAM-write window is set by the SM83 bus-phase signals (T1T2_n, SOTO_n, TYJY) feeding TAXY/SYSY/SOHY. The mode-3-gated tri-state enables are the lock. If they are stable across the CPU's write window, the strobe propagates cleanly; if mode 3 transitions during the window, the address pads and strobe tri-state mid-cycle, truncating the write at the pins. What the external SRAM does with a truncated cycle is off-die and out of scope.

Read Locks

While the PPU owns OAM or VRAM, a CPU read of the locked region returns 0xFF — not the stored byte. The lock disables the array's bus drivers, so the read cycle still fires but nothing drives the bus; it settles to its keeper value. The 0xFF is a floated bus, not a driven constant.

What a locked read returns

Measured on the full-SRAM model (dmg-sim, purpose-built read_lock ROM: OAM pre-filled 0x42, VRAM 0x24). Every Mode-2 and Mode-3 OAM read and every Mode-3 VRAM read returned 0xFF — never the pre-fill — while a Mode-2 VRAM read returned 0x24. The VRAM byte flips 0x24→0xFF across the single read step straddling mode3↑: the lock engages on the Mode-2→3 edge. Mode-0 and VBlank reads return the stored byte because the same gates go inactive there (below).

Disabled drivers, not a blocked strobe

The CPU read strobe fires on every read regardless of mode (cpu_oam_rd_n = NAND3(~clk_t4, FEXX, ppu_rd); the VRAM read-enable toggles each clk_t4). What the lock removes is the drive onto the bus:

With the OAM-address drivers disabled (ASAM high) the CPU address never reaches the OAM array; with the VRAM read latch closed in Mode 3 (ROPY low → SEBY low) the VRAM byte never reaches the CPU bus. Either way the bus holds its keeper value and the CPU reads 0xFF. In Mode 0 and VBlank asam goes inactive and ropy goes high, the drivers turn back on, and the read returns the stored byte — the mirror of the write lock, where the same windows block the strobe (lock boundaries).

Lock Boundaries

Away from mode boundaries both enable chains are stable, so a CPU write sees a fully-open or fully-closed window — never a partial one. Outcomes flip exactly one M-cycle apart across a lock transition (dmg-sim measurement, gbmicrotest oam_write_l0_* / vram_write_l[01]_* families).

The exception is a write whose strobe straddles a boundary transition. On the OAM side all three boundaries are characterised in CPU-visible mode boundaries: a Mode 2→3 straddle lands through the ~6.5 ns permit gap, a Mode 3→0 straddle lands the moment the permit opens, and Mode 0→2 closes cleanly — the write is blocked. The VRAM-side straddle reaches the off-chip SRAM as a partial cycle, outside the netlist's scope (above; Appendix C).

OAM Corruption

The widely documented bug: a CPU bus cycle whose address lands in $FE00–$FEFF during Mode 2 (classically a 16-bit INC/DEC, whose IDU cycle drives the register pair onto the bus) corrupts the OAM row under scan. The mechanism is a suppressed bitline precharge, measured end to end on the full-SRAM simulation model.

FEXX → CUFE → BYCU → COTA → WOVU → oam_bl_precharge_n

The $FExx address decode (FEXX) forces CUFE low for the bus-phase half of the M-cycle; BYCU sticks high, COTA sticks low — and COTA's complement WOVU is the OAM bitline precharge. The beat that should separate two scan rows never fires.

Measured timeline (dmg-sim measurement, purpose-built oam_corrupt_sweep ROM on the full dmg_generic_sram OAM model; INC HL with HL = $FE00 landing in LY=40's Mode 2; t = 0 at the INC's bus cycle):

Three structural facts fall out:

• No write strobe is involved — oam_a_wr2/oam_b_wr2 never assert. An open wordline with defined (un-precharged) bitline charge overwrites the cells; that is SRAM physics, faithfully modelled.
• The wordline side is untouched — WAHE keeps its cadence and exactly one wordline is enabled at every instant (no multi-wordline epochs). Only the bitline precharge is gated through COTA.
• The row granularity is 8 bytes by construction: one wordline row spans 4 columns in each of the two banks.

The corrupted row is the one whose first wordline epoch falls inside the 2-dot CUFE-low window; the source data is whatever the bitlines last carried — the previous row's read. Measured across a 6-frame ladder stepping the INC one M-cycle per frame: each frame's VBlank readback shows exactly one full 8-byte row copy (row 12 ← row 11, then 13 ← 12, … 17 ← 16), with every other OAM byte untouched.

Outside Mode 2 there are no scan epochs to corrupt — AVER carries the scan-phase term, and the same CUFE gating during DMA coincides with the scan being disabled entirely (DMA).

Community documentation catalogues further corruption at other bus/scan alignments — first-word AND/OR mixes rather than the clean copy above — and the blargg oam_bug suite pins them on hardware. These are the same suppressed-precharge mechanism: where a fully-settled read resolves as a clean copy, a partially-driven bitline resolves bitwise. Sweeping the row alignment, the full-SRAM model reproduces the clean copy (single-access) and the multi-row case (two reads, e.g. POP), but never the bitwise mix — a digital SRAM cell cannot partially retain its old value. That mix is analog bitline physics below the netlist's reach, so the hardware-validated community formulas remain its reference.

OAM DMA

OAM DMA copies 160 bytes from a source page to OAM at one byte per M-cycle. The behavioural surface — the source-region quirks (gb-ctr covers the address decoding), and the transfer timing and "CPU should stay in HRAM" rule (Pan Docs) — is documented elsewhere. What this chapter adds is the arbitration machinery: who owns each bus during DMA, what the PPU's scan and fetch hardware does in the meantime, what happens at the engage/release boundaries to the dot, and what the CPU actually observes when it touches a bus DMA is driving.

What's where

The OAM Bus

Four sources can drive the OAM address bus; DMA preempts the other three without ever contending the bus. Meanwhile the PPU's scan machinery keeps running blind — and what it holds (not captures) during the overlap is the mechanism behind the strikethrough and phantom-sprite artefacts.

OAM address-bus arbitration

Four sources drive the bus through active-low tri-state enables; at any instant exactly one is asserted.

The CPU enable carries all three PPU-state conditions in ASAM's OR3; the parse and render enables terminate in their mode-nets, themselves gated through BOGE = NOT(dma_run) upstream:

• Parse: mode2 = AND2(BOGE, oam_parsing) (ACYL) — DMA forces mode2 = 0 regardless of BESU; APAR tri-states the parse driver.
• Render: AJON = AND2(mode3, BOGE) — DMA forces AJON = 0 regardless of XYMU; BETE tri-states the render driver.

Every cell has exactly one driver — the bus is never contended (dmg-sim measurement, Hacktix strikethrough ROM: with dma_run=1 and BESU.q=1 mid-scan, mode2 = 0, only the DMA driver active).

Per-T-cycle structure of the byte transfer

flowchart LR
    UVYT["UVYT<br>dma_phi = NOT(data_phase)"] -- "clk" --> MATU["MATU<br>dma_run + byte counter"]
    MAKA["MAKA<br>dffr · ppu_4mhz"] --> NAXY["NAXY<br>NOR(dma_phi, MAKA)"]
    UVYT --> NAXY
    NAXY --> POWU["POWU<br>AND(dma_run, NAXY)"]
    MATU --> POWU
    POWU --> WYJA["WYJA → YLYC / YNYC<br>OAM write strobes"]

dma_run (the M-cycle-stable active flag) is the Q of the MATU DFF, clocked by dma_phi. Within each 4-T-cycle byte transfer:

• dma_phi = NOT(data_phase) (gate UVYT) — high during the address-phase half (T1–T2) and low during the data-phase half (T3–T4) of each M-cycle.
• MAKA (DFF, ppu_4mhz) carries the byte-transfer state; with dma_phi it gates the read-then-write structure.
• NAXY = NOR2(dma_phi, MAKA) rises only when both are 0, identifying the sub-window within each byte where the write strobe fires.
• POWU = AND2(dma_run, NAXY) asserts the OAM write arm during that sub-window; the resulting WYJA → YLYC/YNYC strobe chain (OAM writes) commits the byte.

Each byte transfer therefore has two sub-phases with the same address-bus owner (DMA) but different OAM-bus activity:

1. Read-phase sub-window — DMA address asserted, no write strobe; the SRAM presents the prior contents of DMA's destination cell.
2. Write-phase sub-window — POWU arms WYJA, the strobe fires, and the SRAM commits DMA's source byte into the destination cell.

The strikethrough effect: the PPU keeps running

DMA gating tri-states the PPU-side bus drivers only — the scan and fetch machinery keeps running: BESU still sets on Mode-2 entry (CATU.q), the scan counter clocks, and the Y comparator, sprite store, and fetch state machine all keep operating. They just sample the OAM data bus while the SRAM is decoding DMA's destination address.

This is the mechanism behind the Hacktix strikethrough.gb "+" overlay: the sprite store on affected scanlines fills with the Y/X byte-pair the Stage-1 latches held when DMA began — captures are gated off for the whole overlap, so no freshly-written OAM byte reaches the store.

The two-bank SRAM

OAM is two parallel 80-byte banks:

Both banks share the address inputs (row decode from a3..a7 — the wordline row, an 8-byte sprite pair; column mux from a1..a2 — the column within the row) and the output enable. (Logically that same address is sprite index a2..a7, byte-within-sprite a0:a1.) Reads ignore a0: on every read, bank B presents OAM[addr & ~1] and bank A presents OAM[addr | 1] — the bus is effectively 16 bits wide, always carrying an aligned (even, odd) byte-pair. a0 matters only for writes.

The scan-chain capture hold

Stage-1 capture: one shared enable for 16 dlatches. Each output-bus bit is captured by a single dlatch clocked by oam_data_latch (ODL):

• X side (bank A) — XYKY, YRUM, YSEX, YVEL, WYNO, CYRA, ZUVE, ECED;
• Y side (bank B) — YDYV, YCEB, ZUCA, WONE, ZAXE, XAFU, YSES, ZECA.

All 16 share the same enable — the Y and X operands always update together as a byte-pair.

The ODL source. oam_data_latch = NOT(AND3(AJEP, XUJA, cpu_oam_rd_n)) (gate BODE). Three contributing paths:

1. Mode-2 scan tick — AJEP = NAND2(mode2, XOCE) falls once per 2-dot scan step while mode2=1 (XOCE toggles at the scan cadence — OAM scan). One byte-pair per sprite entry.
2. Mode-3 sprite-fetch capture — XUJA = 0 requires mode3=1 plus sprite-fetch counter state (TUVO decode); one pulse per sprite fetch.
3. CPU OAM read — cpu_oam_rd_n = 0 during a CPU OAM read.

During DMA + Mode 2 overlap, no path can fire. DMA forces mode2 = 0 (path 1), mode3 = 0 in Mode 2 kills the TUVO decode (path 2), and CPU OAM reads are blocked (path 3). Measured across an overlapped Mode 2's 80 dots: zero ODL pulses (dmg-sim measurement, Hacktix strikethrough ROM). The Stage-1 latches hold whatever byte-pair they captured before DMA started, for the whole overlap:

• the last Mode-2 scan tick of the prior line holds (sprite 39 Y, sprite 39 X);
• a Mode-3 sprite fetch after that holds the last fetched sprite's (tile index, attribute);
• a CPU OAM read during H-Blank holds whatever pair the CPU read.

Whichever fired most recently before dma_run↑ pins the held pair.

Meanwhile the scan counter advances through all 40 entries (its clock is not DMA-gated, only its bus driver), the Y comparator evaluates the held Y against LY every step, and — on a match — the store fills successive slots with the same held X byte: phantom sprites.

A long DMA window confirms the hold directly: across one full DMA the 16 Stage-1 dlatches show zero transitions, a Mode-2 entry lands inside the hold span without effect, and the first post-DMA scan tick reflects the freshly-written OAM (dmg-sim measurement, gambatte late_sp00x_2 re-trigger stream).

Stage-2 latches. Between Stage 1 and the comparator/X-storage chain sits a second dlatch_ee rank (Y side: XUSO and siblings; X side: YLOR and siblings), enabled by COTA = NOT(BYCU), BYCU = NAND3(CUFE, XUJY, AVER) — a net AND3. During DMA with the CPU off $FExx, CUFE reduces to dma_phi, so Stage 2 is transparent during T1–T2 and holds during T3–T4 of each DMA M-cycle. Since Stage 1 holds throughout the overlap, Stage 2's windows merely re-affirm the held value.

The SRAM forces the aligned-pair capture model — two plausible alternatives do not hold:

The DMA-end escape. The held-byte gating lasts only as long as the DMA holds the bus. A DMA that ends part-way through Mode 2 releases the OAM bus mid-scan, and every entry the counter has not yet visited is then read from the freshly-written OAM — so a sprite DMA'd into a not-yet-scanned slot is captured normally. This is the mechanism behind the diverging oamdma_late_sp* outcomes: not a path outside the held-pair rule, but its boundary — captures resume the instant DMA releases the bus.

Engage, Release, and HALT

A transfer has three boundaries: the engage after an FF46 store, the release back to the scan when the last byte commits, and the pause across HALT. Each interacts with the Mode-2 scan differently — engage is edge-immediate, release waits for the scan cadence, and HALT freezes the byte counter without surrendering the bus.

DMA-start during Mode 2: engage cadence

A dma_run↑ inside Mode 2 freezes the scan partway through the line. Two things fix where it cuts off: the FF46-store → dma_run↑ latency, and the engage cascade's alignment to the scan cadence.

FF46-store → dma_run↑ latency. The arm chain:

LAVY → NOLO → MYTE → LARA/LOKY → MATU

LAVY = AND2(ppu_wr, ff46) detects the store; MYTE captures it on dma_phi_n; the LARA/LOKY latch pair arms; MATU (clocked by dma_phi) raises dma_run.

Because MATU is clocked by dma_phi, dma_run↑ is M-cycle-phase quantised: measured LAVY↑ → dma_run↑ is a fixed engine constant of 1,459,029 ps = 1.495 M-cycles ≈ 6 dots, identical across all 1,154 DMAs in the capture, always landing at dma_phi = 1. A one-M-cycle shift of the FF46 store shifts dma_run↑ by exactly one M-cycle.

Engage cascade. Opposite polarity to the release chain (next section), and — unlike release — with no XOCE wait:

The +4,507 ps is constant across every mode2=1 engage in the stream (dmg-sim measurement, gambatte late_sp00x_2). The lock takes the bus and suppresses captures on the same master-clock edge as matu.q↑ — engage is immediate, unlike release.

The last captured entry. The scan captures one byte-pair per XOCE↑ with mode2=1; entry 0 is captured at BESU↑ + 0.49 dots. The scan tick at dot 2k captures sprite k, so with dma_run↑ at Mode-2 dot D, sprites 0..⌊D/2⌋ are captured this line and ⌊D/2⌋+1..39 are blocked, holding the pre-engage Stage-1 pair. A 4-dot shift of the FF46 store moves the boundary by ±2 sprites — the structure the late_sp* partner ROMs bracket.

Sprite 0 is always captured — the early-engage sub-case is unreachable. The engage instant is phase-locked twice over (dmg-sim measurement):

• dma_run↑ sits at a fixed phase of the CPU clock grid (+973,143 ps past clk_1mhz↑; single population, n=1,154);
• the line boundary CATU↑ sits at its own fixed phase (+610,111 ps, n=5,468), and the PPU grid's phase against the CPU clock is itself pinned by the M-cycle-quantised LCD-on write.

The only reachable engage positions are therefore Mode-2 dots 1.488 + 4k: no program can place a lock inside the first ~0.5 dots of Mode 2, and the entry-0 capture (BESU↑ + 0.49 dots) always completes a full dot before the earliest possible lock.

DMA-end during Mode 2: release cadence

A matu.q↓ (DMA end) inside Mode 2 re-enables the scan capture — but not on the same edge; the next ODL pulse waits on the scan cadence:

Every stage is a few nanoseconds; the only multi-dot wait is for the next XOCE edge. Upper bound: the first post-DMA capture fires within 2 dots of DMA end.

The interlock that matters is BESU: the release requires BESU.q = 1 at the matu.q↓ edge. BESU's set (CATU, at the scanline boundary) is independent of DMA, and its reset (AVAP) fires at scan completion — the line's dot 80 — regardless of DMA, because the scan counter free-runs through the overlap. So:

• DMA ends before dot 80: the chain re-enables at the next XOCE↑, and the remaining sprites of this line's scan capture from the freshly-written OAM. Earlier entries hold the pre-DMA Stage-1 pair.
• DMA ends after dot 80 (post-AVAP): BESU is already clear, mode2 stays 0, and no captures occur for the rest of this line — new OAM contents first become visible at the next line's Mode 2.

The boundary is sharp at dot 80, with at most one XOCE period (2 dots) of resolution. Both regimes are directly captured in the DMA re-trigger stream (dmg-sim measurement, gambatte late_sp00x_2): a release with BESU.q=1 resumes captures within ~1 dot; a release ~280 dots after AVAP produces zero captures for the remainder of the line.

DMA pause during HALT

The DMA byte counter (MATU) is clocked by dma_phi = NOT(data_phase), and data_phase is held LOW throughout HALT (HALT and EI). The consequence is structural: while halted, dma_phi is held HIGH, MATU has no clock edges, and the byte counter does not advance. Any DMA in flight at HALT entry pauses on the byte being fetched and resumes on the first dma_phi↑ after HALT exit (~+0.5 dots after the wake CLK9↑). The same holds for any state that pins data_phase low (reset, STOP).

dma_run does not fall during the pause — both its set and reset transitions require dma_phi clocks — so all dma_run-gated arbitration (OAM bus and source bus alike) continues to assert "DMA owns the bus" for the entire HALT span, even though no bytes move.

The Source Bus

The OAM bus is one side of DMA; the other is the source bus DMA reads from — the external bus (cart ROM/RAM, WRAM) or the VRAM bus. The question here is what the CPU observes when its own read or write targets the same physical bus DMA is driving.

Source-side bus arbitration

One asymmetry drives every conflict on this page: during DMA the address pads are MUXed to DMA, but the data pads and the CPU's read/write strobes are not gated at all.

So whatever the CPU's instruction intended, the address reaching the bus during DMA is DMA's:

CPU read conflict

The CPU's read strobe asserts on its normal cadence; the address pads carry dma_a; the memory drives source[dma_a] onto the data pads; the CPU latches it. The CPU's register receives the same byte DMA is fetching this M-cycle — equivalently OAM[dma_dest] after this M-cycle's commit.

Anchored end to end (dmg-sim measurement, gambatte oamdma_src0000_busyread0000_1 ROM): at the conflict M-cycle the pads show DMA's address $009E, the CPU's sample edge latches 0x04 = source[$009E], and the DMA OAM commit of the same byte fires co-temporally on a distinct strobe chain — A = 0x04, matching the hardware-verified out4.

CPU write conflict

The CPU's write strobe and data drivers assert on their normal cadence, overriding DMA's read-direction pad state — so when DMA's write arm (POWU → WYJA) latches the data pad into OAM, the pad carries the CPU's data. Three things follow:

• OAM[dma_dest] receives the CPU's byte.
• the off-chip cell at DMA's source address takes a spurious write of the same byte (the strobe asserts with DMA's address on the pads);
• the CPU's intended target never sees the write.

Anchored: the pad sequence shows the CPU's 0x00 winning the data bus mid-settle, the OAM commit strobe latching it, and OAM[$9E] = 0x00 after the transfer — matching the hardware-verified out0 (dmg-sim measurement, gambatte oamdma_src8000_busywrite8000 ROM).

Both conflicts resolve deterministically — CPU and DMA share the master clock, so the CPU's data-phase and DMA's write-arm sub-window are co-aligned the same way every M-cycle. There is no sub-dot race here.

HRAM exemption. The HRAM chip-select chain derives from the CPU bus phase and the $FFxx decode; dma_run is not an input. CPU access to HRAM during DMA is uncontended (120 successful HRAM reads inside one DMA window in the measurement above) — the basis of every HRAM-stub DMA routine.

Stack accesses are ordinary bus cycles at SP; the rules above apply unchanged. Stack in HRAM is unaffected; stack in WRAM during a same-bus DMA redirects identically.

DMA sources $FE and $FF

For source pages $FE/$FF the address MUX behaves as for any other page: dma_a goes onto the cart address pads. The difference is the cart chip-select MUX (TYHO, sel = dma_addr_ext): during DMA it takes DMA's a15 directly, bypassing the CPU-side decode (TOZA) that would normally de-assert /CS for $FE–$FF. So the cart bus is driven with $FE00–$FE9F / $FF00–$FF9F addresses — even though on the CPU side those map to on-die OAM/IO/HRAM.

The package bus is now driven with an OAM/IO-range address; one device on it answers:

The WRAM die in the DMG-CPU-B package selects on cs_n_pad and a14=1 alone — no a13 qualifier and no $FE/$FF exclusion, because those exclusions live in the CPU die's internal decode, which TYHO has bypassed. It drives the data pads with work_ram[a[12:0]], so the address wraps: $FExx → $1Exx, $FFxx → $1Fxx.

The behaviour is the documented echo region extended one page: DMA from $FE/$FF fetches work_ram[(src − $E000) & $1FFF] — hardware-verified as work_ram[$1E00+i] / work_ram[$1F00+i] per byte index.

A pre-filled-WRAM ROM family confirms 8-of-8 byte matches at the fold offsets (dmg-sim measurement, gambatte oamdma_src{FE,FF}00_busypop* ROMs), and both bank commit strobes fire exactly 80 times per transfer — every byte index commits, with no per-index suppression. $FE and $FF sources differ only in offset — work_ram[$1Exx] vs work_ram[$1Fxx] — through the identical mechanism; there is no per-page behavioural difference between them.

Mode 2: OAM Scan

Mode 2 is the first 80 dots (20 M-cycles) of each non-VBlank scanline. The PPU scans the 40 OAM entries (2 dots each), comparing each sprite's Y position against LY and capturing the X position of matching sprites into a 10-slot sprite store for Mode 3 rendering. At scan completion, AVAP rises and triggers the Mode 2→3 transition. This chapter follows the signal chain: scan counter → scan-active latch → Y comparator → sprite store → AVAP generation.

What's where

The Counter and BESU

The scan's bookkeeping: a 6-bit ripple counter walks the 40 OAM entries, and the BESU latch (with its XUPY-phased copy CENO) marks the scan as active.

The scan counter

The 6-bit OAM scan counter is a ripple chain clocked by GAVA = OR2(XUPY, FETO), counting 0–39 across the 40 OAM entries. Each stage's output clocks the next (the same ~Q convention as the LX and BG fetch counters). All six cells share ANOM as reset, driven by the CATU/ANEL scanline-boundary chain (Mode transitions).

The terminal value 39 is 0b100111 — YFEL=WEWY=GOSO=FONY=1, ELYN=FAHA=0 (1+2+4+32 = 39) — the value visible in the boot-ROM handoff snapshot (Post-boot state).

Clocking and reset

XUPY = NOT(wuvu_n) = WUVU.q is the 2 MHz scan clock from the clock tree. FETO's AND4 over a2, a3, a4, a7 is another partial decode that is exact within range: in [0..39], only 39 sets all four of those bits.

OAM bus address. The counter drives OAM address bits oam_parse_a2–a7 (the entry index); bits a0–a1 come from a separate byte-cycle counter advancing within each entry's 4-byte record. The address reaches the OAM SRAM through the APAR tri-state driver — which DMA tri-states without stopping the counter (DMA).

XUPY buffer copies. Two signals appear as OAM-scan clock sources for per-byte-bit DFFs: CYKE = NOT(XUPY) and WUDA = NOT(CYKE) = XUPY. They are physical buffer copies, not new signals — XUPY edges by another name.

COTA, the composite Stage-2 enable. COTA = NOT(BYCU) gates the Stage-2 capture latches (XUSO and siblings, below); BYCU = NAND3(CUFE, XUJY, AVER) is a net AND3 of three condition terms:

• AVER = NAND2(mode2, XYSO) — scan phase;
• CUFE — CPU/DMA $FExx access;
• XUJY — sprite-fetch counter.

Its cadence therefore depends on CPU/DMA activity and mode state; during Mode 3 steady-state with CPU and DMA idle it sits at 1 — Stage 2 transparent (dmg-sim measurement). COTA's complement WOVU drives the OAM bitline precharge — the lever behind the OAM corruption bug (OAM corruption).

The scan-active latch (BESU) and its phased copy (CENO)

BESU tracks whether OAM parsing is in progress; CENO is BESU re-captured on XUPY rising, giving downstream consumers an XUPY-edge-aligned copy.

CATU captures RUTU AND NOT(vblank) on the XUPY rising edge after each scanline boundary; its Q both sets BESU and drives the scan-counter reset chain. At scan completion, AVAP propagates through ASEN = OR2(ATAR, AVAP) and the rising ASEN clears BESU.

The OAM-bus lock is BESU-direct — mode2 takes BESU.Q straight, not through CENO. CENO's two consumers are:

1. The Mode 3 rendering gate — oam_rendering = AND2(ceno_n, mode3).
2. The sprite-store save enable — CEHA = NOT(ceno_n) feeds CARE = AND3(XOCE, CEHA, sprite_y_match). CENO's one-XUPY-cycle lag behind BESU gives the save window precise XUPY-edge alignment — and is the source of the first-entry staleness race catalogued in Races: the CARE-gated window has not fully opened when the very first OAM entry's compare result arrives.

Reset behaviour. BESU has no reset net of its own; it starts at 0 at LCD-on because ASEN includes ATAR, which is 1 throughout LCD-off.

On the first scanline of the first frame after LCD-on, BESU never sets — the LCD-on Mode-2-entry path bypasses CATU (Scanline and frame timing). Consequences:

• the STAT Mode 2 bit reads 0 through the nominal scan window;
• the Mode 2 interrupt does not fire;
• the CARE chain never arms;
• the sprite store is not populated by the first scanline's scan.

The Y Comparator

During the scan, the hardware compares each sprite's Y position against LY. The comparison is an 8-stage full-adder carry chain with a NAND6 decoder, and the match result is combinational — there is no DFF capture of the match during the scan. sprite_y_match gates the per-slot sprite-store write-enables directly via the CARE chain.

The chain computes LY − spriteY in two's-complement form:

• Operand A — LY, complemented: each a-input is a not_x1 on a V-counter bit (EBOS…GUSU = NOT(v0…v7)).
• Operand B — the OAM Y byte, complemented: the Stage-2 latches' q̄ outputs (XUSO and its seven siblings, each holding the Stage-1 byte through the COTA-gated rank).
• Stage-0 carry-in — constant 0.

The decoder is WOTA = NAND6(GACE, GUVU, GYDA, GEWY, wuhu_c, GOVU). Its six inputs:

• GACE, GUVU, GYDA, GEWY = NOT(GOPU, FUWA, GOJU, WUHU) — the upper-nibble sums, inverted (not_x1 cells, netlist-derived);
• wuhu_c — the top-stage carry-out, the sign of the difference;
• GOVU — the LCDC.2 size mask (below).

WOTA asserts (low) exactly when sum bits 4–7 are all zero, the sign carry is set, and the size mask holds — i.e. the difference lies in the sprite-height range.

LCDC.2 (OBJ_SIZE) in the comparator. GOVU = OR2(XYMO, GYKY): with XYMO=1 (8×16 sprites) the OR masks one bit of the range comparison, accepting a 16-row match; with XYMO=0 it passes GYKY unchanged for 8 rows. Because the compare is combinational, a mid-scan CUPA write to LCDC.2 splits the scan — entries before the write use the old range, entries after use the new — so hybrid sprite-store populations are possible. XYMO's other consumer (the sprite tile VRAM address bit, Mode 3) lives in the sprite pipeline.

Capture durability. XUSO's enable (COTA) is high through most of Mode 3 steady-state, so XUSO is transparent there — its held Mode-2 value survives only because the Stage-1 latch upstream (YDYV) holds when oam_data_latch stops pulsing. On scanlines with Mode-3 sprite fetches, each fetch pulses oam_data_latch once and overwrites the Stage-1 byte-pair with the fetched sprite's (tile index, attribute) — the Mode-2 Y bits do not survive past the first fetch. This breaks nothing: the Y-compare chain is only consumed during Mode 2.

The Sprite Store

The store captures up to 10 sprites' X positions (plus per-slot state) into dedicated latch arrays — the first 10 Y-matching sprites in OAM-index order, the widely documented DMG behaviour (Pan Docs covers the rule; this page covers the machinery). Each slot has its own write enable (save_sprite_numN, N ∈ [0..9]): a 4-bit slot counter and a 10-way one-hot decoder make exactly one enable fire per matching sprite.

The priority mechanism:

1. sprite_y_match is combinationally established per OAM entry.
2. When it holds AND XOCE=1 AND CEHA=1, CARE=1 releases the write enables.
3. The slot counter (matched sprites so far) selects which slot's selector fires — FOCO decodes counter = 0b0011, via FYCU = BESE, FONE = CUXY, CAPE = NOT(BEGO), CAXU = NOT(DYBE).
4. save_sprite_numN = NOR2(sprite_save_en_n, selector_N) fires only when enabled AND targeted.
5. CAKE pulses once per stored sprite, advancing the counter.
6. At counter = 10 no decoder matches; remaining matching sprites pass through without a write.

The late write enable. The store's data input is the OAM bus (depth 0); its write enable arrives through the deepest per-line combinational path in the PPU (71.2 ge from MUWY). The enable arrives very late relative to data — the family of races this creates is catalogued in Races.

X-side Stage-1 register. The per-slot latches store sprite_x0_n..x7_n, derived combinationally (via YLOR/ZAGO) from the X-side Stage-1 capture register: XYKY, YRUM, YSEX, YVEL, WYNO, CYRA, ZUVE, ECED on the bank-A bus, sharing the oam_data_latch enable with the Y side. DMA covers the byte-pair semantics and the hold under DMA.

Reset domains. Each of the store's 80 X-position latches resets via its slot's sprite_rstN = NOR2(ABAK, fetched flag):

• ABAK = OR2(ATEJ, AMYG) — AMYG carries LCD-off (every slot held at 0 while the LCD is off); ATEJ pulses at each scanline boundary, including every VBlank line (RUTU keeps firing through LY 144–153).
• The per-slot fetched flag (EBOJ/CEDY/FONO family, clocked by WUTY) holds a fetched slot in reset until the next line's ATEJ.

Cross-frame state at the first scanline. From the second frame on, the first scanline's store is cleared by the VBlank ATEJ pulses and populated by its own scan. On the first frame (LCD-on) it is cleared but never populated, twice over: BESU never sets (CARE never arms, the slot counter never clocks), and oam_data_latch is mode2-gated (the comparator operands are never refreshed from OAM).

LCDC.1 (OBJ_EN): the sprite-trigger branch

LCDC bit 1 (XYLO) drives four netlist consumers, all combinational (the full set is in LCDC.1/.2 paths). The trigger-side branch:

XYLO → AROR → per-slot match NAND3s → FEFY/FOVE → FEPO

AROR = AND2(XYLO, AZEM), with AZEM = AND2(mode3, BYJO); the ten match NAND3s reduce through the two NAND5s to FEPO, the "sprite match active" aggregate.

With XYLO=0, AROR=0: every NAND3 settles high, FEPO stays 0, TEKY never fires — no sprite fetch starts at all, SACU is never frozen, and no penalty dots are added. The pixel-mux consumer paths (what happens to already-fetched sprite pixels) live in the sprite pipeline.

AVAP and the 80 Dots

At scan completion, a rising-edge detector formed by BYBA and DOBA produces AVAP — a ~0.483-dot pulse that triggers the Mode 2→3 transition.

AVAP = NOT(BEBU) fires when BYBA has just captured scan-done (byba_n=0) AND DOBA hasn't yet caught up (DOBA=0) AND the parse reset is released (BALU=0). BYBA captures on XUPY rising (= ALET falling); DOBA captures BYBA half a dot later on ALET rising. The AVAP pulse runs 0.483 dots — just under the 0.487-dot BYBA.Q↑→DOBA.Q↑ capture span it tracks (the small skew is the BEBU/AVAP gate delay).

BALU is structurally dominated. When BALU rises, BAGY falls and forces BYBA into reset, driving byba_n to 1 within 864 ps (dmg-sim measurement). BALU is therefore never the sole BEBU contributor, and the OR3 reduces observationally to AVAP = BYBA AND NOT(DOBA) (given BYBA's clearing at the scanline-boundary reset).

Measured cascade: counter=39 → AVAP

From the XUPY edge that advances the counter 38→39 (dmg-sim measurement, gbmicrotest int_hblank_nops_scx0, zero variance across 1,721 scanlines):

The one-XUPY-cycle latency from counter=39 to BYBA's capture is structural (BYBA is a clocked DFF, not a combinational path): FETO settles 2,602 ps after edge N — a comfortable margin against the 488,000 ps period — and the static race analysis tags the whole BESU/CATU/BYBA/YFEL/FETO family static accordingly.

Supporting pulse measurements (same scenario, zero variance): BALU pulse 1.008 dots per scanline at an exactly-456-dot period; BYBA Q delay 902 ps after XUPY; DOBA Q delay 884 ps after ALET.

Where the 80 dots come from

Mode 2's duration (BESU=1, CATU↑ to AVAP↑) decomposes exactly:

2 dots (CATU↑ → first counter tick) + 76 dots (counter 1→39 over 38 XUPY cycles) + 2 dots (FETO → BYBA capture) = 80 dots

The preceding RUTU↑ → CATU↑ capture latency is one dot — measured at 243,059 ps (0.996 dots), picosecond-identical across 431 steady-state boundaries (dmg-sim measurement) — and sits before Mode 2: total scanline boundary (RUTU↑) to AVAP↑ is 81 dots.

Mode 3: The BG Pipeline

Mode 3 is the pixel-transfer phase — typically 173 dots plus fine-scroll, sprite, and window penalties. Two machines run in parallel: the tile fetcher pulls BG/window tile data from VRAM on an 8-dot cadence, and the pixel clock (CLKPIPE / SACU) shifts pixels out of the BG shift registers toward the LCD. This chapter covers the BG side across four pages; the sprite pipeline, window control, and LCD output have their own chapters.

What's where

The Tile Fetcher

The BG/window tile fetcher is a 3-bit counter, a drain-detect pipeline, and a combinational VRAM address generator. It runs continuously through Mode 3, producing one tile (two bitplane bytes) every 8 dots, in parallel with pixel shifting.

The fetch counter

The counter advances through six states (0–5) to drive one tile fetch, then holds at 5 until the NYXU reset pulse restarts it for the next tile, window handoff, or Mode 3 startup. (The downstream drain-detect pipeline that closes each tile is tabulated in the next section.)

LEBO (nand2) = NAND(MOCE, ALET) — gated clock, stops when MOCE=0
├── LAXU (dffr) [clk=LEBO] — bit 0
│   ├── MESU (dffr) [clk=LAXU.~Q] — bit 1 (ripple)
│   │   └── NYVA (dffr) [clk=MESU.~Q] — bit 2 (ripple)
│   └── data to LYZU
MOCE (nand3) = NAND(LAXU, NYVA, NYXU) — self-stop at count 5 when NYXU=1

Reset and restart. NYXU = NOR3(MOSU, TEVO, AVAP) combines three triggers: window activation (MOSU), tile boundary (TEVO), and OAM-scan completion (AVAP). A single ~0.5-dot NYXU pulse asynchronously resets the counter DFFs and forces MOCE=1, re-enabling LEBO — clear and clock-restart in one operation. At count 5 (LAXU=1, MESU=0, NYVA=1), MOCE freezes LEBO and the counter holds; the six states match the 6 dots of one tile fetch (3 VRAM accesses × 2 dots).

NYXU firings per scanline under normal BG rendering — 22 at SCX=0, 23 at SCX&7 ∈ {1..7}:

The 167-pixel SACU count per Mode 3 is decoupled from the TEVO firings — SACU runs at CLKPIPE cadence, not fetch cadence.

The 8-dot tile cycle

The counter counts 0→5 over 6 dots, then holds at 5 for 2 dots while the cascade (NYKA → PORY → RENE/RYFA) drains. When SEKO detects the drained state, TEVO fires and resets the counter for the next tile. The counter is a position within the current tile fetch, not an absolute Mode 3 position — fetching and pixel shifting run in parallel, and the per-tile TEVO reset is normal fetcher operation, not a stall.

The 2-dot hold, stage by stage:

1. The counter reaches 5: MOCE→0 freezes LEBO, and LYRY→1 starts propagating down the NYKA/PORY/PYGO half-dot pipeline; POKY sets; RYFA still holds 1.
2. Hold-dot 1: RENE captures RYFA=1 — SEKO stays 0.
3. Hold-dot 2: PANY falls, RYFA captures 0, RENE follows — and once both are 0, SEKO rises, TEVO fires, NYXU resets the counter, and LYRY's fall propagates back down, returning SEKO to 0.

The cascade does not drain during a sprite fetch. When FEPO=1 freezes SEGU at 1 (the pixel clock), RYFA is frozen at its pre-freeze 1 and RENE keeps re-capturing 1 — SEKO never rises, so neither TEVO nor NYXU fires during the sprite window. The counter holds at 5 by the ordinary MOCE self-stop, but the reset that would normally come 2 dots later simply does not arrive until the freeze lifts (sprite pipeline).

Outside Mode 3 the MOSU/TEVO/AVAP cascade is idle, so NYXU=1 and the counter is not held in reset — it freezes via the self-stop at whatever value was last clocked (typically 5) until the next AVAP. Reset domains:

• LAXU/MESU/NYVA — reset on every NYXU pulse;
• PYGO/RENE/RYFA/LYZU — the mode3 reset net (held at 0 outside Mode 3);
• NYKA/PORY — NAFY (VID_RST plus window-related events).

The fetch cycle and VRAM addressing

Each tile fetch takes 6 dots:

The set-address/data-arrives pattern assumes the standard async-SRAM model — VRAM is external, and its access time is not determined by the on-die netlist. The address is driven combinationally from the fetch counter through the VRAM address adder (up to 66.2 ge for the full carry chain, though the high bits settle from the previous line in practice).

LCDC.3/4/6 sampling during the fetch

Three LCDC bits feed the fetcher's VRAM address generation, each through a purely combinational path gated by tri-state drivers that the fetch counter enables at specific stages:

The enables derive combinationally from the fetch counter:

• BAFY / WUKO (BG vs window tilemap arm) — mutually exclusive, both fire at counter=0.
• bp_cy (the NETA AND2 output) — active across counters 2–5 (measured 4.000 dots continuous per fetch), so TILE_SEL is read twice per fetch, once per bitplane.
• PYJU (dffr_cc_q) — captures VRAM data bit 7 at the tile-index stage and feeds VUZA, implementing the signed/unsigned tile-index split.

The sampling cadence:

Mid-fetch writes. A CUPA write landing mid-cycle takes effect by stage: before the sampling stage — normal; during it — the fetched byte is the one the address held when the access window opened; after it — next fetch. For BG_MAP/WIN_MAP this produces tile-aligned 8-pixel divergence; for TILE_SEL, a write landing between counter=2 and counter=4 produces a hybrid fetch — low bitplane from the old tile-data block, high bitplane from the new (the Mealybug m3_lcdc_tile_sel_win_change reference image). Model it by reading each bitplane once, at its own sample stage.

LCDC.5 transients and the fetcher arbitration

The window-enable consumer chain enters the tilemap-select arbitration through PYNU only, and the chain PYNU → NOCU → PORE → in_window → AXAD/XEZE → BAFY/WUKO is purely combinational (~3 ge). A mid-Mode-3 LCDC.5 1→0 write therefore switches the fetcher back to BG-tilemap arbitration on the dot the write lands: every subsequent counter=0 stage drives ~ma10 from XAFO.

Measured across a 65-dot LCDC.5↓ gap: all 8 counter=0 stages in the gap drive the BG tilemap region, with VEVY tri-stated (high-Z) and AMUV active (dmg-sim measurement, Mealybug m3_lcdc_win_en_change_multiple ROM) — matching the hardware reference image, which shows BG content in the gap.

SCX/SCY sampling during the fetch

SCX and SCY both feed the VRAM address adder, but they enter at different fetch stages, so a mid-Mode-3 scroll write splits differently for X and Y:

Like the LCDC fetch-address bits, the scroll address bits are level-sensitive, not edge-captured: each stage drives the adder from whatever the SCX/SCY latch holds at that stage's address dot (counter=0, then +2, then +4). Which SCY each of the three stages sees therefore depends on where any mid-fetch write commits. A write landing in the counter=2 → counter=4 gap leaves the map row (counter=0) and the low-bitplane fine-Y (counter=2) on the old SCY while the high-bitplane fine-Y (counter=4) takes the new one — splitting the two bitplanes vertically, the Y-direction analogue of the LCDC.4 hybrid fetch.

The Pixel Clock

Two tightly coupled circuits meter every pixel of every scanline: the PX counter tracks horizontal position, and CLKPIPE (SACU) — the pixel pump — decides on each dot whether the pipeline shifts at all. Every Mode 3 penalty in this book is, mechanically, a CLKPIPE halt.

The pixel counter (PX)

PX is an 8-bit hybrid synchronous/ripple counter clocked by SACU. The lower nibble (XEHO, SAVY, XODU, XYDO) is clocked directly by SACU with XOR carry logic — all four bits update on the same SACU rising edge. The upper nibble (TUHU, TUKY, TAKO, SYBE) clocks on TOCA = NOT(XYDO), rippling off bit 3.

PX is held in reset during Mode 2 and video reset and released when Mode 3 begins. PX starts at 0 regardless of fine scroll — fine scroll is pure clock suppression, never PX masking.

Terminal count 167. XUGU monitors PX bits {0, 1, 2, 5, 7}: all five high = 0b10100111 = 167 (bits 3, 4, 6 are 0 at that count, so the partial decode is exact at the terminal). XUGU=0 → XANO=1, and with no sprite match (XENA=1), WODU goes high — the H-Blank condition (STAT interrupts).

CLKPIPE / SACU

SACU — the pixel pump — is an OR2 at depth 63.8 ge with fan-out 53, clocking 52 cells across the shifters, the sprite attribute pipes, and PX. Its gate chain (SACU ← SEGU ← TYFA ← VYBO) and the four halt inputs are below.

Four halt conditions — any one stalls CLKPIPE (SACU stuck high):

When free-running, SACU is simply MYVO's alternation pushed through the tree: SACU is low while ALET is high and high while ALET is low — one rising edge per dot, on ALET falling. The shift registers advance on SACU rising only.

Why CLKPIPE arrives late.

Crystal → ALET (16.3 ge) → MYVO (22.2) → VYBO (46.9, dominated by WODU's 45.5-ge input) → TYFA (48.5) → SEGU (49.4) → SACU (63.8)

The pixel clock is the deepest routinely-toggling signal in the PPU — which is exactly why data-vs-clock ordering works out: shifter data settles at depth 0–8 ge, the parallel-load enable at 16.2 ge, and the shift clock last of all. Data is always stable long before the edge that shifts it.

Sprite penalty interaction

A sprite X match sets FEPO=1, halting CLKPIPE for the fetch core (TEKY↑ → TAKA↓, 6.010 dots; zero SACU transitions; SACU resumes 1.024 dots after TAKA clears — dmg-sim measurement; the plateau total is exactly +11.000 dots, penalty model). The resume edge is the book's one margin-sensitive edge assignment — its exact dot is delay-calibration-dependent to within half a dot, a model prediction rather than a hardware fact; the totals (the +11.000 plateau, the 6-dot core) are calibration-independent. The freeze also pins the drain-detect cascade (the tile fetcher), so no tile boundary fires during a sprite fetch.

H-Blank

When PX hits terminal with no sprite match, WODU=1 halts CLKPIPE the same way; VOGA captures WODU on the same-dot ALET rising edge and XYMU sets 0.436 dots after WODU↑ (mode transitions). When XYMU flips, the PAHA/LOBY/ROXY/POKY chain switches to its non-Mode-3 state combinationally — POKY disarms, ROXY re-arms for the next scanline, the Mode-3-only DFFs acquire their reset hold, and VRAM/OAM access control releases. No clock edge is waited for.

Startup and Fine Scroll

Every scanline's Mode 3 opens with the same deterministic cascade from the scan-complete pulse (AVAP) to the first pixel clock — and fine scroll rides on it, holding the pixel clock off for exactly SCX & 7 extra dots. This page covers the fine-scroll counter, the startup pipeline stage by stage, and the measurements that pin both.

The fine scroll counter

A 3-bit ripple counter that discards SCX & 7 pixels at Mode 3 startup by delaying SACU's enable. The counter runs at CLKPIPE cadence (via ROXO = NOT(SEGU)) while ROXY holds SACU high; a two-stage match pipeline (PUXA on ROXO, NYZE on MOXE) captures the match, and POVA then clears ROXY.

The match pipeline:

• Per-bit XNORs read ff43 (SCX) live — there is no SCX snapshot at Mode 3 entry.
• POHU = AND4(ROXY, match bits): the ROXY term makes the comparator self-terminating — it collapses as soon as POVA clears ROXY.
• PUXA latches POHU on ROXO↑; NYZE mirrors PUXA on the next MOXE↑; POVA = AND2(NYZE.Q_n, PUXA) is high exactly between those two edges — a single-dot pulse, by construction unable to re-fire within the scanline (PUXA/NYZE reset to 0 outside Mode 3, guaranteeing NYZE.Q_n=1 at entry).

The startup pipeline: AVAP to first SACU

Each scanline's Mode 3 begins with a 7-dot cascade from AVAP↑ to the first SACU rising edge — 7.026 dots at SCX=0, with every stage at a deterministic offset, zero variance across scanlines (dmg-sim measurement, purpose-built scx0_steady ROM, n=1,612):

The "AVAP at 0.000" row is the dot-count reference, not an ALET-edge alignment — AVAP transitions on the ALET falling edge preceding the table (it derives from BYBA's XUPY-clocked capture); the downstream DFFs are ALET/MYVO-edge aligned. The cascade is identical on every scanline including the first (whose 2-dot shortening lives entirely in Mode 0 — see Register writes). The window's MOSU trigger feeds NYXU through the same NOR3 and produces the same 7-dot pipeline (Window control). The NYXU pulse itself runs 0.492 dots when AVAP drives it and 0.495 dots from TEVO (0.503 from MOSU).

Fine-scroll startup suppression

The cascade (NYKA → PORY → PYGO → POKY) fires at the same offsets regardless of SCX; only ROXY's release moves. Measured at three SCX values (dmg-sim measurements, purpose-built scx{0,3,7}_steady ROMs, n=1,151–1,612 scanlines each, zero variance):

The model is exact: 1.000 dot per SCX & 7 step; first SACU at 7 + (N & 7) + 0.026; Mode 3 core duration 173 + (N & 7) + 0.045.

Edge-by-edge startup waveform

The internal transitions, measured at SCX ∈ {0, 3, 7} (dmg-sim measurement, purpose-built scx{0,3,7}_steady ROMs; AVAP↑ = 0.0000; PASO re-arms for good shortly after ROXO's first rise):

Common cascade (SCX-independent):

Per-SCX match pipeline:

Each SCX increment shifts the block by exactly 1.0000 dots with identical internal shape. The counter self-stop at SCX=7 does not suppress ROXO (PUXA's clock path is independent of PECU), so the SCX=7 match fires with the same geometry.

The tail-of-Mode-3 drain

The drain detector fires on a fixed 8-dot cadence at +13.997, +21.997, …, +165.997, +173.997 dots from AVAP — independent of SCX. Mode 3 ends at +(173.045 + N). The 21st drain edge at +173.997 therefore lands:

• at SCX=0: after Mode 3 ends (by 0.952 dots) — suppressed: the VOGA/WEGO transition and the mode3 reset on PYGO/RENE/RYFA clear the cascade first;
• at SCX&7 ≥ 1: inside Mode 3 — SEKO fires, TEVO → NYXU → a final parallel-load of the in-flight fetch's tile data.

The 21st load completes within the closing dot but produces no observable LD output — the SACU count is already at 167, so the freshly loaded content never meets another CP-gated edge before H-Blank. Both planes load from the same tile index — there is no hybrid-fetch path here (dmg-sim measurement, AGE m3-bg-scx-nocgb ROM: post-load shifter content 0b11111111 on both planes where tilemap column 21 holds an all-$FF tile).

Late SCX writes during the discard

The live-SCX rule, measured to its edge (dmg-sim measurement, gambatte ly0_late_scx7_m3stat_scx3_{1,2} ROMs — SCX=3 held, late SCX=7 write during the first-scanline discard):

In _2 the write becomes visible 0.025 dots after the capture edge — and the already-cleared ROXY cannot re-open (POHU collapsed at ROXY↓). The rule is purely "the ff43 value at the count=N ROXO↑ wins"; both hardware outcomes follow from it.

Startup invariance under stacked sprites

The whole cascade is configuration-invariant: with 5+5 sprites stacked at two X positions chosen so (X + SCX) mod 8 == 0 (the wilbertpol intr_2_mode0_timing_sprites_scx1_nops worst case), every BG-fetch and cascade transition between AVAP↑ and first SACU↑ lands at an identical sub-dot offset across SCX ∈ {0..4}, and the sprite-chain edges (FEPO/TEKY/SOBU/ RYCE/TAKA/WUTY/SUDA) are likewise SCX-invariant (dmg-sim measurement). The transitions nearest integer-dot boundaries sit 83–469 ps clear of them, deterministically — real-silicon process variance cannot produce per-configuration selectivity from a uniform per-die offset.

The BG Shift Registers

The shifters are where fetched tile data becomes a pixel stream: two 8-bit planes shifting under SACU, refilled in parallel every 8 dots from a bank of temporary latches. The interesting timing is all in the load path — when it fires, and why loaded data can never race the shift clock.

The cells

Two 8-bit shift registers (planes A and B), each an 8-stage chain of dffsr cells clocked by SACU. Tile data arrives via an 8-bit temporary latch group whose enable chain hangs off fetch-counter bit 2.

The 16 shifter cells: MACU, MODU, MOJU, MYDE, NEDA, NEPO, NOZO, PYBO, RALU, RYSA, SADY, SETU, SOBO, SOHU, TACA, TOMY — chain order determined by dffsr d-pin connectivity.

Parallel load via NYXU

Each cell has a NAND2 pair driving its s_n / r_n, gated by LOZE = NOT(NYXU): s_n = NAND2(LOZE, temp bit), r_n = NAND2(LOZE, temp bit complement). When NYXU pulses low, LOZE pulses high and every cell loads its temp-latch bit; when NYXU is idle, both NANDs output 1 and the cells shift normally under SACU. The load is level-sensitive and independent of the shift clock — and since the load enable settles at 16.2 ge against SACU's 63.8, loaded data is stable before any shift edge.

Two parallel loads per Mode 3 startup

NYXU fires twice during the startup cascade:

1. Load #1 at AVAP (dot 0). The temp latches still hold pre-Mode-3 content — the previous scanline's last tile, or power-on state on the very first frame. The shifters load this stale content.
2. Load #2 at the first TEVO (dot 5.996). By now the fetch counter has run 0–5 and the temp latches hold this scanline's first tile. The shifters load the fresh content, overwriting load #1.

The first SACU edge lands at 7.026 — after load #2 — and CP is gated by PX ≥ 9, so load #1's stale content never reaches the glass. This matters cross-frame: on the first frame vs a steady-state frame the stale content differs, but load #2 overwrites it before any CP sample either way, so LD output is identical. At mid-Mode-3 tile boundaries only the TEVO-driven load fires — 20 more per scanline, 21 at SCX&7 ≥ 1 (the tail drain).

Mode 3: The Sprite Pipeline

Sprite rendering interleaves with BG fetching: when a sprite's X position matches the pixel counter, a trigger chain freezes the pixel clock while the sprite fetcher reads OAM attributes and VRAM tile data, then merges the fetched pixels into dedicated shift registers with hardware-level priority. This chapter covers that machinery across four pages.

What's where

Sprite Storage and X Matching

Fetched sprite pixels live in two dedicated 8-bit shift registers whose load path implements sprite-to-sprite priority, and a bank of SACU-clocked comparators decides — pixel by pixel — when a sprite fetch must fire.

Sprite pixel shift registers

The 16 shifter cells: LEFE, LESU, MASO, NATY, NURO, NYLU, PEFU, PYJO, VAFO, VANU, VARE, VUPY, WEBA, WORA, WUFY, WYHO. Chain order from dffsr d-pin connectivity:

• Plane A: NYLU (stage 0, d = const0) → PEFU → NATY → PYJO → VARE → WEBA → VANU → VUPY (stage 7) — outputs sprite_px_a[0..7].
• Plane B: NURO (stage 0, d = const0) → MASO → LEFE → LESU → WYHO → WORA → VAFO → WUFY (stage 7) — outputs sprite_px_b[0..7].

Stage-7 outputs feed the pixel mux (LCD output). Stage-0 cells have d = const0 — content arrives only via parallel load.

The transparency-gated parallel load

Unlike the BG shifter's single broadcast LOZE, each sprite stage gates its own load: sprite_onN = NOR3(XEFY, sprite_px_aN, sprite_px_bN), with XEFY = NOT(WUTY) the fetch-done pulse.

During a fetch (WUTY=0, XEFY=1) every stage's load is disabled — and SACU is frozen anyway. At fetch completion, WUTY pulses, XEFY drops, and sprite_onN = NOR2 of the stage's current bits: the load fires only where the current content is transparent (both planes 0). Opaque stages keep their content.

A broadcast load would lose overlap semantics; a transparency-gated BG load would under-load tiles. The asymmetry is load-bearing.

The shifters have no reset domain — set/reset comes only from the load path, so content persists across LCD-off. Residual content is unobservable: VAVA gates sprite output at the mux so only active-sprite pixels reach the LCD, and no fetch has loaded data until the first X-match of a scanline.

Sprite X match

Matching is fully combinational from the store latches and the PX counter:

stored bits ⊕ NOT(PX) → two NOR4s (per nibble) → NAND3 with AROR (the LCDC.1 gate) → per-slot active-low match → FEFY/FOVE → FEPO

The ten per-slot matches reduce through FEFY/FOVE to FEPO; FEPO=1 → VYBO=0 → CLKPIPE freezes — the sprite penalty mechanism.

The sixteen CLKPIPE-clocked dffsr cells beside the pixel planes are attribute pipes — per-pixel palette-select and priority shift registers loaded at fetch time — not match logic. Match state is never clocked; it follows the store latches and PX combinationally.

The mask pipe carries priority, not validity. VEZO→VAVA holds the per-pixel BG-over-OBJ flag loaded from DEPO (OAM attribute bit 7). VAVA gates BG visibility at RYFU = AND2(RAJY, VAVA) in the output path: VAVA=0 — sprite priority, BG suppressed; VAVA=1 — BG shows through. (Fine scroll is clock suppression, not mask-pipe work.)

Why a reset slot cannot fire

The store holds the X coordinate inverted, and the comparator compares against the inverted PX bits — so a written slot matches at PX = X, and the all-zeros reset state decodes as X = 0xFF, a coordinate the PX counter (terminal count 167) never reaches. There is no hidden armed flag: the "armed" state is the latch contents themselves.

• A written X=0 stores 0xFF internally and fires at PX = 0.
• A reset-held slot stores 0x00 ≡ X = 0xFF and can never fire.
• The same mechanism stops refiring after a fetch: EBOJ (the slot's fetch-done flag) sets at WUTY and holds the slot reset, clearing its X back to the unreachable state for the rest of the line.

Measured (dmg-sim, a locally patched 1-sprite variant of gambatte's 10spritesPrLine_10xposA7, sprite at X = 0xA7): slot 0's store reads 0x00 while reset-held and 0x58 = NOT(0xA7) between save and reset (22/22 lines); YDUG fires at exactly PX = 0xA7 (7/7); DYDU — slot 1, reset-held at 0x00 — never fires across the capture even though PX passes 0 every line.

The Fetch State Machine

The sprite fetcher is a one-shot trigger chain, a 3-bit counter on the opposite clock edge from the BG fetcher, and a running latch (TAKA) whose lifetime extends well beyond the fetch itself.

The gates

The trigger chain

TEKY → SOBU (DFF) → RYCE → TAKA, with SUDA closing the one-shot

Measured with zero variance (dmg-sim measurement, purpose-built sprite_steady ROM — one sprite at SPRITEX 80, 64 firing scanlines):

The counter then counts 0→5 over five dots (one tick per ALET rising via SABE); at count 5 WUTY fires and clears TAKA at +6.010 dots from TEKY↑.

The net penalty is 6 dots (six suppressed SACU edges; the TEKY↑ → TAKA↓ freeze is 6.010 dots gate-resolved), zero SACU transitions inside the window, SACU resuming 1.024 dots after TAKA falls (the next ALET falling edge) — developed with its alignment overhead in the penalty model.

A brief TEKY glitch pulse (~0.016 dots ≈ 3.9 ns) appears as TAKA clears and FEPO deasserts (combinational race); it is too narrow for SOBU's capture and has no pipeline effect.

The BG cascade freezes too

Throughout each TAKA-high window, the BG drain-detect cascade is pinned: SEGU stuck at 1 gives RYFA no clock edges (frozen at 1 — the pre-freeze capture of PANY=1 is guaranteed, because LYRY=1 was required for TEKY); RENE keeps re-capturing RYFA=1; SEKO stays 0; TEVO and NYXU never fire. The BG counter holds at 5 by the ordinary MOCE self-stop, and no BG-shifter parallel load occurs during a sprite fetch. Verified across 30 TAKA-high windows with zero NYXU/RENE/RYFA/SEGU/SEKO transitions inside any of them, while the same scanlines show the normal 22-pulse NYXU cadence outside the cluster (dmg-sim measurement, the gambatte 10spritesPrLine stacked-sprite ROM).

OAM byte capture during the fetch

The fetcher has no dedicated tile/attribute DFFs — it reuses the two-stage capture chain that Mode 2 uses for (Y, X), with the byte roles following the address:

In Mode 3 the capture enable reduces to oam_data_latch = WEFY = AND2(TUVO, tyfo_n), with TUVO high while the fetch counter ∈ {0, 1} — one pulse per fetch, near TAKA-rise, capturing the byte-pair at the fetcher-driven address (sprite index × 4 + 2, + 3). Stage 2 is transparent through most of Mode 3, so the bytes flow straight through.

TAKA outside Mode 3

TAKA's set net SECA = NOR3(RYCE, ROSY, ATEJ) includes the line-end pulse: ATEJ fires at every scanline boundary (including VBlank lines) and re-asserts TAKA during H-Blank. TAKA is therefore high for most of every scanline — low only between the startup carry-over clear (TAVE↑ at AVAP+5.996; TAKA↓ at +5.996) and the line's first real fetch, and between fetch completions. The carry-over is cleared each scanline by TAVE through VEKU's second reset arm.

Measured per-scanline waveform (zero variance, six scanlines): ATEJ↑ at AVAP+376.000 dots sets TAKA (= the scanline boundary: 456 − 80 dots of Mode 2); ATEJ pulse width 1.001 dots (one half-XUPY cycle); TAKA holds through H-Blank until the next line's TAVE.

A side effect of the carry-over clear: SOWO = NOT(TAKA) rising at +5.999 briefly satisfies TEKY's AND4 — a glitch pulse too narrow for SOBU to capture.

The Penalty Model

What sprite fetches cost, measured: a fixed 6-dot core, an alignment overhead set by (K + SCX) mod 8, an exact composition rule for stacked sprites, and two edge regimes — the prelude and the right edge.

Penalty by SPRITEX

Single-sprite and four-sprite penalty by SPRITEX (= OAM X; displayed X + 8), SCX=0 (dmg-sim measurement, gbmicrotest sprite ROMs; firing-scanline median minus non-firing median):

The single-sprite cost decrements exactly 1 dot per +1 SPRITEX over [8, 9]; the four-sprite penalty decrements a clean ~4.094 dots per +1 SPRITEX over the first three steps of [8, 13] (≈1 dot of alignment per sprite × 4 sprites). The SPRITEX=12 row (+27.646) carries a sub-dot wobble — its non-firing baseline itself drifts ~1 dot by tile-boundary alignment, so the 11→12 and 12→13 steps read −5.103 / −3.084 rather than the clean −4.094. At SPRITEX ∈ {14, 15} the sprites straddle a BG tile boundary and per-sprite alignment overhead re-enters in a form the linear model does not capture (dmg-sim measurement).

Stacked sprites at one X: the chain collapses to combinational

When N sprites share an OAM X byte, each runs its full fetch core but the inter-fetch gap collapses to gate delays: WUTY↑ᵢ → VEKU → TAKA↓ᵢ → SOWO↑ → TEKY↑ᵢ₊₁ with no clocked element on the path. SACU never resumes between fetches, the BG counter stays at 5, LYRY stays high — which is exactly what keeps the AND4 re-fire chain armed. Each completed fetch's per-slot fetched-flag DFF (EBOJ/CEDY/FONO family, clocked by WUTY) clears that slot's X latch, so the next unfetched same-X slot drives FEPO for the re-fire; the chain ends when no unfetched same-X slot remains.

Measured cadence (zero variance, 7 firing scanlines per N, the gambatte 10spritesPrLine K=167 chain):

mode3_ext(N, K, S) = single_sprite_penalty(K, S) + (N − 1) × 6.000 dots

The rule's measured anchors:

The Mooneye intr_2_mode0_timing_sprites calibration table (extras of 2/4/5/7/8/10/11/13/14/16 M-cycles for N = 1..10) is M-cycle rounding of this uniform 6-dots-per-sprite extension — there is no hardware shared-fetch alternation, and the BG fetcher plays no per-sprite role (it is frozen throughout the chain). Multi-group configurations compose per X-group: when PX passes from group A to group B, FEPO drops, SACU resumes, the BG fetcher advances normally, and group B re-pays its own first-sprite alignment.

The right edge: K = 167

At K = 167 the X match fires at the dot WODU would otherwise fire. The cost is not right-edge-special: (167 + 0) mod 8 = 7 puts the single sprite at the alignment model's 6-dot floor, and the stacked-composition rule applies unchanged — ext = 6.000 + (N − 1) × 6.000 per effective sprite. Measured (dmg-sim measurement, gambatte 10spritesPrLine_10xposA7 ROM — nine on-screen sprites — and N ∈ {1,2,3,4} patched variants, zero variance, 7 firing lines each):

The ~0.02-dot residual against exact N × 6 is the end-of-chain WODU rise arriving through the FEPO↓/XENA arm rather than the PX-decode arm. Per-sprite TEKY spacing in the long chain: 5.947 dots between #1 and #2, then exactly 6.000 between each subsequent pair, ending in a final TEKY glitch pulse too narrow for SOBU's capture as FEPO falls.

Sprites at SPRITEX < 8: the fetch hides in the prelude

When the X match fires before the first SACU↑, the whole fetch lands inside the AVAP→first-SACU prelude instead of between SACU pulses — same total cost, different shape. Measured at SPRITEX=0 (zero variance, 23 firing scanlines): the real TEKY fires at +11.255 dots from AVAP (the second LYRY-high event — the first is consumed by the TAKA carry-over clear), the fetch runs +11.766 → +17.399, the first SACU lands at +18.430 (vs 7.026 baseline), and total Mode 3 duration is identical to the SPRITEX=8 case.

LCDC.1 and LCDC.2: The Sprite Consumer Paths

Two LCDC bits act directly inside the sprite pipeline. OBJ_EN (LCDC.1) splits into a trigger path and an output path that a mid-Mode-3 write can divorce; OBJ_SIZE (LCDC.2) feeds the VRAM row-bit mux live while sprite visibility stays scan-latched.

LCDC.1 (OBJ_EN): the pixel-mux paths

XYLO has four netlist consumers: AROR (the trigger gate — OAM scan), XULA and WOXA (this section), and XERO (CPU read-back).

Trigger vs output divergence. Steady-state XYLO is redundant across the two paths, but a mid-Mode-3 flip between a sprite's fetch and its emission splits them: data in the shifter but gated at output, or vice versa. The outcome of a write depends on where the CUPA window lands relative to the trigger's capture edge:

The mid-fetch OFF write and Mode 3's end. In the "after SOBU" row, the same write also drops FEPO within gate delays of CUPA↑ via AROR (TAKA is not on the SACU halt path — VYBO watches FEPO). SACU resumes mid-fetch from the AROR↓ dot; the fetch machine runs on; Mode 3's end is set by the FEPO↓ edge. Measured across the four gambatte sprites_late_late_disable_spx{18,19,1A,1B} ROMs (bit-identical AVAP, all four firing the write inside the freeze window), the closed form

mode3_end(SPRITEX, AROR↓) = floor(AROR↓ dot) + 167 − SPRITEX + 0.436

predicts the measured XYMU↑ to <0.001 dots in all four cases (dmg-sim measurement). The +3-dot step in the data between SPX=0x19 and 0x1A is a test-harness artifact — the +1-NOP CUPA shift (+4 dots) net of the −1-dot SPRITEX step — not a tile-boundary effect; the formula holds across it.

The OFF-CUPA single-pixel transient

Like the BGP OR-overlap (palette latches), LCDC.1 OFF transitions exhibit a behaviour below the netlist's modelling scope, characterised against hardware reference photographs:

When a CUPA write transitions LCDC.1 from 1 to 0 inside Mode 3, the first cp_pad↑ after that CUPA↑ (+0.534 dots) emits one anomalous LCD column on real DMG hardware — shade 3 in the Mealybug reference image — before the sprites-off state takes hold. Subsequent columns follow the normal mux path. The 0→1 RESTORE direction produces no transient.

The gate-level simulation shows zero transitions on NULY/POKA/PATY across the affected scanlines and white output at every column — the netlist does not produce the symptom at any available timing calibration. The reference images show the transient walking columns x=1..7 across LY≈24..125 (the walking reflects per-LY cp_pad cadence variation from sprite-stall positions; the write's AVAP-offset is constant within each test branch), with verified column agreement at five sampled LYs.

Two further empirical facts:

• some LYs at frame edges and a few scattered rows do not fire the transient at all despite ps-identical netlist state (verified across all 144 LYs — no signal differs between firing and non-firing rows);
• multi-pixel rows in the reference carry additional earlier columns that are ordinary gate-level shifter content, not part of this rule.

LCDC.2 (OBJ_SIZE): the VRAM address path

XYMO's second consumer (the first is the Y comparator — OAM scan) selects the sprite tile-data row bit during the fetch:

Mid-Mode-3 OBJ_SIZE writes. Sprite visibility was decided at scan time and is latched; XYMO writes cannot change it. The VRAM row-bit path, however, is live: any in-progress or subsequent fetch uses the new XYMO combinationally through GEJY. The result is a hybrid — visibility under the old size, tile-data row under the new — producing the small rectangular artefacts the Mealybug m3_lcdc_obj_size_change tests exercise.

Window Control

The window subsystem decides when the BG fetcher switches from background to window tiles within a scanline, and triggers a full fetch-pipeline reset at the handoff. It comprises a WY-match decoder with a frame-held latch (REJO), a per-dot WX-match decoder (NUKO), a four-stage trigger chain (PYCO → NUNU → PYNU → NUNY, three capture stages feeding the combinational NUNY) gated by LCDC.5, a hit-and-latch condition (RYDY), a window-mode DFF (NOPA), and the window-trigger pulse (MOSU) that drives NYXU alongside AVAP and TEVO.

The WY-match frame latch (REJO)

wy_match (= LCDC.5 ∧ LY==WY) → SARY (TALU-clocked) → REJO.s, with REJO.r = REPU = mode1 ∨ ppu_reset2

Three properties carry all the behavioural weight:

1. LCDC.5 lives inside the decode. PALO's NAND5 includes ff40_d5, so wy_match is force-low whenever the window is disabled — SARY can only capture 1 during scanlines where LCDC.5 is held high.
2. REPU holds REJO cleared through every VBlank. The set chain only becomes effective at REPU's fall at VBlank exit: REJO sets there if SARY is already 1, else it waits for a later in-frame wy_match capture. Under a fixed WY, a missed set at VBlank exit locks REJO at 0 for the whole frame (LY cannot re-cross WY except via the 153→0 wrap, which lands back inside VBlank).
3. Once set, REJO cannot be disarmed mid-frame. A WY rewrite that drops wy_match cannot clear the NOR latch; only the next VBlank's REPU does.

The capture clock hclk is TALU — one rising edge every 4.000 dots at a fixed phase relative to AVAP (measured anchors at ≈ +0.99, +4.99, +8.99, +12.99, +16.99 … dots; SCX-invariant, since SCX gates SACU, not the TALU distribution). A fresh wy_match↑ therefore reaches REJO within 0.083 dots of combinational delay plus a race to the next TALU edge — uniform in [0, 4.000] dots.

The VBlank WY-rewrite trap (gambatte window_late_wy family, dmg-sim measurement): a test inherits WY=0, enables LCDC.5 mid-VBlank, and rewrites WY=$FF before VBlank exits. The LY 153→0 wrap briefly raises wy_match and SARY captures 1 — but REPU still holds REJO at 0. The WY=$FF write drops wy_match; SARY recaptures 0 on its next TALU edge, ~1.4 ns before mode1 falls. At VBlank exit SARY=0, REJO stays 0, and the window never fires all frame. The whole family's hardware-pass outcomes follow from this SARY/REPU edge order.

Mid-Mode-3 fresh arming (gambatte late_wy_FFto2 sub-cluster at SCX ∈ {0, 2, 3}, dmg-sim measurement): the WY=$02 write lands at LY=2 AVAP+15.495 dots; wy_match rises +0.080 dots later; the next TALU edge at +16.992 captures it and REJO sets at +16.997 — identically across all three SCX variants. Whether the same-scanline cascade fires then depends on whether the one-dot PX==WX window is still open when REJO arms:

In all three, LY=2 renders without a window and LY=3 fires the standard cascade (REJO holds across H-Blank). PX is monotonic within a scanline: once past WX, no same-line re-fire is possible without a WX rewrite. The general rule: the cascade fires same-line only if REJO's set (write dot + 0.083 + TALU race) lands before the PX==WX window closes — and increasing SCX widens that budget dot-for-dot, since the window shifts with the fine-scroll delay while TALU's phase does not.

The 10-step activation sequence

flowchart LR
    PX["PX == WX"] -- "NUKO<br>(gated by REJO)" --> PYCO
    PYCO -- "ROCO↑<br>(needs POKY=1)" --> NUNU
    NUNU -- "MEHE↑" --> PYNU["PYNU<br>window-armed latch"]
    PYNU -- "∧ nopa_n" --> NUNY["NUNY<br>win_start"]
    NUNY --> MOSU["MOSU → NYXU<br>fetch-pipeline reset"]
    NUNY --> PUKU
    PUKU --> RYDY["RYDY<br>window hit"]
    RYDY -- "self-latch" --> PUKU
    PYNU -- "ALET↑" --> NOPA["NOPA<br>window mode"]
    NOPA -- "closes NUNY" --> NUNY
    PORY -- "clears" --> RYDY

With WIN_EN=1, REJO=1, and the fetcher idle (POKY=1):

1. PX reaches WX → NOGY drops → NUKO rises.
2. PYCO captures NUKO on the next ROCO edge.
3. NUNU captures PYCO on the next MEHE edge.
4. PYNU sets (window armed).
5. NUNY = AND2(PYNU, nopa_n) rises → win_start → MOSU rises.
6. PUKU drops; RYDY = NOR3(0,0,0) rises (window hit).
7. NOPA captures PYNU on the next ALET edge (window mode active).
8. NUNY falls → MOSU falls.
9. PUKU stays low — RYDY's own feedback holds it.
10. RYDY remains latched until PORY rises during the restarted BG fetch's cascade — the SUZU falling edge that tells the fetcher to load window tile data.

RYDY's fan-out (each via the shared SYLO/TOMU triple-inversion): SOCY halts CLKPIPE (BG pipeline), TUKU blocks the sprite trigger (sprite pipeline), and SUZU (via TUXY) drives TEVO's window-restart arm.

MOSU drives the same 7-dot pipeline reset as AVAP. Measured on a window-firing scanline (dmg-sim measurement):

MOSU, AVAP, and TEVO each drive NYXU independently through the NOR3 — they do not combine or extend each other.

One interaction: at WX=0 with SCX & 7 = S > 0, the first window pixel lands +S later still (+10.037 at SCX=3). MOSU fires at the POKY floor before the line's fine scroll has been paid, and the post-restart pixel start absorbs it; at WX ≥ 1 the pipe is already running and +7.037 holds at any SCX.

The per-WX timing model

Measured across the full gbmicrotest window sweep (dmg-sim measurement, win[0-15]_a ROMs; all values sim-dots):

• MOSU↑ from AVAP = 6.989 + WX for WX ≥ 1 — one dot per WX step.
• WX=0 fires at the same +6.989 floor: the POKY gate on PYCO's clock blocks anything earlier (PX==0 is true from reset, but no capture clock runs until the first fetch completes).
• Window penalty: +6.000 dots, invariant across WX ∈ [0, 15] — exactly one BG-fetch restart.

The joint (WX, SCX) generalisation: SCX enters only through the PX==WX match dot (PX advances on SACU, which starts (SCX & 7) dots later); the capture chain downstream of NUKO has no SCX dependence, and the WX=0 POKY floor is SCX-invariant:

MOSU↑(WX, SCX) = 6.989                     if WX = 0   // POKY floor, SCX-invariant
               = 6.989 + WX + (SCX & 7)    if WX ≥ 1   // PX-driven

Measured joint anchors: (WX=0, SCX=3) → +6.989 (floor confirmed SCX-invariant); (WX=10, SCX=0) → +16.989; (WX=10, SCX=3) → +19.989 — the formula is exact at all three (dmg-sim measurement, gbmicrotest win{0,10}_scx3_a ROMs, 1,290 firing scanlines each, zero variance).

Sprite-coincident MOSU delay. A sprite fetch overlapping the capture window freezes ROCO (PYCO's capture clock) with the rest of CLKPIPE; NUKO stays high (PX is frozen too), and the capture fires on the first ROCO edge after TAKA clears — the whole cascade shifts 6.000 dots later. Measured at the collision band of Mealybug m3_lcdc_win_map_change (WX=7, sprite X=7 at LY=56–63): MOSU↑ at +19.989 vs the +13.989 control — the 5.515-dot TAKA window plus post-freeze ROCO alignment (dmg-sim measurement, zero variance across 56 collision scanlines).

Whether the sprite cost appears as "MOSU later" or "Mode 3 longer at the tail" depends only on whether TAKA overlaps the capture window; total Mode 3 picks up the same +6 dots either way.

Edge cases

Three self-contained edge-case studies — the right-edge inert zone, multiple window activations on one scanline, and the NUKO/PANY one-dot slip — are collected in Window edge cases.

Window Edge Cases

Three edge cases of the window trigger model (window control): the inert right-edge zone, multiple activations on one scanline, and the NUKO/PANY one-dot slip.

The right edge

WX = 167 never fires: PX terminates at 167 on the same dot XUGU fires, and TADY resets PX before any further advance — no NUKO rise is possible.

WX ∈ [~162, 166]: the cascade fires but is observationally inert. Measured at WX=166 (dmg-sim measurement, patched gbmicrotest win0_a ROM; zero variance across 368 firing scanlines, all values sim-dots from AVAP↑):

Mode 3 length is identical to the no-window baseline on the same trace. The MOSU-driven NYXU pulse executes (BG counter resets, steps 1–7 of the sequence all fire, NOPA captures), but XYMU sets ~0.5 dots after MOSU↑ and the combinational POKY-clear switches the pipeline off before any SACU edge can advance the fresh fetch — structurally executed, observationally inert. The +6-dot penalty term simply does not apply once MOSU lands inside the [WODU↑, XYMU↑] closing window.

Right-edge window + sprite collision (WX=166, sprite at OAM X=167, gambatte m2int_wxA6_spxA7 ROM, dmg-sim measurement): on steady-state firing scanlines the window cascade adds nothing (inert as above) and the sprite adds exactly +6.000 dots — the right-edge collapse of the single-sprite penalty (sprite pipeline). The one-off first firing scanline (LCDC.5 just enabled, NOPA still 0) measures +17.0 dots — the standard 11-dot first-sprite penalty plus the 6-dot core, induced by the MOSU↑ NYXU pulse re-firing the fetch on the cascade's maiden activation only.

Multi-activation within one scanline

A mid-Mode-3 LCDC.5 1→0 write raises XOFO and clears PYNU on the same dot; NOPA captures the cleared PYNU one ALET edge later, re-opening NUNY's gate. PYCO and NUNU are not reset by XOFO — they keep propagating any NUKO pulse regardless of LCDC.5. PYNU's nor_latch inputs are level-sensitive, so what happens at a subsequent LCDC.5 0→1 restore depends on NUNU's state at the XOFO↓ edge:

1. NUNU=0 at restore — the match fired long before the disable and has drained. PYNU stays 0; a new activation needs a fresh NUKO rise, which under fixed WX is impossible same-line (PX is monotonic) — the CPU must rewrite WX ahead of PX. This is the structurally-new "multi-fire" case: Mealybug m3_lcdc_win_en_change_multiple (WX rewritten 24 → 120 between the toggles) produces two independent MOSU pulses per scanline (dmg-sim measurement: second activation at NUKO↑ +132.013, PYNU↑ +132.996).
2. NUNU=1 at restore — the match fired inside the disabled window and the restore lands within the ~1-dot NUNU-high pulse (≈ [NUKO↑+1.0, NUKO↑+2.0]). PYNU sets combinationally at XOFO↓ — a deferred completion of the first activation, not a new one. Mealybug m3_lcdc_win_en_change_multiple_wx exercises exactly this: on LY=16 and LY=44 the restore lands inside the NUNU pulse and MOSU fires within a gate delay of XOFO↓; on LY=22 the match falls between the off-pulses and the standard sequence runs untouched (dmg-sim measurement).

The window line counter (VYNO → VUJO ripple) clocks on PYNU falling edges. A scanline with N intra-line LCDC.5 1→0 transitions advances it N+1 times (once per disable, once at the end-of-line ATEJ). Under WX-only rewrites with LCDC.5 held high it advances exactly once per scanline: PYNU's set input saturates (already 1) and NUNY stays closed (NOPA holds), so a second NUNY/MOSU pulse is impossible without a PYNU fall.

The NUKO/PANY slip

NUKO has exactly two netlist consumers: PYCO (the capture chain above) and PANY — the BG drain-detector input (BG pipeline). The second consumer produces the subtlest window behaviour on the DMG.

PANY pulses high for ~1 dot at every tile-boundary drain. A NUKO pulse landing inside that window splits it across RYFA's capture edge: PANY is forced low at NUKO↑, released at NUKO↓, and then falls naturally one dot late — so RYFA captures the late half, and the entire SEKO → TEVO → NYXU chain slips by one dot for that boundary. The slip delays both the BG-shifter parallel load (unconditionally — this branch has no window gating) and the window tile-X increment (only when in_window=1).

• WX-rewrite form (Mealybug m3_wx_4_change family): a mid-Mode-3 WX rewrite that lands PX==WX inside a PANY window produces the documented pair-shuffle pattern at recurring tile boundaries. Measured: three perturbed scanlines per batch with NUKO arriving in the last sub-dot of the PANY window; pulses outside the window do nothing; and the simulated render is bit-identical to the hardware reference — the mechanism is fully on-die (dmg-sim measurement).
• Armed-but-disabled form (no rewrite needed): NUKO is gated by REJO but not by LCDC.5. With the window armed then disabled (REJO=1, LCDC.5=0) and WX ≡ 7 (mod 8) placing PX==WX at a tile boundary, the natural sweep fires the same slip — the BG shifts one pixel right from that column to the line's end, every scanline until VBlank clears REJO, while the window itself never renders (PYNU is held reset, so the wx_clk branch stays silent). Measured end to end: the boundary's PANY/RYFA/SEKO/TEVO/NYXU all slip exactly +1.000 dot (dmg-sim measurement).

LCD Output

The LCD output path combines the BG and sprite pixel MSBs through a pixel-multiplexer pipeline gated by LCDC.0 and the sprite priority pipe, then drives eight physical pads to the LCD glass. This chapter covers the pixel mux, the per-pixel emission edge (cp_pad) and its interaction with mid-Mode-3 register writes, the horizontal-sync driver, and the full pin inventory.

The pixel multiplexer

CPL and FR: the column alternators

cpl and fr alternate the LCD column drivers. Their sources are AO22 muxes selected by LCDC.7:

• KAHE = AO22(ff40_d7, KASA, KEDY, UMOB) — CPL source
• KUPA = AO22(ff40_d7, KEBO, KEDY, USEC) — FR source
• KEDY = NOT(LCDC.7) selects the second arm

With the LCD on, KAHE follows KASA = RUTU.Q (once-per-scanline LINE_END cadence) and KUPA follows KEBO = NOT(MECO). With the LCD off, both pins are muxed onto buffered APU audio dividers — UMOB (~8 kHz) for CPL, USEC (~4 kHz) for FR.

The rationale is glass protection: LCD column cells must see a net-zero average voltage, so CPL/FR must keep alternating even with the LCD off — the silicon borrows APU clocks to do it. Measured across a full pre-LCD-on boot window: cpl_pad alternates at ~8 kHz and fr_pad at ~4 kHz throughout, then both switch to per-scanline cadence at the LCD-on edge without a glitch (dmg-sim measurement).

The other four pins (cp, cpg, ld0, ld1) are not audio-muxed — they hold at 0 during LCD-off. Keep the two mechanisms apart: LCDC.7=0 holds the whole rendering machinery in VID_RST (the pixel pipeline never advances), whereas LCDC.0=0 merely gates the BG planes at RAJY/TADE during active rendering.

cp_pad: the pixel-emission edge

cp_pad is the pixel clock the LCD glass uses to capture LD0/LD1 — one pixel per rising edge. The drive path from SACU is purely combinational:

SACU↑ → TOBA↑ (= AND2(PX9, CLKPIPE)) → SEMU↑ (= OR2(TOBA, POVA)) → RYPO↓ → cp_pad↑

Net delay SACU↑ → cp_pad↑: +1,019 ps; the falling edge lags SACU↓ by +1,711 ps — identical across 68,256 rises (dmg-sim measurement), with the once-per-line POVA-arm capture at its own +4,493 ps offset. TOBA's PX ≥ 9 gate is why the first 8 CLKPIPE cycles never reach the glass, and the POVA arm of SEMU supplies the end-of-line 160th-pixel capture (BG pipeline).

The palette-write timeline, glass-side

For a palette write whose CUPA↑ lands at dot N, the emission edges bracket the on-die race (palette latches) like this:

No latching exists between the pixel-mux output and the pad.

The LCDC.0 mid-Mode-3 overlay

At netlist resolution, a mid-Mode-3 LCDC.0 write behaves exactly like the palette write above: VYXE settles within 41–69 ps of CUPA↑, the combinational chain follows, and the cp_pad↑ at +0.534 dots samples the NEW value (dmg-sim measurement across five anchor scanlines; the static race analysis lists no per-dot entries anywhere in the VYXE→RAJY/TADE→NURA→PATY chain).

On real hardware there is one more wrinkle — third in the family of below-netlist LCD-interface overlays (with the BGP OR-overlap and the LCDC.1 OFF transient):

When a CUPA write transitions LCDC.0 inside Mode 3, the first cp_pad↑ after that CUPA↑ emits a pixel computed using the OLD VYXE state; the NEW state takes effect from the second cp_pad↑ onward. The rule is bidirectional (both 1→0 and 0→1) and applies to every Mode-3 write — no first-write-of-scanline exception.

Characterised against the Mealybug m3_lcdc_bg_en_change hardware reference, which shows each transition deferred by exactly one LCD column relative to the netlist prediction, in both directions, across the affected scanline range.

The three family members have distinct scopes but share one signature:

In every case the netlist captures CUPA-edge propagation cleanly, and the hardware exhibits a +1-column overlay at the LCD-pipeline boundary. The silicon mechanism (glass-side sample-and-hold vs pad-driver residue) is a shared open question (Appendix C).

The ST (horizontal sync) driver

ST is driven by a three-cell combinational feedback loop gated by a PX-bit-3 tracker and synchronised per scanline by AVAP:

The loop dynamics: during the AVAP pulse, POME is forced low and POFY initialises to NOT(PAHO) = 1 (PAHO was reset throughout Mode 2). During Mode 3, PAHO tracks XYDO on each CLKPIPE cycle — PX-bit-3-aligned transitions — and the first PAHO=1 event with POFY=1 drops POFY to 0, where the loop self-holds until the next scanline's AVAP.

LCD-off and release. During LCD-off, TOFU=1 forces POFY=0 and the pad is static; PAHO is additionally held by XYMU. At the LCD-on edge TOFU drops combinationally, the loop stays quiescent, and the first AVAP produces an ST edge on the first scanline — HSYNC is normal from the outset. Measured: first st_pad↑ inside that scanline's Mode 3, the second exactly one 454-dot first-scanline period later, and per-scanline cadence thereafter — with the second scanline onward at the steady 456-dot period (dmg-sim measurement; the 2-dot first-scanline shortening sits in Mode 0 and shifts the cadence once without altering pulse shape).

Pin inventory

Eight pads connect the PPU to the glass. Each pad is driven through a single inverting driver stage into an inverting pad cell (pad = !o_n) — two inversions, so each pin tracks its source signal in phase (measured: the st pin follows POFY with ~490 ps of buffer delay):

The VSYNC path. MEDA (the NYPE-clocked LY=0 capture) drives s_pad through the MURE inverter — one gate delay end to end. MEDA's first 0→1 transition after LCD-on lands at the LY 153→0 boundary ending the first frame, so the first frame emits no VSYNC pulse — part of the LCD-on startup transient (LCD-on power-up). Community pin-role documentation describes pin S as the input to the LCD's Y-driver row shift register (one row per pulse); that interpretation is not netlist-derivable.

The pads are stateless. The LD0/LD1 pad cells have no clock and no stateful element; their propagation is fixed at the netlist level, independent of pixel index or upstream pipeline state. Measured across both branches of a palette-write iteration family: the CUPA-relative offsets at the chip pin are picosecond-identical within each branch, and a known one-M-cycle upstream differential reproduces at the pin without compression (dmg-sim measurement). Whatever produces the LCD-interface overlay family above, it is not a stateful pad driver on the die.

Mode Transitions

Mode transitions are the state-machine edges between Modes 2, 3, 0, and 1. Each is driven by a specific signal event: AVAP↑ starts Mode 3; the WODU → VOGA → WEGO chain sets XYMU to end it; the RUTU → NYPE distribution ends the scanline into Mode 2 or Mode 1; the CATU/ANEL chain re-initialises the Mode 2 machinery at each boundary; MYTA fires at frame end. This chapter walks each edge.

Mode 2 → Mode 3

AVAP — the scan-complete pulse (OAM scan) — drives XYMU's reset directly: AVAP↑ clears XYMU to Q=0 and Mode 3 begins. AVAP's four netlist consumers:

The transition lands at dot 80 of the scanline (Mode 2's 80-dot decomposition is in OAM scan), and the 7.026-dot startup cascade to the first pixel — zero variance across scanlines, no first-scanline transient — is in the BG pipeline.

Mode 3 → Mode 0

WODU → VOGA → WEGO → XYMU set

The sequence: PX reaches terminal count (XUGU decode), no sprite match (FEPO=0), WODU = AND2(XENA, XANO) rises — in the ALET-low phase, 0.063 dots after the ALET falling edge. The same-dot ALET rising edge, 0.435 dots after WODU↑, latches WODU into VOGA; WEGO rises 315 ps later and XYMU sets simultaneously (dmg-sim measurement):

Mode 3 ends within the same dot WODU fires — a half-dot pipeline delay set by WODU's ALET-low-phase rise and VOGA's same-dot capture. The baseline duration decomposes exactly: AVAP → WODU = 173.045 dots (167 pixels through the pipe after the 7-dot startup), WODU → XYMU = 0.436, total 173.481 dots at SCX=0 with no sprites or window.

Mode 0 → Mode 2 / Mode 1

The scanline ends through LINE_END (RUTU) and its NYPE redistribution (line counters carries the cell detail):

1. LX reaches 113; SANU fires.
2. RUTU captures on the SONO edge and holds for one full TALU cycle.
3. LY increments (MUWY toggles on RUTU's rise).
4. NYPE captures RUTU on the next TALU rising edge — half an M-cycle after RUTU's capture. NYPE's Q clocks POPU; NYPE's Q_n clocks MYTA and MEDA — splitting the distribution across two TALU edges one period apart.
5. POPU captures XYVO on NYPE's rise: LY < 144 → Mode 2 begins; LY ≥ 144 → Mode 1 (VBlank).
6. One TALU period later, MYTA captures NOKO (FRAME_END) and MEDA captures NERU (LY=0). MYTA's later edge is the source of the LYC=153 race window (STAT interrupts).

In parallel, RUTU drives the scan-counter reset chain below.

The CATU/ANEL chain

The OAM scan counter is reset at each scanline boundary by a two-DFF-plus-combinational chain transforming RUTU into the ANOM reset pulse:

flowchart LR
    RUTU["RUTU<br>LINE_END"] -- "∧ NOT(vblank)" --> CATU["CATU<br>dffr · XUPY"]
    CATU -- "Q sets" --> BESU["BESU<br>scan-active latch"]
    CATU -- "Q" --> ANEL["ANEL<br>dffr · NOT(XUPY)"]
    CATU -- "ABAF = NOT(CATU)" --> BYHA["BYHA<br>oa21"]
    ANEL --> BYHA
    BYHA --> ATEJ["ATEJ<br>line-end pulse"]
    ATEJ --> ANOM["ANOM<br>scan-counter reset"]
    ATEJ --> TADY["TADY<br>PX reset"]
    ATEJ --> SECA["SECA<br>TAKA set"]
    ATEJ --> AZYB["AZYB<br>slot-counter reset"]
    ATEJ --> ABAK["ABAK<br>store resets"]

Only CATU and ANEL are clocked — one half-XUPY pipeline stage between them; the rest is combinational. CATU's data decomposes to RUTU AND NOT(vblank) (SELA is RUTU through two buffers; ALES = NOT(XYVO)) — the chain fires only outside VBlank. Both DFFs are held in reset while the LCD is off.

The steady-state sequence: RUTU rises mid-XUPY-cycle; CATU captures it one dot later (243,059 ps = 0.996 dots, picosecond-identical across 431 boundaries — dmg-sim measurement); ANEL captures CATU half an XUPY cycle after that; BYHA/ATEJ/ANOM pulse the counter reset between the two captures. Total: CATU's capture asserts the reset on its own edge (via the ABAF arm), ANEL's capture releases it (via the second BYHA arm), and the counter ticks 0→1 on the next XUPY rising — one XUPY cycle after CATU.

CATU's clk-to-Q is directly measured: 988 ps after the XUPY edge, zero variance across 860 scanline boundaries (dmg-sim measurement) — slightly slower than BYBA's 902 ps, matching the two cells' relative load parameters.

ATEJ's other consumers matter. Beyond ANOM, the line-end pulse drives TADY (the PX-counter reset — BG pipeline), SECA (the TAKA set net — the H-Blank TAKA re-assert in the sprite pipeline), AZYB (the sprite-store slot-counter reset), and ABAK (the per-slot store resets). One pulse, five subsystems.

ANOM's BALU arm. While the reset pulse is asserted, BALU = NOT(ANOM) goes high and forces BEBU=1 — masking AVAP during the boundary transition. The full interaction lives with the AVAP detector in OAM scan.

The LCD-on bypass

When LCDC.7 goes 0→1, the first scanline enters its scan by a different mechanism — CATU and ANEL are not involved:

• During LCD-off, ATAR=1 holds ANOM=0 (counter in reset) and ABEZ=0 holds CATU/ANEL at 0; RUTU is 0.
• At the LCD-on edge, ATAR falls and ANOM releases immediately — combinationally, no chain propagation. CATU's data is still 0 (no RUTU pulse exists yet), so the chain stays silent.
• The counter simply starts advancing on the next XUPY edge.

Consequences on the first post-LCD-on scanline:

• BESU never sets (its set input is CATU.Q) — the STAT mode bits read Mode 0 through the nominal scan window and the Mode 2 interrupt does not fire;
• the scan itself runs — counter 0→39, FETO, BYBA, AVAP, Mode 3 all normal;
• the sprite store is never populated (CARE stays unarmed).

From the second scanline on the full chain operates — RUTU fires at the first LINE_END and everything proceeds steady-state. The first-frame observability consequences are catalogued in LCD-on → first WODU.

Mode 1 → Mode 2 (frame start)

1. LY reaches 153: NOKO=1; MYTA captures it on NYPE's falling-edge distribution.
2. LAMA = NOR2(LYHA, MYTA) goes low — LY resets to 0.
3. NERU (the LY=0 NOR8) rises.
4. MEDA captures NERU on the same NYPE_n edge family — driving only the LCD vertical-sync pad (LCD output); MEDA touches no scan-state or mode-control logic.
5. The first visible line's OAM scan begins through the normal RUTU/CATU machinery at the next scanline boundary.

The LY=153→0 wrap's CPU-visible fine structure ("LY reads 153 for only a few dots") is timed edge-by-edge in CPU-visible timing at mode boundaries.

STAT Interrupts

The STAT interrupt (IF bit 1) is set by LALU, a DFF whose clock is the combined STAT condition: SUKO, an AO2222 that OR-ANDs the four sources with their enable bits. There is no periodic clock anywhere in this chain — LALU fires when SUKO's output rises. Everything subtle about DMG STAT interrupts ("blocking", the write glitch, the boundary races) falls out of that one fact plus per-leg gate depths.

The enable bits and the FF41-write transient

The four enables are level-sensitive latches sharing the CUPA strobe — and that transparency is the netlist origin of the "DMG STAT-write glitch". During a CPU FF41 write, the data bus settles bit by bit across the write window, and the transparent latches follow it. Measured (dmg-sim measurement, gambatte enable_after_lyc_during ROM, write $40 → $08): the bits being cleared walk through a transient where all four enables read 1 simultaneously for ≈ 15.8 ns before settling to the written value.

Whether that transient fires an interrupt depends entirely on SUKO's through-zero behaviour. A transiently-set enable matters only if its paired condition is high — and if some other leg already held SUKO high, no edge occurs.

In the measured scenario (WODU high mid-H-Blank, LYC leg high then dropping), SUKO transitions exactly zero times: the Mode 0 leg takes over as the LYC leg drops, the output never dips, LALU never clocks. The glitch is ordinary transparent-latch bus-settling: SUKO = OR(EN·COND) settles per-leg, and LALU clocks only on a genuine through-zero.

WODU: the Mode 0 condition

WODU = AND2(XENA, XANO)
├── XENA = NOT(FEPO) — no sprite fetch active
└── XANO = NOT(XUGU) — pixel counter at terminal count (PX = 167)

One signal, two consumers with very different latencies: the mode transition (WODU → VOGA → XYMU, 0.436 dots — mode transitions) and the STAT chain (WODU → TARU → SUKO → TUVA → VOTY → LALU, 0.011 dots). The interrupt fires 0.425 dots before the CPU-visible mode changes.

The terminal-count WODU pulse

WODU's inputs settle at different depths. On the advance onto PX=167, XANO (a shallow NAND5 decode) rises while the deep sprite-match aggregate FEPO is still low for the new count. With a sprite stacked at X=167, this ordering produces a brief WODU pulse before the terminal sprite's match suppresses it (dmg-sim measurement):

The two consumers treat it asymmetrically: the combinational STAT chain catches the pulse and sets IF bit 1 at the early edge — ahead of the visible Mode 3 end by the whole terminal-sprite fetch extension — while VOGA samples on the ALET edge after FEPO has settled and misses it entirely; the mode bits flip only at the sustained WODU rise after the last terminal sprite. A sprite at X=166 or below produces no pulse (it is fetched before the terminal count).

Propagation: measured leg latencies

Mode 0 path (dmg-sim measurement, 1,289 assertions, ps-identical):

Mode 2 path (dmg-sim measurement, 1,289 assertions):

The 2,210 ps differential vs Mode 0 is entirely SELA's double-inverter; the shared SUKO→VOTY tail (966 ps) and the AO2222 input delay (870 ps) match the Mode 0 leg to ps resolution. The static analysis gives LALU a tight-but-safe per-line race (diff 5.8 ge, deepest input VOTY at 64.8 ge).

The Mode 0 condition (TARU) drops in two structurally different situations.

On VBlank entry WODU stays high and TARU drops via TOLU as mode1 rises (Case 3), a cascade riding the boundary TALU↑ — TARU↓ = TALU↑ + 4,038 ps (dmg-sim measurement).

At a line start the trigger is WODU itself, de-asserting as the pixel counter resets — ≈ 1 dot after RUTU↑ (WODU↓ at +1.008 dots, TARU↓ at +1.010), quantifying Case 2's "further dot to drop". With only the Mode 0 leg enabled that SUKO drop is uncovered, exposing the whole falling leg (dmg-sim measurement, three consecutive boundaries ps-identical):

The AO2222 input delay (1,016 ps) and the SUKO→VOTY tail (1,077 ps) match the Mode 1 / Mode 2 legs' falling cascade to the picosecond — the tail is leg-independent, the falling mirror of the rising 870 / 966 ps. LALU clocks on VOTY's rise, so this VOTY↓ sets no interrupt; it only readies the clock for the next line's Mode 0 rise.

Edge-triggered behaviour and the leg-swap races

Because LALU clocks on SUKO's rise, overlapping conditions produce one interrupt, not two — the "STAT IRQ blocking" behaviour emerges naturally. The interesting cases are leg swaps: one source leg falls and another rises on the same boundary. Whether SUKO dips (→ fresh interrupt) or stays covered (→ nothing) is decided by gate-prop depth, and all four configurations have been measured (dmg-sim measurements, gambatte interrupt-precedence ROM family):

Case 1 — VBlank entry, LYC + Mode 1 enabled: glitch fires. On the TALU edge ending scanline 143, the LYC arm drops via ROPO (one TALU-clocked stage — fast) while the Mode 1 arm rises via NYPE → POPU → PARU (buffered, ~1.9 ns slower). All four arms sit at 0 for 1,802 ps; SUKO dips; LALU fires ~4.4 ns after POPU's capture. IF bit 1 sets even though "the LYC interrupt ended and the VBlank interrupt began".

Case 2 — line boundary with all four enables: covered. The Mode 2 arm rises ~1 ns after RUTU while the Mode 0 arm takes a further dot to drop (WODU's deep pipeline-end conditions). At every instant some arm is high — measured across 143 consecutive boundaries: zero SUKO transitions, zero spurious interrupts. The structural ordering (Mode 2 rises fast, Mode 0 drops slowly) is intrinsic to the netlist.

Case 3 — VBlank entry, Mode 0 + Mode 1 enabled: covered. Both arms cascade off the same POPU chain: the Mode 1 arm rises at PARU (2 stages from POPU.q), the Mode 0 arm drops at TARU (4 stages, via TOLU). The rising leg arrives 1,216 ps before the falling one — no dip.

Case 4 — VBlank exit (LY 153→0), Mode 1 + Mode 2 enabled: glitch fires. The symmetric counterpart: the Mode 1 arm drops at PARU (2 stages) before the Mode 2 arm can rise at TAPA (4 stages). SUKO dips for 1,524 ps; LALU fires ~5.5 ns after POPU's fall. Measured identically on two independent ROMs.

The general structure, from the shared propagation tree:

POPU.q → popu_n → PARU (mode1)            — 2 stages: the FAST leg
                    └→ TOLU → TARU (mode0) — 4 stages
                          └→ TAPA (mode2)  — 4 stages
ROPO (LYC) — 1 TALU-clocked stage: the only leg FASTER than PARU

The LYC-match pipeline

LY bits + LYC bits → per-bit XNORs → SUBO/SOVU → RAPE → PALY (combinational)
  → ROPO (dff17, clk = TALU rising)         — the only registered stage
      ├→ SUKO's LYC arm (with RUGU)
      └→ RUPO (nor_latch) → tri-state → STAT bit 2

RUPO is transparent in normal operation. Its reset-side driver PAGO is static-1 outside hardware reset, so the NOR latch continuously re-evaluates and STAT bit 2 tracks ROPO.Q with gate delay only. A true latch-hold requires hardware reset and a concurrent FF41 write — irrelevant to normal operation.

LCD on/off does not reset the pipeline. ROPO's reset traces to the system-level hardware reset, not VID_RST. Across an LCD-off span, ROPO holds whatever it captured at the last TALU edge before the LCD went off; after LCD-on, the first TALU edge (+1.483 dots after VID_RST deasserts — register writes) recaptures (LY=0 == LYC). STAT bit 2 in the brief window between LCD-on and that first TALU edge reads the pre-LCD-off match value.

The LYC=153 boundary race

At the 152→153 boundary, MYTA captures FRAME_END one TALU period after POPU (line counters) and async-resets LY to 0. The reset propagates to PALY through six gate stages; ROPO's capture on the same TALU edge completes through four shorter internal stages — ROPO wins the race and captures pre-reset PALY, the LY=153 comparison.

Across three consecutive TALU rises at the boundary:

For LYC=153 the match window is therefore two TALU periods; for LYC=0 the match onsets at rise 3 — one TALU period after MYTA's edge. The sub-phase window between PALY's combinational transition and ROPO's next capture — where the comparator and the visible bit disagree — interacts with CPU read sampling and is worked through in CPU-visible timing at mode boundaries. Implementations that fire POPU and MYTA on a single collapsed edge place MYTA one TALU period early and shift all of this downstream.

Scanline and Frame Timing

This chapter frames the per-subsystem behaviour at scanline and frame level: one scanline's dot structure, and the physical ordering of events inside a single dot. The complete power-up story — the shortened first scanline, the startup transient at the pins, and the LCD-on → first-WODU composition — has its own pages.

The scanline

One scanline = 456 dots = 114 M-cycles (LX counts 0–113):

The Mode 3 budget, consolidated (all developed in their own chapters):

• Baseline 173.481 dots: 7.026 startup + 166.019 dots through the pipe (167 SACU edges, 166 steps after the first) + the 0.436-dot VOGA tail.
• Fine scroll: exactly 1 dot per SCX & 7 step, applied at startup via ROXY; the SACU count never changes.
• Sprites: 6-dot core + 0–5 dots alignment per sprite. Single sprite at SPRITEX 8/9 → +11/+10 dots; four sprites step ~4 dots per +1 SPRITEX over [8, 13]; tile-boundary anomalies at {14, 15}; stacked same-X sprites add exactly 6 dots each (sprite pipeline).
• Window: +6.000 dots, invariant across WX — one fetch-pipeline restart (window control).
• The 21 TEVO tile boundaries are internal to the fetcher and cost nothing.

Inside one dot

By propagation depth, each master-clock edge unfolds in three bands:

• Early (0–8 ge) — registered outputs and the VRAM bus settle.
• Mid (8–22 ge) — ALET arrives and ALET-clocked DFFs capture; MYVO/LEBO arrive on the opposite edge.
• Late (22–64 ge) — sprite matches, FEPO, WODU, VYBO, and finally CLKPIPE at 63.8 ge.

The physical ordering on silicon:

ALET rising: the ALET-clocked DFFs capture (NYKA, LYZU, PYGO, RENE, DOBA, NOPA, VOGA); the sprite fetch clock SABE rises; the NOR/NAND latches (XYMU, ROXY, POKY, LONY, BESU) respond combinationally; addresses and enables settle.

ALET falling (= MYVO rising): PORY captures NYKA's fresh output; the BG fetch clock LEBO rises and the LAXU→MESU→NYVA ripple advances; CUPA is high in this window once per M-cycle, making the CPU-written register latches transparent.

Delayed, same falling edge: SACU's rising edge is the ALET falling edge, arriving 41.6 ge later through VYBO/TYFA/SEGU — the delay is what guarantees DFF captures and counter advances settle before the pixel pipe shifts. CPU register reads are not ordered events at all — the read path is continuously-enabled combinational logic, sampled on the CPU's own schedule.

At the 1 MHz tier, TALU/SONO distribute LX counting and LINE_END capture across M-cycle boundaries (line counters).

The LCD-on story

The power-up sequence has two pages:

LCD-on Power-up

What happens on the first frame after LCDC.7 goes high: the shortened first scanline, the startup transient at the LCD pins, and which PPU flip-flops are reset by what (scanline and frame timing).

The first scanline: the 454-dot line

Immediately post-LCD-on, the first scanline measures 453.5 ≈ 454 dots instead of 456, with the deficit entirely in Mode 0 — Mode 2 and Mode 3 match steady-state. The gate-level decomposition (dmg-sim measurement):

The structural sum lands at −2.5 while the directly-measured Mode-0 deficit (below) is exactly −2.0 dots (488,000 ps): the ~0.5-dot difference is sub-dot TALU phase, conserved through the LX chain and never realised as a whole-dot change in line length, so the line runs an integer 454 dots and the Mode-0 deficit is exactly 2.

The deficit's location is measured directly: the first scanline's Mode 3 + Mode 0 span (XYMU↓ → RUTU↑) is 48,680,932 ps (199.512 dots) against 49,168,932 ps (201.512) on scanlines 1–5 — shorter by exactly 488,000 ps = 2 dots — and the pure-Mode-0 interval (XYMU↑ → RUTU↑) shows the same 488,000 ps gap, placing the whole deficit in Mode 0 (dmg-sim measurement).

Three structural facts compose the deficit — and none of them is "drift":

1. No leading RUTU pulse. A steady-state line spends one TALU period inside the RUTU pulse where LX is held at 0; the first scanline starts counting immediately. Saves 6 dots against the reference.
2. The LCD-on write lands in T3 of its M-cycle (the CUPA position, +2.020 dots); VID_RST deasserts a gate delay later at XODO↓ (+2.021), so the chain's first effect is 2.021 dots late against the M-cycle boundary.
3. The divider stack starts mid-phase: the first TALU↑ lands 1.483 dots after VID_RST deasserts — 3.504 dots past the M-cycle boundary instead of the 6.000 a steady line spends reaching its first counting rise.

That phase is then conserved exactly: the write sets the divider phase for the whole epoch, and every TALU↑ thereafter — all 113 on the first scanline and every steady-state rise after — lands 854,890 ps past its M-cycle boundary with zero variance (155,000+ edges, dmg-sim measurement). No per-line adjustment exists anywhere in the chain. The LX chain is a delay-conserving propagator, not an amplifier.

The LCD-on startup transient at the pins

Seven of eight pins are normal from the first scanline. VSYNC is silent for all of the first frame: MEDA can only capture the LY=0 decode at an LY 153→0 wrap, and the first such wrap is the one ending the first frame. From the second frame on it fires once per frame; the first frame is distinguished by the absence of a pulse, not an altered one.

The community-documented consequence — the first frame never reaches the glass ("first frame is blank") — rests on pin-role references for the LCD's Y-driver, not on a measured glass-side behaviour; the PPU-side mechanism (MEDA's reset domain) is netlist-derived and measured. The 2-dot first-scanline shortening changes no pixels — it only moves where the mode and LY transitions fall — so it has no display consequence, but it is fully observable to the CPU: STAT mode reads, LY reads, and per-scanline interrupt timing all see it.

VBlank IF is not gated by the first frame. The IF[0] latch (LOPE) has no LCD-off reset path; POPU resumes normally after LCD-on, and the first frame's VBlank entry raises IF[0] with the same edge structure as any steady-state frame (dmg-sim measurement) — there is no first-frame interrupt suppression of any kind.

Pipeline state at LCD-on: the reset-domain taxonomy

Every PPU DFF belongs to one of five reset classes, and the whole cross-frame story follows from the classification:

What matters is whether any persisted stale state reaches LD0/LD1. For the BG plane, no — the two-parallel-loads mechanism (BG pipeline) propagates stale content at load #1 (AVAP) and overwrites it at load #2 (first TEVO, dot 5.996) before the first CLKPIPE shift at 7.026, and CP is PX≥9-gated besides. For the sprite plane, stale shifter content is mux-gated until a real fetch fires. That leaves exactly two pieces of cross-frame state to examine at the first scanline; only the first reaches LD0/LD1:

1. The sprite store is empty on the first frame — the LCD-on bypass never sets BESU, CARE never arms, and oam_data_latch never pulses (mode transitions). Consequences by OAM content:

   Case	OAM at LY=0	Divergence on LD0/LD1?
   1	no Y-visible sprite	none — both frames render spriteless. Anchored across 777 Y-non-matching scanlines (zero TEKY/FEPO, zero variance) and 842 scanlines of DMA overlap across all three regimes: DMA cannot convert an empty-store line into an extended one
   2	Y-visible sprite, on-screen X	yes — the first frame misses the sprite; steady-state frames render it
   3	Y-visible sprite at OAM X=0	timing only — a steady-state frame's save-written X=0 fires the X match and its fetch penalty; the first frame's reset-held store cannot fire (the store holds NOT(X); reset decodes as X = 0xFF — sprite pipeline)

2. The window's REJO latch. REPU clears it on every VBlank entry (window control), so it carries nothing across frames — no divergence from this path.

Everything else either lands outside the pixel path (MEDA's silent first-frame VSYNC; BESU's missing Mode 2 status/IRQ on the first scanline of the first frame) or is overwritten before it can be sampled.

One cold-boot footnote: ROPO (the LYC-match capture) resets only at system reset, so STAT bit 2 between LCD-on and the first TALU edge briefly exposes the pre-LCD-off match value — and on the very first boot, the power-on zero.

LCD-on → First WODU

The end-to-end path from the CPU's LCD-enabling write to the first H-Blank, and how it maps onto CPU-observable timing (scanline and frame timing).

The end-to-end path

The full path from ff40_d7↑ (the LCD-enabling write's effect) to the first H-Blank condition on the first scanline — SCX=0, no sprites, no window (dmg-sim measurement):

With two dot-of-M-cycle invariants: the write's ff40_d7↑ lands at +2.020 dots into its M-cycle (the CUPA position), and the first WODU↑ lands at +1.556 dots into its M-cycle. Both are CPU-prelude-invariant — ps-identical across five LCD-on events in three radically different instruction streams (quickboot's mid-boot enable, a test ROM's own enable, and a post-HALT interrupt-handler enable, twice) — the instruction stream between the write and the first WODU is irrelevant to the PPU cascade.

The first-scanline Mode 2 measured from the write spans ~78.5 dots rather than 80 — not a Mode 2 shortening, but the dot-0 reference shifted by the write phase (+2.020) and divider startup (+0.480); each subsequent Mode 2 is exactly 80 dots.

SCX extension (measured at SCX ∈ {0,1,2,3,7}): the entire +1-dot-per- SCX&7 shift lands in the startup pipeline; every other stage is SCX-invariant to picosecond precision. Total: 251.536 + (SCX & 7) dots, giving a first-WODU M-cycle phase of (1.556 + (SCX & 7)) mod 4.

Mapping to CPU observables

For the canonical LDH (LCDC),a; xor a; inc a; inc a; … prelude, walking the wall-clock M-cells from the write pins everything: 63 CLK9 edges separate the write's M-cycle from WODU's, placing the first WODU at dot 1.556 of cell M65 with inc#61 in flight — handler-entry A = 61, matching the hardware-verified ROM expectation.

Per-SCX, the in-flight instruction and one further mechanism — a one-M-cycle dispatch slip when the WODU-driven int_pending settles past the dispatch-trigger setup boundary (first-WODU phases 2.556/3.556 — see interrupt dispatch) — combine into the hardware-verified expectations:

Skip-boot note

CPU-Visible Mode Boundaries

What does a CPU read latch when it lands on a PPU transition? This chapter answers that question edge-by-edge for the four STAT-readout boundaries and the LY 153→0 wrap, plus the write-side analogue (an OAM write straddling the Mode 2→3 boundary). The recurring structure: a PPU trigger fires at some sub-dot phase; a gate cascade settles in nanoseconds; the bus driver takes far longer; and the CPU latches at data_phase_n↑, +974,856 ps (+3.995 dots — the tail of T4) after its M-cycle's CLK9↑. Which of those windows the read M-cycle straddles decides PRE vs POST — and the proximate mechanism differs per transition.

The LYC stale window

Between PALY's combinational transition (the comparator seeing the new LY) and ROPO's next TALU-edge capture, the comparator and the visible STAT bit 2 disagree (STAT interrupts). The CPU never sees the stale value on a normal read: its data_phase sample lands late enough in the read M-cycle that ROPO's transition has propagated to cpu_port_d first.

Measured on a read M-cycle containing the transition (dmg-sim measurement, gbmicrotest line_153_lyc153_stat_timing ROM family): the bus flips 0xC5 → 0xC1 at the instant rupo_n transitions, ≈117 ns before the CPU's latch point (−116,838/−116,911 ps across two variants) — the CPU captures 0xC1, matching hardware. Emulators that latch CPU-visible reads early in the M-cycle report the stale value instead.

Mode 2 → 3: the AVAP dot

Two paths fan out from AVAP↑ to the STAT mode-bit gates SADU = NOR2(mode3, mode1) and XATY = NOR2(mode2, mode3): the BESU branch clears mode2 in ~2.2 ns; the buffered XYMU branch raises mode3 at ~8.5 ns. In between, XATY sees NOR(0,0) — a ~6.3 ns transient "Mode 0" glitch on bit 1 (dmg-sim measurement, zero variance across 1,720 scanlines):

The glitch closes ~350 ns before any plausible CPU latch — never directly observable. What is observable is the bus: the mode-bit drivers are not_if1 tri-state cells whose output transition plus contention holds the transitioning bit unresolved through the rest of the trigger M-cycle. Measured on a read whose M-cycle contains AVAP↑ (dmg-sim measurement, gbmicrotest lcdon_to_stat3_c): AVAP fires mid-T3 (+2.5 dots), the gate cascade settles in ~8.5 ns, the bus bit starts transitioning at ~69 ns — and is still unresolved at the CPU's latch, ~360 ns later (it resolves ~21 ns after).

Hardware latches the PRE-transition value (Mode 2 — the bus voltage hasn't crossed the input threshold), matching the hardware-verified expectation; the sibling ROM one M-cycle later reads Mode 3. The threshold is not the ~3 ns cascade — it is the bus-driver settling window.

Mode 0 → 2: the BESU-set boundary

The same bus-driver mechanism with a faster cascade: BESU.q rises combinationally from CATU at the scanline boundary, mode2 rises at ~3.4 ns (2.5× faster than the AVAP cascade — one combinational stage closer), only bit 1 transitions. Measured on the trigger M-cycle (dmg-sim measurement, gbmicrotest lcdon_to_stat2_c): gate settle at ~3.4 ns, bus bit unresolved from ~61 ns through the CPU latch (it resolves ~20 ns after) — hardware latches PRE (Mode 0); one M-cycle later reads Mode 2.

Mode 3 → 0: the WODU cascade

This transition differs structurally: the cascade contains a DFF (VOGA, ALET-clocked), so it takes ~106 ns rather than ~8.5 ns, and WODU↑'s phase within the read M-cycle varies with Mode 3's duration (set by SCX, sprites, and window). Both mode bits transition. Five measured anchors span the regime structure (dmg-sim measurements; all five ROMs are gbmicrotest; parenthesised offsets are dots from the M-cycle's start):

All five share a bit-identical gate cascade; only the alignment against the read M-cycle differs. Every expectation matches hardware-verified ROM results.

The ambiguous middle does not exist at single speed. VOGA quantises XYMU↑ onto the ALET grid — one possible position per dot. The WODU→XYMU delay is not a constant ("next ALET edge minus WODU, plus a DFF delay" — measured shrinking exactly as WODU↑ slides toward the capture edge); the grid position is the invariant. For the canonical FF41-read M-cycle, the nearest grid points land +0.006 dots after the CPU latch and −1.00 before it — nothing in between is reachable, so every single-speed read is provably fully-PRE or fully-POST.

The residual metastability sits at VOGA's capture: a WODU↑ inside the setup/hold window flips the outcome between two clean values a full dot apart — whole-mode selection, not a torn read.

One scoping caveat from the anchor family: "PPU timing is prelude-invariant" holds per-scanline only when that scanline's Mode 3 is not coupled to in-flight OAM DMA. A sibling ROM pair whose preludes pause DMA differently across HALT showed three mid-frame scanlines differing by one 11-dot sprite penalty — because DMA's byte 1 (a sprite X write) landed in one ROM's scan window and not the other's (DMA).

LY 153 → 0: the MYTA reset

The LY wrap is the clean counter-example to the STAT cases. MYTA fires on a TALU edge at the start of an M-cycle (T1); the LAMA reset cascade to the LY DFFs and the FF44 read drivers is purely combinational (~3–4 gate stages); and crucially the LY drivers are not_if0 cells — single tri-state inverters with no companion-driver contention, so no hundreds-of-ns unresolved window exists.

• A read whose M-cycle starts on MYTA's edge latches 0x00 — the bus has been at the post-reset value for nearly the whole M-cycle.
• A read one M-cycle earlier latches 0x99 (153).

Measured anchors place two hardware-verified ROMs exactly one M-cycle apart across this boundary (latch points 975,927 ps apart), with the LCD-on→first-MYTA interval matching the analytic frame structure (454 + 152 × 456 + 4 dots) to within 0.13 M-cycle (dmg-sim measurement, gbmicrotest line_153_lyc153_stat_timing family). The same boundary M-cycle read on FF41 catches the LYC stale window with bit 2 mid-transition, resolving to the post-clear value per the first section above.

The write-side straddle: AJUJ's ~6.5 ns window

The Mode 2→3 cascade's mode2/mode3 gap exists on the write-permit path too: AJUJ = NOR3(dma_run, mode2, AJON) sees mode2 fall at +1,951 ps and AJON rise at +8,759 ps — the permit is open from +2,318 to +8,820 ps after AVAP↑, a 6,502 ps window between Mode 2 closing and Mode 3 locking (dmg-sim measurement, 1,720 scanlines, zero variance).

A CPU OAM write whose CUPA strobe spans this window fires the full WYJA → strobe chain. Measured in situ on the landing anchor (dmg-sim):

That is 1,862 ps from permit to strobe, completing 4,640 ps before the window closes. The OAM SRAM cell — a transparent latch with no setup/hold edge — captures the bus value during the strobe-high residue. The hardware-verified anchor is gbmicrotest oam_write_l1_c (write lands on DMG), bracketed by one-NOP siblings whose writes are blocked: blocked / LANDS / blocked.

The structurally parallel boundaries behave differently: Mode 0→2 has no transient gap (mode2 rises directly; AJUJ closes cleanly — write blocked), and Mode 3→0 simply opens the permit: AJON releases at WODU↑ +111,054 ps and AJUJ opens at +111,421 ps — 4,999 ps after the mode-bit change (dmg-sim measurement, 1,721 scanlines, zero variance).