PPU implementation with sprites

STATE.md

@@ -45,7 +45,12 @@
 - PPU 2a done (src/palette.rs + src/render.rs): 64-color 2C02 SYSTEM_PALETTE in index order, index_to_rgb with & 0x3F mask. Renderer trait (the only hardware trait) + PpmRenderer writing numbered frames to renders/ (frame_0000.ppm etc.) + pure ppm_bytes for testability. 4 unit tests pass. 2C02 chosen over composite palettes - we render raw PPU output
 - PPU 2b done (src/ppu.rs struct + registers + VRAM routing + src/bus.rs open-bus): Ppu has ctrl/mask/status/oam/oamaddr, shared write_latch (W bit for $2005/$2006), vram_addr (14-bit), data_buffer ($2007 read-buffer), vram[0x1000] (4KB for FourScreen), palette[32]. read/write handle $2000-$2007 with open-bus for write-only regs ($2000/$2001/$2003/$2005/$2006), $2002 read = (status & 0xE0) | (open_bus & 0x1F) + clears vblank + resets write latch, $2004 write increments oamaddr, $2007 palette reads bypass the read-buffer. VRAM routing: $0000-$1FFF = CHR via cart, $2000-$3EFF = nametables via cart.mirroring() (H/V/OneScreenLow/High/FourScreen), $3F00-$3FFF = palette with 10/14/18/1C mirror. Bus tracks open_bus (last byte on CPU data bus, updated on every read/write) and passes it into ppu.read; PPU regs routed via disjoint-field borrows; APU/expansion stubs now return open_bus instead of 0. cartridge.rs mirroring honors the four-screen header bit
 - PPU 2c implementation done (src/ppu.rs full background renderer): scanline/cycle timing (3 PPU dots per CPU cycle, 341 dots/scanline, 262 scanlines/frame, odd-frame 340-dot pre-render line), vblank+NMI at scanline 241 dot 0, clear at 261 dot 0, frame_complete at 261 end. Loopy scroll $2005/$2006 (t/x/w, shared write latch reset on $2002 read). Background fetch pipeline (4-fetch/8-dot: nametable at %8==0, attribute at 2, pattern lo at 4, pattern hi at 6, reload shift regs + increment coarse X at 7), two attribute shift registers (0xFF/0x00 per bit), horizontal copy at dot 255, vertical increment at 256, vertical copy at 280. Fine-X pre-shift at cycle 0 of visible scanlines. Transparent pixel uses palette[0]. Fixed mirroring swap (Horizontal=>a>>11, Vertical=>a>>10). Bus frame-driving methods (tick_ppu/frame_done/take_nmi/framebuffer/begin_frame). main.rs run_cart boots any ROM, renders frames to renders/ with PpmRenderer
-- CURRENT BUG: SMB renders ALL GREY. The framebuffer is all 0x00 (palette index 0 = dark grey 0x5D5D5D) - every frame renders identical grey boxes (180/3600 frames tested). Diagnosis: either the framebuffer is never written (rendering never enabled / render_bg never true) or every pixel computes transparent. SMB ROM confirmed to write $2000 5x, $2001 3x, poll $2002 6x, reset vector $8000 points at real SEI init code. NMI forwarding fix applied (take_nmi/set_nmi moved inside the frame loop) but did not change the grey output. Next step is machine-state diagnosis
+- PPU 2c FIXED - SMB BACKGROUND RENDERS CORRECTLY. Three bugs found and fixed, in order:
+  1. NMI fired unconditionally at vblank (src/ppu.rs dot()): the PPU asserted nmi_pending on every vblank regardless of the $2000 NMI-enable bit (ctrl & 0x80). Game boots with NMI off, so every frame the CPU got yanked into the NMI handler mid-boot, pushing stack and spinning in the RAM-clear loop at $90CC (SP dropped 8 bytes/frame, PC pinned at $90DE, palette/nametable never written = all grey). Fixed by gating nmi_pending on ctrl & 0x80. Verified with debug_out/state.txt + pctrace.txt (src/dump.rs dbg mode)
+  2. Attribute table fetch wrong (src/ppu.rs bg_fetch): column term used (v & 0x07) instead of ((v >> 2) & 0x07), and quadrant selector used coarseX bit 0 / coarseY bit 0 instead of bit 1 ((v & 0x40) >> 4 | (v & 0x02)). Produced green/brown logo colors, invisible letters (blank lines through P/R), and wrong-palette garbage on the right edge. Fixed both formulas per nesdev
+  3. Background pipeline timing (src/ppu.rs dot/bg_fetch, modeled after olcNES Part 4 reference): shifters must shift ONLY during fetch windows (cycles 2-257 and 321-337), with LoadBackgroundShifters + TransferAddressX at cycle 257 (preloads the NEXT scanline's first tile), IncrementScrollY at 256, idle NT fetches at 338/340, TransferAddressY on the pre-render line 280-304. Our code shifted every dot and copied horizontal at 255 -> each scanline started mid-tile, image shifted showing page 1 + page 2. Rewrote dot() with windowed shifters, (cycle-1)%8 fetch phases, load_shifters/update_shifters helpers, bit-mux fine-X (0x8000 >> x) in render_bg_pixel. Frame now renders pixel-correct with correct colors
+- ACCEPTANCE MET: SMB renders the full frame correctly (background). Mario himself is a sprite and is NOT rendered yet - that's the next milestone (PPU-2 sprites + $4014 OAM DMA)
+- PPU-2 3a SPRITES DONE: $4014 OAM DMA (bus.rs routes to Ppu::oam_dma, copies 256 bytes from CPU RAM page through the 2KB mirror), sprite evaluation at cycle 257 (8 sprites per scanline, overflow flag bit 5, sprite-0 tracking), sprite pattern fetch at cycle 340 (8x8 via ctrl bit 3, 8x16 via tile id bit 0, V-flip with 7-row inversion, H-flip via reverse_bits, hi plane +8), per-sprite shifters with X countdown (decrement X until 0 then shift, cycles 1-257), and render_pixel compositing (bg vs sprite priority via attr bit 5, sprites use palettes 4-7, sprite-0 hit sets status bit 6 at cycle>=9). Fixed one integration bug: the old bg-only pipeline block was left in dot() duplicating the new combined block (shifters shifted/fetched twice per dot) - deleted the old block. ACCEPTANCE MET: Mario visible and the coin sprite animates across frames
 - Backup library mapper audit: mappers 0 (NROM) and 1 (MMC1) cover many games; still need mapper 2 (UNROM: Castlevania, Contra, Megaman 1), mapper 4 (MMC3: SMB2, SMB3, Lolo 2), mapper 7 (AOROM: Who Framed Roger Rabbit)
 - Finding: real commercial games rarely use illegal opcodes; none of the backup library needs them. Official-only CPU is sufficient for the goal of playing these games
 
@@ -58,13 +63,25 @@ Phases in order:
 1. NMI/IRQ servicing - DONE (see Done section). cpu_interrupts.nes verification deferred to the last milestone (needs APU frame-counter IRQ)
 2. PPU-1 rendering core - PARTIAL: 2a (palette/render) and 2b (registers/VRAM/open-bus) DONE (see Done section). Remaining: full background rendering in ONE merged step - timing + scroll + background pipeline together, no intermediate gating (we do not test until the full PPU exists). Acceptance: SMB title screen renders to PPM via main.rs run_cart. NEXT. Confirmed decisions: full dot-accurate scanline model, loopy v/t/x/w scroll system, Cartridge passed as parameter, open-bus tracking in the bus, hardware-accurate throughout (same philosophy as the CPU). Merged step:
 
-   2c. Full background renderer - IMPLEMENTED but BROKEN (grey screen, see Done section). Code complete and reviewed: timing, loopy scroll, background pipeline, fine-X, mirroring fix, transparent pixel fix, NMI forwarding fix all in. Acceptance NOT met yet: SMB renders uniform grey (framebuffer all 0x00). Diagnostics pending
-2d. CURRENT TASK - diagnose the grey screen. The framebuffer is all 0 (dark grey), meaning rendering is either never enabled or every pixel is transparent. Two-step plan:
-   - Step 1 (quick inline probe): temporarily print per-frame state from run_cart - CPU PC (stuck loop?), PPU mask bit 3 (rendering enabled?), status, palette[0..4] (game wrote colors?), framebuffer non-zero pixel count (pipeline producing?). Needs small read accessors on Cpu (pc/a/x/y/sp/p) and Ppu (ctrl/mask/status/scanline/cycle/palette/framebuffer_nonzero) and NesBus (ram/ppu)
-   - Step 2 (full dump module): new src/dump.rs writing machine state to text files, recreated fresh each run (clear + new files). Write debug_out/state.txt with CPU regs + PPU regs + palette + nametable + zero-page + framebuffer non-zero count, plus debug_out/pctrace.txt appending CPU PC each frame (identical lines = infinite loop). cargo run -- dbg <rom> mode clears debug_out/ and renders/, runs N frames, writes snapshot
-   - Expected outcomes: PC trace identical every frame = stuck loop (look at what the CPU polls); mask never gets bit 3 + palette stays zero = PPU writes not landing (check Ppu::write masking / vram_write routing); regs set but framebuffer 0 = pipeline/render_bg bug
-   - After diagnosis, fix and re-run until SMB title screen appears in renders/frame_XXXX.ppm
-3. PPU-2 sprites + scrolling + $4014 OAM DMA: makes SMB actually playable
+   2c. Full background renderer - DONE. Acceptance MET: SMB renders correctly (colors correct, no shift, no holes). Mario missing = sprites not yet implemented
+2d. DONE - diagnosis + fix. Built src/dump.rs dbg mode (state.txt + pctrace.txt per frame). Found 3 bugs (see Done section): unconditional NMI, attribute address/quadrant formulas, and pipeline timing (shift windows + cycle-257 preload). All fixed, verified by renders/ output
+3. NEXT: PPU-2 sprites + input + GUI window - makes SMB actually playable (Mario + enemies visible AND moveable). Detailed plan below. Four phases, sprites first (verifiable headless via PPM + dbg), then input logic (testable in isolation), then the window (first external deps):
+
+   3a. SPRITES - DONE (see Done section). Acceptance MET: Mario + coin sprite visible, coin animates
+   3b. NEXT: INPUT (new src/input.rs, pure logic, testable without GUI):
+       - InputSource trait (the ONLY new trait): fn buttons(&mut self) -> u8, NES button bit order. Impls: KeyboardInput (winit later), BotInput for automated tests (e.g. "hold right 120 frames" to verify scrolling headlessly)
+       - Controller struct (concrete, NOT a trait - fixed hardware protocol): holds Box<dyn InputSource>, strobe latch + shift register for $4016/$4017 semantics. read/write protocol implemented once here
+       - Keyboard defaults: Z=A, X=B, Shift=Select, Enter=Start, Arrows=D-pad. Pure mapping fn, unit-testable
+       - One Controller per player ($4016 = P1, $4017 = P2); SMB1 is single-controller, two-player support for SMB2 later
+
+   3c. BUS WIRING (src/bus.rs): add Controller(s) to NesBus, $4016 write = strobe, $4016/$4017 read = shift out one bit (open-bus for unused bits). Bus stays a trait; controller wiring lives in the concrete NesBus impl like everything else
+
+   3d. GUI WINDOW (src/render.rs + new deps): first external crates (egui + egui-winit + winit). main.rs owns the frame loop for ALL modes (nestest/blargg/cart/dbg/gui) - window is passive, renderer is dumb:
+       - Renderer trait gains two default no-op methods (PPM inherits them): fn should_close(&self) -> bool { false }, fn poll_input(&mut self, controller: &mut Controller) {}
+       - WindowRenderer: egui + winit impl of Renderer. present() converts palette indices -> RGB via index_to_rgb, uploads as texture, draws. poll_input() maps winit key events -> Controller bits. should_close() from winit close request
+       - PPM stays as headless/dbg output; renders/ no longer written for normal GUI runs (was ~1MB/frame, heavy)
+       - New run_gui <rom> mode: event pump -> one emulated frame -> present, 60fps
+       - Acceptance: walk Mario in the window, screen scrolls correctly between nametables (this is how scrolling gets verified - the scroll logic itself is already fixed and correct)
 4. GUI (egui + winit, first external deps): display framebuffer, 60fps loop, keyboard -> controller ($4016/$4017). First "games running on screen" moment
 5. Mappers: 2 (UNROM), 7 (AOROM) simple; 4 (MMC3) complex - includes scanline IRQ counter required for SMB3 status bar. Verified by running the real backups
 6. APU audio: 5 channels, frame counter -> IRQ, mixing. Verified with SMB
@@ -77,7 +94,8 @@ Blargg/illegal background: ~76 illegal opcodes in the nestest log (23 undocument
 ## Decisions
 
 - No external dependencies yet, keeping it pure std until the GUI milestone
-- GUI choice: egui + winit (decided, not yet used)
+- GUI choice: egui + winit (decided, not yet used); main.rs owns the frame loop for all modes, window is passive
+- InputSource is a trait (Box<dyn InputSource>) so input sources are pluggable: keyboard, gamepad, bot/test harness. Controller (shift-register protocol) is a concrete struct - the protocol is fixed hardware, only the button source varies
 - Scope: cartridge + CPU first, verified headless before graphics
 - Bus is a trait (impl Bus) so the CPU works against any memory layout (real bus, test bus, debug bus)
 - Flags stored as a raw u8 with named bit-mask constants (FLAG_CARRY etc.)