# Emulator Architecture and Proof Boundaries

## Layers

1. **MN103S CPU core and memory model** — instruction execution, aliases, trace,
   and peripheral hooks.
2. **Firmware harness and proof probes** — bounded CPU execution and explicit
   state injection.
3. **GDR SCSI/auth model** — stateful command handling and host-visible behavior.
4. **Media model** — XGD1 topology, resources, locked/unlocked geometry, and
   backing-image mapping.
5. **Host bridge** — JSONL/TCP/iSCSI transport and Windows-facing device behavior.
6. **Profile/orchestration layer** — separate device, media, session, proof, and
   test ownership.

## Closed READ(10) chain

```text
front dispatcher 0x9001C5F4
  -> class 0x48
  -> wrapper 0x9002EA7C
  -> handler 0x9001EED0
  -> CDB-shadow LBA 0x05D2..0x05D5
  -> assembled host LBA 0x05EC
  -> command state 0x05F0 = 0x11
  -> phase handoff 0x06F1 = 0x04
  -> main service loop 0x9001B285
  -> phase 0x04 handler 0x9001B4AE
  -> descriptor setup 0x9001B54E
  -> gate 0x05B6 & 0x04
  -> descriptor copy 0x9001B5EF
  -> descriptor LBA 0x06E4
  -> armed flag 0x06E0 = 0xF0
```

This is a **state-handoff proof**, not yet one uninterrupted call stack.

## Open window proof

The live bridge uses:

```text
unlocked media delta = 198144 = 0x00030600
```

The value is correct for the current media profile and live behavior. It is not
firmware-derived. An executed firmware consumer must show how descriptor output
and authentication/window state select or compute the mapping before this status
changes.

## Timer/MMIO boundary

Reaching the GDR HL handler and stalling in the loop at
`0x90006227..0x90006231` is positive parser/discriminator evidence. It is not a
parser failure. Deeper progress requires a more faithful timer/MMIO model.
