fix(serial): gate RCNT interrupt and Joybus controls by mode

docs/architecture.md

@@ -66,6 +66,7 @@ The repository is a Cargo workspace with three crates:
 | `crates/gba-core/src/memory/audio_step_tests.rs` | Audio access phases, shadow validation, and CPU/DMA failure rollback |
 | `crates/gba-core/src/io/inactive.rs` | Disconnected serial initialization with explicit unsupported-activity validation |
 | `crates/gba-core/tests/inactive_devices.rs` | Device masks, wave RAM, GPIO pull-ups, serial data, and failed CPU/DMA write isolation |
+| `crates/gba-core/tests/serial_control.rs` | RCNT mode gating, inactive bits, byte/halfword lanes, CPU/DMA diagnostics, and interrupt isolation |
 | `crates/gba-core/src/io/timer_step.rs` | Staged timer/audio state, divider phase, timer IF bits, and sound refill requests at ordered CPU/DMA bus phases |
 | `crates/gba-core/src/memory/timer_step_tests.rs` | Timer access phases, coherent lanes, cascades, IF ordering, rollback, DMA, idle, and clock ownership |
 | `crates/gba-core/src/display.rs` | Display clock, scanline status, comparison edges, and display IRQ events |

docs/hardware/serial.md

@@ -11,10 +11,12 @@ Unsupported activity remains diagnostic rather than reporting a fabricated compl
 - `SIOCNT` at `0x04000128` retains normal 8/32-bit mode, IRQ configuration, clock selection, and the output-data bit.
   The retained mask is `0x500b`. The disconnected serial input is high, except when a general-purpose output drives it low.
   Transfer-start bit 7 and multiplayer/UART mode bit 13 return explicit errors.
-- `RCNT` at `0x04000134` retains general-purpose mode, output latches, and pin directions with mask `0x80ff`.
+- `RCNT` at `0x04000134` retains mode bits, interrupt configuration, output latches, and pin directions with mask `0xc1ff`.
+  With bit 15 clear, bits 8 and 14 are writable latches without GPIO interrupt or Joybus effects.
+  With bit 15 set, bit 14 selects Joybus; otherwise bit 8 enables GPIO interrupts. Both active configurations remain diagnostic.
   In general-purpose mode, each input reads high through its pull-up. Each output reads its output latch.
   `RCNT=0x8000` therefore reads back as `0x800f`, not `0x8000`.
-  Joybus mode and GPIO interrupt enable return errors. Normal-mode low-byte pin readback remains unmapped rather than guessed.
+  Normal-mode low-byte pin readback remains unmapped rather than guessed.
 - `JOYCNT` permits clearing already-empty status flags. Joybus interrupt enable is unsupported.
 - `JOY_RECV` and `JOY_TRANS` permit only zero writes and zero readback for reset initialization.
   Nonzero writes return an explicit error. Joybus status and data-transfer side effects are not implemented.
@@ -32,12 +34,15 @@ It uses ordinary ARM bus stores, not a host-side reset bypass.
 
 Original tests cover independent byte lanes, input pull-ups, output directions, reset flag selection, and explicit unsupported operations.
 Whole-access and block-store validation prevent a rejected control value from committing preceding bytes or registers.
+RCNT selection bits share the high byte. Each high-byte write replaces the complete selection, so validation needs no retained-mode shadow.
+Mode-gating tests cover every high-byte value, previous modes, low-byte preservation, CPU stores, DMA retries, and unchanged interrupt state.
+Inactive configuration bits do not wake HALT. RCNT word accesses still reject the unmapped padding at `0x04000136`.
 
 ## References
 
 - [GBATEK reset functions](https://problemkaputt.de/gbatek-bios-reset-functions.htm): reset flags, general-purpose selection, and the unconditional SIODATA32 side effect.
-- [GBATEK normal serial mode](https://problemkaputt.de/gbatek-sio-normal-mode.htm): data widths, input status, and control bits.
-- [GBATEK](https://mgba-emu.github.io/gbatek/): general-purpose pin directions and internal pull-ups.
+- [GBATEK normal serial mode](https://problemkaputt.de/gbatek-sio-normal-mode.htm): data widths, input status, control bits, and writable unused RCNT bits 8/14.
+- [GBATEK](https://mgba-emu.github.io/gbatek/): GBA general-purpose pin directions, internal pull-ups, SI falling-edge interrupts, and the SIO mode-selection table.
 - [mGBA BIOS implementation at 3a5e34be](https://github.com/mgba-emu/mgba/blob/3a5e34be33dc7f8f707e5bc9db69e8a430046f21/src/gba/bios.c): functional serial reset defaults, not copied source.
 
 Exact firmware write ordering and hardware pin timing remain unverified.

docs/research/emerald-reset.md

@@ -33,13 +33,18 @@ The earlier reset-only implementation stopped at master sound enable (`0x0400008
 The Direct Sound increment then reached a PSG channel 1 trigger (`0x04000065`, PC `0x082e03bc`).
 Channel 1 support reached the channel 2 trigger (`0x0400006d`, PC `0x082e03c0`).
 Both pulse channels then reached the noise trigger (`0x0400007d`, PC `0x082e03c4`).
-With noise channel 4 implemented, both runs now stop at general-purpose input/output (GPIO) serial interrupt enable:
+Noise channel 4 support then reached an incorrectly rejected RCNT write: `0x0100` at `0x04000134`, PC `0x082e2aac`.
+RCNT bit 15 was clear, so bit 8 did not enable general-purpose input/output (GPIO) interrupts.
+GBATEK documents bits 8 and 14 as writable but unused in normal mode.
+The serial model now retains these inactive bits. Effective GPIO interrupt enable and Joybus selection still return explicit errors.
+
+Both runs pass that write and now stop in the original BIOS replacement:
 
 ```text
-Steps: 395420; instructions: 393690; IRQ entries: 2; DMA units: 1728; HALT idle: 0
-Nominal cycles: 1328057
-PC=0x082e2aac
-unsupported GPIO serial interrupt enable: write 0x01 at 0x04000135
+Steps: 398019; instructions: 396289; IRQ entries: 2; DMA units: 1728; HALT idle: 0
+Nominal cycles: 1334271
+PC=0x00000378
+read-only memory at 0x00000000
 ```
 
 The native run captures five startup frames. These do not establish a working title screen or gameplay.
@@ -54,9 +59,10 @@ Workspace debug/release tests, strict Clippy, public ARM/Thumb/memory/BIOS check
 Native ROM-window tests and graphics smoke modes pass on Darwin arm64.
 The pinned Pong debug/release reports match.
 
-The next observed requirement is [serial control-register behavior](../hardware/serial.md), specifically RCNT bit 8.
-Check mode gating and interrupt-enable semantics before changing the current rejection.
-This diagnostic alone does not establish that the game needs an active link transfer.
+The next investigation is the BIOS replacement's attempted write to address zero at PC `0x00000378`.
+Trace the service arguments and original firmware routine before deciding whether the caller or service behavior is wrong.
+The diagnostic alone does not establish the root cause. Do not make BIOS memory writable to bypass it.
+The corrected RCNT write does not establish a need for active link transfers or GPIO interrupts.
 
 Noise now has deterministic counter clocks and shares tested length/envelope logic with the independent pulse channels.
 Sweep applies only to channel 1. Direct Sound has FIFO clocks and nominal DMA requests.

docs/status.md

@@ -142,6 +142,7 @@ The [audio subset](hardware/audio.md) supports Direct Sound, both PSG pulse chan
 It does not yet provide a continuous sample stream. Wave channel 3 playback and unverified sound-DMA pairings remain diagnostic.
 PSG timing and signed mixing are nominal; hardware startup edges and analog behavior remain unverified.
 The [serial initialization subset](hardware/serial.md) supports idle normal data and disconnected general-purpose pins, not active transfers.
+RCNT retains inactive bits 8/14 in normal mode. Effective GPIO interrupt enable and Joybus selection remain diagnostic.
 Mapped I/O covers DMA, timers, interrupts, WAITCNT, display control/status, background control/scroll/affine registers, window/effect registers, KEYINPUT/KEYCNT, POSTFLG, and HALTCNT.
 Keypad IRQs use a documented polling model; hardware retrigger edges and asynchronous input timing remain unverified.
 STOP implements keypad wake only. Serial/Game Pak wake sources, oscillator restart delays, and exact wake timing remain unimplemented or unverified.
@@ -151,9 +152,10 @@ ROM files can run in bounded terminal mode or a window with the original BIOS re
 ROM windows have no demo-specific startup checks. Input is sampled between bounded execution slices.
 Audio, saves, and external BIOS loading remain unavailable. ROM loading does not establish commercial-game compatibility.
 A local Emerald run now completes its all-device reset and master sound enable.
-It also passes the pulse and noise triggers, then stops explicitly at GPIO serial interrupt enable (`0x04000135`).
-No title-screen, gameplay, or audible-game compatibility is established.
-Its captured startup frames do not establish title-screen or gameplay compatibility. See [the startup result](research/emerald-reset.md).
+It also passes the pulse/noise triggers and normal-mode RCNT configuration.
+It next stops on an attempted write to address zero in the BIOS replacement at PC `0x00000378`.
+The cause remains under investigation. No title-screen, gameplay, or audible-game compatibility is established.
+See [the startup result](research/emerald-reset.md) for the bounded run and next investigation.
 See [cartridge loading](hardware/cartridge.md) for file limits, step budgets, and exit status.
 The [ROM suite runner](rom-tests.md) has original regressions and a [pinned public ARM baseline](public-arm-tests.md).
 The pinned public ARM ROM passes its result checkpoint in debug and release builds.