feat(cartridge): add explicit Flash identification and banked reads

docs/architecture.md

@@ -49,6 +49,9 @@ The repository is a Cargo workspace with three crates:
 | `crates/gba-core/src/cpu/tests.rs` | Condition truth tables and immediate arithmetic tests |
 | `crates/gba-core/src/cpu/instruction_tests.rs` | Register operations, transfers, branches, and edge cases |
 | `crates/gba-core/src/cartridge.rs` | Explicit GPIO/RTC selection, ROM read overlay, pin directions, caller-clock routing, and bounded diagnostics |
+| `crates/gba-core/src/cartridge/flash.rs` | Explicit save devices, Macronix identification/read controller, bank selection, and unsupported-write diagnostics |
+| `crates/gba-core/tests/flash.rs` | Erased/supplied images, chip IDs, all bank addresses, invalid commands, reset limits, DMA rejection, and RTC independence |
+| `crates/gba-core/src/memory/flash_step_tests.rs` | ARM/Thumb Flash writes and RAM reads, wait costs, staged IDs, fetch restrictions, and failed-step/preflight isolation |
 | `crates/gba-core/src/cartridge/rtc.rs` | RTC framing, control/calendar commands, read snapshots, complete writes, and reset |
 | `crates/gba-core/src/cartridge/calendar.rs` | Validated decimal calendar, BCD representation, checked epoch conversion, and bounded elapsed-time arithmetic |
 | `crates/gba-core/src/cartridge/calendar/tests.rs` | Calendar field validation, century-wide rollovers, hour modes, and large/split advances |

docs/hardware/cartridge-gpio.md

@@ -9,7 +9,8 @@ Unsupported operations and invalid calendar payloads return diagnostics.
 ## Selection
 
 `Memory::set_cartridge_hardware(CartridgeHardware::Rtc)` attaches the bounded interface with initial state.
-`CartridgeHardware::None` is the default. Selecting either option replaces peripheral state, without changing ROM bytes.
+`CartridgeHardware::None` is the default. Selecting either option replaces GPIO/RTC state, without changing ROM bytes.
+The separately selected [Flash device](saves.md) and its array remain unchanged.
 Call this API between machine steps. The core does not inspect filenames, game headers, or library signatures to select hardware.
 
 The desktop enables this interface with `--rtc`, in either ROM execution mode:

docs/hardware/cartridge.md

@@ -33,14 +33,18 @@ It does not decode archives or ELF executables. Supply a raw binary with an ARM
 Headerless original programs are accepted.
 Reads past supplied cartridge bytes remain explicit memory errors, not open-bus values.
 All three Game Pak ROM windows use the same supplied bytes and existing wait-state rules.
-Ordinary cartridge bytes remain read-only. Save devices remain unsupported.
+Ordinary cartridge bytes remain read-only.
+Optional `--save-type flash64` or `--save-type flash128` enables [Flash identification and array reads](saves.md).
+The desktop starts an erased device and does not load or write save files. Programming and erase remain diagnostic.
 Optional `--rtc` selection enables the bounded [Game Pak GPIO and RTC calendar interface](cartridge-gpio.md).
 It supports date/time reads, complete writes, reset, and explicit elapsed-time updates. RTC interrupts and persistence remain unsupported.
 The desktop seeds UTC once, then supplies monotonic host elapsed seconds independently of GBA cycles and STOP.
 
 Both modes call `bios::boot` with the loaded bytes.
 With `--rtc`, the host then selects the cartridge peripheral before the first machine step.
-Without that option, no cartridge peripheral is attached. Duplicate `--rtc` options are rejected.
+Without that option, no RTC is attached. Duplicate `--rtc` options are rejected.
+Save-device selection is independent of RTC selection. Omitting `--save-type` leaves save memory unmapped.
+Unknown save types and duplicate options fail before file access. No ROM-based hardware detection is used.
 The [original BIOS replacement](bios.md) executes its minimal boot before entering `0x08000000` in ARM System mode.
 There is no command-line option for external BIOS files.
 Unsupported services remain diagnostics. RegisterRamReset now accepts sound/serial reset flags, including `r0=0xff`, within the initialization subset.

docs/hardware/cpu.md

@@ -351,6 +351,8 @@ Palette and video RAM cost 1 cycle for byte/halfword accesses and 2 for words, w
 ROM costs include one cycle plus the configured wait states for each 16-bit transfer.
 A ROM word uses two halfword accesses; its second halfword always uses sequential timing.
 Accesses at 128 KiB ROM boundaries force non-sequential timing for the first halfword.
+Supported save-byte accesses use WAITCNT bits 0–1: one cycle plus 4, 3, 2, or 8 wait states.
+Sequential and non-sequential save requests use the same nominal cost. Flash data accesses cancel the opcode prefetch queue.
 
 `WAITCNT` resets to zero and supports byte, halfword, and word access.
 The writable mask is `0x5fff`; the Game Pak type flag reads as GBA, and the upper halfword reads as zero.
@@ -421,6 +423,7 @@ Important timing limits:
 - Refill cost calculation does not read target bytes. ARM/Thumb instruction-buffer and local IWRAM bus-history samples add no extra cycles.
 - Target-pair sampling cannot fail the branch early. An invalid branch target still fails on the following instruction fetch.
 - Game Pak prefetch is nominal. Full-buffer restart, page boundaries, cancellation, and live WAITCNT changes need independent hardware validation.
-- PHI and SRAM wait fields are stored; PHI output and SRAM mapping are not implemented.
+- Save wait fields drive the supported Flash byte-access costs. PHI output and SRAM mapping remain unimplemented.
+  See [Flash access restrictions](saves.md#bus-behavior); wider save transfers and physical bus timing remain unsupported or unverified.
 - External work RAM timing is fixed. The undocumented memory-control register is not implemented.
 - Exact DMA startup/resumption delays, display-bus contention, and timer startup/register-write delays remain unmodeled.

docs/hardware/saves.md

@@ -0,0 +1,122 @@
+# Cartridge Flash identification and read subset
+
+The core supports explicit Macronix Flash selection, chip identification, array reads, and 128 KiB bank selection.
+Programming, erase, busy polling, and host save-file persistence remain unimplemented.
+This is not working game-save support. Unsupported writes fail instead of reporting a completed save.
+SRAM, EEPROM, and other manufacturers' protocols remain separate work.
+
+## Selection and initial data
+
+The desktop accepts either `--save-type flash64` or `--save-type flash128` in ROM terminal/window modes.
+The option is independent of `--rtc`. Omitting it leaves save memory unmapped.
+Unknown values and duplicate options fail before opening the ROM.
+
+```sh
+direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --save-type flash128 --steps 3000000
+direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --save-type flash128 --window --frames 60
+```
+
+Selection is explicit, not inferred from a filename, ROM signature, or the first write.
+A 64 KiB device cannot silently become a 128 KiB device.
+The desktop starts each selected device with erased `0xff` bytes and reports the read-only subset's limits.
+It does not look for, read, create, or overwrite a save file. Existing game saves remain untouched.
+The ROM suite schema still uses no save device by default and has no save-selection field yet.
+
+Core APIs on `Memory`:
+
+- `set_save_device(SaveDevice)` replaces save hardware and initializes its array to erased bytes.
+  `None`, `Flash64`, and `Flash128` are available. The call preserves GPIO/RTC state.
+- `load_save_image(&[u8])` supplies an exact-capacity image and resets command state, ID mode, and bank selection.
+  A wrong length or missing device changes nothing. This is host setup, not an emulated program operation.
+- `save_image()` inspects the complete array, independently of ID mode or selected bank.
+  It returns `None` when no save device is selected.
+
+Configuration and image replacement occur between machine steps. No filesystem operations belong to the core.
+Selecting GPIO/RTC hardware does not replace an attached save device or its bytes.
+This feature can inspect caller-supplied images but cannot modify their data through Flash commands.
+
+## Bus behavior
+
+Only `0x0e000000` through `0x0e00ffff` are mapped when a device is selected.
+The Flash interface uses byte accesses. Halfword/word transfers, DMA, and instruction fetches remain diagnostic.
+Unverified aliases outside this window remain unmapped rather than returning mirrored data.
+Ordinary ROM writes remain read-only.
+
+CPU Flash reads must execute from external or internal work RAM, as required by GBATEK's access description.
+A read from ROM/BIOS code reports a diagnostic rather than inventing a value for an unsupported bus sequence.
+Host byte inspection has no CPU execution restriction. CPU command writes may execute from ROM.
+
+WAITCNT bits 0–1 select save wait states 4, 3, 2, or 8.
+The nominal byte-access costs are therefore 5, 4, 3, or 9 cycles, for both sequential and non-sequential requests.
+Save waits do not alter ROM wait fields. Flash data accesses cancel Game Pak opcode prefetch through the existing nominal model.
+Changing only save wait bits preserves the queue until a cartridge access cancels it.
+These costs are source-backed estimates, not physical timing measurements.
+
+## Commands
+
+Use these byte addresses and values for the unlock prefix:
+
+1. Write `0xaa` to `0x0e005555`.
+2. Write `0x55` to `0x0e002aaa`.
+3. Write a command byte to `0x0e005555`.
+
+Supported commands after the prefix:
+
+| Command | Behavior |
+| --- | --- |
+| `0x90` | Enter chip-identification mode |
+| `0xf0` | Exit identification mode and return to array reads |
+| `0xb0` | On Flash128 only, accept a bank byte next at `0x0e000000` |
+
+In ID mode, byte zero is the manufacturer and byte one is the device:
+
+| Selection | Manufacturer | Device | Combined ID |
+| --- | --- | --- | --- |
+| Flash64 | `0xc2` | `0x1c` | `0x1cc2` |
+| Flash128 | `0xc2` | `0x09` | `0x09c2` |
+
+Other ID-mode addresses remain diagnostic because their values are not established by this subset.
+Array mode reads bytes from the selected 64 KiB bank. Flash64 always uses bank zero.
+Flash128 accepts bank values zero and one only. Bank changes do not alter stored data.
+Entering and leaving ID mode preserves the selected bank.
+Reads during an incomplete unlock retain the previous read mode and bank.
+
+For the documented 64 KiB Macronix device, a direct `0xf0` write at `0x0e005555` resets command/ID state.
+For Flash128, the same write is accepted only as a redundant reset when already idle in array mode.
+This bounded no-op matches the inspected emulators' idle behavior. It does not establish direct ID exit or busy-command cancellation.
+Flash128 still requires the full unlock prefix to exit ID mode. Direct reset during an incomplete unlock remains diagnostic.
+No matching manufacturer datasheet or physical measurement was used to claim broader 128 KiB reset behavior.
+
+`0xa0` byte-program setup and `0x80` erase setup remain diagnostic at the command write.
+No operation starts, data changes, busy state, completion flag, or interrupt is fabricated.
+Unknown commands, invalid prefixes, and invalid bank writes are also diagnostic.
+Rejected accesses retain the previous command state and bytes, so retrying the same access gives the same result.
+This atomic diagnostic policy does not reproduce hardware handling of every malformed sequence.
+
+## Transactions and validation
+
+The small Flash controller state joins the existing cartridge machine-step transaction.
+The full save image stays outside the copied controller state; this read-only subset never mutates it during emulation.
+Failed CPU or DMA steps discard speculative controller changes and timing.
+Block-store preflight rejects a wide Flash destination before committing earlier RAM or device writes.
+HALT/STOP and elapsed cycles cannot create Flash completion events. There is no pending program or erase operation to finish.
+
+Original tests cover both device IDs, every byte in both banks, exact image lengths, erased state, invalid sequences, and unchanged ROM/save data.
+They distinguish redundant idle reset from unsupported Flash128 ID/partial-command reset.
+ARM/Thumb probes verify ROM command writes, RAM byte reads, wait settings, restrictions, and retryable failed steps.
+Additional tests cover staged ID reads, block rollback, DMA rejection, GPIO/RTC independence, and prefetch cancellation.
+Desktop tests execute an original IWRAM byte reader with explicit device selection in terminal and native-window modes.
+No game code, save file, or copyrighted assets are included in these tests.
+
+## Remaining work
+
+Implement and validate program/erase commands, busy polling, cancellation, and byte-program bit transitions before claiming save functionality.
+Then add explicit host save loading and safe persistence, with exact-size validation and restart tests.
+Do not overwrite existing files or add immediate-success responses merely to pass a game check.
+
+## References
+
+- [GBATEK backup Flash](https://problemkaputt.de/gbatek-gba-cart-backup-flash-rom.htm): capacities, IDs, unlock sequences, bank selection, 64 KiB Macronix reset, byte-only access, and RAM-execution requirements.
+- [GBATEK](https://mgba-emu.github.io/gbatek/), WAITCNT section: save wait fields and one-cycle-plus-wait timing.
+- [mGBA savedata at 3a5e34be](https://github.com/mgba-emu/mgba/blob/3a5e34be33dc7f8f707e5bc9db69e8a430046f21/src/gba/savedata.c): comparison for controller phases, bank addressing, ID overlays, and idle reset handling. Its default chip IDs differ; its write/erase timing and busy approximation are not copied.
+- [ares Flash at 9408cb43](https://github.com/ares-emulator/ares/blob/9408cb43d4948fc3ea6e152a307a34348df3fe04/ares/gba/cartridge/flash.cpp): comparison for IDs, banking, unlocked ID exit, and unchanged idle state after an unrecognized direct reset. Its immediate program/erase behavior and permissive unlock handling are not adopted.

docs/research/emerald-reset.md

@@ -25,8 +25,8 @@ Byte, halfword, word, block-store, and DMA validation retain explicit errors wit
 Use a local ROM that you may lawfully use:
 
 ```sh
-direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --steps 2000000
-direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --window --frames 60
+direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --save-type flash128 --steps 3000000
+direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --save-type flash128 --window --frames 60
 ```
 
 The earlier reset-only implementation stopped at master sound enable (`0x04000084`, PC `0x082e0518`).
@@ -71,16 +71,22 @@ The calendar model now supports date/time reads, complete writes, reset, and cal
 Core tests inject deterministic time. Desktop `--rtc` uses UTC startup and monotonic elapsed time, including during GBA STOP.
 Select it explicitly; ordinary ROM bytes and other ROMs' default hardware remain unchanged.
 
-Both terminal and native runs with `--rtc` now reach a Flash unlock write:
+RTC support then reached a Flash unlock write (`0xaa` at `0x0e005555`, PC `0x082e1892`).
+The explicit [Flash read subset](../hardware/saves.md) now handles identification, array reads, and bank selection.
+Select `--save-type flash128` for this bounded run; the device begins erased and no save file is opened.
+A later redundant `0xf0` write occurred after returning to idle array mode.
+The subset accepts that no-op without claiming direct Flash128 ID exit or busy-command cancellation.
+
+Both terminal and native runs with these options now reach Joybus mode selection:
 
 ```text
-Steps: 964375; instructions: 961679; IRQ entries: 80; DMA units: 2616; HALT idle: 0
-Nominal cycles: 3546961
-PC=0x082e1892
-unmapped memory at 0x0e005555
+Steps: 1389249; instructions: 1386088; IRQ entries: 89; DMA units: 3072; HALT idle: 0
+Nominal cycles: 4688039
+PC=0x082deeca
+unsupported Joybus serial mode: write 0xc0 at 0x04000135
 ```
 
-The native run captures twelve startup frames. These do not establish a working title screen or gameplay.
+The native run captures sixteen startup frames. These do not establish a working title screen or gameplay.
 Audio-device behavior is validated by original tests, not by audible game output.
 The window run does not reach its requested frame limit and correctly exits with failure.
 Terminal execution is also diagnostic, not a compatibility pass.
@@ -92,9 +98,9 @@ Workspace debug/release tests, strict Clippy, public ARM/Thumb/memory/BIOS check
 Native ROM-window tests and graphics smoke modes pass on Darwin arm64.
 The pinned Pong debug/release reports match.
 
-The next requirement is a cartridge Flash save device, beginning with command unlock and identification.
-The failing state contains value `0xaa` and address `0x0e005555`, matching the documented unlock sequence.
-Research device selection, IDs, banking, program/erase, busy behavior, and safe persistence before claiming save compatibility.
+The next startup requirement is disconnected Joybus configuration, beginning with `RCNT=0xc000`.
+Research idle registers, absent-device status, and mode transitions before implementing them. Do not fabricate a connected peer.
+Flash programming, erase, busy behavior, and safe persistence remain required before claiming save compatibility.
 RTC persistence and cartridge IRQ behavior remain separate missing features.
 Ordinary ROM writes remain read-only. Without `--rtc`, the earlier GPIO diagnostic is still expected.
 This result does not establish gameplay, linked transfers, or cartridge/serial GPIO interrupt support.
@@ -108,4 +114,5 @@ Cartridge saves remain a separate required feature. SRAM alone will not support
 
 Hardware and emulator references are recorded in the linked subsystem documents.
 [GBATEK backup Flash](https://problemkaputt.de/gbatek-gba-cart-backup-flash-rom.htm) identifies the `0xaa`/`0x5555` unlock and chip-identification sequence.
-The bounded failure establishes an access requirement, not the device's capacity or full save compatibility.
+The selected device is an explicit test configuration, not a cartridge-capacity determination from the filename or unlock write.
+The bounded run does not establish save compatibility.

docs/status.md

@@ -50,7 +50,7 @@ Update this file when a feature lands or a limit is removed.
 - Code costs use actual ARM PC+8/Thumb PC+4 source fetches and branch/exception target pairs, including region and ROM boundaries.
 - IRQ entry samples its discarded incoming-state fetch before the ARM vector pair, with local IWRAM history updates.
 - Persistent fetch access kinds follow CPU data/internal work, compose with DMA resume, and reset after target refills.
-- Game Pak wait-state control (`WAITCNT`) for all three ROM windows.
+- Game Pak wait-state control (`WAITCNT`) for all three ROM windows and supported save-byte accesses.
 - Bit 14 enables a nominal eight-halfword opcode prefetch queue, with partial fetches, cancellation, and DMA/idle integration.
 - Staged timer/audio/serial clocks follow CPU and DMA bus-completion phases, including timer/serial IF reads, acknowledgements, and failed-step rollback.
 - The unchanged original ARM cancellation probe matches both published read interval totals and its unadjusted timer samples.
@@ -79,7 +79,9 @@ Update this file when a feature lands or a limit is removed.
 - Explicit cartridge RTC selection with first-window GPIO read enable, direction/latch behavior, and serial calendar/control transactions.
 - Validated RTC date/time, BCD transfers, read snapshots, complete writes/reset, and caller-supplied battery-clock advancement.
 - Desktop `--rtc` seeds UTC once and supplies host elapsed seconds independently of CPU cycles and STOP.
-- Cartridge GPIO changes participate in CPU/DMA rollback and block-store preflight without modifying ROM bytes.
+- Cartridge GPIO and Flash controller changes participate in CPU/DMA rollback and block-store preflight without modifying ROM bytes.
+- Explicit Macronix Flash64/Flash128 identification, read-only arrays, and 128 KiB bank selection.
+- Exact-size core save-image initialization and inspection; desktop save selection starts erased and performs no save-file access.
 - Raw ROM-file loading with original BIOS boot, terminal diagnostics, and final CPU/step reports.
 - Firmware boot initializes BG2/BG3 identity scales for bitmap and affine programs that do not program their own matrices.
 - RegisterRamReset supports disabled sound and disconnected serial initialization, including the common `r0=0xff` request.
@@ -142,7 +144,9 @@ Internal affine origins, vertical window flags, and vertical mosaic counters tra
 Horizontal window comparators retain four-cycle event history.
 Sprite rows prepare one line ahead with a whole-row cycle40 sample and nominal per-row work limits.
 Individual fetch timing, hardware-accurate work cutoffs, video-bus contention, and per-pixel color composition remain unimplemented.
-There is no host audio output or cartridge save support.
+There is no host audio output or save writing/persistence.
+The [Flash subset](hardware/saves.md) supports explicit device selection, identification, array reads, and banking.
+Flash programming, erase, busy polling, wider accesses, unverified aliases, and other save-device protocols remain diagnostic or unimplemented.
 The optional [cartridge GPIO/RTC subset](hardware/cartridge-gpio.md) supports calendar/control transfers and explicit clock updates, selected with `--rtc` in ROM modes.
 RTC persistence, interrupts, invalid-date correction, physical subsecond timing, GPIO aliases, and byte writes remain unsupported or unverified.
 The core uses deterministic caller time. Desktop RTC runs use host UTC/elapsed time and are not fully deterministic.
@@ -169,7 +173,8 @@ It also completes a CpuSet call to address zero through the corrected ignored BI
 It also accepts an external-clock serial request without inventing clock edges or completion.
 It now also completes internally clocked normal transfers and selects idle multiplayer mode.
 With explicit `--rtc` selection, it also passes Game Pak GPIO configuration and RTC calendar reads.
-It next stops at a Flash unlock write (`0x0e005555`, PC `0x082e1892`). Cartridge save devices remain unimplemented.
+With `--save-type flash128`, it also passes Flash identification and reaches a later startup check.
+It next stops at Joybus mode selection (`0x04000135`, PC `0x082deeca`). Flash writing and persistence remain unimplemented.
 Without `--rtc`, cartridge GPIO writes still return read-only diagnostics.
 No title-screen, gameplay, or audible-game compatibility is established.
 See [the startup result](research/emerald-reset.md) for the bounded run and next investigation.
@@ -201,7 +206,7 @@ Host inspection and instruction fetches remain strict. Other unmapped reads retu
 Reads beyond the supplied cartridge bytes also return errors.
 Direct memory-bus halfword and word accesses require alignment.
 CPU load/store instructions apply ARM7TDMI alignment and rotation rules before accessing the bus.
-Ordinary ROM writes remain read-only. Only the explicitly selected cartridge GPIO register subset accepts writes.
+Ordinary ROM writes remain read-only. Explicitly selected cartridge GPIO and supported Flash command writes are separate from ROM storage.
 
 ## Next steps
 

docs/testing.md

@@ -73,6 +73,11 @@ ARM/Thumb and DMA3 checks retain Game Pak costs; staged fetches, rejected edges,
 Desktop tests execute original ARM calendar commands in terminal and native-window modes with explicit `--rtc` selection.
 Host-adapter tests inject UTC epoch values and elapsed durations without sleeping. Guest time changes survive subsequent elapsed updates.
 Physical pin timing, invalid-date hardware correction, GPIO aliases, and battery persistence remain unverified or unimplemented.
+Flash regressions use original command sequences and exact-size generated arrays, not game saves.
+They check device IDs, every byte in both 128 KiB banks, erased state, image validation, reset limits, and unsupported program/erase commands.
+ARM/Thumb probes verify RAM byte reads, ROM command writes, all save wait settings, staged ID state, and failed-step rollback.
+Wide accesses, DMA, instruction fetches, and CPU reads outside work RAM retain explicit diagnostics.
+An original desktop ROM installs its Flash byte reader in IWRAM; terminal/native tests check explicit selection and unchanged files.
 They verify explicit activation errors and atomic byte/word/block-store/DMA failure behavior.
 The optional [local Emerald startup check](research/emerald-reset.md) now reaches sound activation but still fails deliberately there.
 [Jev evidence review](jev-debugging.md) is optional and never changes deterministic test verdicts.

docs/usability-roadmap.md

@@ -41,11 +41,12 @@ This exposed and corrected missing firmware affine-scale initialization, without
 Frame-based scenarios and the preparation adapter now make the result repeatable.
 A local Emerald run now passes its initial all-device reset, master sound enable, and pulse/noise triggers.
 It also passes normal serial transfers and idle multiplayer configuration.
-With `--rtc`, it passes Game Pak GPIO setup and RTC calendar reads, then stops at a Flash unlock write.
+With `--rtc --save-type flash128`, it passes Game Pak GPIO setup, RTC reads, and Flash identification.
+It next stops at Joybus serial-mode selection.
 The core has tested Direct Sound, both pulse channels, and noise channel 4.
 Wave channel 3, a continuous sample stream, and desktop audio output remain missing.
-See [the runtime result](research/emerald-reset.md). Flash identification and its save protocol are the next demonstrated startup requirement.
-The separate save requirement remains cartridge SRAM, followed by safe host save persistence.
+See [the runtime result](research/emerald-reset.md). Disconnected Joybus configuration is the next demonstrated startup requirement.
+The separate save requirement includes Flash programming/erase and safe host persistence. Identification/read support is not successful saving.
 SRAM is byte-addressable battery-backed save memory. Flash and EEPROM remain separate protocols.
 
 [Paperdomo101/2048-GBA at ae36800d](https://github.com/Paperdomo101/2048-GBA/tree/ae36800dfa1314f96c4c8785b5c2d077fb731aff) is the next independent candidate.
@@ -56,8 +57,9 @@ A reproducible source build or an accessible upstream ROM is needed before recor
 
 Next implementation steps:
 
-1. Verify SRAM bus widths, mirroring, erased state, and wait-state behavior against independent references.
-2. Add explicit cartridge save-device selection and original core regressions. Keep absent-device accesses diagnostic.
+1. Research the demonstrated Joybus configuration failure without inventing a connected device.
+2. Extend explicit Flash selection with verified programming, erase, and busy behavior. Keep absent devices and unsupported commands diagnostic.
+   Add SRAM separately when the independent candidate requires it; verify its widths, mirroring, and wait behavior first.
 3. Add bounded save loading and safe persistence in the desktop crate. Do not put file operations in the core.
 4. Test a save/restart/load cycle across processes with original ROM instructions before external-game validation.
 5. Resume the second-game run and implement demonstrated audio requirements rather than accepting writes without behavior.