feat(cartridge): implement RTC calendar transfers and clock updates

docs/architecture.md

@@ -48,7 +48,11 @@ The repository is a Cargo workspace with three crates:
 | `crates/gba-core/src/cpu/transfer_tests.rs` | Stack, addressing, overlap, empty-list, and swap tests |
 | `crates/gba-core/src/cpu/tests.rs` | Condition truth tables and immediate arithmetic tests |
 | `crates/gba-core/src/cpu/instruction_tests.rs` | Register operations, transfers, branches, and edge cases |
-| `crates/gba-core/src/cartridge.rs` | Explicit GPIO/RTC selection, ROM read overlay, pin directions, serial command/control, and bounded diagnostics |
+| `crates/gba-core/src/cartridge.rs` | Explicit GPIO/RTC selection, ROM read overlay, pin directions, caller-clock routing, and bounded diagnostics |
+| `crates/gba-core/src/cartridge/rtc.rs` | RTC framing, control/calendar commands, read snapshots, complete writes, and reset |
+| `crates/gba-core/src/cartridge/calendar.rs` | Validated decimal calendar, BCD representation, checked epoch conversion, and bounded elapsed-time arithmetic |
+| `crates/gba-core/src/cartridge/calendar/tests.rs` | Calendar field validation, century-wide rollovers, hour modes, and large/split advances |
+| `crates/gba-core/tests/cartridge_gpio/calendar.rs` | Calendar wire transfers, snapshots, aborts, invalid payloads, reset, and independent HALT/STOP time |
 | `crates/gba-core/tests/cartridge_gpio.rs` | GPIO lanes, ROM preservation, RTC framing/control/aborts, unsupported commands, and DMA3 access |
 | `crates/gba-core/src/memory/cartridge_step_tests.rs` | ARM/Thumb GPIO timing, rejected command-edge rollback, block preflight, and staged fetch/read overlays |
 | `crates/gba-core/src/memory.rs` | Memory mapping, I/O routing, write validation, and device clock |
@@ -150,6 +154,7 @@ The repository is a Cargo workspace with three crates:
 | `crates/desktop/src/cartridge/suite/gameplay_tests.rs` | VBlank completion, input snapshots, captured pixels, and rendering failures |
 | `crates/desktop/tests/rom_suite_cli.rs` | File-backed suite execution, case isolation, output schema, determinism, and exit status |
 | `crates/desktop/examples/write_test_suite.rs` | Original ARM/Thumb/BIOS fixture generator with a local JSON suite |
+| `crates/desktop/src/cartridge/rtc_clock.rs` | Host-only UTC seed and monotonic elapsed-time adapter, with injected epoch/duration tests |
 | `crates/desktop/src/cartridge/window.rs` | ROM-window session, bounded slices, capture, STOP/input handling, and progress limits |
 | `crates/desktop/src/cartridge/window/tests.rs` | Original ROM pixels, keyboard mapping, STOP wake, HALT, frame budgets, and diagnostics |
 | `crates/desktop/src/desktop/rom.rs` | Main-thread ROM window, input polling, presentation pacing, and frame-limited exit |

docs/hardware/cartridge-gpio.md

@@ -1,9 +1,10 @@
-# Game Pak GPIO and RTC control subset
+# Game Pak GPIO and RTC calendar subset
 
-The core supports an explicitly selected cartridge GPIO interface and RTC command/control transactions.
+The core supports an explicitly selected cartridge GPIO interface and RTC calendar/control transactions.
 GPIO means general-purpose input/output. RTC means real-time clock.
-Calendar access, clock advancement, battery persistence, RTC interrupts, and other cartridge sensors remain unimplemented.
-Unsupported operations return diagnostics. No fabricated date or successful calendar transfer is reported.
+An explicit caller supplies initial time and elapsed seconds. The core never samples a host clock.
+Battery persistence, RTC interrupts, and other cartridge sensors remain unimplemented.
+Unsupported operations and invalid calendar payloads return diagnostics.
 
 ## Selection
 
@@ -18,9 +19,10 @@ direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --r
 direnv exec . cargo run --locked --release -- --rom roms/pokemon-emerald.gba --rtc --window --frames 60
 ```
 
-The report states that only GPIO and command/control are supported.
+The report states the desktop clock policy: UTC at startup, then host elapsed time, without persistence or RTC interrupts.
+UTC means Coordinated Universal Time. The host does not convert to local time.
 The JSON suite schema does not yet select cartridge peripherals. Its default remains no attached peripheral.
-There is no host-clock dependency, ROM patch, save file, or automatic device detection.
+There is no core host-clock dependency, ROM patch, save file, or automatic device detection.
 
 ## GPIO registers
 
@@ -59,27 +61,80 @@ Chip select rising with clock high begins a command. Chip select falling aborts
 Command bits enter on rising clock edges after software establishes data while clock is low.
 The first four command bits on the wire must be `0,1,1,0`.
 GBATEK's forward and reverse command-byte representations describe this same wire sequence, not interchangeable wire prefixes.
-Control parameters transfer least-significant bit first.
+Control and calendar parameters transfer least-significant bit first.
 During reads, the RTC supplies each bit on the falling edge. GPIO reads do not advance the serial state.
 
 Using GBATEK's MSB-first command representation:
 
 - `0x62` writes one control byte; `0x63` reads one control byte.
-- `0x60` and `0x61` reset supported control state to zero. Calendar reset side effects are not implemented.
-- `0x64` through `0x67` return an explicit calendar-access diagnostic.
+- `0x60` and `0x61` reset control to zero and the calendar to year 00, month/day 01, weekday/time zero.
+- `0x64` writes seven date/time bytes; `0x65` reads them.
+- `0x66` writes three time bytes; `0x67` reads them.
 - `0x6c` and `0x6d` return an explicit force-interrupt diagnostic.
 - Unused commands and invalid command prefixes remain diagnostic.
 
 Initial control is `0x40`, a deterministic powered 24-hour-mode setting.
 Bit 6 is writable. Unused bits and read-only bit 7 do not retain writes.
 Writes enabling bits 1, 3, or 5 fail because their interrupt or uncertain control behavior is not implemented.
-No power-failure condition is synthesized. There is no calendar value behind this control setting yet.
+No power-failure condition is synthesized. Core-only attachment initializes the calendar to the documented reset date.
+Changing hour mode changes its wire representation without changing the stored time.
 
 A partial control write does not commit. A complete byte commits at its final rising edge.
 Extra clocks beyond the documented parameter length remain diagnostic rather than guessing repeated transfers.
 Selecting with clock low, driving data during read clocks, and changing data at a sampling edge also remain diagnostic.
 Minimum physical setup/hold durations, signal races, and exact analog behavior are not modeled.
 
+## Calendar registers and transactions
+
+Date/time payload order is year, month, day, weekday, hour, minute, second.
+Time-only payloads contain hour, minute, second. Numeric fields use binary-coded decimal (BCD).
+Each BCD byte stores a decimal tens digit in its upper nibble and a units digit in its lower nibble.
+The weekday remains an independent counter from zero through six; software can choose its naming convention.
+
+The supported date range is 2000–2099. Month lengths and leap years follow that range's Gregorian calendar.
+Hours use `00`–`23` in 24-hour mode and `00`–`11` in 12-hour mode.
+GBA hour bit 7 indicates PM. In 24-hour reads it reflects hours 12–23; writes ignore it.
+In 12-hour mode, noon is `0x80`, not `0x12`. Midnight is zero.
+Documented unused bits are masked. Invalid BCD digits, out-of-range fields, and impossible dates remain diagnostic.
+The S-3511A datasheet describes invalid-data corrections, including delayed seconds correction. Those behaviors are not implemented.
+
+A read snapshots the selected registers at command completion.
+Later caller time updates or reseeding do not change the current serial payload. The next command observes the updated calendar.
+A write buffers its entire payload and commits only at its final rising edge.
+Dropping chip select before completion discards that payload. A rejected final edge can be retried without partial calendar changes.
+Time-only writes preserve the live date and weekday at commit, including a midnight crossed during the transaction.
+This is a bounded transaction model, not physical verification of chip latching, partial writes, or oscillator phase.
+
+## Clock ownership
+
+The core exposes these APIs on `Memory`:
+
+- `rtc_datetime()` inspects the live calendar, or returns `None` when no RTC is attached.
+- `set_rtc_datetime(RtcDateTime)` replaces the calendar between machine steps without changing pending read snapshots.
+- `advance_rtc_seconds(u64)` applies elapsed battery-clock seconds between machine steps.
+  It changes neither CPU cycles nor interrupt state, and it cannot wake HALT or STOP.
+
+`RtcDateTime::new` validates decimal calendar fields. `from_seconds_since_2000` provides checked epoch conversion with Sunday=0.
+Calendar advancement is bounded for any `u64` duration, without iterating once per second.
+The two-digit year wraps from 99 to 00 while weekday continues independently. This is the bounded century-wrap policy.
+Epoch construction rejects values outside 2000–2099 rather than wrapping a supplied host date.
+
+CPU execution, `advance_cycles`, HALT, and STOP do not advance RTC time automatically.
+A caller can advance the battery clock while GBA clocks are stopped. Core tests inject deterministic dates and durations.
+Reset changes calendar registers but does not reset the caller's elapsed-time source or its fractional phase.
+Exact oscillator startup, subsecond reset/write phase, century-wrap behavior, and mode-switch timing lack physical validation.
+
+The desktop adapter samples `SystemTime` once for UTC startup, at whole-second resolution.
+It then supplies elapsed whole seconds from `Instant`, preserving the fractional remainder in its elapsed-time measurement.
+Guest time writes and reset therefore remain effective; each update does not replace them with a fresh host date.
+Later system-clock adjustments do not change the running RTC. Host dates outside the supported range produce an error.
+
+Terminal runs synchronize between bounded groups of machine steps and at exit.
+Native windows synchronize between execution slices, including while waiting for input in STOP.
+Host sleeping can advance the RTC on the next update but never advances CPU/device cycles.
+This is a coarse host-clock adapter, not cycle-exact pin scheduling or a guarantee about system-suspend behavior.
+There is no battery save file or offline catch-up. Each new `--rtc` process starts from host UTC.
+
 ## Bus integration and tests
 
 CPU and DMA accesses retain Game Pak wait-state costs.
@@ -89,16 +144,20 @@ A later diagnostic leaves earlier RAM, GPIO, and CPU state unchanged.
 Data reads and instruction fetches share the selected register overlay. Fetches have no serial side effects.
 
 Original tests cover selection, masks, directions, retained latches, read enable, widths, ROM preservation, and command framing.
-They check control reads/writes/reset, aborts, both command-byte representations, edge stability, and unsupported commands.
+They check control/calendar reads, complete writes, reset, aborts, both command-byte representations, and unsupported commands.
+Calendar tests cover every day in the supported century, hour modes, PM flags, leap days, midnight, large advances, and invalid payloads.
+Read snapshots, live-date time writes, independent HALT/STOP advancement, and failed final-edge rollback have separate checks.
 ARM/Thumb, DMA3, block preflight, staged fetches, retryable errors, and nominal bus costs have separate regressions.
-File-backed desktop tests check explicit `--rtc` selection, unchanged files, option rejection, and native-window propagation.
+File-backed desktop tests execute original ARM calendar writes/reads with `--rtc` in terminal and native-window modes.
+The probe places executable code outside the GPIO overlay. Host-adapter tests inject epoch values and elapsed durations without sleeping.
 These tests validate the bounded implementation, not physical RTC timing or game playability.
 
 ## References
 
+- [Seiko S-3511A datasheet](https://www.rockby.com.au/DSheets/10110.pdf), sections 2-1, 3-3, and 4: BCD calendar fields, weekday counter, reset values, PM behavior, and invalid-data corrections. Chip variants and physical transfer timing remain unverified; unsupported corrections are not silently approximated.
 - [GBATEK cartridge GPIO](https://problemkaputt.de/gbatek-gba-cart-i-o-port-gpio.htm): register addresses, masks, directions, read control, and uncertain byte-store behavior.
 - [GBATEK GBA RTC](https://problemkaputt.de/gbatek-gba-cart-real-time-clock-rtc.htm): control fields, reset, calendar formats, and command mapping relative to the DS chip.
 - [GBATEK DS RTC](https://problemkaputt.de/gbatek-ds-real-time-clock-rtc.htm): the linked serial flow, chip-select sequencing, bit edges, and forward/reverse command representations. GBA register differences remain separate.
-- [mGBA GPIO at 3a5e34be](https://github.com/mgba-emu/mgba/blob/3a5e34be33dc7f8f707e5bc9db69e8a430046f21/src/gba/cart/gpio.c): comparison for retained outputs, direction changes, idle inputs, serial edges, and initial control. Its host-clock lookup, ROM-buffer mutation, and repeated transfers are not copied.
+- [mGBA GPIO at 3a5e34be](https://github.com/mgba-emu/mgba/blob/3a5e34be33dc7f8f707e5bc9db69e8a430046f21/src/gba/cart/gpio.c): comparison for retained outputs, direction changes, idle inputs, serial edges, and initial control. Its host-clock lookup, ROM-buffer mutation, and repeated transfers are not copied. The calendar implementation uses the documented GBA PM bit, including 24-hour readback; the pinned implementation does not supply that flag.
 - [mGBA memory at 3a5e34be](https://github.com/mgba-emu/mgba/blob/3a5e34be33dc7f8f707e5bc9db69e8a430046f21/src/gba/memory.c): first-window halfword GPIO write routing. This is not physical proof of all address aliases.
 - [Explaining GBA RTC](https://bmchtech.github.io/post/rtc/): introductory background surfaced during research; the author explicitly warns that details may be inaccurate. Register and protocol decisions use the references above.

docs/hardware/cartridge.md

@@ -34,8 +34,9 @@ Headerless original programs are accepted.
 Reads past supplied cartridge bytes remain explicit memory errors, not open-bus values.
 All three Game Pak ROM windows use the same supplied bytes and existing wait-state rules.
 Ordinary cartridge bytes remain read-only. Save devices remain unsupported.
-Optional `--rtc` selection enables the bounded [Game Pak GPIO and RTC control interface](cartridge-gpio.md).
-It supports configuration and control transactions, not calendar access, clock advancement, or RTC interrupts.
+Optional `--rtc` selection enables the bounded [Game Pak GPIO and RTC calendar interface](cartridge-gpio.md).
+It supports date/time reads, complete writes, reset, and explicit elapsed-time updates. RTC interrupts and persistence remain unsupported.
+The desktop seeds UTC once, then supplies monotonic host elapsed seconds independently of GBA cycles and STOP.
 
 Both modes call `bios::boot` with the loaded bytes.
 With `--rtc`, the host then selects the cartridge peripheral before the first machine step.

docs/hardware/timers-irq.md

@@ -235,7 +235,9 @@ The current desktop demos do not enter STOP; the frontend does not yet provide a
 
 Only keypad wake-up is implemented. General-purpose serial and Game Pak wake sources require their missing external devices.
 Oscillator restart delays, exact entry/wake edges, and hardware-specific IF behavior remain unverified.
-There is no host-thread sleep or wall-clock accounting. STOP freezes the emulated timer-driven audio clock.
+Core STOP does not sleep a host thread or account for wall time. It freezes the emulated timer-driven audio clock.
+The optional [cartridge RTC](cartridge-gpio.md#clock-ownership) uses a separate caller-supplied battery clock that can advance during STOP.
+Desktop `--rtc` continues supplying elapsed time while its native window waits for input. RTC updates do not wake STOP.
 
 The graphics demo now uses the optional original BIOS replacement's VBlankIntrWait service.
 Its IRQ callback acknowledges VBlank and updates the BIOS RAM flag before the service returns.

docs/research/emerald-reset.md

@@ -65,17 +65,19 @@ The send register supports 16-bit data; receive latches do not become invented p
 See [the register model and evidence limits](../hardware/serial.md#disconnected-multiplayer-configuration).
 
 Multiplayer configuration then reached a Game Pak GPIO control write (`0x080000c8`, PC `0x082e29f8`).
-The optional [cartridge GPIO/RTC interface](../hardware/cartridge-gpio.md) now supports read enable, directions, pin latches, and RTC control transactions.
-Select it explicitly with `--rtc`; ordinary ROM bytes and other ROMs' default hardware remain unchanged.
-No host date, RTC calendar, or successful calendar read is invented.
+The optional [cartridge GPIO/RTC interface](../hardware/cartridge-gpio.md) first added read enable, directions, pin latches, and RTC control transactions.
+That reached a calendar-read command at PC `0x082e28a6`.
+The calendar model now supports date/time reads, complete writes, reset, and caller-supplied elapsed seconds.
+Core tests inject deterministic time. Desktop `--rtc` uses UTC startup and monotonic elapsed time, including during GBA STOP.
+Select it explicitly; ordinary ROM bytes and other ROMs' default hardware remain unchanged.
 
-Both terminal and native runs with `--rtc` now reach a calendar-read command:
+Both terminal and native runs with `--rtc` now reach a Flash unlock write:
 
 ```text
-Steps: 957729; instructions: 955049; IRQ entries: 80; DMA units: 2600; HALT idle: 0
-Nominal cycles: 3520685
-PC=0x082e28a6
-unsupported RTC calendar access: write 0x07 at 0x080000c4
+Steps: 964375; instructions: 961679; IRQ entries: 80; DMA units: 2616; HALT idle: 0
+Nominal cycles: 3546961
+PC=0x082e1892
+unmapped memory at 0x0e005555
 ```
 
 The native run captures twelve startup frames. These do not establish a working title screen or gameplay.
@@ -90,9 +92,10 @@ Workspace debug/release tests, strict Clippy, public ARM/Thumb/memory/BIOS check
 Native ROM-window tests and graphics smoke modes pass on Darwin arm64.
 The pinned Pong debug/release reports match.
 
-The next requirement is RTC calendar transfers with an explicit clock-source model.
-Implement validated date/time formats, read snapshots, writes/reset, and clock ownership without putting host time in the core.
-Keep battery persistence and cartridge IRQ behavior explicit; do not equate GBA STOP with stopping a battery-powered RTC.
+The next requirement is a cartridge Flash save device, beginning with command unlock and identification.
+The failing state contains value `0xaa` and address `0x0e005555`, matching the documented unlock sequence.
+Research device selection, IDs, banking, program/erase, busy behavior, and safe persistence before claiming save compatibility.
+RTC persistence and cartridge IRQ behavior remain separate missing features.
 Ordinary ROM writes remain read-only. Without `--rtc`, the earlier GPIO diagnostic is still expected.
 This result does not establish gameplay, linked transfers, or cartridge/serial GPIO interrupt support.
 
@@ -104,3 +107,5 @@ Do not treat digital-level tests as audible-game validation or suppress remainin
 Cartridge saves remain a separate required feature. SRAM alone will not support Emerald's Flash save protocol.
 
 Hardware and emulator references are recorded in the linked subsystem documents.
+[GBATEK backup Flash](https://problemkaputt.de/gbatek-gba-cart-backup-flash-rom.htm) identifies the `0xaa`/`0x5555` unlock and chip-identification sequence.
+The bounded failure establishes an access requirement, not the device's capacity or full save compatibility.

docs/status.md

@@ -43,7 +43,7 @@ Update this file when a feature lands or a limit is removed.
 - One-shot non-sequential nominal CPU code timing after successful DMA, including RAM-only transfers.
 - HALT with enabled-request wake-up, continued device clocks, and bounded idle steps.
 - BIOS-only CPU writes to POSTFLG/HALTCNT, with HALT and keypad-wake STOP.
-- STOP freezes CPU/DMA/device clocks, retains device phases, and reports a stopped frame runner without spinning.
+- STOP freezes CPU/DMA/GBA-device clocks, retains device phases, and reports a stopped frame runner without spinning.
 - Machine execution to the next VBlank event, with a configurable step limit.
 - CPU/device stepping with nominal ARM7 instruction costs and memory wait states.
 - Ordered CPU timing transactions record source, data, internal, and refill costs, with whole-step diagnostic rollback.
@@ -76,7 +76,9 @@ Update this file when a feature lands or a limit is removed.
 - `SWP`/`SWPB`, including unaligned word rotation and register aliases.
 - 256 KiB external work RAM and 32 KiB internal work RAM, including mirrors.
 - Read-only cartridge bytes in the three GBA cartridge windows.
-- Explicit cartridge RTC selection with first-window GPIO read enable, direction/latch behavior, and serial command/control transactions.
+- Explicit cartridge RTC selection with first-window GPIO read enable, direction/latch behavior, and serial calendar/control transactions.
+- Validated RTC date/time, BCD transfers, read snapshots, complete writes/reset, and caller-supplied battery-clock advancement.
+- Desktop `--rtc` seeds UTC once and supplies host elapsed seconds independently of CPU cycles and STOP.
 - Cartridge GPIO changes participate in CPU/DMA rollback and block-store preflight without modifying ROM bytes.
 - Raw ROM-file loading with original BIOS boot, terminal diagnostics, and final CPU/step reports.
 - Firmware boot initializes BG2/BG3 identity scales for bitmap and affine programs that do not program their own matrices.
@@ -141,8 +143,9 @@ Horizontal window comparators retain four-cycle event history.
 Sprite rows prepare one line ahead with a whole-row cycle40 sample and nominal per-row work limits.
 Individual fetch timing, hardware-accurate work cutoffs, video-bus contention, and per-pixel color composition remain unimplemented.
 There is no host audio output or cartridge save support.
-The optional [cartridge GPIO/RTC subset](hardware/cartridge-gpio.md) supports command/control only, selected with `--rtc` in ROM modes.
-RTC calendar access, clock advancement, persistence, interrupts, GPIO aliases, and byte writes remain unsupported or unverified.
+The optional [cartridge GPIO/RTC subset](hardware/cartridge-gpio.md) supports calendar/control transfers and explicit clock updates, selected with `--rtc` in ROM modes.
+RTC persistence, interrupts, invalid-date correction, physical subsecond timing, GPIO aliases, and byte writes remain unsupported or unverified.
+The core uses deterministic caller time. Desktop RTC runs use host UTC/elapsed time and are not fully deterministic.
 The [audio subset](hardware/audio.md) supports Direct Sound, both PSG pulse channels, noise channel 4, idle wave channel 3 state, and instantaneous digital mixing.
 It does not yet provide a continuous sample stream. Wave channel 3 playback and unverified sound-DMA pairings remain diagnostic.
 PSG timing and signed mixing are nominal; hardware startup edges and analog behavior remain unverified.
@@ -165,8 +168,8 @@ It also passes the pulse/noise triggers and normal-mode RCNT configuration.
 It also completes a CpuSet call to address zero through the corrected ignored BIOS-write behavior.
 It also accepts an external-clock serial request without inventing clock edges or completion.
 It now also completes internally clocked normal transfers and selects idle multiplayer mode.
-With explicit `--rtc` selection, it also passes Game Pak GPIO configuration and reaches an RTC calendar-read command.
-That command remains diagnostic (`0x080000c4`, PC `0x082e28a6`); no date is fabricated.
+With explicit `--rtc` selection, it also passes Game Pak GPIO configuration and RTC calendar reads.
+It next stops at a Flash unlock write (`0x0e005555`, PC `0x082e1892`). Cartridge save devices remain unimplemented.
 Without `--rtc`, cartridge GPIO writes still return read-only diagnostics.
 No title-screen, gameplay, or audible-game compatibility is established.
 See [the startup result](research/emerald-reset.md) for the bounded run and next investigation.

docs/testing.md

@@ -65,11 +65,14 @@ They verify suite selection, pinned URLs, hashes, sizes, checkpoint validation,
 The [Pong adapter](public-pong.md) has additional offline tests for its pinned downloads, retained license, and bounded gameplay scenarios.
 Run the external Pong suite separately; ordinary Cargo and Python tests require no public ROM or network access.
 Device initialization regressions use original instructions to check disabled sound, wave RAM, disconnected serial pins, and reset flags.
-Cartridge GPIO tests use an explicitly attached RTC control subset and original pin sequences, never game code or host time.
-They cover read overlays, unchanged ROM bytes, masks, directions, widths, serial framing, control/reset, aborts, and explicit calendar/IRQ diagnostics.
+Core cartridge GPIO tests use an explicitly attached RTC and original pin sequences, never game code or host time.
+They cover read overlays, unchanged ROM bytes, masks, directions, widths, framing, control/calendar/reset, aborts, and unsupported commands.
+Calendar tests cover all dates in 2000–2099, 12/24-hour representation, PM flags, midnight, leap days, and large/split elapsed durations.
+Payload tests verify read snapshots, complete writes, invalid-date diagnostics, reset, and clock advancement during HALT/STOP.
 ARM/Thumb and DMA3 checks retain Game Pak costs; staged fetches, rejected edges, and block-store preflight retain diagnostic atomicity.
-Desktop tests check explicit `--rtc` selection, duplicate rejection, unchanged files, and native-window configuration.
-Physical pin timing, GPIO aliases, RTC calendar values, and battery behavior remain unverified or unimplemented.
+Desktop tests execute original ARM calendar commands in terminal and native-window modes with explicit `--rtc` selection.
+Host-adapter tests inject UTC epoch values and elapsed durations without sleeping. Guest time changes survive subsequent elapsed updates.
+Physical pin timing, invalid-date hardware correction, GPIO aliases, and battery persistence remain unverified or unimplemented.
 They verify explicit activation errors and atomic byte/word/block-store/DMA failure behavior.
 The optional [local Emerald startup check](research/emerald-reset.md) now reaches sound activation but still fails deliberately there.
 [Jev evidence review](jev-debugging.md) is optional and never changes deterministic test verdicts.

docs/usability-roadmap.md

@@ -41,10 +41,10 @@ This exposed and corrected missing firmware affine-scale initialization, without
 Frame-based scenarios and the preparation adapter now make the result repeatable.
 A local Emerald run now passes its initial all-device reset, master sound enable, and pulse/noise triggers.
 It also passes normal serial transfers and idle multiplayer configuration.
-With `--rtc`, it passes Game Pak GPIO setup and stops at the first unsupported RTC calendar-read command.
+With `--rtc`, it passes Game Pak GPIO setup and RTC calendar reads, then stops at a Flash unlock write.
 The core has tested Direct Sound, both pulse channels, and noise channel 4.
 Wave channel 3, a continuous sample stream, and desktop audio output remain missing.
-See [the runtime result](research/emerald-reset.md). RTC calendar transfers and an explicit clock-source model are the next startup requirement.
+See [the runtime result](research/emerald-reset.md). Flash identification and its save protocol are the next demonstrated startup requirement.
 The separate save requirement remains cartridge SRAM, followed by safe host save persistence.
 SRAM is byte-addressable battery-backed save memory. Flash and EEPROM remain separate protocols.