Put the palette on the channel, and find one start paints a whole frame

ROADMAP K1, the packed player's one open structural item.  A frame is a picture
AND a palette, and no run in this tree had pointed a DMA channel at the palette
registers.  dmagate.s runs 7-9, gated by dma_run.sh and check.sh:

  7. 512 B off the disc into $E82000, bus held -- byte-exact in 256 register
     words, read back OUT OF the registers by the 68000;
  8. the SAME transfer aimed at RAM -- byte-exact at $2C000, and 256 of 256
     palette words still read the poison the CPU wrote, which is what attributes
     run 7 to the channel's MAR rather than to the readback path;
  9. ONE array-chained start across two kinds of destination -- the palette and
     six picture rows at the 1,024 B line stride, 2,048 B byte-exact.

So a packed frame is one channel start: a 193-entry array, palette first, CPU
halted from the first byte to the last.  The array is scene-constant, because
the packed layout spends both 256-colour pages and there is no page to flip.
What is left on the CPU per frame in the video path is the channel start and the
READ(10) -- no per-frame PAINT, which is not the same claim as no per-frame CPU.

The destination is POISONED first (62.1).  Runs 4-6 wrote into RAM that was zero
and GVRAM that was stale against a record that is mostly pad; "it matches the
disc" was weaker than it read as.  The host counts whether the poison actually
discriminates instead of assuming it: 511 of 512, and the gate refuses under 500.

And it opened a hardware item (62.4, ROADMAP B4).  MAME maps the palette to
palette_device over memory_array, whose write16 is a plain COMBINE_DATA -- RAM
that honours mem_mask, with no handler that could refuse a byte write.  Unlike
GVRAM's 256-colour arm there is nothing here to be wrong about, so the run
bounds the model and not the board.  What a real palette register does with a
byte write is unmeasured.  A negative costs 0.28% of a frame and nothing else.

29_packed_player.py now also prints the two rows with the per-frame palette
charged -- 55.7% of a frame on the chain, 582 KB/s -- alongside the picture-only
figures the codec comparison is quoted against.

check.sh ALL GREEN before (tmp/check_s30_start.log) and after
(tmp/check_s30_end.log).

Claude-Session: https://claude.ai/code/session_01194oWYW8DQXK1SZ2DnChW6

tools/bench/dma_run.sh

@@ -108,6 +108,43 @@ grep -aq "BYTES OK: 2048 B from LBA 1000 .*\[chain\]" tmp/dma_run.log || \
 grep -aq "THE CHANNEL WALKED THE ARRAY ITSELF" tmp/dma_run.log || \
   fail "the chained run did not report walking its own array."
 
+# ---- THE PALETTE (ROADMAP K1, FINDINGS 61.9). If the registers at $E82000 take
+# a byte-wide DMA the way GVRAM does in buffer mode, a per-frame palette is a
+# 193rd array-chain entry and ONE channel start paints a whole frame; if they do
+# not, the CPU writes 256 words a frame and the architecture still stands. The
+# run is poisoned first and controlled twice -- once by aiming the same transfer
+# elsewhere, once by counting how many of the 512 positions the poison and the
+# disc actually differ in.
+grep -aq "BYTES OK: 512 B from LBA 1000 .*\[pal\]" tmp/dma_run.log || \
+  fail "the channel did not write the palette registers at \$E82000 -- so a
+      per-frame palette costs the CPU 256 word writes and cannot ride the
+      frame's array chain (61.9). That is a RESULT, not a broken run: check the
+      PALETTE WRONG line above for whether the bytes were dropped or misplaced."
+DIFF=$(sed -n 's/.*PALETTE POISON IS A DISCRIMINATOR: \([0-9]*\) of 512.*/\1/p' \
+       tmp/dma_run.log)
+[ -n "$DIFF" ] && [ "$DIFF" -ge 500 ] || \
+  fail "the poison and the disc's bytes agree in ${DIFF:-?} of 512 positions, so
+      the palette run could have passed without a channel writing anything --
+      this is run 4's could-not-fail trap in a new place. Change DGPOIS."
+grep -aq "BYTES OK: 512 B from LBA 1000 .*\[palctl\]" tmp/dma_run.log || \
+  fail "the ATTRIBUTION control's read did not land in RAM, so its palette claim
+      is about a transfer that did not happen."
+grep -aq "PALETTE UNTOUCHED BY THE CONTROL: 256 of 256 words" tmp/dma_run.log || \
+  fail "the palette changed during a transfer aimed 20 KB away from it. Then
+      what reached \$E82000 in the run above was not decided by the channel's
+      MAR, and that run measured something else."
+if grep -aq "CONTROL DID NOT FAIL \[palctl\]" tmp/dma_run.log
+then
+  fail "the control reported its own failure -- see the line above it."
+fi
+grep -aq "BYTES OK: 2048 B from LBA 1000 .*\[palchain\]" tmp/dma_run.log || \
+  fail "ONE array-chained start could not cross from the palette registers into
+      GVRAM. A frame is one palette entry and 192 row entries; if the two kinds
+      of destination cannot share a chain, the CPU is back in the video path
+      once a frame to start the second half of it."
+grep -aq "ONE START PAINTED THE PALETTE AND 6 ROWS" tmp/dma_run.log || \
+  fail "the palette+rows run did not report the crossing it exists to show."
+
 grep -aq "WINDOWED DMA READ REFUSED" tmp/dma_run.log || \
   fail "a WINDOWED read through the channel was not refused. 117 of 120 records
       start part way into a sector (58.3), and a channel cannot drop the bytes