Put the container on the chip, and find the held bus costs 463 times the seam

ROADMAP P6c, FINDINGS 68. 78,125 B of a DLXP2's audio out of channel 3,
sample-exact, while the video channel fetches records off the same disc.

The two pieces 67.6 said were missing: the lump buffer (pg_afill/pg_afetch,
three slots and the minimum is unmeasured) and 67.2's remainder accumulator
(pg_apay). The capture prices what the accumulator avoided at 1.26 s of
lip-sync over the game, against 67.2's predicted 1.25.

The finding is the third piece, which nothing had named: the MSM6258 has no
starvation state, so the gap between a channel counting out and the next arm
is a held nibble pair driving the predictor. Stealing, the seam is 0.51 ms
over ten seconds because dma.i's new DM_HOOK services the chip from inside
the transfer wait -- 250,000 of 250,240 looks. Held, the 68000 is halted and
gets 369: every one of the ten lump boundaries has a seam, worst 72.8 ms,
2.31% of the audio. Identical bytes, different sound. 64.3 reaching the audio.

Two bugs, and no counter in the player could see either. Clearing DM_BARV does
not unchain a channel -- OCR bits 3-2 are what it obeys -- and the symptom is
POLL TIMEOUT on the lump and every record after it. And the refill ran one lump
ahead of its ring and overwrote the buffer the channel was reading: 11 of 11
armed, 11 fetched, no starve, and the sound wrong from 0.2 s in. Which is why
the gate is a WAV: verify_packed_audio.py walks the stream one delivered byte
at a time, because MAME's okim6258 resets the nibble select on every write and
a byte is two nibbles only 99.994% of the time.

check.sh ALL GREEN before (tmp/check_s36_start.log) and after
(tmp/check_s36_end.log), with the new stage.

Claude-Session: https://claude.ai/code/session_01194oWYW8DQXK1SZ2DnChW6

README.md

@@ -625,6 +625,13 @@ tools/bench/     MAME Lua injection harness and 68000 benchmark sources.
                  a new config cannot weaken the gate.
                  crtc_mode.lua is the single source of truth for CRTC R00-R08
                  and R20. Do not write CRTC values anywhere else.
+                 verify_packed_audio.py is P6c's gate and it reads the
+                 SPEAKER: it accounts for every byte of a DLXP2's audio against
+                 MAME's own -wavwrite capture, ONE DELIVERED BYTE AT A TIME,
+                 because the chip plays a byte as two nibbles only when the DMA
+                 write lands inside the right sound-stream slice. A player's own
+                 counters cannot gate this -- all of them stayed right through a
+                 bug that overwrote the buffer the channel was reading.
                  prep_dlx.py/decode.lua/verify_decode.py load, time and verify
                  decode.s. prep_stream.py/stream.lua do the same for stream.s,
                  but lay the container out as a DISK in a host file and feed it
@@ -704,7 +711,19 @@ tools/encoder/   hybrid VQ encoder and DLX3 container writer.
                  24 models the ring with the 68000 owning it: the request
                  queue, the poll-only-when-not-decoding rule and 54.4's frame
                  cadence, and reports the pipe the player's own loop gives away.
-src/player/      decode.s is the 68000 DLX3 decoder with a preloaded-stream
+src/player/      packed.s is the DECODER-FREE player: it brings up its own
+                 display, builds the DMA chain, keeps its own clock, fetches
+                 every record off a real volume and -- since FINDINGS 68 -- feeds
+                 the container's own audio lumps to the MSM6258 on channel 3
+                 while it does. Its audio half is three things: a lump ring
+                 (pg_afill/pg_afetch), the remainder accumulator that stops the
+                 padding becoming drift (pg_apay, 67.2), and a service routine
+                 that runs from inside dma.i's transfer wait rather than once a
+                 frame (pg_aserv through DM_HOOK). The last of those is the
+                 whole difference between 0.51 ms of seam and 236 ms.
+                 adpcm.i is the transport, every register byte of it decoded out
+                 of the IPL ROM by tools/analysis/21_iplrom_dmac.py.
+                 decode.s is the 68000 DLX3 decoder with a preloaded-stream
                  front-end. stream.s is the same decoder behind a bounded ring.
                  load.i is the LOAD-time half: codebook expansion and palette
                  packing, out of the raw container header, with loadgate.s as