Dynamic validation

Run the real ROM's link code and check its output against the wire. Source: emulator/race-link/ — make -C emulator/race-link test.

How

1. CPU core — tlcs900h.c / race-memory.c / ngpBios.c from libretro/RACE, compiled headless (video/sound stubbed).
2. COM services — RACE stubs the serial BIOS calls; linkemu.c re-implements them as a byte transport to a C model peer. The only functional change.
3. Drive — after boot, call_rom() invokes the game's comms tick 0x206c8f per frame; writing 00 to 0x564e starts the handshake (what the 2P menu does).

flowchart LR
    CORE[real ROM on TLCS-900H core] <-->|COM| TRANS[transport] <-->|F-frames| PEER[C model peer]

Result

ROM emitted FC 01 .. 30 (advertise)        : PASS
ROM emitted FD 01 .. 30 (responder reply)  : PASS
ROM emitted F0 heartbeat                   : PASS
ROM emitted F8 00 <input> offer            : PASS
ROM decoded peer reply into 570d/5715      : PASS

• State machine walks 00→04→08→0C→14 on real code.
• Confirmed the bit-7 gate (set = transport, clear+bit3 = F8 at 0x207447).
• F8 offer sends only when 0x564f==01, input from 0x56ed & 7f.
• Receive stores F8 <p1> <p2> into 0x570d/0x5715 — button bits match live.

Limits

• Peer is a C model, not a second ROM (RACE's global state → two instances need two processes; the COM transport is the seam).
• Phase transitions are poked via status bits, not menu-driven — but the link code run is the real ROM's.
• Timing is logical (1 tick/frame); wall-clock comes from the capture.