Methodology

Three independent methods, cross-checked. A fact is trusted only when two agree.

Two consoles, the notebook recording the pinout, and the logic analyzer.

flowchart LR
    PROBE[Logic analyzer on mainboard] --> CAP[Physical capture] --> DEC[Decode 19200 8N1]
    ROM[Game ROM] --> DIS[Static disassembly] --> MODEL[Protocol model]
    DEC --> REC[Reconcile]
    MODEL --> REC
    ROM --> EMU[Dynamic emulation]
    REC --> EMU --> CONF[3-way confirmed spec]

Method	Sees	Blind to
Physical capture	real bytes, timing, role arbitration	why the bytes are what they are
Static analysis	full logic, all branches	wall-clock timing; which path runs
Dynamic emulation	live execution, real state	emulator fidelity (checked vs the other two)

Where each method was decisive

• Capture gave the wall-clock base (33.39 ms/tick); the disassembly only had "ticks".
• Disassembly explained the capture's input mirror — the combined reply F8 <p1> <p2>.
• Emulation corrected a misread: bit 7 gates normal transport, not gameplay (only running the ROM showed it).

Tools

Capture	8-channel logic analyzer @ 24 MHz, grabbers direct on the mainboard
Disassembler	MAME dasm900, standalone (tools/tlcs900d.cpp) → out/*.asm
Emulator	extracted libretro/RACE core, BIOS COM re-implemented (emulator/race-link/)
Model	Python reference (tools/samurai2_link.py)

The sniffer PCB was designed but not used here

A passive sniffer PCB was designed and is fab-ready, but this capture used grabbers directly on the mainboard — cheaper than fabbing and shipping a board. The PCB remains available for non-invasive, repeatable captures.