IOS LLE: optional Starlet write watch REV_WATCH (StarletOS phase 11 F1)

Logs Starlet CPU stores (instruction address, LR) and device DMA writes
in the given physical ranges. The ARM JIT keeps fastmem but sends accesses
overlapping a watched range to its bus slow path, recording the
instruction address there. Nothing changes without the variable.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/StarletOS_Checkpoint.json

@@ -56,6 +56,21 @@
       "sha256": "40d45aed7c5edb4540105dcdee4dd8dcde88c21ba7f3279eff0a9564f2d02a29",
       "bytes": 75597
     },
+    {
+      "path": "Source/Core/Core/IOS/Starlet/ARMCore.h",
+      "sha256": "765bc1ebe9554f9821fd649a94a74f27d2b811383b73286062bf382d6a15aee6",
+      "bytes": 14356
+    },
+    {
+      "path": "Source/Core/Core/IOS/Starlet/ARMJitX64.cpp",
+      "sha256": "2aa934e97097b25fdf760a9a97849ee066439f1ea7ad231b9329611feeb24e23",
+      "bytes": 109011
+    },
+    {
+      "path": "Source/Core/Core/IOS/Starlet/ARMJitX64.h",
+      "sha256": "7e99ddee84b738bbb1e72aae0c8e2ee31335499c9eeb9585dfe5725688ad8c9e",
+      "bytes": 13979
+    },
     {
       "path": "Source/Core/Core/IOS/Starlet/BootstrapELF.cpp",
       "sha256": "344e6e38922b64fa58d9755c2df5fd752b00cf3dc73114809f6e9cada724c42a",
@@ -68,8 +83,8 @@
     },
     {
       "path": "Source/Core/Core/IOS/Starlet/Starlet.cpp",
-      "sha256": "9654635b4892f1e07bb72256cbf34b7bebd89eee8389154af946b47eab011f29",
-      "bytes": 26516
+      "sha256": "2d10d03f2434f03a58f0a8e5f6cdab93ee8e8028d94ad519d137e739b3a99467",
+      "bytes": 26556
     },
     {
       "path": "Source/Core/Core/IOS/Starlet/Starlet.h",
@@ -78,13 +93,13 @@
     },
     {
       "path": "Source/Core/Core/IOS/Starlet/StarletMemory.cpp",
-      "sha256": "da5267d0cede011e74ed56155999ec721a562680c07b9c928f56fcea191f20c9",
-      "bytes": 190485
+      "sha256": "b6896d66410e08629b1dee568f94326a1caab1fa2740ad8c886f50b4a7d494de",
+      "bytes": 192641
     },
     {
       "path": "Source/Core/Core/IOS/Starlet/StarletMemory.h",
-      "sha256": "954cf8d3253eeebe6910ef9fb92137e3a551d04551ed8f1fbfc6fff907c591ce",
-      "bytes": 15322
+      "sha256": "3005d026366a27d28e2bab0ee6cdbb9fffc347e10a384b77f19e23db1ec09ca0",
+      "bytes": 16146
     },
     {
       "path": "Source/Core/DolphinNoGUI/PlatformHeadless.cpp",
@@ -151,6 +166,18 @@
       "files": [
         "Source/Core/Core/HW/WII_IPC.cpp"
       ]
+    },
+    {
+      "recordedAt": "2026-10-06",
+      "purpose": "StarletOS Phase 11 proposal F1: REV_WATCH=start:size[,...] logs Starlet CPU stores (instruction address, LR) and device DMA writes in those physical ranges; the ARM JIT routes accesses in watched ranges to its bus slow path and records the instruction address there; off by default",
+      "files": [
+        "Source/Core/Core/IOS/Starlet/Starlet.cpp",
+        "Source/Core/Core/IOS/Starlet/StarletMemory.cpp",
+        "Source/Core/Core/IOS/Starlet/StarletMemory.h",
+        "Source/Core/Core/IOS/Starlet/ARMCore.h",
+        "Source/Core/Core/IOS/Starlet/ARMJitX64.cpp",
+        "Source/Core/Core/IOS/Starlet/ARMJitX64.h"
+      ]
     }
   ]
 }

docs/StarletOS_Handoff.md

@@ -172,3 +172,24 @@ and for IOCTLVs whose first input vector is 64 bytes (READ_DIR, GET_USAGE);
 rung, like the OPEN path; nothing else of the buffers. Checked headless under
 Revolution: `/shared2/test2`, `/title/00000001/00000002/data/cache.dat`, the
 GET_USAGE directories. 95 Starlet tests passed.
+
+## Write watch for Starlet memory — 2026-10-06
+
+Companion proposal F1 (approved): find what changes Revolution's RAM layer
+table between two filesystem requests (the companion's finding 11).
+
+- `REV_WATCH=start:size[,start:size...]` (hexadecimal, physical): every
+  Starlet CPU store (`StarletMemory::Write8/16/32`) and every device DMA
+  write (`WriteDMABuffer`, `WriteDMA8`) touching a range is logged as
+  `REVWATCH CPU addr/size value PC <instruction> LR <r14>` or
+  `REVWATCH DMA addr/size PC <instruction>`. Off without the variable.
+- The ARM JIT keeps fastmem; `ARMBus::GetWatchRanges` gives it the ranges,
+  `EmitFastmemAddress` sends any access overlapping one to the existing bus
+  slow path, and the ARM and Thumb slow paths store the instruction address
+  first (only while watching). Speed under watch is the JIT's (companion
+  smoke run: the Menu's main menu at 74 s, as without the watch).
+- `ARMCore.h` (`GetInstructionAddress`, `GetWatchRanges`), `ARMJitX64.cpp`,
+  `ARMJitX64.h` are now exact integration files (26 in the checkpoint).
+- The 95 selected Starlet tests passed (`.starlet_linux`); `.starlet_linux_x11`
+  rebuilt. Smoke run with the companion's Revolution P11-H06: 1519 watched
+  writes on its layer table during start-up, attributed by instruction.