re: memory-driven autopilot -- infrastructure, and an honest account of what is not solved

Reads the live world out of guest RAM and drives the pad from it. Working:
loop-rate memory reads, whole-RAM float scanning with numpy (1270 orthonormal
3x3 blocks in 6.2 s), entity enumeration by unit type (116 live instances in
Stage 02), pad control written straight into the vgamepad FIFO (the CLI spawns
a process per command and its tap/hold sleep inside the server, so neither is
usable in a control loop), unattended mission entry, and the Hangar loadout --
the "Recommended" control is AUTO SELECT, which at 5 % progress is a no-op
because only two weapons are developed and both are already mounted.

Not working, and the reason the craft is not yet flown: the class 0x820af030
is NOT the live entity. It has one object per spawned thing and carries the
unit-ID string, which is why it looked like the entity list, but every one of
its 384 words is constant across a 29 s in-flight capture. No transform lives
in it or one pointer hop from it. Input correlation (hard left yaw vs hard
right, looking for a turn axis that reverses) does find self-like objects at
cos = -0.99, but they cluster in what looks like a camera volume rather than
the craft, and with no definition pointer near them the trick of learning one
entity's layout and applying it to the rest has nothing to anchor on -- so the
33418 moving triples in a firefight cannot be split into enemies, friendlies
and bullets, and there is nothing to aim at.

Two dead ends are recorded so they are not repeated: RT is not the throttle
(the two-state speed scan therefore found nothing), and comparing orientation
matrices 2 s apart is outside the small-angle regime, which is what produced
"angular velocities" of 30000.

Also corrects the claim in unit-struct-runtime.md that 0x820af030 holds live
state. The definition class 0x820af844 and every value derived from it are
unaffected.

autopilot2.py (a PD controller using body angular velocity from consecutive
rotation matrices) is committed but has never had a valid config to run
against, and is marked as untested.

tools/re-capture/flight_probe.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""Drive a scripted input sequence in flight while sampling guest RAM, so the
+player craft's live transform can be *derived* rather than guessed.
+
+The point is correlation: each sample is tagged with the stick/trigger state
+that produced it, so afterwards we can ask "which floats move only while the
+yaw axis is deflected?" and "which triple integrates to the velocity?".
+
+Writes a .npz-ish flat binary: a header of (va, offset, name) per instance,
+then per frame a timestamp, the input vector, and every instance's raw window.
+
+Usage: flight_probe.py <out.bin> [seconds]
+"""
+import os
+import struct
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import gworld  # noqa: E402
+
+FIFO = "/tmp/sylph-vgamepad.fifo"
+
+
+class Pad:
+    """Talk to the vgamepad server directly over its FIFO.
+
+    The `vgamepad` CLI spawns a process per command (~20 ms); a control loop
+    cannot afford that, and `tap`/`hold` additionally sleep *inside* the server.
+    Writing lines to the FIFO ourselves keeps a tick under a millisecond.
+    """
+
+    def __init__(self):
+        self.f = open(FIFO, "w", buffering=1)
+        self.state = {"LX": 0.0, "LY": 0.0, "RX": 0.0, "RY": 0.0, "LT": 0.0, "RT": 0.0}
+
+    def axis(self, name, v):
+        self.state[name] = v
+        self.f.write(f"axis {name} {v:.3f}\n")
+
+    def trig(self, name, v):
+        self.state[name] = v
+        self.f.write(f"trig {name} {v:.3f}\n")
+
+    def press(self, b):
+        self.f.write(f"press {b}\n")
+
+    def release(self, b):
+        self.f.write(f"release {b}\n")
+
+    def reset(self):
+        self.f.write("reset\n")
+        for k in self.state:
+            self.state[k] = 0.0
+
+    def vector(self):
+        return [self.state[k] for k in ("LX", "LY", "RX", "RY", "LT", "RT")]
+
+
+# (duration_s, description, action)
+SCRIPT = [
+    (3.0, "idle", lambda p: p.reset()),
+    (4.0, "pitch-up", lambda p: p.axis("LY", -0.9)),
+    (2.0, "idle2", lambda p: p.reset()),
+    (4.0, "yaw-right", lambda p: p.axis("LX", 0.9)),
+    (2.0, "idle3", lambda p: p.reset()),
+    (4.0, "yaw-left", lambda p: p.axis("LX", -0.9)),
+    (2.0, "idle4", lambda p: p.reset()),
+    (5.0, "boost", lambda p: p.trig("RT", 1.0)),
+    (3.0, "idle5", lambda p: p.reset()),
+]
+
+
+def main():
+    out = sys.argv[1]
+    w = gworld.World()
+    inst = w.refresh()
+    print(f"# {len(inst)} instances", flush=True)
+    if not inst:
+        sys.exit("no instances — not in a mission?")
+
+    pad = Pad()
+    hz = 10.0
+    with open(out, "wb") as f:
+        f.write(b"SYLPHPRB")
+        f.write(struct.pack("<III", len(inst), gworld.WINDOW, 6))
+        for va, off, nm in inst:
+            f.write(struct.pack("<IQ", va, off) + nm.encode()[:63].ljust(64, b"\0"))
+        t_start = time.time()
+        for dur, label, act in SCRIPT:
+            act(pad)
+            print(f"# {label} ({dur}s)", flush=True)
+            n = int(dur * hz)
+            for _ in range(n):
+                t = time.time()
+                f.write(struct.pack("<d", t - t_start))
+                f.write(struct.pack("<6f", *pad.vector()))
+                f.write(struct.pack("<32s", label.encode()[:32]))
+                for va, off, nm in inst:
+                    f.write(w.read_off(off, gworld.WINDOW).ljust(gworld.WINDOW, b"\0"))
+                time.sleep(max(0, 1.0 / hz - (time.time() - t)))
+        pad.reset()
+    print(f"# wrote {out} ({os.path.getsize(out)/1e6:.1f} MB)", flush=True)
+
+
+if __name__ == "__main__":
+    main()