Observe execution instead of sampling it

[macabeus]

Item 2 of the analysis-surface audit: telling "not observed" apart from "not happening".

wait({ pc }) could not see execution

It compared registers[15] once per runFrame(). A frame is ~280,896 cycles, so the comparison only ever saw whatever the CPU was doing at the boundary.

Measured on a real game with an instruction-level counter over 300 frames:

• 1,624 distinct PCs execute
• exactly 1 is ever observable at a frame boundary — the BIOS wait loop the game idles in, all 300 samples

So for the busiest named function in that window:

call_r3 executes 420 times in 60 frames   (7x per frame)
wait({ pc: 0x804fb8c, timeout: 120 })  ->  timed out ... waiting for PC=0x804fb8c

A caller reads that as never reached. Absence is the answer that gets written into a docstring or used to justify deleting a branch, and no build gate checks it.

After: found in 23 ms.

The change

• ArmCpu.addExecWatchpoint(address, cb) — fires from the instruction step, returns a disposer. A registry rather than a hook because setDebugHooks is a single slot one owner replaces wholesale, and gba-browser already owns it — an analysis tool must not evict a debugger's hooks to watch a PC.
• wait({ pc }) uses it, and accepts a symbol name as well as an address, so the timeout can name what did not run: wait({ pc }) timed out after 30 frames waiting for "AcknowledgeInterrupt" (0x8001144).
• watchExecution(target, options?) — the execution counterpart to watchMemory. Exact count, hits carrying the caller's lr and source location, dropped, stop().
• watchMemory reports dropped. Capping silently left hits.length === maxHits meaning either "that is all of them" or "that is the first few". On one measured watch: 50 recorded, 26,744 dropped, nothing in the handle saying so.

The obvious objection does not hold. A per-instruction dispatch measured 0.92x against the unhooked run over 120 frames — inside the noise. The dispatch is gated on a flag, so the no-watchpoint path is a single boolean test.

Verification

Against the ROM: wait({ pc }) finds call_r3 by symbol and by address, still times out on a function that genuinely never runs, and watchExecution counts exactly 420 — matching the independent instruction-level ground truth.

Ablations: removing the dispatch fails 5 arm-emulator and 4 gba-emulator tests; removing the drop counter fails the watchMemory cap test.

141 tests in arm-emulator (was 135), 74 in gba-emulator (was 67). check-types, lint, format:check, build and test all exit 0.

Three things measurement corrected

• I had cited AcknowledgeInterrupt as a function that "runs every frame" when briefing this item. The counter says it executes zero times in this savestate — the example was wrong, and call_r3 replaces it.
• The first test loop encoded b .-4 as 0xE7FD, which targets BASE+2 and never re-executes BASE. The watchpoint fired once and the test failed for the right reason; the correct encoding is 0xE7FC.
• watchExecution read Thumb state from the optional cpuCpsr hook, which only HeadlessRuntime wires, so a directly-constructed engine reported ARM for everything.

One process note: the first gba-emulator ablation proved nothing, because that package builds against arm-emulator's dist — the ablation has to be rebuilt before it is visible. Re-run with a build in between, it bites.