Emit AE/AGC callback skeleton + document ipctool sensor monitor

[widgetii]

Follow-up to #145 / #146. Two changes that share a theme: making the AE/AGC layer of an extracted sensor driver navigable.

Write-side: AE/AGC callback skeleton

trace_to_driver.py now emits a third function <sensor>_ae_step containing the per-frame AE/AGC writes captured during the runtime phase, tagged /* TODO: derive */. The original plan in #145 promised this; #145 shipped only a comment block.

For SC2315E + Majestic from #145:

void sc2315e_ae_step(VI_PIPE ViPipe)
{
    (void)ViPipe;
    sensor_write_register(0x5781, 0x60);  /* TODO: derive */
    sensor_write_register(0x5785, 0x30);  /* TODO: derive */
    sensor_write_register(0x3314, 0x14);  /* TODO: derive */
}

The reference's cmos_gains_update writes 0x5781=96 (0x60), 0x5785=48 (0x30) in its else-branch and cmos_inttime_update writes 0x3314=20 (0x14) in its low-inttime branch — the skeleton captures the right registers and the values that the running AE loop wrote during steady-state ambient light. A varying-light capture would surface the if-branches too.

Selection heuristic: top 8 by frequency, each ≥25% of the max count. Conservative on noisy traces; permissive on clean ones.

Read-side: document ipctool sensor monitor

ipctool sensor monitor is an existing feature: poll a fixed list of AE/exposure registers from the running sensor over I2C/SPI in a loop, decoded as labelled fields. SC2315E was already wired up but the feature itself was never documented.

$ ipctool sensor monitor
EXP   100  AGAIN  310  DGAIN  80  VMAX  546  R3301  f  R3314  14  R3632  8  HOLD  0  R5781  60  R5785  30
                                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                                       same hot regs that trace_to_driver picks up

Same idea as _ae_step, but read-side. The two pair naturally:

1. Extract _ae_step via trace → register set
2. Run sensor monitor while varying lighting (cover lens, switch IR cut) → value time-series
3. Derive the AE conditional / LUT from the value distribution

The new "Stage 4 — Live-reading the AE state" section in docs/sensor-driver-extraction.md walks through this pairing and includes the recipe for adding a new sensor's reg list to src/snstool.c.

Also renamed R3812 → HOLD in the sc2315e reg table — that register is the group-hold trigger from cmos_gains_update and self-documents the live output.

Test plan

• tools/test_pipeline.sh extended to assert the new _ae_step function is emitted; passes
• gcc -Wall -Wextra -fsyntax-only on real captured + generated scaffold passes
• CI test-extraction-pipeline job catches regressions in segmenter / generator
• Cross-check against widgetii/smart_sc2315e/sc2315e_cmos.c confirms register selection
• ipctool-upx sensor monitor runs on the SC2315E camera; output shows the renamed HOLD field correctly
• No regression in pre-commit clang-format check

🤖 Generated with Claude Code