Move-power / parameter table Confirmed

The kernel reads +0x00 at three load sites and derives four shifts. They are not a full / half / quarter ladder: two bound a random roll, two are summed straight into the damage accumulator.

Both moduli are used as rand % (x + 1), so power < 4 rolls a constant 0 on the >> 2 branch and < 8 on >> 3. The half and eighth scales appear only in the retry arm, which re-floors a too-low attacker score. The roll is then scaled by the element-affinity matrix FUN_801dd864, a sibling table in the same overlay.

So the kernel takes the whole halfword and does every shift itself; the unshifted word is the biggest term of the attack roll. The power figures on this page (record 3's 1500 from raw 0x1770, Freeze Thunder's 37) and the asset move-power column are the >> 2 modulus base. Fed that quarter instead, the roll shifts twice: Tail Fire (raw 0x1E) on a Spirit-guarding Vahn reads 16 on retail's damage ring, where the quartered roll lands on 6 or 7.

The map lookup in the tick materialises 0x801F4E64 and reads lbu a0,-0x1(v1); the 0x801F4E63 base is that addiu 0x4e64 / lbu -0x1 pair, so the constant 0x4e63 appears nowhere in the code. The stride is built as 13a << 1, never a literal, so a search for 0x1a finds nothing either.

Of the three sites that materialise the base, the one at 0x801dd36c defeats a linear lui+addiu matcher: its lui a0,0x801f sits in the branch delay slot at 0x801dd2f8 and the addiu is the branch target, 0x74 bytes later with a0 clobbered in between. A sweep folding pairs must follow branch targets, not adjacency.

Per-field load sites: +0x02 at 0x801e0dc4, 0x801e13b8; +0x04 at 0x801df288; +0x06 at 0x801e0d70, 0x801e1360; +0x08 at 0x801e1018, 0x801e1074, 0x801e1274; +0x09 at 0x801e10d4; +0x0a stored at actor+0x21f, indexing 0x801f53d4 ((v-1)*4, packed u32 words with 0x3FF-masked lanes, not pointers) into actor+0x04; +0x0b at 0x801e0ca0, 0x801e0cd0; +0x0d at 0x801e184c; +0x0e at 0x801e0c54, 0x801df408, 0x801df4fc; +0x12 at 0x801e0d00, 0x801e114c, 0x801e1250, 0x801e12ac; +0x16 at 0x801e0ddc, 0x801e0f54, 0x801e13d0, 0x801e1550, 0x801e1800.

Swept over bytes, not dumps: SCUS_942.54 plus every overlay image in static-overlays.toml, every 4-byte word decoded independently, for every valid R3000 load / store and j / jal target (not COP2, which cannot address a record). Access shapes modelled: absolute constants (lui+addiu/ori pairs folded and tested against [table, table + 44*26)), base-folded displacements, ×26-indexed registers, pointer-relative reads through lw rD, 0x1014(rB), straddling loads, and data-resident pointers. No reference lands at a shifted offset, no data word holds an in-table address, and PROT 0898's five byte-width loads at literal displacement 0xc all sit on unrelated RAM structs (the image has 134 memory operations at that displacement; the other 38 byte-width ones are stores). The one form an absolute scan cannot see is impossible here: $gp is 0x8007B318, so a signed-16 displacement off it reaches 0x80073318..0x80083317 and the table sits about 1.5 MB outside that window. PROT 0896 is closed by bytes, producing zero hits in either base-independent encoding. +0x0d, by contrast, is read - once, as a byte, at 0x801E184C, feeding the cue dispatcher.

• Setup walks one contiguous run from +0x0E, stopping only on a zero byte. 0xFF is not a terminator there: it has bit 7 set and routes to the 2D path with id 0x7F.
• Tick reads +0x12 and +0x16 as two separate 4-byte lists and treats +0x0E == 0xFF as a broadcast to all four arms.

Ids 0x0A, 0x2D and 0x2E additionally latch the spawned handle into ctx+0x1028 and seed the per-frame delta triple at ctx+0x1184, which is what makes their effect follow the actor. The 2D path (FUN_801dfdf0 → FUN_801DFDF8) special-cases pack1 0x04 → 0x801F5D90 and 0x13 → 0x801F5CF8, the two burst-arm move-VM trigger programs. The 61-entry space bounds both side tables; the runtime's < 100 spawn guard is a loose safety check.

Indexed by group id rather than effect id; the cue expander reads one 5-byte record per call:

13 records fill 0x801F6470..0x801F64B5, followed by padding and the summon.DAT path literal; callers never index past 0xC. The table has exactly one consumer - a reference scan of SCUS plus every base-mapped overlay finds the address materialised once - while its two sibling tables are reached from five sites each, always in pairs. The caller is the damage-application primitive FUN_800402F4 (eleven branches, group ids 5..0xC literal or computed). The port carries the kernel, both tables and the per-branch dispatch (legaia_engine_battle_vm::battle_cue_group).

The tick calls FUN_80050ed4(world_pos, src_pos, 0x801f6324[id], 0x1000), a 0x60-slot allocator that tail-calls the shared stager FUN_80021B04 (the disassembly preserves a0..a3; the C decomp drops them), which reads the record's +0x00 model_sel (< 0 / 0x4000 / 0x4001 are transform-node / render-mode sentinels, else the mesh is DAT_8007C018[model_sel + gp[0x754]]), allocates an actor (FUN_80020de0), stores the record as the actor's move-VM buffer (+0x48), forces the PC to u16-index 2 (bytecode at record+4) and drives it through the move VM (FUN_80023070). move_power::parse_effect_proto_records decodes the whole table (ids 0x27 / 0x28 → 0x801F5BBC / 0x801F5BDC); a live Gimard “Fire Tail” mid-cast holds a part-actor whose +0x48 is 0x801F5484.

gp[0x754] (global 0x8007BA6C) is party_count + 2 in battle: 0 when no effect-model library is resident, 3 for the 1-member training party, 5 for the full party. The two fixed pool slots plus the live party meshes precede the effect-model library (PROT 0871, engine global_tmd_pool[3..=32]), so model_sel is library-relative and there is no per-summon base.

Across 186 monsters, 46 distinct attack ids appear in the monster record's special-attack bytes (+0x21..=+0x23); 28 are in this table. The other 18 (0x2E / 0x2F / 0x3C / 0x4A..=0x6E, plus 0xA7 / 0xB8 beyond the map) are the magic / elemental casts. 95 of 186 monsters carry no magic attack at all. Freeze Thunder is record 22.