Open reverse-engineering threads

• A scene-local music id never loads the scene's own block. The loader computes that index only to test for a change, then loads a fixed fallback track from the shared bank; retail never stages a scene bank.
• The shop's last three rows are Platinum Card stock. The probe looks for item 0xFF, the card - not an empty slot - and without it those rows are dropped; a capture shows 13 rows with the card and 10 without.
• Rula and Riremito are the Door of Wind and Door of Light. The handler table is indexed by value, so the missing address references proved nothing; the arts scan the CDNAME define table, and the routine read as a fade is the pause-menu session.
• The routine read as a glyph or draw helper is the NPC visibility cull, and the "motion-pause kick" holds nothing. Both dumps filed under the cull's address held other code.
• The battle "target-highlight dim" is a near-camera ghost pass, and party animation entry 8 is the downed kneel, not a recover clip with a backstep.
• The USA dialog font already carries accented letters - 32 high cells, most with zero width.
• No Muscle Dome hub texture subtracts. The GPU blends only texels with the STP bit, so the "subtractive" packets draw opaque.
• A battle drops at most one item. Retail rolls every enemy's drop chance but keeps only the last winner's item, then throws the drop away three times in four unless an enemy's chance is 100% or a party member has Items Up. The docs and the port had granted a drop per defeated enemy.
• Two battle routines named for Miracle Arts and the capture cinematic belong to the Seru absorb. One checks whether the killer already knows the Seru, the other holds the Seru the killing blow absorbed - and the absorb itself had never run in the engine.
• Incense stops random encounters outright for a window of walking steps; the word it fills had been read as a brightness ramp and as a frame cooldown.
• A scene-stream chunk read as a texture upload is the music score's install, carried by every scene stream that has a score, and the installer decodes no compressed data at all.
• Baka Fighter's "sprite" passes drive 3D models. The two "sprite archives" are the scene's animation-clip banks, the "mirrored sprite pass" is the special attack's afterimage, and the round-start cameo is the ring girl, not a party member.
• The prologue jungle's black plants were a native-only mistake - a staging step gave the dim prologue ambient to every vertex of one colour, authored billboards included - not the sepia grade and not retail's own colour rewrite.
• The field drop shadow is four textured quads over a projected grid, not a lighting helper and a gouraud grid; the port had filed the pair as handled by its rasteriser while neither host drew a shadow.
• A field-script opcode read as "talk to this NPC" starts a fight. Op 0x3E with a first operand below 100 installs a scripted battle from the scene's formation table, exactly as the 0xFF form does; the engine had opened dialogue at all ten such sites on the disc, and eleven doc sentences described it as the talk trigger. Talking is a button press, not an opcode.
• Three fog readings fell together. The fog sheets sample VRAM (448, 0), not (448, 256); the larger fog cap is every overworld's, set from a scene-header bit, not a debug value; and the port's excess fog came from feeding the spawner raw random-number state where retail's BIOS rand returns the high half, not from the stale live count.
• kor5's tail flag needed no poke. The record that sets it does so a few thousand frames into the chain; the 17,500-frame estimate was the probe re-triggering an earlier beat over the running chain.
• The title menu has two rows. No title route reaches Options, and the "boot Options screen draws twice" drift reading was wrong on both counts.
• A battle routine's "captured-monster payout" is the refund of an item a fallen fighter had committed, read at an address that belongs to no routine - a mis-based print of the turn-order picker.
• A routine named for zeroing the GTE light block zeroes the translation vector instead. The three control-register writes in the routine the docs cited are the far-colour trio, written from registers rather than zeroed; the routine that zeroes anything targets the translation vector. The battle-intro swirl rolls about two axes with it, not one. Both readings had been graded from Ghidra's C output, where a control-register write prints as a helper call with the register number buried in an argument.
• The cast-voice bank was named from the wrong end. Each slot-B module hardcodes its own literal cue id near its head - 62 of the 64 images, the other two forming it at run time - so the bank is a property of the module, not of the caster, and it is seventeen streamed-audio files rather than the three the drift page listed. With it: the cue table its reader indexes is four times longer than the port's constant, and the reader bounds nothing above the threshold, so every cast cue fell off the end of a table that looked complete.
• The port's shop screen was read back as retail's. Retail's quantity control is a pair of pad steppers (+1 / -1 / +10 / -10, clamped) whose bound is the smallest of what the purse affords, 99, and 99 minus what is held. The "nine-row list whose cursor is the quantity" describes the port's own screen, and while that stood the port capped every purchase at 9.
• A 72-slot item bag was a cheat page's display bound. The bag is one 256-slot array reached only through an active window that a single setup routine writes; a real three-member memory card holds items up to index 159, so 88 of them were dropped on every lift. Enemy Steal has a third acceptance test nothing modelled - the item's shop price being non-zero - and its consume helper scans only the active window and returns a sentinel, so a steal outside the window banners a success and removes nothing.
• An actor's heading is the middle of a triple. The field actor updater hands the whole +0x24 vector to the rotation setter, so pitch and roll ride beside the yaw a reader taking the halfword alone sees - which is why per-actor tilt was missing on both hosts and looked like a renderer gap.
• The field-VM word the port called an input lock is the ambient-particle master gate. One opcode's sub-0 raises it and sub-1 clears it, both stores in a jump delay slot, and the word has six references disc-wide of which none is pad state. A field script decides per scene whether ambience emits at all.
• The staged background loader is two dispatchers, not one walk. One word picks between a 19-arm field-restore table and a 12-arm panel-still table, and both run from phase 2 because the SCUS sequencer owns states 0 and 1. That is why a teardown census recorded four field-restore uploads and zero panel stills - the branch working, not a missing consumer.
• The cast-arm countdown drain is per arm. It is a per-arm multiplier of a scratchpad frame byte - the product, twice it, or once it - so the single product shape held for one family only, and two arms measured as constants 4 and 8 were 1x and 2x a byte that read 4.
• Two in-world minigames started the wrong track, because the extraction map from a loader index to a global BGM id is piecewise and a flat base had been assumed. Nearby: only one of the three overlays a doc listed as dance variants is the dance overlay.
• The dance count-in banner is a sprite record, not text, seated from the dance overlay's own table with per-arm blend, and its animator samples once per three vsyncs. And the field follow camera's three "constants" were one save state's values - over the walkable state population they hold in 12, 8 and 1 of 19; retail derives all three per scene and per player tile.
• The failing rebuilt character-pack container is not constructible. The decode is length-driven by the descriptor and the loader sizes its buffers from the container header, so a header-byte-exact rebuild with a different decoded size simply gets a truncated pack - and no shipped patcher path changes that size. The test turns out to need no patched disc at all: retail's own pack pointer is garbage in every catalogued battle state, and the registrar that reads it is unclamped.
• Every scene-bundle descriptor offset is inside its entry - all 668 over 102 tables. The "offsets fall outside the file" reading was the over-reading entry-size expression, not the bundles. The type-0x14 descriptor of every count-4/5 bundle is the placeholder fill file, and the dispatcher answers it without reading the payload, so a descriptor resolving to filler is the format working.
• Six readings of the cast band fell at once, and one measurement blind spot explains most of them. A phase-store census keyed on the literal 0x279 displacement misses every module that stores through a formed pointer - one module reads as zero stores and has six. A "no damage wrapper, no HP write" verdict taken inside one tick's own frame missed the applier one call deeper. The band has three clamp shapes, not two, and one module picks its cap per hit from its own slash counter. Only two of the eleven player-Seru bodies heal, and the published (power << 5) + 0xE0 formula belongs to neither - each has its own closed form over the caster's magic level. Actor +0x1DC is a bitfield at the reaction sites, not a counter. And a body's head table is not the body: one image's MP writer was named by the VA of the table that points at it.
• Monster record +0x20 is a texture-page width flag, not a per-monster instant-death immunity byte. Three summon ticks read it before an instant-death roll and force the resist when it is set, and the 37 records carrying it are bosses plus one insect family - exactly what an immunity list looks like. Its primary reader is the model upload, which widens the VRAM rect. A field's meaning is its primary reader's, not its most interesting reader's.
• Actor +0x8A bit 0 suppresses the scripted motion VM; it does not enable it. A zero byte runs the bytecode, and the bit gates the player-engaged / actor-busy / off-map early returns. Two op readings fell with it: op 0x06 is a home-relative one-tile wander rather than a pad echo, and op 0x0C fades a packed RGB tint and a draw mode rather than gliding a position - the speed halfword is one field away.
• The field entry seat belonged to the ambient emitter. The quoted spawn coordinates are the one plain template's; the player is seated on both arms of the field MAIN INIT from the door operand. "Cold entry happens only at New Game" is false too - the same function's epilogue clears the gating word, so every ordinary scene change takes the cold arm.
• The battle context byte the port called "counter-attack" is the scripted-fight flag, derived at battle init from a bit of the per-battle flags; the counter-attack byte is the next one along. All three action-SM reads gate on it, so two audio-duck arms and the attack-return arm were unreachable while the port seeded zero. In the same area: the dome arena's pre-test seed of the special-battle word is 1, not 0 - course 0 with no bans, which is a different thing from no seed.
• The dome tally screen's rows were wrong on both hosts. Retail puts the HP accumulator between lanes 2 and 3 and uses four brightness steps, not six. The lane base is re-formed into a different register between the product and the store, which is what mis-attributed the lanes.
• The koin4 coplanar sliver was manufactured by the port's own lift. The offending strip is exactly one nudge wide, because the lift applied to that family lies inside the second plane; zeroing the offset takes the measured overlap to zero. A repair pass is part of the instrument measuring the defect, so its own artifacts read as findings.
• Nothing on the disc can materialise the rebuilt-container wild read's address. No overlay image holds the upper half it would need, and the delta from the container base is an order of magnitude off what the earlier arithmetic assumed - so the pointer is computed at run time, with two pack walks as candidates, and the byte-exactness rule the modding path follows stays conservative rather than explained.
• Two measurement headlines were the instruments' own. A feature view's Port % counted ignored rows in the numerator and the denominator, so five views read far below their real figure and the headline moved whenever an ignore row was added; and every dump of one 588-byte function stops at 276, because the decompiler stops at an interior jump table the preceding branch skips past. Seven dumps agreeing is agreement about the decompiler.
• An open-ended CDNAME block's range is not a length. The last block runs to the end of the map, so an unclamped block range reserved 64 GiB on a scene load - and Linux overcommit granted it silently until a test run met the memory watchdog. Reproduce this class under a ulimit -v cap: an overcommitted reservation only aborts under one.
• "No dome round bans magic" was wrong, and this page published it. The claim rested on the magic bit's known writers keying on the first enemy monster id, which the dome ladder never reaches - true, and beside the point: the arena seeds the whole restriction word itself, on three story flags, last match winning. Every seed bars the Item chip and the top seed bars magic, so retail really does cross out the Ra-Seru chip on the highest course. Enumerating one bit's writers is not enumerating the word's.
• A correction on this very list was itself wrong. "A slot-B module's regions interleave - records sit between bodies" was published here after the bodies above two images' record bands were read as those images' own code. They are the donor's: one image is byte-identical to its neighbour from a file offset partway up, so its own content ends there and everything above belongs to the other. A dump that prints at an address under two images' names is not evidence of which one owns it.
• Sixteen of twenty "un-dumped code runs" were never code - the count was published as seventeen, and the twentieth run really is code: an eight-arm leaf table whose seven 20-byte leaves and one 12-byte leaf have no frame for frame matching to see. The other sixteen are an image's own data tail or a neighbouring image's bytes at the same file offset - a build-buffer leftover every extracted overlay ends in, and the rule that recognises it carried two wrong restrictions of its own: the buffer is indexed by file offset, so the donor need not share a load base, and the length field is a sector extent, so it need not be longer. 79 of 83 images and 88,150 bytes, not 66 and 61,597.
• A slot-B module's data tail is a spawn-record band. The uncovered span is [i16 model_sel][u16 reserved][move-VM bytecode] records addressed by the consumer's own lui/addiu; 62 of 64 images carry one. The +0x02 halfword is zero in every one of the band's records with no reader, so it is reserved rather than flags.
• FUN_801DA390 eases a camera height, not a yaw. 0x801DA3B4 reads ctrl[+0x4A], 0x801DA3B8 reads the actor's +0x16 - the Y of the position triple, not an angle. The same halfword had three incompatible readings across the docs, and nothing on the disc masks it as an angle.
• Retail's title screen does not run under mode 0x10. The front end is six mode stores and the title's own mode is the card mode 0x17; 0x10 is one frame of logo INIT. Each hand-off is the handler's own store, not a field of the mode table.
• A dome round is an ordinary battle; the dome hub is the OTHER mode. A cast also costs MP, not AP, so every "the pennant pays for a cast" argument was about the wrong currency. (The magic-ban half of this bullet was itself overturned - see the top of the list.)
• FUN_80058490 is MoveImage, not a sound-driver lane. It moves a VRAM rect to (0xE0, 0x1DC) - CLUT row y = 476 - so the table behind it holds VRAM x coordinates, and anything reading those bytes as sound-effect ids is reading a palette column.
• FUN_8003E8A8 returns a sector count. 0x8003E90C is subu s0,v0,s2 over the two TOC words and 0x8003E948 returns it; the LBA is a side effect. Two loader rows and one argument order were reversed against it, and the libcd directory cache is at 0x801CB408. How 0x801C4BEC arose is not settled: the "offset half of an instruction pair" story does not survive, because that halfword occurs at no word in the executable.
• A live port wore another routine's address. engine-core::dialog carried PORT: FUN_8001FD44 and implements nothing of it. Nothing gates this class: a // PORT: tag naming the wrong routine passes every check that exists.
• Twelve feature views were measuring one blob. A breadth-first walk from a feature root spills through the title tick into the save UI, the effect spawner and the move VM, so one view's anchor set was a strict subset of another's. Localized, the same feature measures 72 anchors instead of 781.
• FUN_801DD35C is the title tick, not a menu dispatcher, and _DAT_8007BAB4 is its pre-attract hold rather than an "active submenu index" - read at 0x801DDA9C, tested bgtz at 0x801DDAB4, drained by frame_scalar << 3. Three more title readings fell with it: the sub-mode word is 0x801F0204 and 0x801DD920 is only the instruction that writes it; a cold boot never shows sub-mode 0x02; and the slider state[-0xEB4] has no [0, 0x2C] range - both arms converge on 0x2C, and the graph seeds it 0x100 and -0x16.
• The summon draw does not run 35-64 times a frame. Re-measured on the same catalogued state, FUN_80048A08 is called once per live actor per rendered frame - at most 2 in the solo fight the original figure came from.
• The world-map overlay's per-prim handler table is based at 0x801F8968, not at its first non-zero word. FUN_80043390 materialises the base with lui s4,0x8020 / addiu s4,s4,-0x7698 and indexes it with the same (flags >> 1) * 4 it uses on the SCUS table 0x8007657C - which has the identical shape, words 0..7 zero. Re-basing by the zero prefix shifts every prim kind by eight.
• Two dumps were reading the wrong image. 0x801D2784 is PROT 0976 (Baka Fighter), not 0979 - the two are byte-identical from file 0x3C68, so only the operands separate them. And every overlay_dance_* print above 0x801D6818 is PROT 0972's fishing overlay: 0x801D73B8 is that image's file 0x8BA0, byte for byte.
• Not every alias is a phantom. 0x801DDA90 is a real entry in both slot-A images - the field overlay's screen-frame corner writer and the title tick's AttractDelay arm - and the "two slices of one loop, neither an entry" reading was right about 0x801DDB44 only.
• Four field-overlay routines were named for the wrong effect. FUN_801DD784 is the scene shutter blackout, not a letterbox; 0x801F27EC oscillates one rung of the floor-height ladder at 0x1F80035C, not a fade; FUN_801CFF3C is FUN_801DE754 printed 0xE818 low; and 0x801D44CC flips the dance step-marker's mesh rather than facing a dancer.
• A jal sweep scoped to one image answered the wrong question. PROT 0898 really does not call FUN_8002C69C; SCUS FUN_80031D00 drives it off the retained widget list every frame a battle is up, so the post-battle report chrome is the ordinary nine-slice.
• FUN_80019D50 uploads a palette, it does not emit primitives - one LoadImage at 0x8001A030 per call, the CLUT-cell HSV cycler. And FUN_801D362C has exactly one reference on the disc, the move VM's own op-0x2F arm, so the world-map controller does not call it directly.
• Two measurement reflexes were wrong. A disc-coverage --check floor regression is attribution lag - a new unattributed dump raises the denominator first - not lost coverage; and a // PORT: tag's live/inert bucket is a property of the tagged item, not of a neighbouring symbol that happens to be called.
• The title screen was never "ahead of the mode table". It runs under the CARD mode pair 22/23; main()'s one pre-loop overlay load is the boot init.pak 0895, and FUN_801DD35C is inside PROT 0899 at +0xEB44. Four more inference-graded rows were re-derived from instructions in the same pass; _DAT_8007BD84 is an effect handle, not a mode word, and the item table carries 250 names, not "far below 128".
• The five "sealed" chapter-1 scenes were never sealed. uru, urudre1..3 and jouine carry walk-on exits in their .PCH sidecar; the ladder's own caps produced the verdict. Live-confirmed for uru.
• The battle-intro enemy-name banner is raised by no placement record; the composer FUN_801D9D3C spawns its labels with immediate geometry. bse.dat loads at battle init, not boot, and its columns are pinned.
• Debug flag _DAT_8007B8C2 had its branch sense backwards, and one arm was named for the wrong loader. Every site reads the flag with lh and takes the zero arm to the debug-station host trap, the non-zero arm to the index resolver. Settled on that polarity, writer and all.
• The VA-aliasing corollary was too narrow. It read as an 0x801Fxxxx problem; 801e23ec is a settled casualty in the 0x801E band, and its aliased reading had silently dropped all three initiative modifier terms.
• The op-0x2F "seven byte-identical dumps" shorthand was compressing. The capture-derived dumps agree with each other; the static 0897 dump is a strict subset of them, not a twin.
• FUN_8001EBEC's second pose-copy arm loads seven words, so its range ends at +0x15C, not +0x158.
• A committed claim can quote a dump statistic the dump no longer reports. Re-extraction makes dumps longer, and a caveat written against the old one keeps suppressing work - 0x8005BA38 was recorded "not a function, do not open a port row" and is a complete RotTransPers. Checker: scripts/ghidra-analysis/check-dump-stat-drift.py; the class is on do not re-walk § measurement readings.
• A battle 0xB5 was read in the wrong id space. Spell 0xB5 is Lapis Wave; formation 0xB5 is Cort. The branch at 0x801E6D04 reads the formation-id byte, and the wrong reading survived because Cort casts Lapis Wave - the two spaces agreeing on the answer is what hid the error.
• Op-0x35 sub-op 9 was recorded as "Queue". It is a start behind an asset-load barrier - the arm at 0x801E0224 waits on _DAT_8007BAB8 == _DAT_8007BA9C and then makes sub-op 1's own _DAT_8007BAC8 store. It is what a cutscene changes music with, so a scene-corpus BGM sweep (which only runs prescripts, and those emit sub-op 1) could not see the difference. Falsification: do not re-walk.
• FUN_801D27E0 was handed off as "the talk controller that restores party count/leader and drops lock 0xD". The disassembly says otherwise. The function is the three-actor talk's leader-cycle state machine (six states off +0x54): state 0 polls system flag 0xD and the per-participant flags base+0..2, and a switch trigger fades out, hands control to the next un-talked participant (rewriting 0x80084597/98 + flags 0x10..0x12, parking the old leader's record at 0x3F80), and fades back in. It never writes the party count 0x80084594 and never clears flag 0xD - when the script clears the flag, state 5 merely despawns the controller (s4+0x10 &= ~8). Retail's post-talk party membership comes from the scene script's own party ops (the field VM's 0x454-offset writers). The engine's restore (World::end_three_actor_talk) therefore keys on the flag-drop trigger and restores an arm-time snapshot, disclosed as such.
• The quick-travel placement scene_id "unresolvable id space" is resolved. The u16 at record +2 of DAT_80073A98 is the destination scene's raw CDNAME TOC index - disc values 0x55/0xF4/0x187 are the map01/02/03 kingdom bases and 0x162/0x215 are son/korout - and the staged copy at 0x80084628 is the same word the world-map arrival kernel FUN_801EE328 matches (record +0xC of the visited-map table) before seating the party at (tile << 7) + 0x40. Resolver: World::tables.scene_toc_names; drain World::drain_staged_menu_warp.
• "Retail shots rarely roll the camera" was false, and so was the row that replaced it. Retail authors a non-zero op-0x45 slot-2 roll in eight scenes. The renderer's dropped RotMatrixZ factor was a real divergence, and the two linear censuses that had measured it - one strict, one byte-resuming, plus a raw byte scan quoting a "2 %" figure as fact - were each measuring their own decode gate. Settled by execution on settled threads.
• The field view matrix is built per field frame, not three times a vsync, and two of its five call sites are not a camera at all. Over a world-map-to-town entry only 749 of 1800 captured vsyncs carried any build, split 389 / 313 between the full order and a short one. The two sites a sweep of the executable and the first-slot overlays cannot see are one bracket in the world-map render module, which zeroes the camera yaw to draw a screen-fixed band and then puts it back.
• The last build before the draw does not win - it frames no geometry at all. A link count already put 16810 of 31046 under the first build and fourteen under the last; splitting by graphics command code gives the real figure, because that count was mixing attribute packets and flat rectangles in with polygons. Of 4289 polygons over three runs, 3861 are under the first build, 428 under the second and none under the last.
• The slot-B stage selector does have a writer. The field entity tick clears the byte and raises it off a system story flag, and battle latches its other value directly. Every access is of the register-relative form the project's address sweep is blind to, which is the same blind spot that hid a camera-focus destination earlier.
• The cast-cue band's door is an item, not a spell. Its one caller is the Spirit / Item wait state, entered from a pre-arm state that the item command sets unconditionally and the magic command sets only for ids below a threshold the player's own Seru block sits above - so fifteen injected casts finding it cold was a bound, not a sampling accident.
• An archive entry labelled monster_test is the world-map top-view debug image. Names inherit forward from the block that opens above it, so the label says which block a slot is in and nothing about its content; the image's own operands are the world-map location table, the kingdom filter and the camera pair. The "324-byte routine" the corpus printed inside it is one arm of its own dispatcher.
• The developer menu's BGM row plays a track; it does not cycle the index. Cycling is the input half, a different routine. The row's action installs a sound-test entry's global track id, which makes it the fourth writer of the music-request word on the whole disc - and the reason it had been filed as a world-map region change.
• The equip compare panel's no-passive sentinel is not a free substitution. Every equipment row carries it, so it reproduces that arm exactly and nothing else; 80 of the 151 non-equipment ids carry a real passive index on the other arm, and a host feeding the sentinel unconditionally loses two of the three row sets. The screen that opens the panel was wrong too - it is the equip candidate step, not the shop's recipient flow, and no screen opens both compare windows.
• A captured sound voice is audible by its envelope level, not its phase word. The phase has no idle member - a key-off parks a voice in release - so a phase test counts every voice a state has ever keyed, which is why retail snapshots read 20 to 24 of 24 voices live and why an oracle rule looked unsatisfiable. Against the level, retail holds 4 to 9 audible voices and the engine 4 to 8, and 1624 of 2352 slots across the retail corpus are at level zero. The engine really was missing three cold scene-entry steps underneath; that was a second, independent defect.
• The browser play page's frame path does short-circuit - in the page's own JavaScript rather than in the Rust runtime, so a guarded frame runs none of the per-frame work and still paints. A check that reads only the Rust cannot see it.
• Two minigame citations were off by bytes rather than by reading. The Baka Fighter editor's actor record and its sibling start four bytes lower than cited - the cited words are each record's filler field, not its head - and the fishing bite tick's two per-frame map reads are unrelated (one is the water gate, the other drifts the lure sideways over an obstructed cell), and the halfword read as the lure's z is its height.
• The Muscle Dome's "match state machine" is the round state machine every battle runs. It has exactly one call site disc-wide, unconditional, inside the SCUS battle frame driver, and three non-dome battle states enter it hundreds of times over 700 frames each. Reading it as a dome controller was reading one caller's context for the routine.
• The audio oracle's "reverb" channel was the SPU control register. The emulator's register blob is the hardware window verbatim, so the offset being compared was the control register, and the value that read as "retail routes four voices" is enable | unmute | reverb-master | CD. The real per-voice enable mask reads all 24 voices on every captured frame - and the engine's own zero came from an oracle building a bare SPU where the shipped audio host builds one with retail's reverb installed.
• "The engine runs half retail's voices" compared two pieces of music. An engine trace plays the track the scene's own entry script selects; the retail capture it was paired against still held the overworld track, because that save walked into town from the world map. On one track over a comparable stretch the two sides land in the same place, and the sequencer drops no notes at all.
• An overlay with "no load base that fits" had one all along. The measurement was a resolution ratio over the image's address-forming pairs, which is one-sided: a base that catches few pairs scores perfectly on all of them, and on this image it ranked a refuted base first. The call-graph recovery lands, every internal jump resolves inside the file at that base, and the image turns out to be linked against an executable this disc does not carry.
• The dome panel still has a draw site; it never materialises the number that was searched for. A textured primitive addresses video memory through a packed page index, so the emitter's constants are page numbers rather than the pixel column. It is in the contest hub - a mode later than the upload, in an image that is not resident when the load runs.
• A frame kernel paired by name can be an empty body. The host-drift gate paired a native step with a browser one and asserted both advanced the scene's posed actors; the native body was {}, and an empty body pairs with anything. The window does that work inline, which is a different claim.
• The port's camera visible-tile window was seeded once at construction, not at scene entry. A scene that scripted a wide window handed it to the next scene's clamp. Retail's window is per region: a town walk alternates between two windows as the player crosses regions, and neither is the port's default.
• A wall-slide oracle was not asserting the defect it was blamed for. Both pinned wall-press legs are slide-neutral - the resolver hands back the held direction at each - so the test measured points where the two models agree, while retail's slide fires in ordinary free-roam.
• A reserved value on the music request word is a park sentinel, not a track. The resolver compares against it, copies the pending index onto the loaded-index barrier and skips the load; the second streaming slot carries the same test. The states that read it are the ending ones.
• A spawn opcode's two operands are envelope rates, not a kind/variant pair. The opcode spawns from the morph-weight descriptor, whose handler reads the two fields as the rise and fall steps of the morph weight. The port's field names were the generic allocator's, not this spawner's.

Two rows a prior audit flagged as the highest-risk decompiled-C claims on the register - the narration-roller op's operand decode and the item-add OOB store-order claim - have both now been re-derived from the disassembly and confirmed (grade disassembly). Both live on the settled register with the instruction evidence cited.

teien's hedge-base ground fill had a false premise. Retail ships no kind-2-cell draw channel at all: a live teien field pass visits 1536 window cells and emits 370 - exactly the cells carrying 0x1000 - and none of the 42 that are 0x0800-only. Only 8 of 84 images touch the object grid at all, only PROT 0900 / 0901 hold a per-cell pass, and each one's andi 0x800 reads an object record's +0x12 rather than a cell bit. The cell bit 0x8000 turns out to be a per-tile depth-sort flag. Answer on settled threads; the falsified reading on do not re-walk.

Neither of the gate's two walk-on bands holds the player in - the exit record is ungated and the other is five inert bytes; a collision row painted by the gate object's own script does. Answer on settled threads; the falsified force-walk reading is on do not re-walk.

The per-region C1/C2 gate families - the partition-2 record-header flag lists the spawn evaluator FUN_8003BDE0 checks - are decoded across the chapter-2/3 regions and the Rim Elm variants, with every family's exact lists pinned by census-file anchor tests. The full structure (Sebucus spokes, Rim Elm opening/revisit/final bands, Uru Mais, Nivora Ravine, Karisto castle depth, Conkram, and the 0x7/0xF variant-discriminator pattern) lives on settled threads § Region story-flag gate families.

Residual. Poll-tier playthrough captures (mined with save-state-load frames screened out by their mode-churn + inventory-rewrite signature) confirm live play order for retona, dohaty, taiku, the Sebucus teien-tower-geremi spine, korb3, the kor5 chain head (0x43A to 0x436) and the map03 hub latch, alongside the earlier organic ropeway/ropeway2/jiji walks and Nivora's 0x370 SET. Still owed:

• never walked, and the corpus cannot help: rayman/rayman2, station/station3, and the Karisto spokes bubu2 + deroa/chitei2. A sweep of both emulators' state populations finds no state in station, station3, bubu2, deroa or chitei2 at all, and the one rayman state answers a different question - an idle firehose over it logs 0 SETs and 2 CLEARs, because a family SET fires on the beat, not on standing still. These need a human play-forward, not another probe;
• walked without an organic family SET (the beats were already latched in the loaded state, or the region was entered mid-arc): retock/retockin (0x502 never fired; 0x357 pre-latched), doman (0x3FB did not fire), nilboa's entry family, son, and the kor5 tail 0x6C4.

The generic C1/C2 seeder already drives every family. One more session from an early-enough save (before the retock/doman/nilboa beats) closes the walked-but-latched set; the never-walked set needs the walks themselves.

A door no longer needs a walk. A walk-on door is an exact tile match in the scene map's trigger table, so writing the player's position onto a door tile crosses it in about ninety frames (scripts/pcsx-redux/autorun_w5a_poke_walk.lua), plus one confirm press where the door asks a question first. Paired with a single-flag write watch, that turns each residual spoke into one run from a card save that reaches its region. It measures arrival, never the walk - and read what it logs with the conc lesson in hand: a flag written every other frame from an entry script's per-frame body is a position test, not a story beat.

What this needs is capture time, not a new instrument. scripts/pcsx-redux/autorun_flag_firehose.lua is already the right probe: an exec breakpoint on the flag SET / CLEAR entry points with the writer's ra, plus a per-VSync scene-name and game-mode poll, so a single play-forward through a region emits the region's own SET order with the scene each write happened in. It is designed for whole-playthrough runs, so the four unwalked regions can be covered in one session.

Two operating notes, both already bitten: PCSX-Redux probes do not exit on their own - kill on a timeout or the process hangs (PCSX-Redux automation) - and pgrep -f matches the caller's own command line, which is why the process-matching helpers in scripts/lib/proc.sh exist.

The cort_evolved_battle_first_menu PCSX-Redux state (first command menu of the evolved-Cort fight, before any cast) shows the loader-B tracker 0x8007BC4C reading 0x49 and entry 968 100% byte-resident at 0x801F69D8 over its own 0xA28 extent, with the field-side ladder states bracketing the page-in to the battle load. See settled threads § PROT 0968; the instrument is scripts/mednafen/check-0968-residency.py, which reads either emulator's states (dispatched on file extension).