Settled reverse-engineering threads

FUN_801F69D8 calls SetFarColor(0x100, 0x100, 0x100) (FUN_8005B7D8) at 0x801F729C just before jal 0x801F89B8; the emitter cues each cell with IR0 = max(SZ1 - 0x5000, 0) >> 3, SZ1 being corner (x1, z0). Scratch 0x1F800398 is the base RGBC, not the far colour. A PCSX-Redux watch saw far colour 0x1000 on all 6000 cue hits, and on keikoku's retail frame 566 of 584 continent cells match the port's engine-field::overworld_ground_cue exactly, all within 3. The emitter tests no 0x1000 cell bit; both hosts draw the cue (world-map.md).

Before each jal 0x80043390 (0x801F7254) the decoration sweep FUN_801F69D8 forms IR0 = min(max(TRZ - 0x5000, 0) >> 3, 0x1000) from the object origin's camera depth (0x801F7200..0x801F7220) with a1 = 0x00D0D0D0; the dispatcher makes a1 the far colour and parks IR0 at 0x1F800038, which all eight PROT 0901 prim leaves load before their DPCS / DPCT. The landmarks are not this sweep's. Both hosts stage it per draw (engine-field::overworld_ground_cue::decoration_draw_cue; world-map.md).

The sheets are additive (ABR 1, texpage 0x0027 at 0x8007322C; every row-473 CLUT entry has STP set) and texture-blended; the GPU writes (t5 * c8) >> 7 per channel at the framebuffer's 5-bit depth, so at the median packet colour 39 a wisp texel of 1..3 of 31 contributes nothing, and a sheet adds about half the light of an unquantised blend. Both hosts' screen-primitive shaders run the truncating product, render-kernels::screen_prim::psx_texture_blend (field-ambient-fx.md). Colour, count, shape, draw order and camera offset match regardless.

Its only reference is the tick word of template 0x801F2978, which only FUN_801E5834 materialises, and nothing on the disc references FUN_801E5834 in any form (both reference scans plus a raw jal/j scan). No live actor carries the tick in any of the 98 mednafen states. Filed [unreferenced]; no port.

The bulk terrain emitter FUN_801F89B8 takes the largest of a cell's four corner SZ values and links it at (max SZ >> 5) + 14 off *0x1F8003F4 with no shift (0x801F8DC8..0x801F8E20); the fog links at (SZ - 0x10) >> 5 off the same base, so the keys share one scale and a cell covers a sheet in its own bucket (the fog is first in the chain in all 11 shared buckets). On keikoku_chest_preload 538 of 584 matched cells sit at exactly this key and 32 one bucket off. Pinned by overworld_draw_order_retail_capture_disc.rs.

The overworld is a mode-0x03 field-run scene. On keikoku_chest_preload, sebucus_overworld_resident and karisto_overworld_resident the live pitch, yaw and eye trio 0x800840B8 equal the zone composer FUN_801DAB90's staging descriptor at 0x801F3580, with H = 368; the region ease is FUN_801DB510 (world-map.md).

Set on every non-battle kingdom-overworld state in the mednafen library and clear on every other state, overworld battles included. FUN_801D629C (PROT 0897, s4 = 0x1F800314, lw 0x80(s4)) takes an overworld arm on it: a camera-space depth test before the slot pop (jal 0x8003D344 at 0x801D6460, slti 0x4001 at 0x801D6470) and a further -0x28 lift of the particle height (0x801D651C..0x801D653C); map01's system script raises the pool's gate (4C 30) after widening the view window (field-ambient-fx.md).

Three: the scripted game-over has one clean site in each of map01 / map02 / map03. The count needs text segments and pickers decoded as strides of the stream; a census walk that ends at each record's first 0x1F text segment and starts partition-0 records three bytes late reads one fewer than the op-arm oracle (field-op-census.md).

FUN_801F89B8 is the bulk terrain-cell emitter - a hand-written GTE loop that draws one textured quad per map cell. It reads the four signed bytes of the camera's visible tile window at scratchpad 0x1F8003E8..EB and takes max - min on each axis as its two loop counts (0x801F89FC..0x801F8A28), which is what makes that window a draw extent rather than a fog hint, and it indexes the floor-height ladder at 0x1F80035C (0x801F8A7C). jal'd from 0x801F733C in its own image. Row + detail on functions/world-map.md.

Field-VM op 0x4C nibble-4 sub-9 dispatches an arm table spanning 0x801E1480..0x801E162C. Subs 0xA / 0xB / 0xC write the horizon gate in the delay slot of the j that leaves the arm (0x801E1648 / 0x801E1688 / 0x801E16C8), so a scan that stops at the branch names the instruction before; sub 0xD scales _DAT_8008457C >> 12 into 0x8007B910. The bit-24 arm of sub 9 writes two words - ctrl[+0x4A] and _DAT_8007BCAC - not one. See script-vm-menuctrl.md.

details ↓

The resident slot-B kernel FUN_801F69D8 (PROT 0901, byte-matched against a map01 walk capture) tests only cell & 0x2000 at 0x801F6ECC, skips placed records, and reads +0x10 with no zero test and no flag-0x2 test; Y is the 2x2 corner average. Mode 3 reaches it through FUN_80026CE4, which picks it over the field sibling FUN_801F7088 on _DAT_8007BA90. The big enterable mountains are 0x2000-only cells, so a 0x1000 gate drops exactly them - addresses and the cell census in world-map.md.

FUN_80043390 selects the renderer by the group header's flags >> 1 (0x80043614) and skips a group only on a null table entry. Slots 12..=15 (F3 / F4 / G3 / G4) are populated in the SCUS row 0x8007657C and in the world-map overlay row 0x801F8968 (0x801F7644 / 0x801F7838 / 0x801F7F78 / 0x801F8198, cued like the textured leaves). Rim Elm (Drake slot 29) is 24 G3 roof triangles over textured walls; 34 slots across the three packs carry colour prims - world-map.md.

details ↓

details ↓

details ↓

Called from the allocator FUN_80020DE0 at 0x80020F18 and from FUN_80024E08 at 0x80024E60: actor+0x64 = .MAP_record[actor+0x60][+0x10] + DAT_8007B6F8, render mode from rec[+0x12] & 3, then FUN_80024D78 fills the 0x9C-byte chain at actor+0x44 from DAT_8007C018[actor+0x64]. The port's field_objects::pack_mesh_index + FIELD_ACTOR_PACK_BIAS implement it. See world-map.md.

Section 2's body is the scene display name the on-entry banner draws (and the save screen's location row); section 5, the universal zero-length terminator, leaves its pointer on the world-map location table the kingdom MANs trail - 29 records of region + map x/y + discovery flag + 24-byte name, walked by the label pass that draws each place's name at its map position. Readers: the banner at 0x8003BB44, PROT 0981's label loop at 0x801CF34C (stride 0x20). With the SCUS quick-travel cells that is three carriers of one name, so a rename edits all three. Layout + provenance: place-names.md.

FUN_80024E08 resolves a model id against the pool and does no splitting at all. The 0xF0 fork lives at 0x800393B8 and at 0x8003A2DC - the latter inside FUN_8003A1E4's placement installer (0x8003A2CC..0x8003A328) and its op-0x0E sibling - each choosing between DAT_8007B824 and the scene base DAT_8007B6F8 before it calls. A port that documents the split on the resolver names a routine that cannot perform it.

The registrar is the only routine that installs an entry, but 0x801CF1E0 inside PROT 0976 stores zero into the table without going through it. A liveness rule derived from the registrar alone therefore has one hole; DAT_8007B6F8 is stored with sw and read back with lhu, which is the other thing a pool walk has to respect.

A 0x1000-byte slot-A image at 0x801CE818. Its monster_test label is CDNAME inheritance from the block opening at extraction 0978; the image's own operands are world-map ones throughout - DAT_80073EE0, the kingdom filter uRam8007b970, the camera pair _DAT_80089118 / _DAT_80089120, the eye trio 0x800840B8. Retail reaches it from the L1 edge, with no dev gate: the mode-12 handler FUN_80025DA0 loads it and calls 0x801CF4AC, the mode-13 handler FUN_80025F2C calls the tick 0x801CE850 every frame. One framed function and three leaves. details

File offset 0xB2C at base 0x801CE818. The argument is formed by lui/addiu pairs inside the renderer's own body - 0x801EAE44 / 0x801EAE48 and 0x801EB320 / 0x801EB324 - and a map03 state's 0x801CE818..0x801D0000 RAM window is byte-identical to 0897's first 0x17E8 bytes. PROT 0981 aliases the same VA as the other slot-A occupant, and the two are never co-resident, so the address is attributable only by image contents.

P1[0]'s park loop reaches 4C 49 3C 00 00 00 at +0x1B2 once its CD F8 00 00 7E 7E box test passes; the prologue's 2E 19 has raised _DAT_1F800394 bit 25, which sub-9 tests first (0x801E1488), so it stores 60 at 0x801E14BC and 60 - player[+0x16] into _DAT_8007BCAC at 0x801E14D4. A PCSX-Redux watch across the castle-to-map01 entry sees the reset at 0x8003A0D4 and then that single store (field-ambient-fx.md).

FUN_8003AEB0 calls it as (0x28, 0x2AB980) when _DAT_8007B6A8 is set. It fills 0x8007BB08 with a 0x4000-entry quadratic drop, then RTPSes (0, ramp[3n/2], 2000) at H = 0x3C0 and stores SY - 0x78 into the 0x2000-entry i16 table at 0x8007BB04. Its readers are FUN_80043390's overworld leaves and FUN_8003F86C at index (SZ >> 5) + 1, and FUN_8001C394 at (ΣSZ >> 2) >> 5 with no +1; checked entry for entry against capture RAM (renderer.md).

The builder stores SY - 0x78 under whatever OFY the GTE holds. FUN_8005B7F8 (SetGeomOffset) has two callers disc-wide: the frame-begin pass (OFY = 114) and FUN_8001DAF8 (120). FUN_800271A8 has three: the MAN installer (0x8003AF98, reached only from the field init right after FUN_8001DAF8(0x140)) and PROT 0981's mode-1 / mode-3 arms (0x801CE958, 0x801CEB88), which run inside a mode-0x0D frame. Every library overworld state reads entry 0 = 0 but sebucus_overworld_resident (-6) (renderer.md).

The world-map leaf at 0x801F7644 bends each corner's SY by the table entry for its own SZ after NCLIP and the ordering-table depth are taken (0x801F7770..0x801F77E4). Only the overlay's rows 12..19 read the table pointer; the SCUS lit rows 8..11 draw flat. A fog sheet takes one entry at its particle's depth (renderer.md).

The overworld dispatch takes a group's row as its header word >> 17 (srl s5,s7,0x11 at 0x800435A4), i.e. flags >> 1, so a lit row is a flags 0x10..=0x17 group. A census of every TMD a magic sweep finds in the three kingdom bundles' scene entries and in the party pack PROT 0874 counts none; the lit-row groups on the disc sit in field scenes and a few non-overworld entries. So bending every overworld draw matches retail pixel for pixel. details

Retail's table holds the pointer as flat semi packets (0x22 / 0x2A) in the TMD's baked reds one cue step down, with no E1 among them, so they blend on the draw mode the chain left (ABR 0). The untextured leaves read only the dispatcher's ABE word (0x800449B8, 0x80044B94); the ABR word reaches textured leaves alone (world-map).

FUN_801D5854 writes no anim field, and battle setup seats clip 0 at (rand() % frames) << 4 (0x80051574). The engine's first idle request rebuilt the idle a render build had installed, so bodies swayed in step until their first turn and snapped there. Write-up

The 0x51 teardown resets the element list (FUN_801D99BC at 0x801E6170) before it re-spawns its closes on gliding mode 1 (0x801E6178..0x801E6204), and the label (records 76 / 77, opened by the 0x28 arm's FUN_801D8DE8(0x4C, 0)) is not among them, so it is gone from that pass to the next action's open. The port hides it on the same latch (BattleState::action_hud_wiped, engine-battle-hud::battle_move_name); battle_jou_party_wipe_results_retail reads image 1.000.

The heal's flight rolls FUN_801DD0AC on its victim whatever the cast is (0x801E188C, applied at 0x801E1960), then 0x3F calls FUN_800402F4(0, 0, ..): +200, no popup. A --watch recording reads the Killer Bee 96 -> 46 -> 246. Write-up.

On the cost-column recording from dohaty_nova_v2_pre_scythe_wind, retail's arm 0 lands Nova at (61, -497) and the clip-9 turn reads 2175. On --retail-steps the engine lands her at (62, -497) and turns to 2180; on its own constant step 3 at (48, -529) and 2168. The walk law is the port's; what parts the plain film (.913 against .972 on the steps) is the two step-2 passes retail runs once 0x6E's heavy entry leaves the ring, which is the frame step's thread.

FUN_801D8DE8's case 0x52 stores DAT_8007BD10[ctx[+0x13]] - 1 there (0x801D9094), and the action seed's Spirit arm raises the panel (0x801E2FDC). It names the fitted seat on all nine captures that walk from an earlier actor. Write-up.

A --watch film of Gomboo's Steal reads glide records 0 / 1 cleared by the seed's table clear (0x801E2CF4) and spawned on that pass, which also stores the yaw rung 0x800 (0x801E2CEC..0x801E2CF8; only the Attack arm overwrites it with 0x200). The capture's counter 0x81C is seven step-3 passes on, both records retired at 15: the screen shows the last in-flight pass. The forty-vsync reading took the Attack rung. The engine frame matches (image 1.000). Owning page: retail-compare.

Rasterised under both rules, the still's ordering table places the capture on PCSX-Redux's side: the fans read (165, 94, 39) in the buffer, (162, 93, 39) under the emulator's rule, (145, 75, 30) under the console's, and each fan's builder output and dispatcher calls match the engine's. With the image child on that rule the fans read within 2 per cent of retail's and the state .945; the rest is the crystal's outline and the rays' rand() deal. Owning page: retail-compare.

PROT 0916's arm-14 pass writes -16 into the creature's running clip entry (sh v0,0xc(v1) at 0x801F79A8), and a negative root speed steps every pass with no range test. A --watch of the creature's +0x38 reads the anim tick's root-motion store (0x80047DC0), -24 a step-3 pass, z -2307 to -3075. Port: World::apply_aluru_seat_writes. Owning page: cast-module.

Arm 2's face pass calls FUN_800319A8(0x21) (li a0,0x21; jal 0x800319A8, 0x801F7F34..0x801F7F40 in PROT 0957), the destroy-window routine, and 0x21 is the window id FUN_801D8DE8 opens the label under for (0x4C, 0): placement record 76's +0x00 byte (0x80077330). PROT 0966 (Evil Seru Magic) does the same on arm 10's pass (0x801F7058). battle_jou_puera_v3_death_game_mid_cast's recording shows the label through arm 1 and none from the faces on. Port: ModuleCamState::move_label_closed (cast-module).

PROT 0953's arm 0 stores +0x21D = 1 (0x801F6CA0) beside its stage of clip 0xA with the +0x1DC bump, and Xain's anim tick commits that clip on the same pass; the commit lifts any rate but 8 to 4 (0x8004B080..0x8004B090). A --watch 0x800ED481 recording of the punch from battle_tunnelc_xain_bull_charge_mid_cast reads both stores on one vsync, 1 from 0x801F6CA0 and 4 from 0x8004B090 with the old 1 in v1, and later commits leave 4. The cursor's 8 a step-4 pass is rate 4's. The port's commit already makes the lift. Owning page: cast-module.

Under LEGAIA_RC_CAM_TRACE the headless seed's yaw counter now reads 588, retail's, and the ground snap's strike-heading target 2805 against retail's endpoint 2803 (it read 2752); the glide aligned on it reads retail's live 2794 and the camera channel 1.000. Nighto's facing still stands 1911 against retail's 1930, which the strike-heading law turns into those two units. retail-compare

The replay now gates on the walk (clip 1), but the capture's clip seeds stand each body on the displayed frame, so the film's Ogre walked from cursor 72 where the state holds 96, and the replay's pick swung 09 where retail's queue holds 07 07. The film driver now seats the state's own cursor and queue at the gate: every segment runs retail's length, .920 to .983 (battle_korb2_medusa_strike .718 to .959). No law changes. cast-sequence oracle

Recordings of battle_kor_spoon_strike and battle_tower_swordie_strike with the cost column read 0x28..0x32 at 540..650 and the close-up's first two passes over 0x1FF; retail drops to 2 twenty-two vsyncs into 0x34, the engine twenty-one ticks in, its camera on retail's to the unit. 0x32's drive wait ran eight passes (24 vsyncs at step 3) against retail's 15; a CD read is wall-clock, so it now counts vsyncs. battle-action

The deal read hit words off spark-burst frames, so Flap's blocked event drew on the replay's own stream. A --hit-trace recording of battle_rugi_caruban_3_strike logs the seed at the head of the strike kernel's hit body (0x801EC5A8) for all four hits, blocked ones included; dealt those words (--strike-deal), the engine's block verdicts are retail's and the film's cues match 12 of 12 (.696 and film .834 on the burst words, 1.000 and .850 traced). No law changes (oracle).

The effect-script table arm's code 45 (record 0x801F5628, library mesh 13; codes 10, 46, 47 likewise), seated by FUN_801DEA50 on the actor's facing plus 0x800. Its program sets a colour, a lane, a level rate and a wait and halts: nothing moves it, and both ordering tables of minigame_muscle_dome_retail_skeleton_hyper_arts hold the same eleven POLY_GT3 pairs under two camera depths. Seated on the RAM's pose the frame reads .874 to .980. retail-compare

The list walk reads next before a node's tick and the allocator appends at the tail, so the twelve children a tail trigger's 0x17 seats are not reached on their seat pass: they draw frame 0 at the parent's point and tick a pass later. The engine drew frame 1 there. Retail's two extra listed passes draw nothing (0x80022BB4). A --retail-parts film and the engine's fxparts.csv now agree pass for pass. functions/battle.md

The probe's cost column rises from 392 to 579 as the special clip's two after-image ghosts (+36 each) and the four hits' spark parts (about 2 a part) come up, so retail's step goes 2 to 3 and ctx[+0x6DA] climbs 4 a pass. The engine adds both loads to the ring's push (World::battle_frame_load_cost) and reaches step 3 there: the film reads .728 against .729 on retail's own steps. a frame's draw load.

The menu SM's gate runs every pass ahead of the action SM (0x80047014 / 0x80047048), and the glides snap within a pass of the 0xFF arm; the pass they snap on is gated. autorun_round_boundary_hold.lua: at step 2 (party_basic_attack_vs_gobu_gobu) that is the 0xFF pass and 0x14 holds nothing; at step 3 dropping to 2 (chitei2_kemaro_v2_pre_lava_breath) it is 0x14's first. The port's fixed four passes are now three plus the gate. battle-hud.

The rugi_rogue_pre_rogue_* states hold the party at +0x1DE == 4 and the engine child ran with no guard. FUN_801DD4B0(0x580, ..) (0x801F74C0..0x801F74CC, PROT 0964) doubles the defender roll on the stance, the bonus arm rebuilds the attacker at def + 0x580 + rand % 0x161 and the finisher halves: 704..880 a victim. Retail's Thunder, Flame and Wind hits and the guarded engine's all land there. The driver now stands the probe's guard= seats. cast-sequence-oracle.md

FUN_80042558's grant scan (0x80042714..0x80042890) and revoke scan (0x80042894..0x80042990) run in crates/retail-exec against CharacterRecord::sync_equipment_summons, byte-equal over whole records. retail-kernel-differential.md.

Battle init copies the record's maximum into +0x152 (FUN_80053CB8, 0x80053E50..0x80053E58; a monster's from its record +0x10, FUN_80054CB0 0x8005518C), and from then on every in-battle reader takes the seat's: the MP tint (FUN_80046A20 0x80046B74, FUN_801D8DE8), the item applier's clamp and the validator through their actor pointer tables. The dumped corpus stores it only there, in Lapis Wave (0x801F6D1C) and in Fatal Decision; nothing restores it in the fight or copies it back to the record. battle_deene_lapis_strike reads 0/0 on every seat on both sides. battle.md

The eight jal 0x80056798 of FUN_801E9504; the differential holds the record and the draw count equal on one stream. level-up.md.

The kill of the fade parked at ctx[+0x102C] and its white fall sit behind word > 3 * scalar << 6 (0x801F86AC) in the tail arms 0x12 and 0x13 share; fired on the arm's first pass, they took the wash away and the frame fell to the night stage. On the pass alone, with the verdict's draw held on retail's seed (--rand-at 0x34:0), arm 19 tracks retail. cast-module.md

Effect-0x10 sparks from the burning-body emitter, shed by the dead victim, which keeps the +0x21F = 2 of arm 0x12 (0x801F8684) after the Done arm hides it. The emitter sits in the pose decode, which only the draw callback FUN_80048A08 reaches, and the draw tick FUN_800480D8 calls it only for a body it draws (0x800482E0 / 0x800482F8). The port now takes the draw plan's verdict, and the film holds no arcs. battle-action-helpers.md

Both draw a kill verdict in arm 0. Retail's seed word gives Nighto 22235 % 8 = 3, no kill, and the engine's stream 30808 % 8 = 0, a kill, whose death clip sounds the extra cues. Aluru's differs the other way, and --rand-at 0x34:0 puts it on retail's kill path with cue score 1.00. Nighto's draw sits later in that tick than the hold reaches.

Those arms read 0x800 - caster +0x46, and a group-target cast does not turn the caster, so the shot keeps the facing 34 the fight left in the state. The cast-sequence seed leaves it 0. Seeding 34 gives yaw 2014 on both sides and leaves both casts' scores where they were.

Arm 8's hit stages +0x1EF, else +0x1F0, with no knockdown fork (0x801F77B4..0x801F77D4). The port ran the shared pre-hit, whose fork took the knockdown entry on a monster with a get-up. Retail's recording shows clip 2, then arm 9's sb zero,0x1da leaves its cue 0x21C.

The port seated PROT 0925's whole record set at the band's entry, so arm 7's five additive shells (0x801F7DB0..0x801F7EE0) drew from arm 1 on. parts.csv showed them live from the first module tick. The records are seated per arm (cast-module.md).

The tick reads entry[0x10 + ((entry + 0x13) & 0xFF)] in RAM, and the block address follows a fixed law: ids load upward (0x800543EC..0x800549F0), each block takes block[+0x08] bytes (0x80054668) from the top of the free node, and the first ends at 0x800B9A50 with one member seated, 0xA8 lower per further member. The +0x88 relocation (0x8005473C) puts 0x80 under k = 0x1A. 145 placements and 22 reads in 86 retail states match (monster-animation.md).

The commit zeroes the cursor (sh zero,0x68(s5) at 0x8004B068), so no fraction carries. The tick advances it (step * speed * rate) >> 1 a pass (0x80047730..0x80047764, step = DAT_1F800393) and latches +0x1F7 after the commit (0x80047E1C..0x80047E54), so the byte drops on the first pass boundary at or past the formula and a step-3 pass overshoots in vsyncs (battle-formulas.md).

FUN_8004AD80 stores 0 to the cue cursor +0x1F6 on every commit (delay slot 0x8004AFD0) and 1 (0x8004B05C) when the staged entry is the playing one (bne 0x8004AFCC), +0x1F7 is up (0x8004AFD4), and the entry is +0x1EF / +0x1F0, or +0x1F3 on a party seat (0x8004B010) or with first cue entry[+0x56] >= 0x64 (0x8004B048..0x8004B050). A juggled re-hit replays its reaction without the first cue. It is not a counter or guard window, and it reads the juggle counter's own byte. Port clip_ladder::recommit_cue_cursor (battle-formulas.md).

Called from state 0x0C for every category but Run (jal at 0x801E2D44). It squashes an axis span over 0x800, boxes the formation - for an Attack only its target +0x1DD - and subtracts the box's centroid from every included slot's +0x34 / +0x38, so a melee opens with its target on the stage origin. The Cort capture reads Vahn (0, -812) -> (0, -1625) and Cort (0, 813) -> (0, 0) across the seed pass. Empty party seats are moved and boxed too. Port battle_action::seed_formation_recentre (battle-action-helpers.md).

State 0x14 (0x801E30CC..0x801E3198) gives each slot that is neither attacker nor target a heading a quarter turn off the attack line, on its own side, into ctx[+0x6E6 + slot*2], and seeds the countdown ctx[+0x6D6] with the melee monster's size class; the SM's shared tail (0x801E6824..0x801E6934) steps them (lut * step) >> 9 while it drains. Port battle_action::arm_make_way / make_way_step (battle-action-helpers.md).

FUN_80046A20 calls the driver FUN_80051078 at 0x80047050, right after jal 0x801E295C and under its gate (ctx[+6] and 0x8007BD71 both 0xFF, 0x80047024..0x80047044); the driver runs every ordered pair of seven slots with actor +0x04 set. The kernel FUN_80050BB8 pushes when |dx*sin>>12| + |dz*cos>>12| < (r_a + r_b) / 6 (0x80050BBC..0x80050CC8), by sin >> 10 / cos >> 10 on the live pair +0x34 / +0x38 (0x80050CD0..0x80050D24). Neither reads DAT_1F800393. Party radius: the stager's 0x280, 0x400 on Terra (0x8005151C..0x80051538).

The battle draw's FUN_800495C8 (jal at 0x80048A7C) reads both lanes off the playing entry (0x800495FC): keys +0x01..=+0x04 give a trapezoid weight over the clip phase (0x80049634..0x80049704), +0x08 counts [object, first_vertex, count, deltas] records it blends in place through FUN_8005B038 (0x800497DC) after saving the authored vertices; FUN_80049858 restores them, lane +0x08 first. All 313 disc lanes parse with every run inside its object. Both hosts draw it through World::battle_morphed_tmd. monster-animation.md.

The two words are one 64-bit field: the stat aggregator FUN_80042558 turns each equipped item's passive index into bit index of +0xF4 (sltiu < 0x40 at 0x80042664, sllv / or / sw at 0x80042684..0x8004268C) over all three character records with no membership test (0x80042D8C), so an absent member's party-wide passive still reaches the global mask; and all 64 indices are tabulated with their names, scopes and readers on accessory-passive-table.md. The bits named on battle-formulas.md are entries of that table.

Tetsu's only row, town0d row 4, carries header byte 1, so ctx+0x287 = 4, Run is refused and the roll is skipped. Battle init still raises 0x200: its 0xAF arm (0x800519DC..0x80051A04) runs straight-line after the seat loop, ungated by the row. The lone seat is (0, 800) from either seat family - counts 1 and 2 are authored identical in both, and every solo library battle reads it. The engine enters the row this way (tetsu_row_is_flagged_and_forbids_the_ra_seru). No state inside the fight exists; the tutorial spar is monster 0x4F with the word 0.

The exit's party loop clears +0x16E unless _DAT_8007BAC0 & 0x100 (0x80046E90..0x80046EB0), and floors HP 0 to 1 on every exit. The controller node runs before the actor nodes, so the party ticks copy the cleared word to record +0x12E (0x80048040 / 0x80047680), which battle init reloads (0x80051718). That the list walk finishes in the exit frame is inference; all 38 non-battle library states read +0x12E as 0. Port battle_formulas::battle_exit_party_reset.

FUN_801D8DE8 ids index the SCUS placement table 0x80076C10 (jump table 0x801CEB68 at id - 0xA); records 0x41 and 0x42 are byte-identical, a framed 288x42 box landing at (16,160). The loss string is the defeat buffer ctx+0x129 (FUN_801D84C0): the lead's name plus the suffix at 0x801F4C94, or the team string 0x801F4C78 with its name escape patched. Both hosts draw it through engine-battle-hud::battle_defeat_banner (battle.md).

On the stream's last frame the next entry is frame 0 of the queued clip when HP +0x14C is non-zero and +0x1DA < 0x10, with the committed entry's +0x0E added to the Z delta unless +0x228 is set (0x80049A7C..0x80049BD0, 0x80049D64). The natural end (frame >= frames) moves +0x34/+0x38 by that +0x0E along the facing (0x80047A68..0x80047B2C); the event-path cut moves it pro-rated (0x80047950..0x80047A28). Port World::battle_tween_target, MonsterAnimPlayer::set_tween_target, motion::end_root_step.

The counter gp+0xA10 is zeroed per part (0x80049D6C) and gated > 0xC00 (0x80049FD8); the retry rebuilds the next frame's triple as (x+0x800, -(y+0x800), z+0x800) in the journal 0x801C9060, never in the stream. The battle unwrap guards on > 0x800, the field helper on >= 0x800. On PROT 867, 103650 of 9448740 blended part samples take it; whole-frame samples are unchanged. Port engine-battle-vm::battle_pose_blend, live on both hosts.

0x801D1E60..0x801D1F7C, each refused press answered with cue 0x23. The ring refuses Attack at 0x38 (0x801D1560) and Magic under Curse (0x801D1434). Port rot_blocks / ring_arm_refused.

With _DAT_8007BAC0 non-zero, 0x801E6578..0x801E65AC counts the whole party down when the leader's +0x16E & 0x38 == 0x38. The three Rot limbs accumulate: the applier ORs each new limb in at 0x801E1734..0x801E1740. Port battle_formulas::special_battle_wipe.

Flow 0xFE's tail (0x801D3228..0x801D328C) stores ctx+0x274 = 0 and the leg outcome 0x80084448 = 4. First monsters 0xAF and 0x3D..=0x3F are exempt - exactly the two 0x200 fights. Port special_battle_run_forfeit, a leader-first dispatch.

FUN_8004E568 skips FUN_801D8DE8(0x41) at 0x8004F614 and FUN_801D8DE8(0x42) at 0x8004F8F0 when the word is non-zero. Port VictorySequence::window_opened, which gates the spoils panel both hosts draw.

A find-gp-relative-refs.py sweep finds eight stores, including boot FUN_8001D424 (0x8001D528) and the minigame exit FUN_80026018 (0x80026098). None runs between the formation roll's raise (0x8005205C) and FUN_8004E568, so the Rim Elm ambush pays nothing (battle-formulas.md). No state reaches that victory, so it is not capture-confirmed.

Whole-word readers: FUN_8004E568 zeroes gold (0x8004F0AC) and EXP (0x8004F274) and skips the drop (0x8004F480); FUN_8004AD80 skips the steal (0x8004B48C); FUN_801DDB30 skips spell XP (0x801DE450); FUN_801E91E8 answers an absorb as known (0x801E9224); FUN_801E9FD4 drops a granted monster flee (0x801EA994, after the roll). Op 3E FF writes no escape flag (0x801E070C..0x801E0788, PROT 0897); ctx+0x287 is the row's record[+0] (via 0x8007BD60 bit 7). The Rim Elm ambush row carries 0 (escapable; engine: rim_elm_ambush_disc).

Its 3E FF row (town01 row 4) carries header byte 0, but FUN_80051D84 also skips the roll on DAT_8007B64A at 0x80051DB8, which the tutorial arm sets.

The battle flow runs FUN_801DB318 at every round start (0x801D0EE4) and on the ring's first cancel (0x801D11E0): it squashes an axis wider than 0x800 and subtracts the centroid ((max + min) as u32) >> 1, which is -13 for z = -825 ..= 800. Balanced formations read their authored rows. Engine World::normalize_battle_formation (battle.md).

The tag-4 commit at HP 0 stages entry 7 for a party seat (0x8004BEA8..0x8004BEE0), the tag-7 commit stages 8 (0x8004BF18..0x8004BF24), and the tag-8 commit raises +0x1DC bit 3 (0x8004BF34..0x8004BF4C); entry 8 - root speed 0, the downed kneel - re-commits at each natural end. Three states read +0x1D9 = +0x1DA = 8 with +0x1DC = 8. Engine world::battle::clip_ladder (battle.md).

Every battle frame (jal at 0x80047124) it sets +0x8 |= 0x83000000 (semi-transparent, blend 3) on bodies within dist/4 of a point on the camera's view axis and ghosts a caster's side during states 0x28..0x2E; a RAM replica matches 277 of 279 seated slots. Engine camera_ghost_pass, drawn on both hosts (battle.md).

Battle init clears a word of exactly 0x200 and raises the bit for first monster 0xAF (0x800519C0..0x80051A04); the formation roll raises it for 0x3D..0x3F on map 0x0C / 0x15 (0x8005200C..0x8005205C). The ring crosses the chip out at 0x801D12DC and refuses its arm at 0x801D1448; no other load of the word tests 0x200 (battle.md).

Templates A (0x801DB8FC / 0x801DB960) are op-0x23 sprite-arm quads (FUN_8002A5A4) stepping a 16-cell flip-book; B (0x801DBBA4 / 0x801DBBD4) are stage TMDs 1 / 2 (gp[+0x754] zeroed at 0x801CF1B0), faded through +0x78 from 0x1000 under an additive colour word. Port engine-minigames::baka_impact_fx (minigame-baka-fighter.md).

0x801F0B4C..0x801F1274 walks the character's art-animation bank (0xD0 stride) from record rand() % 5 + 0xB and splices learned arts' arrow strings over the end of the queue the spend loop wrote, paying out of a local copy of the Spirit gauge actor[+0x170] - nothing is stored back. The per-arrow cost is halved under record +0xF8 & 0x800 (0x801F0D00), the routine's only test of that bit. The pool arm and its tail run only for a slot whose ctx[+0x266 + slot] Auto flag is set (0x801F0704) (battle-action.md).

FUN_801D5854's target arm (0x801D5B08..0x801D5BAC) measures the target's name (jal 0x80035F04) and seats the box at x = 0xE8 - w/2, pulled back to 0x130 - w past 0x130, row 162; the live seat starts at max(x + 0x80, 0x148) and slides in. On party_basic_attack_vs_gobu_gobu "Gobu Gobu" measures 55 and rests at (205, 162) (battle-action.md).

FUN_80048A08 reloads the colour word +0x74 and blend +0x78 for each object (0x80048BEC..0x80048C00) and, for a party seat (+0x5A < 3), overrides both when the seated actor's +0x16E carries a Rot bit and the object falls in that bit's range from the five-byte row at 0x80077998 + (0x8007BD10[seat] - 1) * 5: bit 0x08 objects row[0]..=row[1], 0x10 row[2]..=row[3], 0x20 from row[4] up (renderer.md).

Gala's tag-0x67 arm (0x8004D1E8..0x8004D248) calls FUN_801E1D98 with the target's seat vector +0x3C (addiu a0,s1,0x3c at 0x8004D220) and the literal trail id 0xC on every frame the clip cursor sits in 0xB0..=0xF0 (battle-action.md).

Actors whose turn the round passes over without acting: 0x801DAB84 clears it (sb zero,0x25 in the delay slot of jal FUN_801DABA4) and the dead-slot sweep bumps it (0x801DAC2C). Every other sb ...,0x25(...) in PROT 0898 stores a GPU-packet u / v byte; the round counter is +0x28A. The action SM's round-end bound subtracts it (battle-action.md).

FUN_801EED1C clears it at its head (0x801EED88); the Miracle arm (sw at 0x801EF5B8, a j delay slot), the Super tail match (0x801EFBD4) and the head of FUN_801F0450's auto-fill arm (0x801F0518, not its art tail) set it. Its one reader, lw at 0x801E3840, arms the drift that moves the actor and its target along their facings each frame when the committed clip carries a header byte and the latched clip is outside 0x10..=0x1A (battle-action.md).

FUN_801D388C's commit arms land name, command and target through FUN_801D5718, seat them at x = 16, name_w + 0x20, name_w + 0x60, and scroll rows 170 / 146, 170 / 146, 170, 194; an all-target commit logs record 0x3D / 0x3E. Settled at 0x801D3E38..0x801D3E48 (n * 3 + 0x2B), the three jals 0x801D3E4C / 5C / 6C, the seats 0x801D3E8C / EA8 / EC4, the rows 0x801D4540..0x801D4548 and the all-target records 0x801D4418 / 0x801D4438. party_basic_attack_vs_gobu_gobu holds the one-row case (battle.md).

Every commit site stores 0x6E instead of 0x28 once FUN_801DB81C equals the party count, for every party size and behind no option; with nobody able, the prompt's Begin stores it directly (0x801D10A0). Reselect is FUN_801D388C(0x21) -> FUN_801D32BC(1) (0x801D4750), and the dispatcher refunds the landing member's Item (0x801D30BC); the party_basic_attack_vs_gobu_gobu display list holds the two 64 x 20 plates at (84, 82) / (172, 82). Both hosts stage it (battle.md).

For a slot with +0x14C == 0 and an unspent key: key zeroed (0x801DABF8), Spirit +0x170 clamped to 100, ctx[+0x25] bumped, and a staged Item (+0x1DE == 1) refunded through FUN_800421D4(+0x1DF, 1) (0x801DAC44..0x801DAC5C). Its tie list is biased: a seat that raises the maximum is entered twice, so the first seat above 0 to reach the top key wins 2 / (ties + 2) (0x801DAC7C..0x801DAD60).

No code compares ctx[+0x28A] to a bound. The AI switch at 0x801CF1CC sends entry 178 to 0x801EB52C, whose round switch (sltiu v0,v1,5 at 0x801EB540, table 0x801CF49C) casts 0xA2..0xA5 on rounds 0-3 and the finisher 0xA1 on round 4. The strip is text actor 1 on the gp+0x148 list, drained by FUN_800355F0 at 0x801D0EB4 and through FUN_801D99BC (0x801D9A24) when a round plays out.

Left / Right walk +0x1DD through FUN_801D8D00 (0x801D21D4..0x801D2268) after the arts entry; retail does not pre-pick the target (arts-command-gauge.md).

FUN_8004C140 re-rolls while the draw equals gp+0xA4A = 0x8007BD62 (beq back to the rand call at 0x8004C3F8), stores the pick there, then forces channel 0xC when formation id gp+0x9F4 is 0x4F (0x8004C400..0x8004C414). A one-entry pool whose channel is the last pick would spin.

Arms 4 / 5 call the course card FUN_801D042C (six corner draws from records 5 + course and 8), arm 0x14 raises nothing on a first visit, and FUN_801D1610 is a subtractive POLY_G4 (tpage 0x46, ABR 2). Every hub emitter links at OT slot 3 through the LIFO FUN_8003D2C4, so the last packet emitted is drawn first, and retail clears record 4's semi byte before each face (sb zero,0x176b at 0x801CFAF8) (minigame-muscle-dome.md).

Not a command and not a hit: FUN_8004AD80's death-spoils arm (0x8004B29C..0x8004B65C) runs when a monster's knockdown clip ends at HP 0, and sets the latch ctx[+0x27] at 0x8004B3E4 before testing the killer, so an action's first kill spends its attempt. The action SM re-arms it at every strike chain's exit (sb zero, 0x16(s5) at 0x801E3A84, s5 = ctx + 0x11). The gates, the roll (doubled by Items Up), the caption record and the table's two readers are on steal-table.md.

When a monster that stole dies, the item goes back to the bag with a "took" (0x80077A38) or "recovered" (0x80077A4C) caption, or "recovered all" (0x80077A70) when ctx[+0x18] already reads 0x5B. PROT 0941 fills the stolen band at 0x801C8FE0.

The ring's cancel tests ctx[+0x1F] at 0x801D11B4 before the direction arms: zero returns to Begin / Run, otherwise FUN_801D388C(0x10) calls FUN_801D32BC(1) at 0x801D4010 and refunds an Item commit (0x801D12AC). Case 0x21 is the Reselect on the 0x6E commit-confirm screen (0x801D3040..0x801D3088).

Arms 4 / 5 draw the course card FUN_801D042C over the title art; arm 2 raises the backdrop level by 4 * dt while the intro card fades; arm 6 drains it and kicks the battle load (0x801CF9E4, 0x801CFC48). The ROUND banner FUN_801D02F0 is drawn by arm 0x15 only.

The four SCUS raises plus the tick's own clear, sb zero, 0x28B(v0) at 0x801E263C in FUN_801E2524 (PROT 0898). Only the MIRACLE raise (0x8004B7D0) and the side-array raise (0x8004B840..0x8004B868) fire the fixed cue; the HYPER default matches the art byte actor[+0x1DF + ctx[+0x15]] against 0x1C..0x1E and coin-flips through jal 0x80056798 at 0x8004B91C.

FUN_801DD4B0 reads +0x168 (lhu at 0x801DD52C, 57C, 594, 608) and FUN_801DD6B4 reads +0x158 (0x801DD738). FUN_801E7320's +3 is a constant (addiu a0,v1,0x3 at 0x801E73B8), and its modulus is the seated monster count ctx[+1] (lbu 0x1(v1) / div at 0x801E7380..0x801E7388), not the actor table's length.

FUN_8001E890 does check integrity in its own frame, on one arm of three: with gp+0x6AC at 2 it reads the raw container back out of VRAM (0x8005842C, four rects from (0x180, 0)), re-sums every word at 0x8001E9C4..0x8001E9F4 against the boot sum at gp+0x6B8, and reloads on a mismatch. That guard is on the decompress source; the register-only arm (bne v1, v0 at 0x8001E974) skips it, so the gate's writers stay the reason nothing walks a clobbered pack. The "header size word" and the "decoded length" are one descriptor field, so a rebuild cannot vary one alone. character-mesh.md.

(value_i16, seat_u8): value at ctx[+0x83C + cursor*4], seat at ctx[+0x318 + cursor*2], ctx[+0x85C + cursor*4] = 0, then the cursor ctx[+0x262] bumps and folds mod 8, ctx[+0x273] counting pushes. FUN_801E09F8 inlines the block at 0x801E1898..0x801E1918; PROT 0955's Kiss of Death calls it to show its literal 1. Not the Point Card clamp.

It reads raw entries 873+874 (etmd+vdf) in one contiguous transfer, keeps the second half's base in _DAT_8007B878, and walks a flat [u32 count][u32 offsets[count]] pack there, handing each base + offsets[i] to FUN_8001FBCC at 0x80052584. Its four constants 0x368..0x36B are raw TOC 872..875 = extraction 870..873, the whole befect_data block. The player-character pack is extraction 874 = raw 0x36C, a different entry. Body in battle.md.

Three gates in order, and only the third selects a mark: the member's own chip byte ctx[+0x25F+member], then +0x16E & 0x1000, then the special-battle word 0x8007BAC0 & 0x200. Three emitters draw the marks - FUN_801DBC30 ((0, 96), 64x16, CLUT 0x7704, the red X), FUN_801DBD04 ((80, 96), 32x24, CLUT 0x770B, the Rot stamp, over the Attack chip under +0x16E & 0x38 == 0x38) and FUN_801DBEC4 ((120, 96), 64x16, CLUT 0x7700, the Curse plate, over the Ra-Seru chip under +0x16E & 0x1000) - all POLY_FT4, tag 0x09000000, code 0x2C808080, tpage 7, each early-out on ctx+0x6CE. See minigame-muscle-dome.md.

The ring stamps Rot on the Attack chip under +0x16E & 0x38 == 0x38 (FUN_801DBD04(0xA0, 0x42)) and lays the Curse plate on the Magic chip under +0x16E & 0x1000 (FUN_801DBEC4(0xF8, 0x42)), 0x801D1314..0x801D1360; the arts entry stamps each rotted direction with FUN_801DBDDC(x, y, cost) (0x801D1DA8..0x801D1E54). The texels are the etim page's blue "Rot" and "Curse". Both hosts draw them from engine-battle-vm::battle_party_panel. No library state carries a Rot or Curse party member, so no retail frame pins the draw. See arts-command-gauge.md.

Bit 0x100 bars Item, 0x200 bars magic, course = ((word - 1) & 0xFF) >> 4. Two writer families: SCUS battle init keys on the first enemy monster id (0x800519DC; 0x8005200C under mode 0xC/0x15), and the arena seeds the word itself: FUN_801CEA6C stores 0x101 / 0x111 / 0x321 over a zero at 0x801CEBA0 / 0x801CEBB4 / 0x801CEBC8 on story flags 0x536 / 0x537 / 0x538, last match winning - so a seeded visit bars Item on every course and magic on the top one. 13 stores over 84 images, 5 clearing. Five readers gate on non-zero; 0x100 also gates the award arms 0x801E7978 / 0x801E7B40.

The cast path 0x801D1408..0x801D1528 writes the action queue +0x1DF[0], sets +0x1DE = 2 and +0x1E7 = 9 and enters phase 0x46; it spends no AP. The cost is the spell table's DAT_800754C8 + id*12 + 3, discounted by the character record's +0xF4 ability bits 0x20 / 0x10. See battle-formulas.md.

It is the tail of the once-per-action teardown latch, entered only by falling through from sb v0,0x6(s5) at 0x801E6214; a five-form reference sweep over 84 images finds nothing else that reaches it. Its multi-cast part is a widget unload loop (jal 0x801D8DE8 at 0x801E62CC / 0x801E62F0, pair (id, id - 4)), not a separate sweep, and is ported (done::done_band_capture_and_banner_sweep, battle_value_readout). See battle-action-exit-gates.md.

PROT 0955's Kiss of Death miss arm, ori v0,v0,0x400 at 0x801F8CFC followed by sh v0,0x16e(s0) (the status appliers are tabulated in battle-formulas.md). The hit arm sets the victim to exactly 1 HP and clears 0x0F80 with no wrapper.

White Shield multiplies the defence pair by 3/2 idempotently from 0x801C9348[seat-3]; Power Charge adds x >> 2 to ATK capped at 999 (sltiu 0x3E8 at 0x801F74D4); Melt Spray takes 20% off ten halfwords and underflows x in {0, 1} to 0xFFFF (only 2 of its 10 floor tests read a live 32-bit register - 0x801F83E0, 0x801F8504 - the other eight re-lhu the store, same outcome); Void Accessories rolls one of three Goods slots off record[+0x19B+slot], refunds through FUN_800421D4 and rebuilds the bitfield with FUN_80042558; Kiss of Death is the row above; Terror Scream steals only the turn. Table in cast-module.md.

Kiss of Death seats its lips and burst per arm; White Shield's arm 0 seats 0x801F93D4 and Power Charge's 0x801F972C, each a twenty-byte record whose op 0x20 calls the cell's stager FUN_801F9370 (arm 0 0x801F93EC, the shield; arm 1 0x801F9744, the aura); Melt Spray makes no spawn call. PROT 0951's Chaos Flare seats two runs of seven per arm. details

The lips record samples tpage 0x88, CLUT 0x7A00: the side-band page (512, 0) the turn pick FUN_801DABA4 has the applier stream for the acting monster's group (3 * record[+0x1C]). The engine wrote the formation's groups once in seat order, so in [0x21, 0x44] the page held the second seat's dev placeholder ("BACK READ"); the port now streams the group on every monster turn. details

A camera-space sprite at z = 0x1000 on tpage 0x88, the stars Xain's group streams to (512, 0) (both VRAMs agree). The stage stayed lit because arm 8's sb zero,0x278 (0x801F75E4), which sits behind its gates, fired at the arm's entry. details

Eight of the 64 images write +0x150..+0x16D: 0940 (0x801F78B8), 0942 (0x801F7D34), 0943 (0x801F6A04 - 0x801F69D8 there is the 0xB5 body's head table, not the writer), 0945 (0x801F69F8), 0954 (0x801F6A58), 0955's own cells, and 0925 / 0956 which touch +0x16C only. See cast-module.md.

The band holds 21 trampolines carrying 48 (action id -> body) arms over 32 distinct bodies. A body VA is not a key: 0x801F69D8 is a tick body in six different modules, so the seam is keyed (entry, body). See cast-module.md.

FUN_801EED1C's character-id-4 arm (0x801EEE40..0x801EEE48) reads actor_table[0] (+0x14C / +0x14E / +0x16E at 0x801EEE58, E8C, EC8) and writes actor_table[1] (lw 0x4(s0)). Its physical leg redraws rand() % ctx[+1] + 3 until the seat is alive (0x801EEF2C..0x801EEF98); a monster record with +0x1E == 2 yields a single 0x0E (0x801EEFC8..0x801EEFD4, store at 0x801EF02C), otherwise two draws of rand() % 2 + 0x0C (0x801EEFD8..0x801EF024). See battle-action.md.

Jump table 0x80014FA0 holds 132 slots over 15 distinct targets; 116 point at 0x800421A8, the shared epilogue, so there is no "stat-up / status-clear / queue-end / item slot" family above 0x0E. The one body above 0x0E is slot 0x82 at 0x800421A0, the Incense window top-up FUN_80046870 (port top_up_cooldown; not a brightness ramp). Decoded arms: 0x08, 0x0A, 0x0B..0x0D, 0x0E. See battle-formulas.md.

Both list writers insert in ascending order: the party-slot learned-Arts list at +0x74D (selector 0x0B) and the displayed-skill list at +0x186 (arm 0x80041FB4). A head insert would have reversed both displays.

The counter starts at li v1,0x5 (0x80043284) and runs while slti v1,0x8, so it walks char +0x19B..+0x19D - the three accessory ("Goods") slots of the +0x196..0x19D block. Row on functions/battle.md.

The +0x1DC writes are ORs, not stores (|= 4 at 0x801E19D8, |= 1 at 0x801E1A18); the face store carries no +0x800, so the victim turns toward the attacker; and the reaction pick has three legs. Ported as effect_child_hit.

The 0x801CF4EC arms are ctx+0x279 phase machines of 3396..7260 bytes, and the actor+0x14C write lives in them - in PROT 0910's case one call deeper still, in the applier FUN_801F81DC its tick reaches three times. The per-entry "data stager" is a different routine in the same image and carries no magnitude. Bodies in cast-module.md.

PROT 0905 (Vera) restores record[+0x729 + slot] * 0x20 + 0xE0, clamped to the +0x14C/+0x14E pair, skipped at HP == 0 or +0x16E & 4, and pushed to the popup accumulator as a negated value at 0x801F7D0C. PROT 0911 (Orb) restores (magic_level << 6) + 0x1C0 over the party row actor_table[0..ctx[+0]]. Both unlock a status cleanse at level >= 3 (tier chosen through 0x801F6960). The input is the per-magic level byte (ids +0x705, levels +0x729 off 0x80084140, matched on actor[+0x1DF]). PROT 0919 (Spoon) restores (level << 7) + 0x380 over party seats 0..3. Everything else in the base band subtracts.

Actor +0x170. State 0x50 of FUN_801E295C (0x801E5D60..) subtracts the art cost, then adds the accumulator +0x224 = 8 (0x20 for a Spirit action), capped at 100; the defender of a hit gains max(1, damage * 100 / maxHP); and cure tier 4 of Vera / Orb / Spoon (sll at 0x801F7F2C / 0x801F7E18 / 0x801F839C) doubles each cured seat's gauge under the same cap. The attacker's own hit credits it nothing. First reported by the_rabidsquirel (retail save-state testing; every writer).

Per module: 0903 4, 0904 6, 0905 4, 0906 8, 0907 10, 0908 6, 0909 6, 0910 5, 0911 3, 0912 6, 0913 5; eight of the eleven write the terminal 0xFF through a pre-formed pointer. 0x801F69D8 is the tick arm for six of the eleven (0903 / 0904 / 0905 / 0908 / 0911 / 0912). A census keyed on the literal 0x279 displacement misses every store through a saved register and reads PROT 0908 as zero (falsified).

On the victim it is a bitfield: PROT 0903 and 0904 ori bits 4 and 1 into it (0x801F7548 / 0x801F755C, 0x801F7E38 / 0x801F7E50), and PROT 0906 and 0908 store 5 and 1 (0x801F7438; 0x801F7D28, 0x801F7D54, 0x801F7F58). On the caster the same modules bump it (addiu 1, the restage trigger) at 0x801F7364..0x801F7374 (0903), 0x801F71AC..0x801F71C0 (0904), 0x801F6F50..0x801F6F60 (0906) and 0x801F77D8..0x801F77F4, 0x801F79EC..0x801F7A04 (0908). "Nothing increments it" is falsified.

0x801F8534 is rand() % 8 - zero kills, anything else confuses - and 0x801F853C is rand() % (0x13 - level) >= 9 for the resist. The resist is forced, not rolled, when ctx[+0x287] is non-zero and the victim's monster record 0x801C9348[seat-3][+0x20] is set (0x801F6BF0..0x801F6C24), with an extra forced resist on rand() % 3 == 0 for character index 3 alone. Gaza 2 reproduces it live: ctx[+0x287] = 4, record +0x20 = 1, boss untouched.

It claims actor_table[ctx[+1] + 3], copies the monster-record pointer into 0x801C9348[seat], and seeds +0x16C = 0, +0x1DE = 2, +0x1DF = 0x50, +0x1DD = 9 plus an HP copy. The 0xAE arm then coin-flips one of HP 1 / MP 0 / ATK 1 / AGL 0x20 onto either the clone or the caster - the "nine stores in two passes" shape is two mutually exclusive branches, not one pass.

Against a party victim it rejection-samples the 256-slot bag at 0x80085958 (rand() % 0x100, up to 0x400 draws), flooring the slot against *(0x8007B5EA) while DAT_8007BD10[1] == 4, then calls FUN_80042310(id, 1). That gate is lbu v1, 1($s5) at 0x801F77E8, $s5 formed as 0x8007BD10 at 0x801F77B0: seat 1 holding roster character 4, the split-bag condition - not a context field, since PROT 0941 makes no +0x11 access at all. Against a monster victim it rolls rand() % 100 against 0x80077828 + id*2, the same table the player's Steal reads. The stolen id lands at 0x801C8FE0 + (seat-3)*4, the message pointer at 0x800774AC.

0x8004B3F0 walks DAT_8007BD10's party ids to form it, and ctx[+1] is the monster count. The +0x1DD group codes read against it: below 7 is one seat, 8 sweeps 0..ctx[+0], anything else sweeps 3..3+ctx[+1] (PROT 0956 folds codes below 3 into the 8 case and skips the caster).

The tick's arm 4 advances the phase byte into a slot its own table does not serve, and retail parks there busy until the stager runs: 0x801F783C..0x801F7858 is ctx[+0x279] += 1, reached as arm 2 of the seven-word head table at 0x801F69D8 (7788, 780C, 783C, 785C, 7920, 7964, 79A8).

ctx[+0x6D8] accumulates frame_delta * 8 and the arm advances when it passes 0x1000 - a full 12-bit turn - so what moves per tick is the direction of a ±0x30 cone, not the radius of a ring. Seats 3..=6 are tested against it by bearing (FUN_80019B28); a seat is skipped while (|d| - 0x30) < 0xFB1 unsigned, which admits both ends of the circle, and +0x1D9 is what stops a seat being hit twice as the cone comes round. Settled at 0x801F7AC8..0x801F7AF0 (the add), 0x801F7EF0 (slti 0x1000), 0x801F7E80..0x801F7E88 (seats), 0x801F7CF0..0x801F7D14 (the two gates). Port engine-cast::seru_magic_ticks.

bne v0,zero,<hold> at 0x801F7C0C and 0x801F7D08 holds the approach while FUN_8004E2F0 returns non-zero, so a non-zero return is not yet there. FUN_80050BB8 on that path is the separation nudge, not the approach step.

FUN_800513F0 computes it as (DAT_8007BD60 >> 5) & 4, i.e. bit 0x80 of the per-battle flags that FUN_801DA51C raises for a formation row with a non-zero record[+0]; the counter-attack byte is +0x288. Its value space is {0, 4} (lbu at 0x800513F4, srl 5 / andi 4 at 0x80051430 / 34, store at 0x80051444), and 9 of 96 battle states read 4. All three FUN_801E295C reads gate on it, so two audio-duck arms and the attack-return arm are unreachable in an unscripted fight.

Driving casts from pre-cast states gives per-arm dwell in module ticks for PROT 0903 / 0904 / 0905 / 0907 / 0908 / 0910 / 0911 and 0959. PROT 0907 holds 8 of its 16 arms identical across two fights and moves the other 7, so a single per-arm frame constant is the wrong model. ctx[+0x6D8] seeds 120 and drains one per tick on the player half and holds a constant 20 on the capture half. Tables in cast-module.md.

A level-9 Seru debuff takes a monster's ATK from 17 to 14 on both halves - the documented 20%. Both boost profiles reproduce off a live fight: a random encounter's [84, 17, 15, 14, 10, 30] becomes 17 / 25 / 24 / 12, and Gaza 2's 288 / 222 / 220 becomes 360 / 444 / 247. Vera at level 3 restores 320 and Orb 640, matching their closed forms exactly; PROT 0908's splash reproduces 522 -> 130 (/4) and 541 -> 405 (*3/4).

The rows are [lane0 pending, lane1 pending, lane2 pending, the HP accumulator 0x801D1AC8, lane3 pending, the running tally 0x80084440], at per-lane brightnesses [0, 1, 2, 0, 3, 3] - four steps, not six. The six rows draw through FUN_801D1308 -> FUN_801D050C with the brightness argument unclamped; the 0x100 -> 0xFF clamp at 0x801D08FC belongs to FUN_801D08EC, the corner-anchored sibling, which no tally row calls. FUN_801D1184 re-forms the 0x801D base into a different register between the product and the store (0x801D11E0 / 0x801D11F0), so 0x801D1ACC is the round lane.

sw $s2 at 0x801CEB8C, with $s2 loaded 1 forty-three instructions and three jals earlier. That is course 0 with no bans - a seeded word, not an untouched one. The 0x101 / 0x111 / 0x321 values, and therefore the claim that every seed carries 0x100, belong to the three flagged arms only.

The five-word table at the image base is dispatched by the body at 0x801F6A04: sltiu v0,v1,5 at 0x801F6A70 bounds the index, addiu v0,v0,0x69d8 at 0x801F6A80 forms the entry, jr v0 at 0x801F6A94 takes it. The body runs 0x801F6A04..0x801F6EF4 and the MP-pair stores at 0x801F6D08 / 0x801F6D1C are inside it, so citing 0x801F69D8 as the writer names the table that points at the writer.

lbu a2,0x20(v0) at 0x801F1D0C hands it to FUN_80055468, which widens the model's VRAM rect from 0x20 to 0x40 halfwords at 0x800554E0..0x800554F4; 37 of 186 records set it. PROT 0907 / 0908 / 0916 read the same byte as a "big model" resist proxy under the scripted-fight flag; it is not an immunity list (falsified).

Walk the opcode widths to a terminator and round the end up to 4, because the records are word-aligned. HALT (arm 0x800232BC..0x800232CC: ori v0,v0,0x8 into actor +0x10) outranks an armed 0x19 / 0x1B idle loop, the walk chains [header][program] rather than assuming one record per pointer, and where it dies with no terminator the last maximal 0x09 0x0FFF WAIT it stepped over bounds the record. Every image that has a highest record bounds it; the residue misses below or lands on the end and never terminates above it. See slot-b-module-layout.md.

Beyond the roll and the occupied-slot test, the sampled item is accepted only when its +2 shop price is non-zero, so the quest/found-only ids - 96 of the 256 - are unstealable. The consume FUN_80042310 reads gp+0x2D2 / gp+0x2D4 as its first two instructions and scans only [start, end), returning the 0x100 sentinel when it finds nothing; a steal outside the active window banners a success and removes nothing. gp is 0x8007B318 live, so gp[+0x2D2] is 0x8007B5EA.

One 256-slot array at 0x80085958, reached through five SCUS helpers that each check the window pair gp[+0x2D2] (start) / gp[+0x2D4] (end), with gp[+0x2D6] the count. FUN_8004313C is the sole writer of that pair: a page flag at 0x80084594, a fourth-bank flag test and the party-id byte at 0x80084598 choose start 0 or 0x80 against end 0x100, which is the "split bag" a lone character sees. A real three-member memory-card block carries items up to index 159, so a 72-slot bound drops 88 of them - that figure is a cheat page's display page, not a capacity.

Driving both against the same seat, FUN_801DD4B0 (move 0x36, the defence-respecting wrapper) reproduces the shared kernel exactly - 251 against 251 - so nothing in a capture distinguishes it; FUN_801DD6B4 (move 0x37, the bypass) returns 972 where the kernel returns 311. Exactly one capture-class id per wrapper class carries a move-power record.

The action seeder's Magic arm compares the byte against 0x14, and flipping it moves the damage fold 21 frames in a driven cast.

The countdown is drawn down by a per-arm multiplier of the scratchpad frame byte at 0x1F800393 - its product with 0x1F80037D, twice it, or once it; no single product fits every arm (arms that read as constants 4 and 8 are 1x and 2x a byte reading 4). All fourteen are measured, one fight each (PROT 0943's 0xAB twice), reading the single jal 0x801F2160 site in PROT 0898 as one module tick; the last two need a caster with enough spell entries. Three arms park rather than gate and PROT 0950's arm 6 has no gate. Tables in cast-module.md.

Across the catalogued state population the pointer names the same heap block in 97 of 98 states; it is sane in 37 of 37 field states and garbage in 61 of 61 battle states. The unclamped registrar inside FUN_8001E890 - lw a0,0x6BC(gp) at 0x8001EAFC, count off +0x00 at 0x8001EB10, jal 0x80026B4C per entry at 0x8001EB4C - is reached on all three arms of the gp+0x6AC fork, so nothing in its own frame keeps it away from such a block. The gate's writers do: over six measured routes it is never entered over one (see the registrar-entry row).

FUN_8001ED60 takes the section-0 and section-1 buffer sizes from the container header words held at gp+0x69C and gp+0x6C8, and the LZS decode is length-driven by the descriptor. A header-byte-exact rebuild whose decoded size differs therefore gets a truncated pack rather than a larger one. The battle loader itself reads neither: *0x8007B878 is the vdf pack and gp+0xA8C the etmd pack.

beqz _DAT_8007BAC0 at 0x801F6BA8 selects between a 19-arm field-restore table at 0x801F6AD8 (sltiu 0x13) and a 12-arm int.tim panel-still table at 0x801F6AA8 (sltiu 0xC). Both start at phase 2 because SCUS's FUN_80025358 owns states 0 and 1. An ordinary battle teardown takes the field-restore table - four 64x256 uploads at x = 384 / 448 / 512 / 576, one hit each - and the panel-still table records zero. Counts are residency-gated: an ungated breakpoint at the same slot-B VA also fires on whatever else occupies the slot.

Two headerless BGR555 stills, 0x28000 bytes each, uploaded as four 320x64 bands to VRAM (384, 0); one is the cheering party and the other the dejected one, which is what the loader's index rule encodes - the variant is chosen from the lead character's live HP (u16 0x8008480E < u16 0x80084824 >> 1). See ringside-still.md.

Retail's own readout quads name the last texel, not one past it: 31 against 31, 47 against 47, 55 against 55 over the sampled frames. An exclusive corner draws every quad one texel wide; with the inclusive corner the digit gap is 0.

Breakpointing FUN_8001E890's entry, its gate, the registrar at 0x8001EAFC and every jal 0x80026B4C, and write-watching both words, over a door warp, a boss fight resolving to the field, a field walk into an encounter, a cold boot into NEW GAME and a cold boot through CONTINUE into a card load: the routine is entered five times, always over 0x8014D53C, and the registrar reads count 5 every time. The field-to-battle route enters it zero times. State 1 (register only) occurs solely with the field pack intact; states 0 and 2 always have the file read and the decompress between the gate and the registrar.

lw v1,0x6ac(gp) at 0x8001E900 forks three ways: 0 read the entry, decompress and register; 2 re-sum, decompress and register; 1 register only. Twelve writers keep the register-only arm away from a reused buffer - FUN_80016230 zeroes the word on every mode step outside 2/3 (0x800163B4), PROT 0978's post-battle restore writes 0 then 2, and the core reset, the minigame warp and the field overlay write 0. Not 0x8007B83C: that is gp+0x524, the game mode (falsified).

Both stage clip 0x0B on the caster (sb 0x0B,0x1DA(s1) at 0x801F6FBC / 0x801F758C), and the anim commit FUN_8004AD80 resolves a staged clip by indexing the monster record's spell-entry offset array with it (0x8004AF08..0x8004AF18). Gobu Gobu's array holds ten entries, so index 0x0B reads the record's name text as a pointer, an unmapped read. Forced on a twelve-entry caster both casts complete with zero unmapped accesses, walking arms 0..4 in 1, 9, 40, 8 and 32 ticks. No monster record's magic slots name either id, so both are casts retail never performs.

Its writers are FUN_801DABA4 (0x801DAD6C), FUN_801E295C (0x801E49F4) and the applier SM FUN_801F12D0; no tutorial routine writes it. Both CD-XA cue arms test it, and the summon modules poll it before raising their own head cue, so it is open by construction at the moment a cast wants it. It is not a tutorial flag; feeding it from one silences the melee sting in those battles.

On the retail path (0x8007BA70 == 0, 0x8007B8C2 != 0) the poll skips its gp+0x91C countdown (beq at 0x8003DE90, 0x8003DF04) and answers busy only while the stream queue holds a read (gp+0x988, 0x8003DF70..0x8003DF78, then CdSync(1) and gp+0x928). The XA starter sets neither, so a voice inside a sounding clip replaces it. Every PCSX-Redux cast film reads 0x8007BA70 = 0 and the countdown at 120 through playing clips; retail-exec runs the routine to the same answer. The countdown reading is falsified. Engine World::battle_stream_read_in_flight.

Record 0 of the 20-byte HUD table at 0x801D46CC - texel seat (0x48, 0x90), texel cell 0xA0 x 0x20, CBA 0x7D0A - seated by FUN_801D2F38, which halves the cell at the caller's 0x1000 unit scale ((w * scale) >> 13 at 0x801D3180..0x801D319C) and centres the result on the seat. Reading +0x0A as half-extents doubles it to 320 x 64. It is not text, and its animator samples once per three vsyncs.

Arm 14 at 0x8004209C takes min(_DAT_800845B4, 9999) off the Point Card bank and applies it as battle damage. No descriptor carries class 14, but action state 0x3E tests actor[+0x1DF] == 0xFE at 0x801E4080 and stores selector 0x0E into actor[+0x1E8] at 0x801E40C0, ahead of the state-0x3F applier call. item-effect-table.md

FUN_800402F4's arm at 0x80041FB4 turns the class into a roster slot with addiu v1,v1,-0xb at 0x80041FC0, so classes 11/12/13 are Vahn / Noa / Gala and the ally the player picked is never read; the tier byte is stored verbatim as the learned id by sb s6,0x74e(a0) at 0x80042064, into the sorted position the loop above it opens. The nine book records carry Fire and Thunder I/II/III = 3/2/1 and Wind = 5/4/1, which is a per-character art-id space and not a book level. item-effect-table.md

FUN_8001FA68 is an eight-instruction append whose store sits in the jr ra delay slot; its caller loads a capacity into a2 (lh a2,2(a0) at 0x8003F7FC) that the callee never reads. Port cutscene::sprite_stack_push; u16_list_append::list_append_u16 is the same address.

One reference disc-wide, the jal at 0x801E3E04, inside action-SM table slot 0x3D (base 0x801CED44, the arm's word at 0x801CEE38) - the Spirit / Item wait state, entered only from 0x3C, whose sb v0, 7(v1) at 0x801E3B60 is unconditional: the arm's one branch, sltiu v0, v0, 3 at 0x801E3B28, rejoins at 0x801E3B40, above it. The Magic arm 0x801E2EB0 reaches 0x3C only for a class byte < 0x14 and a spell id < 0x65 (sltiu at 0x801E2EF4), which the player Seru block cannot satisfy. details

A gp-relative sweep finds 14 accesses - 7 stores, 5 loads - where an absolute-address scan finds none. The value writer is the field entity tick FUN_801DA51C: it clears the byte at 0x801DA69C (in the delay slot of a jal 0x8003CE64) and raises 1 at 0x801DA6A8 when system flag 0x19 is set, which the consumer then reads back. 1 pages extraction 967, the battle tutorial; 0 skips the load (beqz at 0x80052688). Battle latches 3 at 0x801E6D2C, right after FUN_8003EC70(0x4A, 0) pages 969 directly. Zeroing sites: SCUS 0x80046E74 / 0x800557AC / 0x80056114, field 0x801DA69C, and both stage images at 0x801F7120.

FUN_8003EC70 computes a0 + 0x381 in raw TOC space, and raw is extraction + 2 (measured across every TOC entry), so the pager's own index is extraction a0 + 895. The one site that hands it the stage selector, 0x8005269C, passes selector + 0x47, so selector n pages extraction n + 966: 1 -> 967, 2 -> 968, 3 -> 969, and 0 skips the load. The same algebra reproduces the band's other two call sites, +0x28 -> 935 + i and -0x79 -> 903..913.

Neither is a cast module: none of the three PROT 0898 entry tables names them, and only the pager loads them. Each is one function over its whole image, a phase machine on ctx[+0x289] driving the first monster seat. 0968 (FUN_801F69F4, seven phases behind the table at 0x801F69D8) is the arrival staging - camera walk, cue 0x20A, banner, then a hand-back clearing the stage id at 0x801F7120. 0969 (FUN_801F69D8, four phases, no head table) is the form transition - cue 0x20B, the seat's HP +0x14C = 1, a two-position camera shake, then FUN_8003ED04(0). details

DAT_8007BD10 is the per-slot roster character id: FUN_801DA34C indexes it and subtracts one to reach a character record (0x801DA37C..0x801DA3B0). 4 is the AI-companion seat, so the scans are excluding a seat the player does not command. It is not an action-state byte, and no "removed / done" state 4 exists (falsified).

Gated on DAT_8007BD04; the band is chosen by sltu(+0x156, +0x154). The primary leg falls back to +0x77F when its head is empty; the secondary zero-fills with no fallback (beq at 0x801DA4CC into 0x801DA51C). The write-back overwrites exactly one band and is guarded on +0x14C != 0 and +0x1DE == 3. The 0x5C8 save-window delta corroborates the pair: 0x76F - 0x5C8 = 0x1A7, and the patcher's performed-Super mask +0x75D lands at record +0x195.

It has exactly one jal across SCUS_942.54, every based overlay image and every raw PROT entry: 0x80047014, inside the SCUS battle frame driver FUN_80046A20, with no test in front of it and the fall-through rejoining at 0x8004701C. Three non-dome battle states enter it 350 / 313 / 255 times over 700 vsyncs each, every entry with ra = 0x8004701C. The dome is one of its callers' contexts; see minigame-muscle-dome.md.

Two POLY_FT4 quads, tpage 0x106 over screen (0,-20)-(192,220) and 0x109 over (192,-20)-(320,220), sampling (384, 0)..(704, 240); *(0x801D1A7C) is broadcast into all three colour lanes, so it is a fade level and the call is skipped at zero. The emitter never materialises 384 - a textured primitive addresses VRAM through the packed tpage page index, 384 / 64 = 6 - so no 0x180 literal exists to find. Geometry in ringside-still.md.

Not the match teardown: FUN_801CEA6C forks on the arena word _DAT_8007BAC0 and stores 0 to the latch at 0x801CEB54 on a first entry (op 0x3E leaves the word clear) and 1 at 0x801CEC04 on every later one. A 3600-vsync walk into the arena enters the emitter 79 times and takes the six-tile arm every time. The natural arm: the checkpoint RAM of a three-visit dome run reads latch 1, hub arm 0x0A and level 8 at the second and third visits, with both still packets (0x2C080808) in the primitive pool. ringside-still.md

Every sb ...,0x28b on the disc is in FUN_8004AD80: the raises at 0x8004B774 (3), 0x8004B80C and 0x8004B87C (2), all in the actor[+0x1DA] == 0x1A SpecialStarter arm - and 0x8004ADDC adds 4 to a live one for the matching seat. 0x8004B774 falls through to 0x8004B7D8, whose read of the side array 0x801F6990 (0x8004B804) is stored over the 3. The four positions are 1 NEW (build-starter mark), 2 HYPER (default), 3 MIRACLE (ctx[+0x28D + slot]), 4 SUPER (super-starter mark). battle-action.md

Forcing gp+0x6AC = 2 reaches the sum arm; a genuine mismatch enters 0x8001EA08 and self-heals in about 45 vsyncs (clear the gate, j 0x8001E900, CD re-read, gp+0x6AC := 1 at 0x8001EB0C). Four XOR'd words of the resident container left the sum byte-identical (0x7BF74962), because it is taken over a StoreImage (0x8005842C) read-back of VRAM. Only VRAM at (0x180 + 0x40i, 0) or the boot sum at gp+0x6B8 can break it. Probe scripts/pcsx-redux/autorun_w5a_0874_clobber.lua.

Its two arms copy (FUN_8003CA78) and append (FUN_8003CAC4) pool strings at 0x801F4C38..0x801F4CC4 in PROT 0898 into ctx+0xA9 / +0x129 / +0x159 / +0x189: a victory line with its spoils sentence, a defeat line, and the two escape outcomes. FUN_8003CBF8(buf, 0xC1, 1) (0x801D86A4 and siblings) locates the 0xC1 name escape - it is not a width measure - and every patch writes the first seat's id, so a lone lead is named and a party is the lead's team. live-audit-triage.md

The three jal FUN_8003CB54 sites on the disc are all in FUN_8004AD80 (0x8004B2F8, 0x8004B338, 0x8004B60C), each after a FUN_8003CA78 copy of a template formed at 0x80077A38 / 0x80077A4C / 0x80077A64; FUN_8003CB54 appends the 0xC2 escape pair. The caption is shown through FUN_801D8DE8(0x5B). Port engine-battle::battle_steal, run from World::tick_battle_animations (steal-table.md).

Six jal sites in PROT 0898: the round reset 0x801D8910, FUN_801D388C's case 0x10 (back, 0x801D4010), 0x11 (forward, 0x801D4128), 0x21 (back, 0x801D4750) and its tail pair 0x801D5690 / 0x801D56A0. Initiative is the execution order; the command order is the slot scan. Port engine-core::world::battle::member_step (the backward step) and engine-battle-menus::battle_input.

The re-entry init seeds hub arm 0x0A at 0x801CEE2C and zeroes the level at 0x801CECD0. Arm 0x0A raises it 4 dt to 0x80; 0x0B lowers it 2 dt to 0x40 while tally lane 0 sits at its clamp; 0x0C holds; 0x14 raises it 4 dt to 0x80 on the latch-1 arm only; 0x15 holds under the ROUND banner; 0x16 drains it 2 dt to 0. Dispatch is the hub's 51-entry table at 0x801CE990. ringside-still.md

FUN_8004E568 0x8004F3D8..0x8004F5A0: for every enemy seat, rand() % 100 against record +0x49, plus 30 when a living member has Items Up (+0x6C0 & 0x20000); the last winning seat's +0x48 decides, even a zero one, and a seat whose actor has +0x227 set is skipped. _DAT_8007BAC0 != 0 skips the loop. Unless a seat reads 100 or Items Up applies, a rand() & 3 must then be 0 (0x8004F584), and nothing is granted at 99 held (battle-formulas.md).

0x801E66A4..0x801E6724 repeats rand() % party_count until the slot is eligible; a uniform pick among eligible slots spends the same draws on a different slot.

0898 0x801E91E8..0x801E92D8: the 1-based position of Seru id in the acting character's learned-spell list (0x80084140 + char * 0x414 + 0x704, compared as id - 0x80), answering 1 when the slot is >= 3, carries no Ra-Seru (ctx[+0x25F + slot]) or _DAT_8007BAC0 is set. Its one caller is the absorb in FUN_801EC3E4 (battle.md).

The Done band reads it at 0x801E6224 and teaches it through FUN_801E92DC at 0x801E6234 in the same action - the absorb's grant, not a route into the capture cinematic 0x68..0x6B (battle.md).

0x801E3E80..0x801E4018, taken when the committed effect class is 5 (the item class that extends the gauge for one battle): raises HUD elements 0x0F / 0x52, draws (rand() % 2) * 2 for the camera variant (jal 0x80056798 at 0x801E3F2C), stages min(0x120, base * 7 / 5 + 8) and the actor's spirit +8, or +10 with ability bit 0x200, capped at 100.

The approach runs a tag search over the monster's installed action table (FUN_80050E2C with 0x20 at 0x801E3260..0x801E3268, the 0xFF miss falling back to tag 1 at 0x801E327C..0x801E32B0); 180 of the 186 records carry no tag-0x20 entry and take 0x19, and the six that do also carry 0x21 (monster 73 at entries 10 / 11) (battle-action.md).

0x801E5594..0x801E5658: a monster whose attack left its target at zero HP stages its tag-0x22 entry (+0x1DC |= 2) while a party member still stands, so the wiping blow plays none; 166 of 186 records carry no 0x22 entry (battle-action.md).

0x80041BCC / 0x80041C04 in FUN_800402F4's selector-8 arm: the status word is masked with 0xFFFC and a target at zero HP is skipped. Port engine-battle-vm::battle_action::effect_selector.

Begin sets the flow word to 0xFE (0x801D31AC), and that arm writes ctx[7] = 0 (0x801D3224), so state 0x00 - the formation arm and FUN_801F0450's pool arm with it - re-runs at each round's start. FUN_801DB318 is flow cases 0 and 2 (0x801D0EE4), so it too runs per round.

The flow SM's tail table at 0x801CE948 runs FUN_801D5778's copy loops for steps 5, 7, 9, 0x2A and 0x30 (slide out, mode 0) and 0x2B, 0x31 and 8 (slide in, mode 1); Begin (0x24 / 0x29) just exits. The glide is linear in FUN_801D9BBC over ctx[+0x1C], set to 0x10 at 0x801D8904. Engine: battle_commit_log::LogLaunch.

For a repeated species the label loses its final character (the instance letter) and strcat (0x801D9E60) appends the rodata string at 0x801CECA8, giving Killer Bee * 3. The banner is skipped when the first monster id is 0xB5 (0x801D0DF0). Engine: battle_hud::battle_intro_names.

Each slash keeps a progress word at 0x801F8D9C + 4*i that grows by rate * speed per call and lands its hit when it reaches speed << 6; arm 9 starts slash i once ctx[+0x6D8] passes (i + 2) * speed * 16. At four vsyncs per tick the timers reproduce the measured dwell (arm 7 sixty-five ticks, arm 9 twenty-five). Engine: seru_magic_ticks::swordie_slash_step.

Both address scans over every image (--prot) find no reference of any form to any of its 64 bytes. The matrix base 0x801F53E8 is formed at eight lui sites, including the Seru side-effect stager FUN_801F3D3C at 0x801F3E4C, each indexing atk * 8 + def unchecked; no character, monster or summon cast element exceeds 7, so no index reaches the block (battle-formulas.md).

details ↓

details ↓

details ↓

The registration edits the object list rather than truncating it: each backdrop actor owns a private 0x9c part table at +0x44 (allocated at 0x80021184), and 0x80051ad4..0x80051bac applies one count -= 1 plus one entry[i] = entry[i+1] shift from index 1 to each. Object 1 is dropped and everything else kept, gated on _DAT_8007b64b == 0. Indistinguishable from "draw object 0" on the two-object shells; on the seven four-object domes it keeps sky, mountains and the ground ring. See battle.md.

details ↓

details ↓

details ↓

details ↓

No. func_0x801d02c0 builds sixteen literal UV words into scratchpad 0x1f800034 (0x801d0304..0x801d03a0) and the emit loop reads group n for quad n, advancing 0x10 each time. They decode to four fixed 32x32 sub-tiles of the (192..=255)^2 window walked in sub_row * 2 + sub_col order, copied into the packet verbatim - no roll, no corner mirror. The grid origin also carries an extra -0x200 bias on z, and pass 1's cull is a view-z bracket with no screen-space term (that is a separate pass-2 test). See battle.md.

details ↓

details ↓

details ↓

details ↓

details ↓

Not an element drop - a resist-ladder bypass. Capture-class modules (PROT 944..966) pick one of two damage wrappers: FUN_801DD4B0 (fifth finisher argument 0: sw zero,0x10(sp) at 0x801DD67C, resist ladder runs) or FUN_801DD6B4 (1 at 0x801DD82C; the finisher's bne a3,zero at 0x801DDBD4 skips the party-defender jewel/guard block). BH (952, 0x801F7948) / TP (953, 0x801F7410) use the bypass wrapper; enemy ESM (966, 0x801F8610, 0x801F8F08) uses the respecting one (hence Cort reads as Dark). See battle-formulas.md and spell-table.md.

PROT 952's 0xB8 tick 0x801F6A0C has no wrapper jal and no HP store; arm 2 stages clip 0x0A on the caster (0x801F6D88) and parks the strike cursor (ctx[+0x15] = 0xFF, 0x801F6E78). FUN_80047430 calls FUN_801EC3E4 on the playing entry every frame (0x800478A0); Gaza's (165) entry 0x0A carries power bytes 0D 0E 0F 10 on beats 14 15 16 17, so four melee hits accumulate and land on the last. Port: fold skipped, total lands on the beat (cast-module.md).

FUN_801EC3E4's inlined ladder (0x801ED5CC..0x801EDA00) runs for a party defender and a monster attacker and reads 0x801C9348[attacker - 3] + 0x1D in every arm: a matching elemental guard halves the excess over Defense, All Guard takes 3/4 unless the element is 7. This is why a Luminous Jewel halves Astral Slash. The port had passed element 7 for every swing (battle-formulas.md).

The scripted-battle arm is the field-VM op 3E FF <formation_row> (battle.md): Zeto = garmel P2[12] row 9 (lone 0x4B), Caruban = rikuroa stager P1[3] row 17 (lone 0x49, World::run_boss_stager_record). DAT_8007b7fc is writer-less across SCUS_942.54 + every static overlay (absolute, gp-relative and materialisation sweep); readers pin it as the debug forced-battle formation id - battle init FUN_80055b6c (0x80055BF8..0x80055C24) → FUN_8005567c seeds the formation cells DAT_8007BD0C+ from it (sb at 0x80055698..0x800556A8), and FUN_80046A20 routes a nonzero value to its mode-0 debug-menu exit (0x80046DDC). Retail never sets it.

FUN_801E9FD4's round-counter arm, 0x801EB7C0..0x801EB81C (PROT 0898 file 0x1CFF0..0x1CFFC): the round byte ctx[+0x28A] goes through the 0xAAAAAAAB reciprocal, the arm returns unless % 3 == 2, then stores that remainder to actor[+0x1DE] (action category), loads the seat's byte from the formation cell 0x8007BD0C + seat, and writes actor[+0x1DF] = monster_id - 0x29 - the literal 0x2442FFD7, with sb v0,0x1DF(s4) in the next j's delay slot. Formation id 162 announces spell 0x79, 163 0x7A, 164 0x7B, in the party spell table's own id space. See randomizer.md.

The modules drive actor[+0x1DA] as an archive entry index; per-frame capture of natural duel playouts orders the walks. Lu (0960): 0x0E -> 0x0C -> 0x0D, closing 0x0F, all literals. Che (0959): 0x0A -> 0x0B. Gi (0958): 0x0A -> 0x0B -> 0x0C -> 0x0A -> 0x0B, closing 0x0D - the addiu v0,v0,-2 at 0x801F839C is a mid-cast rewind, not a stray step. Sites + walks: monster-animation.md; anatomy: cast-module.md.

Each action entry in a player battle file's record[0] carries [u8 parts][u8 frames] at +0xAC then parts * frames raw 9-byte TRS records - the monster archive's own packing, no codec between disc and RAM. Entries tile the block: Vahn's slot 0 is 15 parts x 9 frames ending at 0x5CD, slot 1 opens at 0x5D0, and so on down the table (Noa's rig is 16 parts to Vahn's and Gala's 15). battle_party_pose_live byte-matches the disc stream against live PSX RAM at record0_base + stream_off. So an idle rewritten at its exact retail length leaves every later entry offset valid and needs no relocation.

The state-0x5A victory arm's party-slot assumption OOB-indexes the win-pose roster DAT_8007BD10 (via 0x801E6770) when a living charmed ally is the acting actor at monster-wipe victory - the FUN_801E7320 reroll theory is falsified (re-do-not-re-walk.md). Fixed on both tracks: engine victory_pose_fixup/charm_widen, and the disc-side legaia_patcher::charm_fix guard - a single-word detour at the 0x801E6690 keep-branch into a SCUS dead-space liveness guard. Full chain + port: battle.md.

The only setter is PROT 0955's Kiss of Death miss arm (ori v0,v0,0x400 at 0x801F8CFC over the lhu +0x16E at 0x801F8CF4, stored at 0x801F8D04) - a slot-B cast image, so a sweep of SCUS_942.54 and the static overlays never sees it. A sweep of SCUS_942.54 + the static overlays finds only clears (cure FUN_8004CE2C, waker FUN_801F45A4, item cures, the on-hit strip, battle-exit); the generic appliers FUN_801EC3E4 / FUN_801E09F8 never reach 0x400. Port: FLAG_KISS_OF_DEATH_MARK in kiss_of_death_tick. Writer inventory: battle.md.

details ↓

Nothing calls it - it is the +0x08 tick of the static actor template at 0x800767F4, and the battle scene-loader FUN_800513F0 spawns that record into the system actor pool at 0x80051D3C as its last act before returning. The selector is therefore a per-frame pass resident for the whole battle. It plays nothing: each arm ends in FUN_8003EAE4, a CdlSeekL with no read (0x8003EB68), parking the drive on the voice's file; the gate at 0x8004DA50 passes on ctx[+0x276] == 0. The port (legaia_engine_audio::battle_voice) is REPLACED-BY ahead-of-time clip decode. The tick is +0x08 from 0x800767F4.

details ↓

details ↓

The picker rolls Gimard's +0x21 Tail Fire (0x27, read off the battle_gimard_tail_fire_a RAM) on half its turns, and take_monster_turn discards a spell its catalog lacks: SpellCatalog::vanilla() has no 0x27, and placeholder entries collide with real ids (0x26 at 9 MP over Thunderbolt's 18). The boot catalog fills the block below 0x81 from the disc table; see battle-action.md.

details ↓

details ↓

details ↓

details ↓

details ↓

details ↓

details ↓

The SCUS arts-name table (DAT_80075EC4) glyph string is byte-exact ground truth for every art's directional command; legaia_art::ArtsOracle exposes it, and disc-gated contract tests validate both the best-effort PROT 0x05C4 parse_record command-decode and the curated gamedata directions/ap columns against it (one documented walkthrough error: Hyper Elbow).

Not a runtime favored-class comparison. The arm command's AP cost is a per-(character, weapon) byte in the player battle file, at the weapon section's swing record (section[+0x04]) +0x74 (favored 0x1E / off-class 0x2A / far 0x36); LZS-decoded and copied verbatim into the runtime gauge (DAT_801C9360[char][0x0C]+0x74) at battle load by FUN_800557B8, read by gauge builder FUN_801D388C case 9. Byte-validated across all three player files; randomized by legaia_patcher::weapon_specialty. See docs/subsystems/arts-command-gauge.md.

details ↓

details ↓

details ↓

details ↓

details ↓

details ↓

details ↓

All three inputs derive from disc bytes: the formation-row selection is the standard scripted-battle op 3E FF 04 in P1[10] (same case-0x3E install arm as Zeto/Caruban; row 4 = lone Tetsu), the sparring-partner reposition is P1[10]'s 4C 51 15 0E 07 22 NpcRun→tile (21,14) = RIM_ELM_SPARRING_CARRIER_TUTORIAL_POS exactly, and the spar Yes/No is a MES-embedded option picker (0x29 open + N×2 signed relative-jump table, handler FUN_80038050; port legaia_mes::Picker::jump_target + InlineDialogueRunner::last_choice), not a field-VM opcode. details ↓

A scene bundle carries one stage stream per sub-area, and the battle's is not uniformly the block's first - map01 uses bundle slot 5 (entry 88), Rim Elm town01 slot 6 (entry 7). Engine ProtIndex::battle_stage_entry_for_scene. details ↓

FUN_800513F0 allocates two actors from one shell TMD (0x80051A7C..0x80051AC0, ctx+0x106C / +0x1070), both drawn. Copy B takes a half turn (0x80051BC0) unless the stage is on the DAT_80078B50 table (0x80051BCC..0x80051C18), which mirrors it in X instead (0x80051CC4..0x80051CE4). Live in 15 battle saves: both pointers distinct, the split matching the table every time. Not "drawn once, so nothing completes it" (re-do-not-re-walk.md). details ↓.

FUN_800520F0 pages a per-stage slot-B overlay via FUN_8003EC70(_DAT_8007B64A + 0x47) (0x8005267C..0x800526A0), skipped when the id is 0 (which every catalogued battle but the Tetsu tutorial reads). Engine engine-scene::overlay_loader::battle_stage_overlay_entry. details ↓

details ↓

Not the formation, scene or monster: a one-shot system-flag arm. FUN_801DA51C's battle-entry tail defaults the stage-id byte to 0 in a delay slot, tests flag 0x19, and on a set flag writes 1 and clears the flag (0x801DA67C..0x801DA6B0). The disc's only setter is town01's Tetsu record (50 19, two ops before its 3E FF battle-entry op). Port battle_tutorial::TUTORIAL_ARM_FLAG. details ↓

FUN_801E6968's tail arm (the Lost Grail Final Heal sweep's epilogue; sb at 0x801E6D2C, battle-SM cleanup state 0x50): formation head still 0xB5 (Cort) + first monster seat dead → stage id 3 (entry 969, the form-transition module), slot-B page-in issued same-frame. Port engine-battle::battle_stage_module::boss_transition_stage_id via World::battle_stage_id. 0x801fd514 is a phantom print off a base-tag-less dump; see re-do-not-re-walk.md. details ↓

Retail's 0x5A wipe scan (0898 0x801E6510..0x801E664C) walks the actor table for exactly the seated count at *(0x8007BD24) - the beq at 0x801E6524 falls straight into the wipe compare on a zero count, and retail has no guard, only a count that is never zero after battle load. "No party seated" is a port-only state (unguarded, it reads as a party wipe on the first end-of-action). BattleActionHost::slot_seated gates PartyWipe on party_seated > 0 (MonsterWipe still resolves), and the pad ladders seed the retail New Game roster. Disc-free pin: unseeded_battle_wipe_guard.rs. details ↓

The other battle SM - FUN_801D0748, the menu half, distinct from the action SM's ctx[+0x07] and overlapping its value space. Its dispatch is a compare tree (0x801D0C84..0x801D0DC8) whose selection band is regular decimal tens 30..120 (turn prompt / category menu / escape / item / magic / arts entry / target / target confirm / commit / attack-mode), which is what identifies it as the tutorial hook table's key: the nine live hook slots are that band minus the magic window. Engine mirror engine-battle-menus::battle_flow. details ↓

details ↓

details ↓

details ↓

A raw-TOC define used as an extraction index lands two entries late, dropping each block's first two retail entries and bleeding in the next block's; Scene::load converts. In the right frame the .MAP is the retail block's FIRST entry (not "two below"); "suimon == dolk2 MAN" and "rikuroa MAN = [18,70,20]" are next-block sidecars under the wrong label; "urudre1 tests 0x15E" and "0x63A has no writer" are false; "0x1BE = rikuroa Zeto gate" is geremi's arrival one-shot. Head blocks (defines 0/1, inside the TOC header rows) keep legacy windows. See cdname.md.

The second motion VM's bytecode source is MAN tail-section 1 (installer FUN_8003A9D4; parser legaia_scene_formats::man_motion; layout + op table in motion-vm.md). Disc-wide op-7/op-8 census (--motion-flag-census): overworld walking-band choreography + one town0b clear; 0x142/0x482/0x1BE and 549 appear in NO stream - the "549 set by op-7 bytecode" carrier claim is falsified. Anchor test motion_flag_census_disc.rs.

details ↓

details ↓

The stat-bonus table (DAT_80074F68, 8-byte stride) is decoded from FUN_801CF650/FUN_801CF5D0 (legaia_game_tables::equip_stats): +0=INT, +1=ATK, +2=UDF, +3=LDF, +4=SPD (not AGL / evasion). Five lbu/add pairs at 0x801CF6C0..0x801CF72C; note the asymmetry that rules out a linearised-C reading - equip+0 lands on the last accumulator, out of sequence with +1..+4. AGL takes no equipment add at all. The four +7 categories are Legaia's four weapon/armour slots (body/head/footwear exact by name; none of the 77 accessories appear in this table). Wired: DiscEquipInfo gates EquipSession's per-character list.

details ↓

details ↓

details ↓

The P2-only class is the town/dungeon exit door (a P2 door-choreography record): town01→map01 (Rim Elm's overworld exit; the P1 pass alone sees zero town01 destinations), retockin→retona, geremi→map02/tower - 13 scenes / 14 destinations disc-wide. jouinb→jouina is not in the class: it is P1-visible (the over-walk resyncs across that record). Merged kernel legaia_scene_formats::man_edit::scene_destinations (P1 pass as prefix + clean-gated P2 pass, (name, index) dedupe); the engine delegates to it; disc pins scene_destinations_p2_disc.rs.

details ↓

details ↓

Their own base+3 bundles are the MAN-less count=4 form [1,2,6,0x14]; the "embedded MAN at 0x1000" inside their SceneV12Table entries is an over-read onto the next scene's bundle (suimon's / geremi's; scene-v12-table.md § over-read). Retail sources their partition scripts from the block's standalone data_field_streaming entry's type-3 chunk (dolk2 ext 70 [29,73,17], rikuroa ext 157 [13,29,64]; live script-heap byte-match at the Caruban beat). Engine: field_man_payload streaming fallback (streaming_man_payloads) + retail-frame Scene::load windows; pins v12_bundle_man_disc.rs.

details ↓

details ↓

details ↓

All five draws sit inside FUN_801CFA48, the lightning effect-ribbon emitter (the 0x2000 arm of FUN_8001ADA4's multi-target case; PROT 0973's dev harness labels it THERNDER1): inner / outer half-widths, a 1-in-8 heading kink, the per-segment turn and the advance length. The state word 0x801F6950 is re-seeded on every call at 0x801CFC18 from param[+0x1C] >> 2, so it is a shape hash, not a stream. 0x801CFB94 is a branch label inside that routine, not a function (the name came from a slot-A VA collision with a real entry in PROT 0970).

The field overlay's content ends at 0x801F3818, below the word. Three of the four overlay_0897_* hits are the address appearing as an instruction address in a mis-based print; the fourth is the seed store re-keyed by 0x167E8 into FUN_801CFA48.

Seat A (+0x00 id, +0x02 x, +0x04 y, +0x0E kind) and seat B (+0x01, +0x0A, +0x0C, +0x0F), shared +0x06 width, +0x08 height, +0x14 content string (measured by FUN_80035F04, the rendered-width kernel - not an animation descriptor). FUN_801D8DE8 has one spawn arm per seat (0x801D92E8 / 0x801D935C, by mode & 1) and glides toward the other seat. Movers: FUN_801D5718 land, FUN_801D5778 launch (seat B pushed -0x140), FUN_801D57E8 clone. +0x10 is 13 on the framed rows and unread; +0x12 is zero in all 103 records. Which seat is parked is per record.

The 32-slot cast-tick table 0x801CF4EC behind FUN_801F1ED4 (jal per arm, key actor[+0x1DF] - 0x81; called from the battle SM at 0x801E4B1C / 0x801E4C7C / 0x801E4CA8), and the 64-word move-VM entry table 0x801F6734 copied into gp[+0x714] (0x801E44C8 / 0x801E4630) and called by move-VM op 0x20 (jalr at SCUS 0x80023764). Both give PROT extraction = 903 + row, verified 13/13 and 12/12 against the extracted images. Most slot-B images carry no internal jal, so a call-graph walk attributes no dump to them. See cast-module.md.

FUN_801F2160 (0898 file +0x23948, sole caller 0x801E50C8 in the battle SM) reads caster[+0x1DF], indexes the static spell table 0x800754C8 + id * 12, takes the record's +1 capture-class sub-id (sltiu 0x20) and jumps through 32 arms at 0x801CF56C; arm i is a hard-coded jal into PROT 935 + i. Most arms land on a per-spell trampoline (88..204 bytes) that re-reads caster[+0x1DF] and calls one body per spell id. It is not keyed id - 0x81 like the cast-tick table.

Function extents recovered by frame matching (prologue → the first jr ra whose delay slot restores the same frame); every 0x801F6734 row and every arm of both tick tables lands on a recovered head in its image and no other. The band holds 196 framed functions (1..8 per image), 25 images with internal jals. The extraction test's pointer-resolution gate counts only references landing inside another mapped image, so references that legitimately leave an image (0898's data, the post-image .bss) do not hold PROT 0915 / 0926 / 0935 back.

PROT 1200 carries three descriptors - TIM_LIST, a 2160-byte untextured Legaia TMD (65 verts, 76 prims, baked greys / dark reds / navy) and a MOVE table. The slot init FUN_801CEC94 loads the entry (FUN_8003EB98(0x4B2, ..) at 0x801CEE2C), FUN_80020224(0) at 0x801CEE44 dispatches all three, and FUN_80020DE0(0x801D3618, ..) at 0x801CEEA8 spawns the actor bound to model slot 0. Its extents enclose the paylines, dot matrix, reels and pedestals. See minigame-slot-machine.md.

koin1 (PROT 543, Sol Tower's minigame floor, whose MAN carries the 0x3E warps op0 = 103 / 104 / 105) picks the track in its entry script by spawn bbox: 2018 (M16, the casino floor), 2024 (the bar), 2045 otherwise (op-0x35 words in P1[0], decoded MAN 0x22C..0x30B); balden (the Vidna cabinet) plays 2058 / 2010.

FUN_801d2440 reads 0x801D3630[DAT_801d4134 * 16 + reel * 4] (0x801D2444..0x801D2464) and stops a hit at raw row R at R + 3 + word (0x801D24F4..0x801D2520); the display's +0x10 bias puts the target on the top, middle or bottom row for word 0 / 21 / 22, and the five rows are the three horizontals and both diagonals. DAT_801d4134 is rand % 5 (0x801D25A0..0x801D25D0). The search window is raw cur + 1 ..= cur + depth. Port land_row; minigame-slot-machine.md.

FUN_801DA34C (called at 0x801D15C8 on the phase-0x28 Attack confirm) reloads the record's 16-byte command string (+0x1A7 / +0x1B7), which FUN_801DA59C writes back and the review screen shows. The swings come from elsewhere: the Auto pick raises the per-fighter flag ctx[+0x266 + seat] (0x801D17D0 / 0x801D164C), and FUN_801F0450 rebuilds that fighter's queue (sb at 0x801F0B04) at action state 0x00, which runs every round (Begin sets flow 0xFE, whose arm writes ctx[7] = 0 at 0x801D3224). Engine: World::run_auto_attack_pool_arms.

37 jal FUN_8004FCC8 sites in FUN_801D0748 (15 / 7 / 15), not 34. Pinned by content: every cancel-mask (*(0x800846D4)) press is 0x23, every confirm-mask (*(0x800846D0)) press 0x21, and the pre-pass 0x22 sites fire only when the pressed bit differs from ctx+0x880. Arm boundaries come from the compare chain 0x801D0C84..0x801D0DCC.

FUN_800513F0 spawns two backdrop actors and, when _DAT_8007B64B is zero (0x80051ABC), decrements both part counts and shifts each list down from index 1 (0x80051AD4..0x80051BAC). One writer on the disc, FUN_801D9E1C at 0x801DA0AC. The arena leaves it clear: autorun_w4d_dome_decal_flag.lua reads 0x00 at the test 0x80051ACC on the contest's one loader entry and logs no write to the byte (minigame-muscle-dome.md).

801F2410 is the cast colour wash - screen-wide POLY_G4 bands onto *(0x1F8003A0) tinted ctx[+0x27E..+0x280] * ctx[+0x27A] / 255 in mode 0, a textured one-line POLY_FT4 backdrop in modes 1 and 2, called only from the cast dispatchers' epilogues (0x801F2144, 0x801F23F4). 801F2E10 has no reference in SCUS or any overlay; its 11 callers are all in slot-B module PROT 0909.

sb $v0, 0x6f9($s0) at 0x800561C8 is its only writer on the disc; an opcode-decoding sweep for lb / lbu / sb at displacement 0x131 and at the four slots' block-relative 0x6f9 / 0xb0d / 0xf21 / 0x1335 over SCUS + all 80 based overlay images finds no reader, and no wider access spans +0x130..+0x131. Nor is +0x9C a rank counter: it is the Monsters Defeated word (save-record.md).

Read once, at 0x801D18E0 in FUN_801D0748 (PROT 0898), forked with andi 0x20 at 0x801D18E8 into phases 0x5B / 0x5D / 0x64 / 0x66 (one enemy / all enemies / one ally / all allies); the spell table's +2 byte runs the same ladder at 0x801D1C50 / 0x801D1C58. The five carriers are the Point Card and the two summon-flute pairs. FUN_801D0F1C never reads the bit (see the falsified row).

Eight sites materialise the table base; a delta-tracked walk of every load off them reaches only +0 / +1 / +2 / +8 / +0xC / +0x10, and a five-form sweep of 0x80075EC8 finds no reference. The values are a per-art tier ladder keyed to list position (60000 Miracle, 50000..30000 the elemental arts, 20000, 15000..5000 by input count, 1 terminator) - neither AP nor input count.

details ↓

details ↓

FUN_800513F0 entered once (ra = 0x80046F7C) with the byte 0x00; at 0x80051ACC the trim arm ran, and a write watch logged zero writes over 1800 vsyncs (koin1, modes 0x03 → 0x18 → 0x19 → 0x14 → 0x15). The field handoff FUN_801D9E1C never runs on the arena path. Probe autorun_w4d_dome_decal_flag.lua.

Zero hits on 0x8004409C / 0x8004423C / 0x80044434 / 0x800445B0 over 1111 map03 overworld frames, 347 + 470 field frames (map02, ropeway) and ~1160 battle frames. The control had to change with the scene: a kingdom overworld never enters the SCUS prim-dispatch family at all (13 handlers armed, zero hits) - it renders through PROT 0901's eight replacements, all of which fired in the same run. Probe autorun_w4d_light_kind_hits.lua; renderer.md.

details ↓

FUN_801F12D0 is an 8-stage machine (jump table 0x801CF4CC): stage 2 uploads slot base to CLUT row 488 / page x = 512, stage 4 uploads base+1 to row 490 / x = 640, gated at 0x801F1500 / 0x801F150C on base >= 0x42 || 0x0C <= base <= 0x36. That gate partitions the file exactly: textures inside it, the four ME archives below it, and in the three excluded groups (base 0x39 / 0x3C / 0x3F, actions 0x14..0x16) an actor record byte-identical to its base+2 twin, which the applier never stages. See summon-readef.md.

0x801D1878..0x801F1A00 is 32,793 zero words of 32,866 - a .bss-shaped hole. The image's real un-dumped code is about 1.3 KB. Recorded in disc-coverage.md.

details ↓

details ↓

Over the 83 wrapper jal words in the 64 images, 79 of them inside a frame-matched function of the image carrying them: 70 take shape A (cap live HP, sltu, kills), seven shape C (cap HP - 1, sltu - neither kills nor heals), two shape B (cap HP - 1, signed slt - the two AoE stagers). Every shape-C site is a tick body or a body a tick calls. PROT 0910's applier picks its cap from its own slash counter at 0x801F8DAC - HP - 1 on slashes 1..3, live HP on slash 4 - so kill capability there is per hit, not per module. Image by image in cast-module.md.

Each capture-class module carries its own power constant as an immediate ahead of its wrapper call (read here for PROT 0966: li a0,0x100 at 0x801F8EFC; the other modules' values are the owning page's), so there is no per-spell power row to patch and no table to randomise - editing the number means editing that image. Per-module values in cast-module.md.

PROT 0927's FUN_801F85A8 sweeps the enemy row actor_table[3 ..] to ctx[+1] (0x801F8718..0x801F87E0) and PROT 0966's FUN_801F8D64 the party row actor_table[0 ..] to ctx[+0] (0x801F8FB4..0x801F8FC0) - not the whole table. Each rolls a wrapper (0x801F8758, 0x801F8F08), caps the roll at HP - 1 with a signed slt (0x801F878C, 0x801F8F34) and subtracts it (sh 0x14c at 0x801F87C4, 0x801F8F6C). A sweep wounds and cannot kill; the kill is the same image's tick. "Neither subtracts HP" is falsified. See cast-module.md.

Arm i is a hard-coded jal into PROT 935 + i, and in six images the landing site is a trampoline of 88..204 bytes that re-reads caster[+0x1DF] and dispatches one body per spell id - PROT 0955 is the extreme case, a 20-word jump table serving six spells from one cell. Two power constants that looked missing are register reuse: PROT 0918 carries 0x12 at 0x801F8798 and PROT 0949 carries 0xC0 at 0x801F72F8. See cast-module.md.

Its single call site is 0x801EE2C0 inside FUN_801EC3E4 (PROT 0898), and the routine contains zero data words. The unconsumed half of what it returns is ctx[+0x269] - staged and never read on the capture leg. Row in functions/battle.md.

The tutorial's wait record is widget kind 0xD at 0x801F75F0, and FUN_80031D00 dispatches on the kind alone - kind 0xD has no draw arm. The pause between tutorial beats is a timer with no picture.

+0x10 reaches FUN_8003541C as a1 from 0x801D8E8C and lands on node +0x1C, the kind the widget dispatcher switches on; +0x0E/+0x0F land on node +0x1D and thence gp+0x14C, which FUN_8002C69C reads to pick a frame style from {0x31, 0x33, 0x34, 0x35}. No image reads +0x11..+0x13. Detail in battle-action.md.

It holds [0, 0x800]: term 0 frames the strike face-on and the from-behind case contributes atk / 32. The battle SM zeroes it at 0x801EC888 once the first hit lands, so it shapes the approach and not the exchange.

The two ids live in different spaces. 0x27 is the enemy special Tail Fire; 0x81 is the first player Seru-magic id, whose loader-B call FUN_8003EC70(0x81 - 0x79) (jal at 0x801E463C, addiu a0,a0,-0x79 in its delay slot) pages extraction PROT 903: the loader adds raw 0x381 (0x8003ECC4), and 8 + 0x381 is raw 905.

It is accessory passive 0x2B (AP Used Down) in the persistent per-character ability bitfield, tested by the queue builder FUN_801EED1C at 0x801EF364 and by the status panel FUN_801D33D8 at 0x801D4520. Not a per-battle actor bit (falsified).

FUN_801D5854 compares the byte against 1, 2 and 3 (0x801D6510..0x801D6540, again at 0x801D6698..0x801D66C4 and 0x801D689C): 1 and 3 add 0x800 of camera yaw; 2 and 3 add 0x80 of pitch and store TR.y = 0x400 - a literal, not a 0x100 drop (li v1,0x400 / sh at 0x801D6564 / 68). No arm tests a bit, so a value above 3 changes nothing. Nothing in any arm writes a Z angle. See battle-action.md.

The compare is bne v0,a1 with a1 = 1 at 0x801E3A4C: the build loop marks an accepted art's starter 1 at 0x801EF788 and the Super tail-replace FUN_801EF9E4 marks 4 at 0x801EFBA8, so a doubled ordinary attack tests against the wrong constant and leaves the Super starter standing. See battle-action.md.

ctx[+0x17] is the action teardown's once-per-action latch and ctx[+0x18] the id of the HUD element that action raised, both at 0x801E2F50. ctx[+0x19] is read at exactly one site, 0x801E61CC, which unloads HUD elements 0x0F / 0x52 - so it latches "Spirit was used this battle" and nothing else.

Written over 0x801D5960..0x801D59B8 and read by one consumer, case 8's death re-frame. The clamp is sb-truncated, so values above a byte wrap rather than saturate - which is the behaviour to port, not the intent.

The caller FUN_801CEA6C tests _DAT_8007BAC0 at 0x801CEB58 and jumps past the jal 0x801D0ED8 at 0x801CEBF0 when it is already non-zero, so a contest refills once when it opens and a leg boundary never does. It refills party slot 0's HP / MP / SP to their maxima (+0x104 / +0x108 / +0x10C), and its stripped arm zeroes only +0x196 / +0x197 / +0x198 / +0x19A - the Seru-lock byte +0x199 and the accessories survive. Detail in functions/minigames-debug.md.

DAT_801D1A80 and its siblings are 0..0x80 brightness levels, not durations (slti 0x81 / li 0x80 at 0x801CF944..0x801CF958), and the two card holds end on pad & 0xF4 (0x801CFBE0, 0x801CFFE4) rather than on a timer. The tally arm tests the same mask a third time (0x801CFD60..0x801CFD7C) to latch the fast roll DAT_801D1AB4. A frame-count port ends the screens at the wrong instants and cannot be ended early by a button. See minigame-muscle-dome.md.

The term is (cost - 30) * K[slot] / 2 with K = DAT_8007B650 = [2, 1, 1, 0] and truncate-toward-zero halving, applied to each of the record's two seat-x halfwords; anchors are 176 / 216 / 216 / 256 from 0x80076BBC. K makes the arm chip grow away from the D-pad glyph between the pair.

The battle tick FUN_80046A20 adds the frame step DAT_1F800393 on entry, every battle frame and ungated (lhu v0,0x9EA(gp) / addu / sh at 0x80046A60..0x80046A7C); the win-pose stage zeroes it (sh zero,0x9EA(gp) at 0x8004EF18) and the stamp pass reads it halved (0x8004C87C..0x8004C884). It counts vsyncs, so the halved value is a 30 Hz clock; the port's per-vsync +1 mirror matches it. battle-data-pack.md

The battle-file loader matches section k against record byte +0x196 + k (FUN_80052770 case 4: lbu v1,0x75E(v0) at 0x800529D0, 0x80084140 + (char - 1) * 0x414 + k). Noa's record keeps her Ra-Seru in byte 2 and her weapon in byte 3, as the SCUS halfword tables say: weapon byte 0x8007B42C = 2, 3, 2, Ra-Seru byte 0x8007B424 = 3, 2, 3. battle-data-pack.md

FUN_801E9504 compares the cumulative XP at +0x00 with the threshold (lw v0,0x5C8(s7) / sltu at 0x801E9F68..0x801E9F70, looping while it still reaches it), stores the next threshold to +0x04 (sw a2,0x5CC(v0) at 0x801E9FA0) and zeroes it at level 99 (0x801E9698). The captured 0x16D -> 0x2DA is Vahn's L3 to L4 threshold beside a level byte 2 -> 3, so the +0x00 step 0x4F -> 0x73 is 36 XP, not a four-level jump. battle-round-loop.md

Each sb ...,0x1DA on a capture body's caster is placed in the arm that runs it (caster_stages::CAPTURE_CASTER_STAGES): Hyper Crush 0x0D / 0x0B and Hyper Lightning 0x0D / 0x0C on arms 0 and 2, Chaos Flare 8 and Melt Spray 7 on arm 2, Power Charge 0x0A on arm 0, Bloody Horns 9 / 0x0A on its director's arms 2 and 3, and Genocidal Cannon 8 on arm 2 (0x801F6EC8, behind the countdown gate bgtz at 0x801F6DB4, table word 2 0x801F6D00). No row replays at the band's head. cast-module.

nilboa_koru_pre_ultra_charge reads .811, .809 on --retail-steps and .931 on --rand-track (phase 1 .799 to .930): the frame pacing that once took a share no longer does, and seated on retail's words each pass the cast matches. Harness seats only (cast-sequence oracle).

Lu's charge clips resolve seven hit events through arm 5 on both sides; retail's block roll grants all seven, the engine's own stream four, so three connect and burn the victim. Seated on retail's words each pass (--retail-steps --rand-track), nivora_duel_pre_plasma_strike matches all 24 cues (.917 on either seat alone) and arm 5 reads .905 against .813: the block rolls draw the same words and land the same verdicts, so the roll is the deal, not a rule. Harness seats only (cast-sequence oracle).

Arm 4 arms the wash with 0x202020 every pass, the high half set by lui a0,0x20 in the delay slot of the switch's branch into the arm (0x801F6AD4), which the presentation decoder missed, so the engine cleared each frame. With the wash armed the farthest bucket holds the subtractive quad, and each pass's ribbons land on the passes before: arm 4 reads .838, .835 and .839 on the three Gilium films against .58. cast-module

The emitter 0x801F8B18 calls stager arm 1 once a pass, and arm 1 seats the next of four cloud records by the word 0x801F9364 ((w + 1) & 3, 0x801F83DC..0x801F848C), so where a pulse falls is the number of passes since arm 6's pass seated the emitter. Not rand(): on --retail-steps the Gobu Gobu film's (0x8F) arm 7 reads .995, its pulses pair for pair, against .75 on the engine's own steps. What is left plain is the engine's step cadence through the arm (cast module).

The four records 0x801F8B40..0x801F8BE8 differ only in their texture band, each a quarter of the cloud page drawn as a 0x800-wide sprite flying at the lens for 31 vsyncs. One is seated a pass in turn, so the frame whitens once every four passes: twelve vsyncs at step 3, irregular because retail's arm-7 frames mix steps 3 and 4. The same arm's sky was a separate defect: its scanline sample origin ctx[+0x285] / +0x286 slides with the words 0x801F9360 / 0x801F9362, which the port now carries (cast module).

On the Gobu Gobu films the frame luma tracks retail's pair for pair through both arms: Theeder's arm 11 within 0.6 on average (at most 3) plain and 0.4 on --retail-steps, Gizam's arm 9 within 0.4 (at most 1.6) on both. Theeder's arm reads .916 / .907 on the two seats, its residue the creature's sway and the spark lines over the flash's first frames; Gizam's reads .97.

The burning-body emitter sheds two puffs a pass at the creature's pose of that pass. On --retail-steps (LEGAIA_DIAG_CAST_PARTS against a --pose-objects recording) the port's arm-11 spawns match retail's in number (32), in pool count (10 live), in anim cadence and in the walk's cursor and live pair per pass, and their mean position per quarter of the walk lies within one walk step (111 units) of retail's. The earlier 70..110 offset counted pool rows, not spawns. Puff by puff they part by the jitter, a rand() deal (battle-action-helpers).

Engine films under LEGAIA_BATTLE_CD_TIMING=console against the PCSX-Redux recordings: Glare keeps its cue, and with retail's rand() words seated Kiss of Death (--rand-at 0x70:4) plays 3 of 3, Plasma Strike (--rand-track) .917 as on the default timing, and Doomsday (--rand-track) 11 of 11. Aluru Cannon keeps every cue, one 7 ticks off retail's. The table.

The party seats' selector retires when the tint decay arm eases their word back to neutral, 16 battle frames into arm 7, in retail as in the port. Seat 7 keeps +0x21F = 1 and its clip 1 (committed id 0x11) 265 vsyncs into the arm, so its ghosts shed fire; k = 4's bare sb zero,0x1da (0x801F8378) waits for the clip's end, which the port had committed at once. PROT 0964.