Settled reverse-engineering threads
Questions about how Legaia works that have an answer, and how firmly each answer is pinned. This is the archive half of the RE register: the live hunts are on open RE threads, and the readings that turned out wrong are on do not re-walk. This page is an index; every full write-up lives in the source document.
How to read this page
A thread is one question the project stopped to ask - why a boss battle freezes with the camera circling, where the party's battle models come from, which routine swaps the music. A thread is settled when it has an answer that can be pointed at: an instruction sequence, a runtime capture, or a measurement taken off the disc. resolved is a claim, not a warranty - which is what the evidence column is for.
Each area below is one table. A row gives the question, a one-line verdict, the evidence grade, and a link to the full write-up - every address, capture and correction - at its anchor in docs/reference/re-settled-threads.md. The areas run from the overworld inwards (world map, battle, field, text, animation, audio, boot, rendering) and end with the project's own instruments.
- Source of record
docs/reference/re-settled-threads.md- Row lifecycle
- open → settled (here) → falsified if a later reading overturns it
- Function names
- A
FUN_<addr>in a row is described in key functions - Function-level view
- Port catalog - dumped × documented × ported per routine
What an evidence grade means
Every thread is graded by what its stated evidence rests on. A thread citing more than one kind is graded by the weakest load-bearing claim - the one that breaks the conclusion if it is wrong.
| Grade | The thread cites |
|---|---|
| disassembly | Instructions, addresses, opcode encodings, branch or store sequences read from the MIPS code. The strongest grade. |
| capture | A runtime capture: a save state, an emulator probe, a write watchpoint, a trace, or a measurement taken off the disc. |
| decompiled-C | Ghidra's C output, a FUN_x(...) call signature, a Ghidra label, or a claim about store order / count / a boolean operator with no instruction behind it. |
| inference | Reasoning from surrounding facts, corpus absence, or analogy, with no direct evidence cited. |
decompiled-C is the re-audit bucket, not a wrong-answer bucket. It marks a claim nobody has confirmed against instructions. Three shapes carry most of the risk: evidence citing a call signature or a funcs/<addr>.txt dump rather than instructions, any claim about store order or count, and any claim about which boolean operator a predicate uses. The catalogue of C-rendering artifacts is on Ghidra workflow.
World map / kingdom bundles
The overworld: kingdom bundles, continent terrain, the slot-4 animation bank and the place-name carriers.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
Does the disc carry one 4C EA occurrence or more than one? | resolved (three - one per kingdom map bundle) | disassembly | The field-op census and the op-arm oracle disagreed by one because the census walk ended at each record's first 0x1F text segment and started partition-0 records three bytes late. With text segments and pickers decoded as strides of the stream, the scripted game-over has one clean site in each of map01 / map02 / map03. |
| Which camera does the overworld walk use? | the field zone camera; the live words equal its staging descriptor on every resident overworld state | capture + disassembly | doc |
| What does scratchpad flag bit 0 select? | the kingdom overworld: the fog spawner's depth-tested, lifted arm | disassembly + capture | doc |
| World-map walk-view continent ground render | resolved | capture | doc |
DAT_8007C018[45..53] mid-load vertex-pool pointers | structural | doc | |
| Field decoration path - does it dispatch the NCC light handlers? | no field light; depth-cue only | capture | doc |
| Kingdom slot 4 - per-record semantic + consumer | the world-map scene's type-0x05 ANM animation bank: 8-byte rigid-transform entries read by the clip selector FUN_800204F8 and the animated renderer FUN_8001B964; the vertex-pool / cluster-A reading is falsified | disassembly capture | doc |
| The placed-actor mesh resolver on the world map | FUN_80020F88, at spawn time from the allocator, not in the draw loop; the port already matches | disassembly | doc |
MAN sections 2 and 5 - what do _DAT_801C6EA0 / DAT_80073EE0 carry? | both are place-name carriers | disassembly capture | doc |
| The ninth routine of PROT 0901's draw band | it is the bulk terrain-cell emitter FUN_801F89B8, not a per-prim leaf: it reads the camera's visible tile window out of the scratchpad and takes max - min per axis as its loop counts, so that window is a draw extent and not a fog hint | disassembly | docs |
| The world-map camera's sub-9 arm table, and where its horizon gates store | three stores were credited to the instruction before them - the write sits in the delay slot of the j that leaves the arm; and the bit-24 arm writes two words, not one | disassembly | docs |
What is the archive entry labelled monster_test above the world map? | the world-map top-view debug image - the label is inherited from the block above it, and the image's own operands are the world-map location table, the kingdom filter and the camera pair | disassembly | doc |
| Which image holds the world-map dev-menu row strings? | the field overlay, at a file offset its own renderer forms the address of; the other slot-A occupant aliases the same address and the two are never co-resident | disassembly + capture | doc |
| What writes the overworld camera's vertical-offset control word? | the first overworld's own entry script, once, through a camera op's delta arm; the port never reached that line because its system script was anchored at the map origin outside field mode | capture + disassembly | docs |
What does FUN_800271A8 build? | the overworld's screen-Y curvature table - not a depth ramp - which the overworld leaves, the fog and the drop shadow add to screen Y; retail bends per vertex, and only the overlay's landmark rows | disassembly + capture | docs |
Battle / arts / level-up
Battle load, the action state machine, arts and Super Arts, damage kernels, the party HUD, level-up and the boss softlocks.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
| Why do battle bodies near the camera turn see-through? | a near-camera ghost pass runs every battle frame and switches bodies close to the camera (and a caster's allies during magic) to a faint blend | disassembly capture | doc |
| What does a downed party member play? | the knockdown, then a hold, then a kneel that repeats with root motion latched off - not a recover clip with a backstep | capture disassembly | doc |
| Why do three-on-one fights sit 13 units off their authored rows? | the battle recentres the formation at every round start; a balanced formation is already centred | capture disassembly | doc |
| Which fights cross out the Ra-Seru chip? | the Rim Elm ambush and fights whose first monster is 0xAF, through bit 0x200 of the special-battle word; only the command ring reads it | disassembly | doc |
| What does the auto-combo assembler's tail do? | splices learned arts over the Auto command's direction queue, paid from a local copy of the Spirit gauge | disassembly | doc |
| Where does the target cursor's name plaque sit? | placement record 0x29, centred on x = 0xE8, row 162 | disassembly + capture | doc |
| Which battle limbs draw dark? | a party member's Rot limbs, per mesh object, from a per-character range table | disassembly | doc |
What is battle context byte +0x25? | the count of actors a round passes over without acting - not a round counter | disassembly | doc |
| How is the command-phase commit log laid out? | one row of name, command and target per committed member, columns set off the name's width, scrolling up as the round fills | disassembly capture | doc |
| What does the party-wide Begin / Reselect screen gate, and where does Reselect land? | it follows the last member able to act, for every party size; Reselect steps back one member, onto that last member, and refunds an item | disassembly + capture | doc |
| What ends Koru's four turns? | Koru's own AI arm casts its finisher on round 4; nothing compares a turn counter to a limit | disassembly | doc |
What arms the Miracle marker ctx[+0x25F + slot]? | the party actor seeding FUN_80053CB8 (0x80054270, its only store), from the Ra-Seru equipment byte - no input recognizer exists | disassembly | doc |
ctx[+0x26] and ctx[+0xD] | the level-up banner's UI element id (0x65) and the per-action camera angle variant 0..=3 | disassembly | doc |
Stone and Curse in FUN_800402F4 | jump table 0x80014FA0 class 9 / 10; Stone also refunds the reserved item and clears +0x1DE; no item record carries either class | disassembly | doc |
| Attack x2, the swing class and the apply-mode arms | ctx[+0x16] has two War God Icon writers: the refill at 0x801E3A20 (0 to 1) and the per-stage bump at 0x801E37AC (only when already non-zero); monster +0x1E is the swing class (0 x127 / 1 x1 / 2 x52 / 3 x6) | disassembly | doc |
| How a cast reaches its slot-B module | FUN_801F1ED4 on the action id, FUN_801F2160 on the spell record's +0x01; the spawn-record data half is now an engine pool | disassembly | doc |
| What an art body costs in AP | computed by FUN_801EED1C: multiplier 11 / 10 / 6 by visit ordinal, halved under 0x800, times command count; spent from Spirit at 0x801E5D74 | disassembly | doc |
| What does a port owe the 0903..0966 module band? | of 65 catalogued addresses, 45 are spawn choreography expressible as the spawn-record data layer, 13 carry game logic (two stagers apply damage), 7 are empty | disassembly | doc |
Which enemy specials name readef groups 19..21 through monster record +0x1C? | none - +0x1C is the readef group index (FUN_801DABA4, base 3*g) and no shipped record takes 19, 20 or 21 | disassembly | doc |
| What arms the dome's panel-still streamer? | a generic battle-end teardown: ctx[+0xC] = 1 at 0x800474CC in FUN_80047430; ctx[+0x7] == 0x67 is only the escape path's hold | disassembly | doc |
| Encounter MAN sub-section layout | header shape corrected | disassembly | doc |
| Battle-intro tile shatter - the side-face shade page | a resident field asset, not a transition upload | capture | doc |
How long does a field-to-battle transition run (DAT_801D2458)? | 132 frames; 252 for the swirl | disassembly | doc |
| Which stage-dome objects does the battle backdrop draw? | drop index 1, not "keep index 0" | disassembly capture | doc |
| Battle ground grid depth cue - the far colour | captured at the draw; port fogs the grid | capture | doc |
Which element the screen-element +0x0E kind pair selects, per value | it is a table index, not a style enum | disassembly capture | doc |
| The element-badge palette selector | the badge record's own palette byte | disassembly capture | doc |
The status-element badge sheet 0x18..=0x20 | nine 48x16 word tags; ladder assignment independently confirmed | disassembly capture | doc |
| Does the battle ground grid roll per-cell randomness? | no - a four-entry table walk | disassembly | doc |
Endless camera orbit (Gaza 2 softlock) - the 0x19 attack-approach park | caught live; root-caused; disc fix shipped | disassembly capture | doc |
0x19 fallback approach drive - which anim-driver field does summon staging leave stale? | pinned + causally reproduced on the parked save | disassembly capture | doc |
| Super / Miracle Arts trigger chain | all 15 Supers live-executed | disassembly capture | doc |
| Xain "Bloody Horns"/"Terio Punch" ignore elemental guards (community mystery) | resolved | disassembly capture | doc |
| First boss trigger → Battle | resolved | disassembly | doc |
| How an enemy's signature cast picks the spell id it announces | resolved | disassembly | doc |
| How a Delilas sibling's signature move stages its clips | walk order capture-pinned | capture | doc |
| Is the player battle idle channel-delta encoded, like the readef "ME" bodies? | no - raw packed inline in record[0] | capture | doc |
| Enemy-ally charm battle softlock | both tracks fixed | disassembly | doc |
Battle-actor +0x16E bit 0x400 applier (guard-disabling status) | exhaustive negative | disassembly | doc |
Who calls the battle on-screen test FUN_8005126C? | exhaustive negative | disassembly | doc |
What spawns the battle XA voice selector FUN_8004DA00? | resolved | disassembly | doc |
Effect-VM pass-1 "state token algebra" (FUN_801E0088) | ported | capture | doc |
| Seru-magic summon visual (e.g. Tail Fire) | player visual; wired | capture | doc |
summon.dat / readef.DAT side-band streaming | entries + format | disassembly | doc |
| Monster steal item (Evil God Icon) | resolved | capture | doc |
| Battle face-stamp issuing site | resolved | capture | doc |
| Per-spell magic power / multiplier | mechanism + roll ported | disassembly | doc |
| Arts command sequence - independent source | resolved | capture | doc |
| Weapon-specialty arm width (off-class widens the Arms command) | resolved | capture | doc |
| Stat growth-rate source | validated + wired; core + opt-in jitter | capture | doc |
Character-record HP/MP/AP pair order (+0x104..0x110) is (max, cur) | relabeled throughout | disassembly | doc |
| Monster stat-record archive source | resolved | capture | doc |
| Monster mesh + texture pool | resolved | capture | doc |
| Terra slot-3 / story-flag overlap | resolved | capture | doc |
Battle party mesh pack other5 = PROT 1204 (battle form; Baka Fighter reuses it) | empirical | capture | doc |
| MP-cost ability-bit priority (half vs quarter) | dump-confirmed | disassembly | doc |
| Scripted Tetsu encounter → Battle (v0.1 oracle Battle leg) | resolved | capture | doc |
Battle stage backdrop: which scene_tmd_stream a scene fights in | resolved | capture | doc |
| Battle stage backdrop: is the authored half completed, and how | two actors; per-stage transform; object 1 dropped | disassembly capture | doc |
Battle-stage overlay band (+0x47) | resolved | disassembly | doc |
| Battle-intro tutorial boxes (Tetsu sparring fight) | machine pinned, ported and wired | disassembly | doc |
| The battle-intro enemy-name banner - which placement record raises it | none does - the composer FUN_801D9D3C places it itself, with immediate geometry, for the intro timer | disassembly capture | doc |
| How is a slot-B cast / summon module entered? | two link-time tables in PROT 0898 - the cast-tick switch 0x801CF4EC and the move-VM entry table 0x801F6734 (op 0x20); row = extraction - 903, verified 13/13 and 12/12 against the extracted images | disassembly | doc |
| How is a capture-class cast module's tick entered? | a third link-time table in PROT 0898: FUN_801F2160 keys on the spell record's sub-id and jumps through 32 arms at 0x801CF56C (arm i = PROT 935 + i), mostly onto per-spell trampolines | disassembly | doc |
| Is the whole slot-B band mapped? | all 64 entries carry a map row and 61 are dumped; 196 framed functions, extents by frame matching; 0915 / 0926 / 0935 wait only on their extraction images | disassembly | doc |
| The slot machine's cabinet emitter | a mesh, not a packet: PROT 1200's second descriptor, an untextured TMD spawned as an ordinary actor by the slot init | disassembly | doc |
| The slot machine's in-game BGM | host-scene authored: koin1's entry script picks 2018 on the casino floor (2024 bar, 2045 elsewhere); balden plays 2058 / 2010 | disassembly | doc |
| The Muscle Dome's Auto arm | no picker - the review screen shows a 16-byte command string stored in the character record (+0x1A7 / +0x1B7), but the Auto flag makes the arts assembler rebuild that fighter's queue at the start of every round | disassembly | doc |
| The dome's three UI cue ids | 0x21 accept / 0x22 highlight moved / 0x23 refused-or-back, over 37 sites | disassembly | doc |
| The arena backdrop's object-1 dust decal | trimmed by the SCUS battle loader unless _DAT_8007B64B is set; no effect path draws it | disassembly | doc |
FUN_801F2410 / FUN_801F2E10 - dome or shared? | neither is the dome's: the cast colour wash, and a beam emitter called only from slot-B module PROT 0909 | disassembly | doc |
What is per-character record +0x131? | nothing - write-only; one store on the disc (the new-game seed) and no reader in SCUS or any of the 80 based overlays; the magic-rank counter is +0x9C | disassembly | doc |
What does item-effect flag bit 0x40 mean? | the target side (set = enemy party), read at 0x801D18E0 and forked on 0x20 into the four target phases; the spell table's +2 runs the same ladder | disassembly | doc |
What is the arts-name table's +4 halfword? | an authored tier constant with no reader (values 60000 down to 1 by list position; neither AP nor input count) | disassembly | doc |
What is the byte at actor[+0x22C] + 0x80 the SFX-cue router folds into the category? | the display object's sound-bank category, {0, 7, 8}, set at battle setup beside the bank-load call - not an element byte | disassembly | doc |
What moves the evolved-Cort battle off flow ctx[+0x06] = 0x0C? | the boss stage module (PROT 0968) hands the flow back as 0x0B at 0x801F713C when its own intro countdown expires; no input involved | capture disassembly | doc |
Is _DAT_8007B64B clear during a Muscle Dome contest? | yes - the loader's trim arm ran with the byte at zero and nothing wrote it | capture | doc |
| Do the renderer's light-capable prim kinds 8..11 ever execute? | no - zero hits over two overworlds, a field scene and a battle, with the overworld's real handlers firing as the control | capture | doc |
What are PROT 1221 / 1222 (other5 / other6)? | int.tim / int2.tim, the dome's two ringside panel stills, streamed by FUN_801F6B24 (PROT 0978) through a computed index s0 + 0x4C7 (below-half-HP picks the second) | disassembly | doc |
| What do the higher readef groups' aux slots carry? | no new kind: textures inside FUN_801F12D0's base-byte gate, the four ME archives below it, and a never-staged actor record in the three groups it excludes | disassembly | doc |
Is cutscene_str's 123 KB code gap un-dumped code? | a zero-filled reservation (32,793 zero words of 32,866); the image's real un-dumped code is about 1.3 KB | disassembly | doc |
| Can a scene TMD pack member be grown in place? | nothing outside the pack holds a byte offset into it - every external reference is an index - so a rebuild is the only cost | disassembly | doc |
| Is any of an enemy signature cast's choreography data-driven? | partially: the spawn layer is data in the art path's own record format, but the lift and camera are module code, and the prototype table has no free slot | disassembly | doc |
| What does the battle overlay's private PRNG feed? | nothing in the battle model - it shapes one lightning ribbon and is re-seeded per call; 0x801F6950 has three references, all in PROT 0898 | disassembly | doc |
What are the halfwords of a 0x80076C10 screen-element record? | a two-seat pair over shared width / height / string; +0x14 is the label string, not an animation descriptor | disassembly | doc |
What arms the battle-stage id 1 (sparring tutorial) | resolved | disassembly | doc |
Mid-battle second _DAT_8007B64A stage-id writer (the 0x801fd514 phantom) | coordinate re-keyed | disassembly | doc |
| "No party seated" vs "party dead" in the wipe scan | port-only state; guarded | disassembly capture | doc |
Battle command-flow byte ctx[+0x06] | resolved | disassembly | doc |
Action-SM state 0xFF treated as battle end by the port | path was live-reachable; port fixed | disassembly | doc |
Spine flag 0x142 (Caruban beat / dolk-dolk2 switch) writer | disc writers + engine port + oracle | capture | doc |
Spine flag 0x482 (Drake mist-wall) writer | writer-less; "direct code path" presumption falsified | capture | doc |
CDNAME scene-window frame (raw = extraction + 2) in Scene::load | engine converts; misattributions corrected | capture | doc |
Motion-VM (FUN_80038158) bytecode carrier + flag census | carrier pinned; spine flags negative | capture | doc |
| Debug-menu "STR trigger teleports + sets flags" mechanism | no per-FMV event table; dev-menu tools explain it | disassembly | doc |
Spawned-record player-channel (0xF8) ExecMove/HaltAcquire handshake | retail machine traced: the halt-acquire creates the wait object and the record parks at the next cross-context op; the port's model diverges | doc | |
| Equipment stat-bonus table - slot model | slot model + passives | disassembly | doc |
Flag 0x63A - the vell/vozz P2[7] gate with NO script writer | script writers exist; the "no writer" premise was the CDNAME +2 skew | capture | doc |
cave01 P2[16] (the 0x15D entry-key setter) - what spawns it | slot-counted spawn chain | capture | doc |
Drake Castle deep interiors (jouinc/jouind) depth decode | door-choreography families, not story gates | capture | doc |
scene_destinations P1-table scan misses P2-only door names | P2 pass folded in | capture | doc |
0x4C 0x51 byte +3 = [bit7 special-model | facing nibble] vs the glide-speed interim depth & 7 reading | facing wins; the two readings were two different ops | disassembly | doc |
| How an NPC's facing changes after spawn - snap vs ramp, and which writer wins | two laws; order-of-execution priority | disassembly | doc |
| dolk2/rikuroa MAN source (the "v12-embedded MAN" was an over-read) | streaming carrier | capture | doc |
kor-family op-0x49 flag window [0x138..0x13F] - what the 8 flags gate | Uru Mais warp-pad destination memory | disassembly | doc |
| Formation species limit - what the battle setup does with 3 distinct monster ids | [a,b,c] loads as [c,c,a] on half of all rolls, verbatim (three streamed blocks) on … | disassembly capture | doc |
| Super Art connectors and physical inputs - the tokenizer keeps the leading arrows | disassembly (FUN_801EED1C 0x801EF2EC..0x801EF858) + capture | disassembly capture | doc |
The runtime art-record chase - the +4 and the - 0x10 grid origin | record(c) = ((DAT_801C9360[char]) + 0x58) + 4 + (c - 0x10) * 0xD0, | disassembly | doc |
| How many damage-clamp shapes does the slot-B cast band use? | three. Of the 79 wrapper sites inside their own image, 70 cap live HP with sltu and kill, seven cap HP - 1 with sltu and can neither kill nor heal, and two cap HP - 1 signed. PROT 0910 picks its cap per hit from its own slash counter | disassembly | doc |
| Where does a capture-class cast get its damage constant? | baked into the module image as an immediate in its own tick body - there is no per-spell power row to patch | disassembly | doc |
| Which slot-B images touch more than one seat? | PROT 0927 (enemy row from ctx[+1]) and 0966 (whole table from ctx[+0]), and both are stagers - neither subtracts HP | disassembly | doc |
How do the 0x801CF56C capture-class arms reach a spell body? | through a per-image trampoline in six of them; PROT 0955 is a 20-word jump table serving six spells from one cell. PROT 0918 carries power 0x12 and 0949 0xC0 by register reuse | disassembly | doc |
| Where is the Spirit AP-halving flag? | character record +0xF8 bit 0x800 - accessory passive 0x2B (AP Used Down), tested at 0x801EF364 and 0x801D4520. Not a per-battle actor bit | disassembly | doc |
| Does an Attack x2 consume the Super Art starter? | no - the build loop marks an accepted art’s starter 1 and the Super tail-replace marks 4, and the compare at 0x801E3A4C is against 1 | disassembly | doc |
What is battle ctx[+0xD]? | two independent bits, not an enum: bit 0 adds 0x800 of yaw, bit 1 adds 0x80 of pitch and drops TR.y by 0x100. Nothing writes a Z angle | disassembly | doc |
| Do the dome’s hub screens run on frame counts? | no - DAT_801D1A80 and its siblings are 0..0x80 brightness levels, and the two holds end on pad & 0xF4 rather than on a timer | disassembly | doc |
| What makes a Ra-Seru chip render? | three gates in order - the member's chip byte, then +0x16E & 0x1000, then the special-battle word's 0x200 - of which only the third selects a mark; the three mark emitters are pinned cell by cell | disassembly | docs |
| What restricts a special battle's commands? | two writer families, not one: SCUS battle init keyed on the first enemy monster id, and the arena seeding the whole word from three story flags. Every seed bars the Item chip and the top seed bars magic, so the Master-course magic ban is real after all | disassembly | docs |
| What does a cast cost? | MP, not AP. The cast path writes the action queue and the phase and touches no AP field; the cost is the spell table's byte, discounted by the character record's ability bits | disassembly | docs |
| Which slot-B images write the actor stat block? | eight of the 64, not the four cells of one module - which is what made a stat-writing module look like an exception rather than a pattern | disassembly | docs |
| How many capture trampolines are there, and what keys a tick body? | 21 trampolines carrying 48 arms over 32 bodies, and a body VA is not a key - one address is a tick body in six different modules, so the seam is keyed on the pair | disassembly | docs |
| What are the battle applier's 132 selectors? | 116 of them are the shared epilogue, so there is no large undecoded opcode family above 0x0E; the one body up there is the Incense window's top-up | disassembly | docs |
| Which entry does the battle loader's VDF registration walk? | the vdf entry, not the player-character pack: the loader reads two entries contiguously, keeps the second half's base, and walks a flat [count][offsets] pack there - and its four TOC constants are the whole effect-data block, a different band from the character pack | disassembly | docs |
| What is the routine an earlier citation gave as the Point Card clamp? | the floating damage-number ring push - it writes a value, a seat and a zero into three parallel arrays at a cursor, then folds the cursor mod 8. It is what the one-HP cast calls to show its literal 1 | disassembly | docs |
| Which routine applies a player-Seru module's magnitude? | the tick body, not the stager - and in PROT 0910 one call deeper still, in the applier its tick reaches three times | disassembly | doc |
| Which player-Seru modules heal, and by what formula? | two. PROT 0905 (Vera) restores level * 0x20 + 0xE0 with a negated popup; PROT 0911 (Orb) restores (level << 6) + 0x1C0 over the party row. The input is the per-magic level byte - matched on the cast id in the record's 32-slot spell list - not a power byte, and everything else in the band subtracts | disassembly | doc |
| How many phase stores does a player-Seru body make? | between 3 and 10, counting stores through a formed pointer as well as at the literal displacement; eight of the eleven write the terminal 0xFF, and 0x801F69D8 is the tick arm for six of them | disassembly | doc |
What is actor +0x1DC at the cast band’s reaction sites? | a bitfield - two modules ori single bits in, two store small constants, and nothing increments it | disassembly | doc |
| What does PROT 0907 (Nighto) roll? | a kill roll (rand() % 8, zero kills, anything else confuses) and a resist roll - and the resist is forced, not rolled, for a boss carrying the monster record’s wide-model byte in a scripted fight | disassembly capture | doc |
| Which band routine allocates a battle seat? | PROT 0940 alone: it claims the next enemy seat, copies the monster-record pointer into the seat table and seeds the action bytes, then coin-flips one stat onto either the clone or the caster | disassembly | doc |
| What does PROT 0941’s enemy Steal take? | a bag slot by rejection sampling over the 256-slot bag - floored while battle seat 1 holds roster character 4, the split-bag condition - or, against a monster, an item off the same steal table the player’s Steal reads. No damage at all | disassembly | doc |
What does a cast module’s ctx[+0] count? | the party; ctx[+1] is the monster count. The group code below 7 is one seat, 8 sweeps the party row, anything else sweeps the enemy row | disassembly | doc |
| What escapes PROT 0906’s phase-5 dispatch hole? | the stager’s arm 2, which bumps the phase byte; the tick parks busy in a slot its own table does not serve until the stager runs | disassembly | doc |
| What is PROT 0904’s arm 12? | the swept quantity is an angle, not a radius: the accumulator passes a full 12-bit turn, so what moves per tick is the direction of a ±0x30 cone. The unsigned cone test admits both ends of the circle | disassembly | doc |
| What is PROT 0962’s arrival predicate? | it arrives when the test reads zero; a non-zero return holds the approach. The port’s doc had the sense inverted | disassembly | doc |
Is ctx[+0x287] the counter-attack byte? | no - it is the scripted-fight flag, derived at battle init from bit 0x80 of the per-battle flags; the counter-attack byte is +0x288. Two audio-duck arms and the attack-return arm gate on it | disassembly capture | doc |
| What gates each player-Seru arm’s dwell? | measured per arm from casts driven off pre-cast states - and it is not one constant per arm: PROT 0907 holds 8 of 16 arms identical across two fights and moves the other 7 | capture | doc |
| Do the Seru debuffs and the encounter boost profiles reproduce live? | yes, at measured magnitudes - a level-9 debuff takes ATK 17 to 14, and both boost profiles reproduce off live fights. Vera at level 3 restores 320 and Orb 640, matching their closed forms exactly | capture | doc |
| What does the dome tally screen draw? | six rows with the HP accumulator between lanes 2 and 3, at four brightness steps rather than six, and the brightness argument goes in unclamped - the 0x100 cap belongs to a sibling emitter no tally row calls. The lane base is re-formed into a different register between the product and the store, which is what mis-attributed the lanes | disassembly | doc |
| What does the dome arena seed the special-battle word with before any story flag matches? | 1 - course 0 with no bans, a seeded word rather than an untouched one. The register is loaded 43 instructions and three calls earlier | disassembly | doc |
Is 0x801F69D8 a routine in PROT 0943? | no - it is the five-word head table the body at 0x801F6A04 bounds and jumps through, and the MP-pair stores are inside that body. Citing the base as the writer names the table that points at the writer | disassembly | doc |
Is the monster record’s +0x20 a per-monster death-immunity byte? | no - a double-width texture-page flag: its primary reader widens the model’s VRAM rect, and 37 of 186 records set it. Three summon ticks borrow it as a "big model" resist proxy, which is what made an upload flag read as an immunity list | disassembly | doc |
| Where does a slot-B module image's highest spawn record end? | its own move-VM program bounds it - walk to a terminator, round the end up to 4, let HALT outrank an armed idle loop, chain [header][program], and fall back to the last maximal WAIT | disassembly | doc |
| What are Enemy Steal's acceptance tests, and what does the consume touch? | a third test on the item's shop price (96 of 256 ids unstealable), and a consume that scans only the active window and returns a sentinel outside it | disassembly | doc |
| How large is the item bag, and what bounds a reader? | 256 slots behind an active window one setup routine writes; a 72-slot bound is a cheat page's display page and drops 88 items off a real card | disassembly | doc |
| What gates each capture-class arm's dwell? | measured for twelve of the fourteen trampoline arms; the drain is a per-arm multiplier of a scratchpad frame byte, not one product shared by the band | capture | doc |
| Is the battle loader's model-pack pointer sane at battle time? | no - the battle load reuses the block, so it is garbage in 61 of 61 battle states and sane in 37 of 37 field states | capture | doc |
| How does the character-pack loader size its section buffers? | from the container header, and the decode is length-driven by the descriptor - so a rebuild with a different decoded size gets a truncated pack | disassembly | doc |
| Is the staged background loader one walk or two? | two dispatchers picked by one word - a 19-arm field-restore table and a 12-arm panel-still table, both starting at phase 2 because the SCUS sequencer owns states 0 and 1 | disassembly | doc |
| What are PROT 1221 and 1222? | the party's ringside reaction pair, cheering and dejected, chosen from the lead character's live HP | capture | doc |
| Which battle state owns the only arm that reaches the high cue band? | the Spirit / Item wait state, and an ordinary item use is the door - the magic command routes into it only for ids below a threshold the player's Seru block sits above | disassembly + capture | doc |
What is the != 4 term in the battle selectable scans? | a seat: the per-slot table it reads holds roster character ids, and 4 is the AI-companion seat the player does not command | disassembly | doc |
| What is the auto-command string pair in a character record? | a staged command queue and its backup, chosen by a stat comparison under one gate; the primary leg falls back to an earlier band on an empty head, the secondary zero-fills with no fallback, and the write-back overwrites exactly one of them | disassembly | doc |
| What writes the slot-B stage selector? | the field entity tick, off a system story flag; battle latches the other value directly. Every access is register-relative, invisible to the project's address sweep | disassembly | doc |
| What are the two archive entries above the cast band? | the two boss-stage modules - one function each, a phase machine driving the first monster seat: one stages the arrival, the other the form transition that drops the seat to 1 HP | disassembly | doc |
| Is the dome's match state machine the dome's? | no - it is the round SM every battle runs; one unconditional call site disc-wide | disassembly + capture | doc |
| What draws the dome panel still? | two textured quads in the contest hub, addressed by texture page rather than by pixel column | disassembly + capture | doc |
| What raises the still's fork? | the arena init, on re-entry - never the match teardown | disassembly + capture | doc |
| What does the victory drop roll do? | at most one item per battle: every enemy rolls, the last winner decides, and three times in four nothing drops unless a chance is 100% or Items Up applies | disassembly | docs |
What is FUN_801E91E8? | the Seru absorb's "already learned?" check, not a Miracle-command lookup; the byte beside it holds the absorbed Seru, taught in the same action | disassembly | docs |
What is monster action tag 0x22? | a knockout taunt, played when a monster downs a target while a party member still stands; 180 of 186 monsters also lack the pre-approach tag and take the short step | disassembly | docs |
Field / locomotion
Town and dungeon scenes: locomotion, doors, story-flag gates, ambient animation, NPC facing and the field-VM event scripts.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
Who marks a field NPC as a walker (+0x10 & 0x20000)? | the placement seater, for every placed NPC, plus one field-VM op at 26 spawn prologues - and nothing on the disc ever clears it | disassembly capture | doc |
What does FUN_801D79E8 do? | it is the per-actor visibility cull: an NPC outside the camera's visible tile window or the region box gets a bit that holds its height; 600 of 600 captured decisions reproduce | disassembly capture | doc |
| What makes the place-name banner appear? | a one-shot story flag (system flag 2) that the overworld entrance scripts raise before the scene change and the scene loader clears after showing the name | disassembly capture | doc |
| What happens, tick by tick, when you use a Door of Light or Door of Wind? | the pause-menu session fades out and hands over to the Riremito / Rula travel art, which runs its effect, fades to black and loads the destination; a Door of Light goes to the region's recorded exit, not to where you last stood | capture disassembly | doc |
| What does a region's battle-setup byte choose? | the battle backdrop, whether the Door of Light / Wind items work, whether one backdrop object stays, and a world-map return point | disassembly | doc |
| What happens when you step on an in-scene warp tile? | a timed warp: a fade out and back, the landing 38 frames after the crossing, the pad back 40 frames after that - and the player stands idle throughout | disassembly capture | doc |
| Where does an inn conversation end? | when its last page closes; the next talk starts from the loop-back and its halt succeeds | capture disassembly | doc |
Why is a kor5 flag set on entry but clear after the chain? | the write sits in a record's spawn section, which runs once per scene load and not on a same-scene reload | disassembly capture | doc |
What does field op 0x3E do with a first operand below 100? | installs a scripted battle from the scene's formation table - the same body as the 0xFF form; talking is a button press, not this opcode | disassembly | doc |
| How many places re-roll the random-encounter step counter? | five - four calls and one inlined copy - all into one counter that survives doors | disassembly | doc |
Does the kor5 chain write its tail flag without help? | yes, a few thousand frames after the previous beat clears; the earlier 17,500-frame estimate was the probe's | capture | doc |
Which ctx does op 0x23 MOVE_TO move? | the one the ctx pointer names (0x801DEC7C vs _DAT_8007C364), not the class-flag bit a spawned record inherits | disassembly | doc |
| Which screen opens menu window 46? | the casino prize counter's Yes / No confirm (script 0x801E4F2C, sub-screen 0x20, entry-context kind 7) | disassembly | doc |
Which prescript copy does FUN_800252EC install from? | the next PROT entry, through the efect.dat window one sector past the .PCH; there is no split | disassembly | doc |
| Rim Elm's south gate - why a seated player exits and a walking one does not | resolved | disassembly | doc |
| Town/field free-movement locomotion | resolved | capture | doc |
| Field ambient animation - what makes jou's ground pulse and the water shimmer | resolved | disassembly | doc |
Ambient render-mode 4 - what the op-0x1E seat animates | resolved | disassembly | doc |
| Master ambient record 0 - what reads the 8-byte rows | it is not a stager record at all | disassembly | doc |
| town0e's morph-record installer | the census was shape-blind, not the disc | disassembly | doc |
Which op-0x34 sub-3 installs fire at scene entry | resolved | disassembly | doc |
| Scene bundle type-7 slot content (VDF) | resolved | disassembly | doc |
| VDF morph render substitution - what draws the staged vertices, and what arms the lanes | resolved | disassembly | doc |
| What opens an inn stay in retail? | the premise was wrong | capture | doc |
| Field collision-map source | headline corrected: the .MAP supplies the base grid | disassembly | doc |
| Tile-board grid mode | resolved | disassembly | doc |
| game_mode 0x03 = field/town gameplay | resolved | capture | doc |
| Scene prescript: field-VM event scripts vs move-VM stagers (dual consumer) | resolved | capture | doc |
What is the scene_asset_table header's +0x04 word? | the sum of the descriptors' decompressed sizes, in all 105 containers; retail never reads it | disassembly | doc |
How does a scene bundle reach _DAT_8007B85C? | a whole-sector block copy (FUN_8003D26C at 0x801D6918) into the 0x62C00 arena | disassembly | doc |
| What consumes the "field-pack" entries? | the scene texture pack at block +4: FUN_800255B8 paths it by mode, FUN_8002541C walks it; the format itself is dissolved | disassembly | doc |
What do the asset-table Flag(0x0A / 0x0F / 0x14) descriptors do? | they are the streamed-file loader's mode argument (case << 8, ORed by the walker, shifted back by the caller) | disassembly | doc |
| Engine VRAM byte-exactness for town01 | major source); minor residue | capture | doc |
CLUT row 510 population (env meshes' (64,510) CBA) | boot-resident system-UI strip band); residue = the exact boot walker call site | capture | doc |
Scene-transition (0x3F door) destination indexing | resolved | capture | doc |
| Intra-town (house / interior) door mechanism | resolved | disassembly | doc |
| Field/town environment-geometry placement | renders | capture | doc |
| Overworld / town entrance story-flag gating | resolved | capture | doc |
Overworld story-conditional destination (dolk→dolk2) | mechanism + engine port | capture | doc |
| Retail-vs-engine NPC + story-flag state parity across the capture library | breadth oracle); residuals filed as their own rows | capture | doc |
Entry pre-run channel slice ends on a no-mask 4C 70 wall paint | slice-continue landed | disassembly | doc |
Writer of the Rim Elm opening flag (549) | self-latching script SET; the census was width-blind | capture | doc |
Field .MAP PROT resolution - which entry holds a scene's map | census-pinned; engine resolver corrected | capture | doc |
| World-map CLUT cycling beyond the ocean head | closed (operand table + emitter + cadence pinned | capture | doc |
init_data UI-tile page residency; the map03 terrain column | both premises falsified | capture | doc |
| What transitions retail into game over? | resolved | disassembly capture | doc |
| Mid-visit NPC re-arrangement beats (dolk2 market crowd; garmel pre-Zeto staging) | resolved | disassembly capture | doc |
| Region story-flag gate families (record-header C1/C2 gates) | as structure (play-order residual on the open page | capture | doc |
Extraction-0874 §2 (player.lzs) F-variant pixels | installing event named | disassembly capture | doc |
| Which chapter-1 scenes the engine can load, script, walk and leave | a per-scene verdict over a 68-scene closure; four of the five late "one-way" rooms now leave in-engine (urudre2 is a port limit) | disassembly capture | doc |
Why did the port drop roughly half the disc's 0x3F destinations? | the clean-label gate was lower-case-only; retail just strcats the operand into an ISO path, and the disc's upper-case destinations are all real CDNAME labels | disassembly | doc |
Why do bubu1 and edbubu resolve no MAN? | both ship a count = 5 asset table, a retail shape the detector's 6-or-7 bound hid; retail bounds the count nowhere | disassembly capture | doc |
| Why did 28 scenes of the frontier closure become unwalkable at once? | a scene change mid-ledge-hop leaked the hop's one-way steering lock 0x0008_0000 - an engine bug retail cannot reach, now fixed | disassembly capture | doc |
How a player leaves the Uru Mais chain (uru, urudre1..3) and jouine | all five have walk-on exits carried by the scene's .PCH trigger sidecar; jouine's is the FMV hand-off; uru's fired live | disassembly capture | doc |
| Who latches the clip-end bit for a conversation's cross-context clip pokes | port residual named | disassembly capture | doc |
What the op-0x49 entry-context kind byte is, and which screens it selects | disassembly + disc measurement - | disassembly capture | doc |
What does the 0x801F2858 template’s tick do? | the scene shutter blackout (FUN_801DD784) - two bars ease in and meet. Its one spawner is FUN_801DE754, from field-VM op 43 0C | disassembly | doc |
What is field-VM op 0x4C nibble 9? | the scene floor-height ladder at 0x1F80035C - sub 0xE installs all sixteen rungs, subs 0..2 oscillate one, sub 0xF retires them. Not a fade family | disassembly | doc |
| How does the shop’s buy list order and ink its rows? | the last three rows are hoisted to the top tagged 0xA000 (ink 5); everything below the split stages at 0x801C6220 tagged 0x3000 and is appended. A row dims when purse < price or held >= 99 | disassembly | doc |
| What keys the menu entry-context byte? | the record kind: 0x00 shop → 0x1A, 0x01 save → 0x19, 0x07 casino → 0x20, sentinel 1 → 0x02, the dev character editor | disassembly | doc |
| teien's hedge-base ground fill - does retail draw a kind-2 cell? | no, and the question had a false premise: a live field pass emits one quad per 0x1000 cell and none for the 42 cells that carry only the platform bit | capture | docs |
Actor +0x16 - heading, facing, or footing? | Y. Three doc readings collapse into one: nothing on the disc masks the halfword as an angle, so the routine that eases it is settling a height and not a heading | disassembly | docs |
| What writes a scene's kind-2 trigger cells at runtime? | exactly one arm of the field VM - a rectangle re-floor. Trigger kinds 0 and 3 have no writer at all, and the sidecar's fixup words have none either | disassembly | docs |
| The ending-scene widget family - how many sites, in how many scenes? | 311 sites across ten ending scenes. The census field it had been counted on is a cross-context target marker, not the sub-op | disassembly | docs |
What arms _DAT_8007B8B8? | nothing retains it - it is a one-shot entry-mode argument, ten writers and 25 readers across 84 images with six sites writing zero, so the ambient template spawns per scene. Its two neighbours have no writer at all | disassembly | doc |
Which way round is actor +0x8A bit 0? | it suppresses the scripted motion VM: a zero byte runs the bytecode, and the bit gates the player-engaged / actor-busy / off-map early returns | disassembly | doc |
What are motion ops 0x06, 0x0C and 0x0E? | a home-relative one-tile wander, a tint and draw-mode fade, and a two-base model bind - not a pad echo, a glide channel and a single base | disassembly | doc |
How do motion ops 0x10/0x11/0x12 address their target? | one selector over five halfwords, with a fourth encoding that asserts a magic constant and then dereferences null. The op table’s last six slots point at the loop test, so 26 op bytes cover 24 bodies | disassembly | doc |
| Where does a field actor's heading live? | it is the middle of a rotation triple at +0x24 - the updater hands the whole vector to the rotation setter, so pitch and roll ride beside the yaw | disassembly | doc |
| What is the field-VM word the port called an input lock? | the ambient-particle master gate - one opcode's sub-0 raises it and sub-1 clears it, and none of its six disc-wide references is pad state | disassembly | doc |
| What does a field submode return to? | nothing reads the parked word - the executable and all 86 extracted overlay images yield zero loads at that displacement, and a live read watch records none while the pointer still names the scene struct; the park idiom itself tiles the field overlay 22 times | disassembly + capture | doc |
| Does the field passive-ability badge column have a suppress gate of its own? | no - its routine has one caller, inside the party readout just above the epilogue the readout's suppress arm jumps to, so the badges carry the readout's suppression exactly | disassembly | doc |
| What do the fishing bite tick's two per-frame map reads do? | one gates water and feeds the bite credit; the other drifts the lure sideways over an obstructed sub-cell, signed by the lifetime cast counter | disassembly | doc |
| Which way does an obstructed sub-cell drift the fishing lure? | by the cast counter's low bit - 447 additions all on an odd counter, 502 subtractions all on an even one, zero violations over 949 forced executions; at the catalogued venue the probe never fires, so retail's lure does not drift there | capture | doc |
| What writes the fishing cast counter? | the bite tick itself, through the save-block base rather than its own address, once per hooked fish - so the drift direction alternates between casts | disassembly | doc |
| What consumes the fishing bite tick's per-cell fish weight? | it is the modulus of the caught fish's size roll, and the same value plus a constant becomes the spawned object's render scale - it touches neither the species roll nor the bite credit | disassembly | doc |
| What is the Baka Fighter blit-rect table? | exactly two records, both the same size and both blitted to one fixed destination; it is the last initialised data in its overlay, so an index past the second reads the destination's own column back | disassembly + bytes | doc |
| What is the equip compare panel's category byte? | the accessory passive index - the panel shows the three stats that passive moves, and the two lookup arms split the item space cleanly | disassembly + capture | doc |
| What is the equip browse row’s index space? | a two-table slot map, not the equip-byte index: row 0 is the weapon row and reads a per-character byte from its own table, rows 1 and up index a second one - weapon, helmet, body, footwear, then three accessory slots | disassembly | doc |
| Does retail's equip screen offer a Goods-slot candidate, and out of which id space? | yes - the screen has two candidate families, and the three accessory rows reach builder cases whose filter is the item's class plus one effect byte, with no character mask; 80 of 151 candidate ids pass on the USA disc | disassembly + measurement | doc |
| What does the shop quantity window print? | quantity over bound, not quantity times price - the second number is the purchase bound the picker fills, the glyph between them is a separator, and the price appears once in the running total | disassembly | doc |
| How does the list-reorder screen exchange two rows? | a two-press latch carried in one cursor word: one bit means nothing is latched, a confirm stores the hovered row and clears it, the next confirm swaps and re-raises it, and a cancel with a latch pending only drops the latch | disassembly | doc |
| Which equip byte is the Ra-Seru slot? | per character, out of a three-entry table that is the exact complement of the weapon table - so neither is a constant across the party, and reading either as one gets a character wrong | disassembly + bytes | doc |
| Is the equip browse map's byte run one table or two? | three tables and a pad byte | disassembly | doc |
| What retail's equip candidate step draws | three stacked panels; the compare category follows the hovered item, not the row | capture | doc |
| Where retail enters the list-reorder screen | the pause menu's Status row - one writer disc-wide; only two of its three lists have a door | disassembly + capture | doc |
| Does retail's wall slide fire in ordinary play? | yes - and the oracle that blocked the port was measuring agreement | capture | doc |
| Is the camera's visible-tile window a property of the scene? | no - of the region; one town walk alternates between two windows | capture | doc |
| What clears the two halt bits an inn conversation sets? | the conversation's opening op, read again by the walk kernel as a twenty-frame "turn to face" order; its last frame clears both bits with the box already open | capture + disassembly | docs |
| What does Incense do? | stops random encounters outright for a window of walking steps - 0x40 walk ticks per use, capped at 0x100; the Use list greys it near the cap | disassembly | docs |
| What is menu window 8? | the notice a Hyper-Art book raises when an art is learned, not a generic notify window | disassembly | docs |
| When does Baka Fighter book an exchange? | on the frame the winner's strike keyframe is crossed; a special attack halves both fighters' animation speed for the round and leaves a two-ghost afterimage | disassembly | docs |
| Who is Baka Fighter's round-start cameo? | the ring girl (scene model 3), who walks on only while Triangle is held and winks at the pose | capture + disassembly | docs |
Text / fonts / dialog
The dialog font and the inline dialog-box encoding.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
| Does the USA dialog font have accented letters? | yes - 32 of the high cells carry glyphs (CP437 order, one stretch shifted a cell), and most of them have zero width so they print over the next letter | capture | doc |
| When does a dialog choice menu open, and can the game press for you? | only on a confirm press at the end of the prompt; a script-set countdown can make that press for the player | disassembly capture | doc |
| What ends an NPC talk? | the dialog SM's verdict on the byte after a box: a jump or opcode parks the cursor, and the next talk runs it | disassembly + capture | doc |
| What draws the battle command chips' words? | text strings in the executable, pointed at by each chip's placement record - translatable, not icon art | disassembly | doc |
| Do the PAL builds keep the narration crawls' page counts? | no - they reflow into more pages with blank pages between paragraphs | disassembly | doc |
What does PROT 0892 (card_data) carry, and who loads it? | the memory-card screen's JIS X 0208 level-1 kanji font - a two-member pack of 4bpp TIMs loaded by FUN_8002574C at CARD INIT; not 12 MB, not a truncated stream | disassembly capture | doc |
| Dialog font extraction | done - kept for reference | capture | doc |
Inline dialog-box format (0x1F-lead segments) | init-arm count corrected; session-end semantics open | disassembly | doc |
| Tetsu 4-option spar menu mechanism | resolved | capture | doc |
| Pause Items/Magic screens: remaining sub-flows | dim-bit residual closed | disassembly capture | doc |
| Which routine samples the card-screen kanji page? | none - a GPU-FIFO watch at card-screen entry draws nothing from it, and neither of the two constants a sampler would need appears anywhere on the disc. The build ships the Japanese glyph page and never reads it | disassembly capture | doc |
| What is the battle plaque’s element badge, and how is it selected? | a caret escape inside the monster’s own name - badge index is letter - 'A' over the strip 0x8B..=0x92, element to caret is the fixed permutation [4, 3, 0, 2, 1, 5, 6, 7], zero exceptions | disassembly | doc |
Animation
Player and NPC animation streams.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
| Player ANM per-record layout | byte-4 nibble corrected | disassembly | doc |
| Battle anim-id space + record[0] "strike family" | resolved | capture | doc |
FUN_80047430 caller | resolved | capture | doc |
Record[0] +0x5C pointer + art-anim bank stream source | +0x5C = vestigial paired-relocation | disassembly | doc |
Audio
SEQ / VAB playback, the SPU transfer engine, BGM selection and the battle voice cues.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
| What plays when a script asks for a scene-local track? | a fixed fallback track from the shared music bank - the loader overwrites the scene-block index it computed, and retail never stages a scene bank | disassembly capture | doc |
| Where does the credits bank go in sound RAM? | over the resident sound-effect banks, from the same base as slot 0; retail never reloads them afterwards | disassembly | doc |
| How does a Muscle Dome round enter battle mode? | the arena stores mode word 0x14, so a round takes the battle arm of the bank switch | disassembly | doc |
| Which field scripts push sound effects? | two opcodes, with the cue id straight from the script; the scene's own bank serves the high ids | disassembly | doc |
| What does a cue whose bank is closed play? | nothing - the driver skips it; it is never played from another bank | disassembly | doc |
| Who sets the minimum frame step? | each mode's init, and a scene's own script - the opening scene raises it to 3 | disassembly capture | doc |
FUN_8003EAE4 - seek plus driver flags, or a stream start? | a seek plus bookkeeping; the CD-callback sequencer is FUN_8003D764, driven by gp+0x928 which only FUN_8003D53C writes; two of the three flag cells are write-only | disassembly | doc |
| What a normal party attack sounds like | an ordinary swing emits neither cue (four captured swings fail the s7 gate); the grunt is the +0x1F3 reaction-commit arm; the sting only when the effect handle _DAT_8007BD84 is non-null | disassembly | doc |
| SPU reverb live routing (C7-REVERB) | wired; Studio C, global | capture | doc |
| XA channel map / STR demux SM | static decompile of PROT 0970 + SCUS | disassembly | doc |
FUN_80018DB0 is a rumble cadence, not an audio one | libpad, not SsAPI; no cue to pin | disassembly | doc |
| Key-on pitch: what does retail put in the voice pitch register? | unity on centre; the port was an octave low | disassembly | doc |
| SFX cue bank routing - the category byte selects the VAB slot | mechanism + the two pinned banks; ported | capture | doc |
| Which PROT entries fill SFX VAB slots 1 / 3 / 6 / 11 | slot 6 = 0876, slot 11 = 0889; 1 / 3 are variable banks | disassembly | doc |
The FUN_8006EF18 trio is a BIOS kernel-patch sequence, not an SPU init | negative | disassembly | doc |
_DAT_8007B910 is the live audio level, not screen brightness | both hosts' labels corrected | disassembly | doc |
XA clip-table writer + (clip_id, chan) cue census | writer pinned statically; census in audio.md | disassembly | doc |
| Hyper Arts fanfare selector - what audio fires when a Hyper executes | per-(char, art) coin flip over a fixed channel pair of the even-slot fanfare bank | disassembly | doc |
Op-0x35 sub-op 0xA - what the "unhalt-pause toggle" waits on | it is the track-swap commit; both globals pinned; ported | disassembly | doc |
What do bse.dat's record columns mean? | the static SFX-table columns; +4 is a u8 category the cue router rewrites per cue | disassembly | doc |
Who consumes the bse.dat record-table pointer gp+0x678 (0x8007B990)? | the cue router FUN_8004FE5C and the overlay-0971 sound test, via lui+lw pairs the word scan cannot see | disassembly | doc |
When does bse.dat load? | battle-scene setup - FUN_8001FA88's only caller is battle init FUN_800513F0 - not boot | disassembly | doc |
bse.dat 888 vs its 1195 sibling | one format, two occupants of the >= 0x200 bank role: 888 in battle, a scene prescript's record 0 in the field | disassembly | doc |
Is there a second bse.dat record family past the table? | no - a neighbouring file's PsyQ VagAtr tone rows left in the sector (888's tail equals 886's and 1063's; 1062's equals 1056's) | capture | doc |
What is _DAT_8007BA9C? | the BGM-swap force-reload latch, read at 0x8002457C and XOR-paired with _DAT_8007BAB8; the barrier op-0x35 sub-op 9 waits on | disassembly | doc |
What is FUN_80065034? | SsUtKeyOnV(voice, vabid, prog, tone, note, fine, voll, volr) - the second argument is the VAB id, which makes a cue’s bank explicit rather than implied by the resident one | disassembly | doc |
| Which voice clip does a Seru cast play? | the module names it, not the caster - 62 of 64 images hardcode a literal cue id, resolving to seventeen streamed-audio files | disassembly | doc |
| What bounds the cue dispatcher's streamed-voice leg? | two decline gates and nothing on the table index; the table is 0x110 entries with live rows to 0x10F, so a reader stopping at 0x40 drops every cast cue | disassembly | doc |
| Which tracks do the in-world minigames start? | three loader entries through the piecewise extraction map; subtracting a single base gives three wrong tracks | disassembly | doc |
| What does the sequencer's pause do to sounding notes? | it is a key-off, not a freeze - a slot flag the per-tick handler sees releases every voice the channel owns, and only the play cursor survives | disassembly | doc |
| Where does a scene's entry music come from? | the scene's own script, not the loader - of the request word's four writers disc-wide, the per-scene initializer's is a conditional clear | disassembly | doc |
| What makes a captured sound voice audible? | its envelope level, never its phase word - the phase has no idle member, so a key-off parks a voice in release and a phase test counts every voice a state ever keyed; 1624 of 2352 slots across the retail corpus sit at level zero | capture | doc |
| Why do two identically-shaped table expressions disagree? | they use different index spaces: the archive table is read into RAM from byte 0 with its header included, so the runtime index is the extraction index plus two | disassembly | doc |
| What is the reserved music-request value? | a park sentinel shared by both streaming slots, not a track | disassembly + capture | doc |
| Does a save state's scene decide which track it holds? | no - a global does, so a town save walked in from the world map still plays the overworld | capture + disassembly | doc |
| Retail's reverb depth and work area | measured, and outside the preset block - matching the preset says nothing about them | capture | doc |
| Is slots-per-note a difference between the port and retail? | no - it is a property of the arrangement, and the sign reverses with the track | capture | doc |
| Does a Muscle Dome round load the battle sound bank? | yes - a round closes the field bank's slots and stages the class-2 bank, as any field battle does | capture | docs |
| What does the scene-stream installer's type-2 chunk install? | the music score (a SEQ open), carried by every stream with a score; no chunk type is a texture upload and none is compressed | disassembly | docs |
Title / boot / overlays
Boot order, the title screen, the save screen, and which overlay is resident when.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
The title menu's law (FUN_801DD35C sub-mode 0x10) | two rows, confirm 0x844, cues 0x21/0x20, 0x5DC attract countdown; ported on both hosts | disassembly | doc |
FUN_801D71F0 and its "shared armament placer" 0x801E5AE8 | one routine, FUN_801E5A08 (0897 +0x171F0), printed 0xE818 low; unreferenced on the disc | disassembly | doc |
Save-screen view mode 4 ("Return") | dead - the block grid has 15 cells and every cursor path is clamped | disassembly | doc |
Does FUN_801CE9C0 pin the per-logo quads? | no - it uploads; the quads are a six-record sprite-descriptor table at 0x801F369C, emitted by FUN_801CFBB8, sequenced SCEA, Contrail, PROKION by FUN_801CEFD4 | disassembly | doc |
PROT 0895 (init.pak) identity + base | slot A 0x801CE818; mode 16's whole body is its FUN_801CE9C0 (the publisher-logo pass), 20 functions closing byte-exactly ahead of the first TIM | disassembly | doc |
_DAT_8007B8C2 polarity, and its writer | docs were backwards | disassembly capture | doc |
Actor-VM (FUN_801D6628) program source - which carrier, what selects one | menu-overlay-resident program table | disassembly | doc |
title.pak PROT entry | resolved | capture | doc |
| Title screen mode-table PROT | no row is named for it, but it runs under the CARD mode pair 22/23; FUN_801DD35C is PROT 0899 +0xEB44 | disassembly | doc |
| Load-screen panel 9-slice geometry | engine renders byte-perfect | capture | doc |
Key-item area consumers (0x800859E8..0x80085A40) | narrow negative; the reader enumeration is closed (125 sites over six images; PROT 0954 reads the whole bag with no window) | disassembly | doc |
| XP-table source + reader | ported | capture | doc |
New-game world-state seed store widths (FUN_80034A6C) | port confirmed, no change | disassembly | doc |
| Overlay identity from the disc (static extraction) | pipeline landed | capture | doc |
| SCUS recomp gap - render/GTE + boot/init clusters | aliases + libgte residue + dev tooling; main() documented | disassembly | doc |
| Options/menu overlay PROT entry | RAM-verified; PROT 0899 @ 0x801CE818 | capture | doc |
PROT 0896 (bat_back_dat) identity | resolved | capture | doc |
| Slot-A scene-overlay family beyond field/battle/menu | in the static map | disassembly | doc |
| "world-map / save / shop" overlay PROT entries | not separate entries | disassembly | doc |
| PROT 0977 / 0978 extraction + the dump re-key | resolved | disassembly | doc |
Slot-B capture-module band 0935..0966 per-entry identity | statically derived, capture-corroborated | disassembly | doc |
| Phantom-VA sweep of the PROT 0897 imports | resolved | disassembly | doc |
Debug flag 0x8007B98F | the MSB of the debug-mode word _DAT_8007B98C | disassembly capture | doc |
| New-Game opening chain + narration roller | chain + caption + roller + prologue gold grade; far-geometry residual resolved-negative | disassembly capture | doc |
| Overlay-loader index off-by-2 - remaining ripple | slot A reconciled; slot-B per-spell identity capture-pinned | disassembly capture | doc |
Slot-B overlay cluster (0900..0969) per-entry identity | for every entry | disassembly capture | doc |
| PROT 0968 - what it is, who loads it, and how big it really is | identity and extent by disassembly, residency by capture | capture | doc |
0x80010390 - the SCUS word that looked like a lead on 0968 | : it is the slot-B overlay destination pointer, shared by every slot-B entry | disassembly | doc |
| Muscle Dome match shape: an ordinary battle ladder, not a card battle | disassembly - | disassembly | doc |
| The dome runs two state machines; the outer one is the contest | disassembly - | disassembly | doc |
| Battle arts-input UI decomposition (dome = standard battle input) | capture - the input screen's full piece decomposition + | capture | doc |
| Full-window item-add OOB reachability | the write primitive is real; normal play cannot reach it. | disassembly inference | doc |
Which title sub-mode does a cold boot show - 0x02 or 0x10? | 0x10, always: the boot init.pak raises _DAT_8007BB00 unconditionally at 0x801CEB84, and the tick’s own epilogue rewrites a surviving 0x02. A per-vsync cold-boot poll never observes it | disassembly capture | doc |
Does anything draw the init.pak WARNING screen? | no - the TIM is uploaded to VRAM (704, 0) as descriptor 1 of the 0x801F369C table and no call site passes that id; the build loads the screen and skips it | disassembly capture | doc |
| Which mode does the retail title screen run under? | the card mode, not the mode a trace sees first. The front end is six stores, each written by the handler that hands off rather than by a field of the mode table | disassembly | docs |
| What does a mode-change edge clear? | four gp words, not three; two neighbouring words are mode copies and are not cleared | disassembly | docs |
| Which of PROT 0978 / 0979 / 0980 is the dance overlay? | only 0980 - 0978 is the staged background loader and 0979 the battle-intro image | disassembly | doc |
| Where does PROT 0896 link? | at a base its own call graph recovers - and it calls no function entry of this disc's executable | disassembly | doc |
Rendering / camera
GTE projection, camera beats, the backdrop draw and VRAM parity.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
| Which Muscle Dome hub graphics blend? | only a few palettes on one CLUT row, and they add; the "subtractive" packets draw opaque because the GPU blends only texels with the STP bit | disassembly | doc |
| In what units is a field light's size? | camera space, six times world scale - two retail darkness masks match it exactly | capture disassembly | doc |
| Why did the Mist forest's fog not show in the native window? | the effect-texture pool the fog page samples was missing under the scene's video memory; retail keeps it resident | capture + disassembly | doc |
| What sets the field-fog cap? | a scene-header bit - every overworld and one opening scene raise it; it is not a debug switch | disassembly | doc |
| Does any retail shot author a non-zero camera roll? | yes | disassembly capture | doc |
| Does retail stack coincident curved shells? | no | capture | doc |
FUN_80045BB4 - a function entry, or interior residue? | the bank-3 kind-19 textured Gouraud quad handler; word 12 of the table at 0x8007668C is what makes it reachable, since no jal names it | disassembly | doc |
How does PROT 0901’s 0x801F7644..0x801F8EB4 band split into routines? | nine - eight frameless tail-call leaves plus a framed ninth at 0x801F89B8. The boundary rule is the j that leaves the band: twenty sit in it and only eight leave | disassembly | doc |
| Which base does the world-map overlay’s per-prim handler table use? | 0x801F8968, words 0..7 zero - FUN_80043390 materialises it with lui s4,0x8020 / addiu s4,s4,-0x7698 and indexes it exactly like the SCUS table 0x8007657C | disassembly | doc |
Does FUN_8002C69C draw the post-battle report windows? | yes - PROT 0898 contains no jal to it, but SCUS FUN_80031D00 drives it off the retained widget list every frame a battle is up (36 SPRT nine-slice cells, CLUT 0x7FC2, tpage 0x1E) | disassembly capture | doc |
What is FUN_80019D50? | the CLUT-cell HSV cycler - one LoadImage at 0x8001A030 per call and no primitives; jou’s pulsating flesh and the lightning | disassembly | doc |
| Which arm lays the post-battle report's nine-slice? | style 0x03, kind 0, tile set 0 - eight tiles byte-identical to a captured 36-sprite band, all 782 emits arriving from one caller. The "that fight carries no report band" reading fell with it | disassembly | docs |
FUN_80058490 - a sound-driver lane? | no: it is MoveImage, moving a VRAM rect onto a CLUT row - so the table feeding it holds palette columns, and two consumers were reading those bytes as sound-effect ids | disassembly | docs |
| Which routine draws the world-map / field ground pass? | PROT 0900 ships a pair, not one emitter twice: the two bodies differ by two instructions, one running the GTE depth cue and storing its colour register where the other stores a plain colour word. The selector's non-zero arm sets the far colour first. The decoration pass is a third routine on a different cell bit | disassembly | docs |
What order does RotMatrix compose? | Rx(vx) * Ry(vy) * Rz(vz), walking the cos and sin table pointers. Composition order is the one thing a capture of a single rotation cannot distinguish | disassembly | doc |
| What does the scene-entry camera reset write? | six stores - an eye triple and an angle triple - and it never touches the camera height, so a port resetting H there adds a store retail does not make | disassembly | doc |
| Is the field follow camera's framing one set of constants? | no - retail derives height, pitch and yaw per scene and per player tile; the pins match 12, 8 and 1 of 19 walkable states | capture | doc |
| What stages the dance widgets' second texture page? | nothing in the minigame's container: it is boot-resident interface art from the archive's unindexed head gap, and both members declare their rect in their own header | capture | doc |
| Which of a field frame's view builds does the drawn geometry use? | the first: of 4289 polygons over three runs, 3861 sit under it, 428 under the second and none under the last or the world-map pair - the last build's whole share is attribute packets and flat rectangles | capture | doc |
| Which routine draws a field or world-map actor's mesh? | three arms of one bracket: every call site of the table-driven renderer is the far arm of a test on one per-actor halfword, and the near arm takes the environment-mapped renderer when a second flag is set, the per-primitive leaf otherwise | disassembly | doc |
| Does any sampled mode enter the table-driven mesh renderers? | no - 720 frames over four states and three game modes give zero entries into either, against 5089 gate reads all of them zero and 10621 entries into the per-primitive leaf | capture | doc |
| Does the disc ship writers of the mesh-renderer gate? | yes, two families - one behind a dev counter, one a move-VM opcode carrying script data | disassembly | doc |
| Which emitter does effect render mode 4 take? | always the default - no store on the disc writes either selector bit | disassembly | doc |
| Is a field fog sheet a world-space quad? | no - a screen-facing billboard at the particle's depth; its colour already matched retail packet for packet | disassembly + capture | docs |
| What does the field drop shadow draw? | four textured quads of a blob texture over a 3x3 grid projected at the actor's feet; matches retail's packets on every captured frame | disassembly + capture | docs |
Measurement + corpus
Claims about the project's own instruments - dump corpus, coverage counts, attribution.
| Thread | Verdict | Evidence | Write-up |
|---|---|---|---|
Does any code reseed BIOS rand? | no: the executable carries no srand thunk, so every caller draws on one kernel stream | disassembly | doc |
| Why do PROT 0896's calls miss this disc's executable? | it was linked against another build's executable | disassembly | doc |
| Which save states carry a patched executable? | measured and tagged per patch family; every capture-graded claim re-checked against its family stands | capture | doc |
| Where does an overlay image's code stop? | at the word after its last jr ra; the only exception is a body the sector-granular PROT extent cut short, which still carries a RAM-page lui | disassembly | doc |
content_bytes vs clean_copy_bytes - which is an overlay's length? | the entry's sector extent; clean_copy_bytes is how much a RAM capture verified (they differ by 0xF174 on PROT 0899) | disassembly | doc |
Does PROT.DAT's TOC leave gaps between entries? | no - a gapless partition; every "unindexed gap" reading was the over-reading entry size | disassembly | doc |
PROT 0867's trailing 0x14000 slots | raw 4bpp PSX TIMs (CLUT row 482, page at x = 384), not LZS monster blocks; the same TIM sits inside PROT 0892 | capture | doc |
summon.dat's seven unclassified slots | the big-summon (0x9A..=0xA0) third members | inference | doc |
| Do a MAN's partition offset tables tile its data region? | exactly, data-region-relative | inference | doc |
What is in the SCUS_942.54 code gap the citation graph never listed | resolved | disassembly capture | doc |
Why three plausible-code blocks in SCUS_942.54 can never be a function body | resolved | disassembly | doc |
| Is the unattributable dump-extent residue a re-dumping problem | no | capture | doc |
| Can the inner of two nested overlay spans be measured at all | yes | capture | doc |
| Is a caller-site citation checkable, or only assertable? | checkable - the disc word at the cited address settles it, and check-port-provenance.py’s site_relation reads it off the bytes | disassembly | doc |
Which image do the overlay_dance_* prints above 0x801D6818 come from? | PROT 0972, the fishing overlay - PROT 0980’s own content is 0x8000 bytes, and 0x801D73B8 is 0972’s file 0x8BA0 instruction for instruction | disassembly | doc |
| Is the overlay corpus's uncovered-byte residue un-dumped code? | sixteen of twenty ranked runs are not code - the image's own spawn-record band, a neighbouring image's bytes at the same file offset, or zero scratch; the seventeenth was seven frameless leaves in PROT 0949 | disassembly | docs |
| Why does every extracted overlay image end in another image's bytes? | the build buffer: an image's extent runs past its own content into the previous, longer module's code at the same offset - 66 of 83 images, and now excluded from each image's own code denominator | disassembly | docs |
| What is the slot-B modules' unclassified data tail? | a spawn-record band, addressed by the consumer's own pointer-forming instruction. No earlier shape rule reached it because a record's bytecode contains a lui word by accident | disassembly | docs |
| Does the TOC resolver return an LBA? | no - a sector count; the LBA is a side effect. Two loader rows and one argument order were reversed against it, and the libcd directory cache had been recorded at the offset half of an address pair | disassembly | docs |
| Do the feature views measure distinct features? | no - twelve of them were measuring one blob, one view's anchor set being a strict subset of another's. Localized, the same feature measures a tenth as many anchors | capture | docs |
| Does a PCSX-Redux save state carry the scratchpad? | yes - in a 64 KiB hardware blob, with the scratchpad at its own offset 0, so the per-cell reads that needed a mednafen state are answerable in either emulator once the reader grows an accessor | capture | docs |
| Where does a slot-B image’s highest spawn record end? | its own move-VM program bounds it - walk the opcode widths to a terminator and round up to 4. 991 of 1027 extents come out exact; of the 33 misses re-walked independently, 14 go past the end, 13 stop on it and 6 below, so the usable invariant is a terminator rule rather than a direction - no miss ever terminates above the end | disassembly | doc |
| When does SCUS’s one call into slot B run? | on ordinary in-battle frames while PROT 0920’s effect budget is non-zero - 212 hits in a single Slippery cast, across six module phases, always with the battle-running signal set | capture | doc |
| Is a VA that prints in two neighbouring slot-B images one routine? | usually, but not always - one such VA is a 272-byte stager in one image and a 2040-byte applier in another, differing at the first instruction. Diff the bytes rather than assuming either way | disassembly | doc |
How long is FUN_801DD9D4? | 588 bytes / 147 instructions. All seven of its dumps stop at 276, because the decompiler stops at an interior jump table the preceding branch skips past - seven dumps agreeing is agreement about the decompiler | disassembly | doc |
| Are the two 24-instruction tally helpers two routines? | one, linked into two overlays - 22 of 24 instructions identical, the two that differ being the pair that materialises the gate word | disassembly | doc |
| Can a mode-seat parity witness sample the mode word? | no - an INIT mode lasts one frame inside the seat's own entry call, so the witness that works is the edge count | capture | doc |
| What does a reach-triage cell assert? | nothing - the page audit checks the addresses a row cites, not the prose beside them, so a cell can keep describing work a ladder already did | inference | doc |
| Is a resolution ratio over address-forming pairs a base test? | no - it is one-sided, rewarding a base that explains little of the image | disassembly | doc |
| When may a dump's filename credit an extent? | only where something else in the same image confirms by bytes | disassembly | doc |
| Do two host kernels paired by name do the same work? | not necessarily - an empty body pairs with anything | inference | doc |
| Can a measurement tool be stale the way its cache is? | yes, and more quietly - a documented historical figure reappearing is a stale instrument | capture | doc |
See also
A thread whose verdict no longer matches the disassembly moves back to the open list; the row here is not edited in place.