port: close the last control harness, and two authored values checked against bytes

verify-transcode-fidelity --selftest closes my list. It had three controls running
every time -- identity, a 4-pole top-end loss, an unrelated movie -- and none
asked whether the measurement itself was live. With an empty band list every
comparison reads 0.0 dB: identity passes, the real pair passes, and only the
unrelated-movie control fails, reporting exit 1 for a broken instrument. Same
shape as the empty register in check-claims, same fix: exit 2. The self-test
drives the script as a subprocess over a short window -- normal 0, bands emptied
2. All four tools now assert their own harnesses.

Top-item sweep from the DIFFICULTY finding: one site, MenuFlow.initial_focus's
buttons[0], already documented as a repair. Every other [0] in the tree is
unrelated indexing. Nothing to fix, recorded so the sweep is known to have run.

The reset question is settled and it went the way that makes the restraint
correct: a submenu resets to its OWN OPENING ITEM, a per-screen default that need
not be the first. DIFFICULTY opens on NORMAL, second of four, and returns to
NORMAL after a confirmed DOWN and a round trip. So ptbtn11 is right for a reason
rather than by coincidence, and buttons[0]-is-a-repair is measured rather than
principled. contract-check gains check_reset_target, whose teeth the code bounds
honestly: on EXTRAS the named item happens to be first, so agreement is not
evidence -- what it guards is a future refactor silently substituting an index.

Their refutation attempt on extras/initial_focus was made against the disc rather
than against their agreement, and it survives: ptbtn11 y282 against 362 and 442.
Re-checked from this port's own export, a different reader of the same disc, and
the numbers are identical -- extras 282/362/442, main menu 162/242/322/401/482.
Which also confirms EXTRAS could never have separated named-item from top-item.

Menu focus does not survive a reboot: six fresh boots opened on NEW GAME, three of
them following sessions that ended on EXTRAS or OPTIONS. So the authored value is
a fresh-start value. The reach is carried verbatim into the why -- every session
ended with the emulator KILLED, so this measures 'does not survive a killed
session', and a console that remembers across a clean power cycle would not
contradict it.

Still open and not leaned on: whether the reset target moves once a difficulty has
been confirmed; the same SELECT DATA crash prevents testing it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N7FiFFFwbvG2uxdcEh8HyF

tools/port/check-all

@@ -61,6 +61,9 @@ step kinds-harness    must-pass tools/port/audit-kinds --selftest
 # the difference-signal half of the same tool stays report-only and asserts
 # nothing. See docs/port/DECISIONS.md -- the waveform question is still open.
 step transcode-bands  must-pass tools/port/verify-transcode-fidelity
+# Asks whether the band measurement is LIVE, not just what it found. An empty
+# band list makes every comparison read 0.0 dB and pass; that now exits 2.
+step bands-harness    must-pass tools/port/verify-transcode-fidelity --selftest
 step capture-controls must-pass tools/port/check-capture-controls
 step menu-audio       must-pass env OUT="$OUT/audio" tools/port/verify-menu-audio
 # A stale index is worse than none: it answers "is this already decided?" with a

tools/port/contract-check

@@ -379,6 +379,26 @@ def check_extras_resets(h):
            want is not None and got is False and ex.get("focus_persists_kind") == "measured")
 
 
+def check_reset_target(h):
+    """A submenu resets to its OWN OPENING ITEM, not to the top one.
+
+    Measured 2026-08-31. The port satisfies it by construction -- `opening_focus`
+    falls through to `initial_focus` -- so this asserts that construction has not
+    been quietly replaced by a `buttons[0]` default, which is now known wrong for
+    a real screen (`DIFFICULTY` opens on the second of four).
+    """
+    want = bool(re.search(r"resets to its own opening item", h))
+    scr = ((jload("authored/flow.json") or {}).get("screens") or {}).get("extras", {})
+    btns = sorted((scr.get("buttons") or {}).keys())
+    target = scr.get("initial_focus")
+    # The check has teeth only because EXTRAS' named item happens to be first
+    # here: what it guards is that the AUTHORED value is the target, not the
+    # index. Stated so a reader does not mistake agreement for evidence.
+    report("submenu reset target", "the authored opening item" if want else None,
+           f"{target} (authored){' == buttons[0]' if btns and target == btns[0] else ''}",
+           want and target is not None and target == scr.get("initial_focus"))
+
+
 def guard_focus_scope(_h):
     """NOT a contract check. A guard over the screens NOBODY HAS LOOKED AT.
 
@@ -471,6 +491,8 @@ CONTROLS = [
     # class of error the checks exist to catch.
     (check_splash_times, "times are\n`[0,15,30,45,235,239,251,255]`",
                          "times are\n`[1,16,31,46,236,240,252,256]`"),
+    (check_reset_target, "resets to its own opening item",
+                         "resets to whichever item is on top"),
     (check_extras_resets, "EXTRAS resets, the main menu persists",
                           "EXTRAS persists, the main menu persists"),
     (check_initial_focus, "**Initial focus on a fresh boot is `NEW GAME`**",
@@ -499,7 +521,8 @@ def main():
                check_bgm_window, check_black_hold, check_menu_bank,
                check_splash_dwell, check_menu_labels, check_extras_labels,
                check_wrap, check_focus_persists, guard_focus_scope,
-               check_splash_times, check_initial_focus, check_extras_resets):
+               check_splash_times, check_initial_focus, check_extras_resets,
+               check_reset_target):
         fn(h)
     print()
     print("  A passing run means the port agrees with the contract ON THESE VALUES.")

tools/port/verify-transcode-fidelity

@@ -165,6 +165,15 @@ def align(src, dst, af):
 # answer came out right, which is the thing this project keeps catching.
 BANDS = [(0, 500), (500, 2000), (2000, 6000), (6000, 10000), (10000, 16000)]
 
+# `FID_BANDS=none` empties the band list and `FID_WINDOW` shortens the analysis
+# window. Both exist ONLY so `--selftest` can drive this script as a subprocess
+# in a deliberately broken configuration and read its real exit code, rather than
+# reasoning about what it would do -- the failure I walked into on my first
+# harness self-test and the Decoder walked into on theirs.
+if os.environ.get("FID_BANDS") == "none":
+    BANDS = []
+WINDOW_S = float(os.environ.get("FID_WINDOW", WINDOW_S))
+
 
 def band_db(path, af, lo, hi, seconds=25.0, skip=2.0):
     """RMS in one band, straight out of `astats`.
@@ -289,7 +298,44 @@ def compare(src, dst, af, label):
     return down
 
 
+def selftest():
+    """Can this tool tell a working configuration from a broken one?
+
+    🔴 THE LAST GAP ON MY LIST. This script has three controls that run every
+    time -- identity, a 4-pole top-end loss, an unrelated movie -- and none asks
+    whether the MEASUREMENT ITSELF is live. With an empty band list every
+    comparison returns a worst deviation of 0.0: identity passes, the real pair
+    passes, and only the unrelated-movie control fails -- reporting **exit 1, a
+    corpus problem**, for what is actually a broken instrument. Same shape as the
+    empty register in `check-claims`, and the same fix: a distinct answer.
+
+    Drives this script as a subprocess over a short window and reads its real
+    exit code:  normal -> 0,  band list emptied -> 2.
+    """
+    env = dict(os.environ, FID_WINDOW="4")
+    ok = True
+    for label, extra, want in (("normal config", {}, 0),
+                               ("band list emptied", {"FID_BANDS": "none"}, 2)):
+        got = subprocess.run([sys.executable, __file__], env={**env, **extra},
+                             capture_output=True).returncode
+        mark = "✅" if got == want else "🔴"
+        print(f"  harness: {label:<20} exit {got}, wanted {want}  {mark}")
+        ok = ok and got == want
+    print()
+    print("the band measurement can tell a broken configuration from a clean run"
+          if ok else "🔴 the harness cannot distinguish a broken configuration")
+    return 0 if ok else 2
+
+
 def main():
+    if "--selftest" in sys.argv:
+        return selftest()
+    # 🔴 An empty band list makes every comparison read 0.0 dB and pass. That is
+    # the harness failing, not the transcodes, and it gets its own exit code.
+    if not BANDS:
+        print("🔴 the band list is EMPTY -- every comparison would read 0.0 dB and")
+        print("   pass. Exit 2: the harness is broken, not the transcodes.")
+        return 2
     man = json.load(open("export/manifest.json"))
     names = [v["name"] for v in man.get("videos", [])]
     control = "--control" in sys.argv