diff --git a/docs/port/HANDOFF.md b/docs/port/HANDOFF.md
index a8101e4b..3aa749f6 100644
--- a/docs/port/HANDOFF.md
+++ b/docs/port/HANDOFF.md
@@ -46,6 +46,48 @@ silent. A blank output is a failure, not an empty ask list.
 
 
 
+## 🔴 2026-09-02 (fourth) — **H1: no key-repeat in the input decoder. The timers are a double-tap LATCH on LB/LT**
+
+[`../re/pad-decoder-double-tap-not-key-repeat.md`](../re/pad-decoder-double-tap-not-key-repeat.md)
+
+I chased `C_PAD_DECODER`'s `+0xB4 = 10` / `+0xB8 = 90` as a repeat delay/interval
+pair. **They are not.** They are two identical channels of a **double-tap
+detector**, on LB and LT, firing output bits `0x40` and `0x20`:
+
+1. both timers tick down once per update;
+2. a press arms the short timer to **10**;
+3. a **release adds 1000** to it — a flag stored inside the counter, which is why
+   the tick watches for exactly 1000 and clears both there;
+4. a second press while the flag is set arms the long timer to **90**;
+5. while the long timer runs, **the output bit is asserted on every update.**
+
+📌 **A latch, not a repeat** — a double-tap opens a 90-update window and holds the
+bit for all of it. That is a dash / barrel-roll shape, and it fits the buttons.
+
+### 🔴 What this means for your authored "one step per deflection"
+
+> **The directions have no timer at all in this layer.**
+
+The D-pad (ring bits 12–15) and left stick (ring bits 4–7) reach the output word
+through **bare mask tests** — the four left-stick literals at `0x8220C458`,
+`C474`, `C490`, `C4AC`, and `DPAD DOWN` via cfg `+0xA4` — with **no counter
+loaded, decremented or tested on any of those paths.**
+
+⚠️ **This narrows H1, it does not settle it.** A menu could implement repeat on top
+of a held bit, and I cannot see that from here. What is established is that the
+repeat is **not in the shared decoder** — so if it exists it is **per-screen**, and
+cannot be answered once for all screens from this function.
+
+**Keep "one step per deflection" as authored.** The next step is either the
+consumer of `this+0x24C`, or a capture holding a direction on a real menu and
+counting cursor moves against presents. I have not run that.
+
+📌 Also committed: [`tools/ppc-dis`](../../tools/ppc-dis), the minimal PowerPC
+disassembler — the container has no `objdump` for this target and no `duckdb`, and
+scratch copies have been lost to restarts three times.
+
+---
+
 ## ❌ 2026-09-02 (third) — **I WITHDRAW the resample caveat. Your test is right: the captures are CROPS**
 
 You pre-registered it and ran it — cropped render **558.1 (0.85 %)** against scaled