port: an authored value becomes measured, and a difference-only check gets an origin

The Decoder corrected their own focus delivery: the persistence run's item names
were two positions out, from a reader using design-space rows against captures
carrying Xenia's chrome and a 1.060 scale. Two things follow.

initial_focus_kind moves from authored to measured. NEW GAME on a fresh boot, 2/2
fresh boots, both the first menu entry. The value did not change; its standing
did, and the upgrade is not because the measurement agrees with me -- they had
said my agreeing with their records was no evidence, which was correct, and this
is a direct reading independent of the reasoning that chose NEW GAME here. "First
entry" is load-bearing: since the menu remembers its cursor, a reading taken
later measures history, which is the objection that voided the earlier
TUTORIAL-versus-NEW-GAME disagreement. The superseded reasoning is kept under
(was) lines -- the field existing and being labelled honestly is what made
arriving at a measurement a label change rather than an archaeology problem, the
third time that has paid off after loop_start_s and the +0x08 read.

My check_focus_persists anchor survived a correction it should not have been able
to detect. It anchors on the heading, the conclusion, not on the item names. That
is lucky rather than designed: the conclusion is geometry-free -- ring at y 384.0
before the round trip and 385.5 after, an equality immune to a constant offset --
while the names were not. The check would not have caught the label error, and
nothing in it distinguishes anchored-on-a-robust-claim from anchored-above-the-
part-that-was-wrong.

Their generalisation: a control that only checks differences is blind to the
origin. check_splash_dwell is that shape -- it compares the widest gap between
keyframe times, and a reader with every time shifted by a constant passes. Added
check_splash_times, asserting the absolute list the contract prints. Origin and
difference now fail independently.

Writing that control reproduced the error one level down: its perturbation
literal was written from memory of the prose, with a space where the document has
a newline, so it reported its own anchor gone. A control written from a memory of
the source rather than from the source is the class of error these checks exist
to catch. Thirteen controls, all firing.

Q2 closed: fixed same day, and the row was worse than I reported -- the splashes
were also mis-paired as 10/11, one half each of two different pairs.

EXTRAS remains unmeasured; the run meant to settle it navigated to OPTIONS
believing it was EXTRAS. Every asserting check passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N7FiFFFwbvG2uxdcEh8HyF

tools/port/contract-check

@@ -158,6 +158,41 @@ def check_splash_dwell(h):
     report("boot splash dwells", want, got, want is not None and want == got)
 
 
+def check_splash_times(h):
+    """The splash's ABSOLUTE keyframe times, not just the gap between two of them.
+
+    🔴 Added 2026-08-30 because the dwell check above is a DIFFERENCE, and a
+    difference is blind to the origin: a reader whose times were all shifted by a
+    constant would produce the same 190 and pass. That is not hypothetical -- the
+    Decoder's own control asserted "two DOWNs move two items", which a constant
+    offset preserves exactly, and it passed for a whole session on a reader that
+    was two items wrong. Ground truth caught it; the control could not.
+
+    The contract prints entry 10's times in full, so the origin is checkable.
+    """
+    m = re.search(r"entry 10's times are\s*`\[([0-9, ]+)\]`", h)
+    want = [int(x) for x in m.group(1).split(",")] if m else None
+    d = jload("export/screens/title/publisher_logo.json")
+    got = sorted({k["t"] for e in d["elements"] for k in e["keyframes"]}) if d else None
+    report("splash absolute times", want, got, want is not None and want == got)
+
+
+def check_initial_focus(h):
+    """What the menu opens on FROM A FRESH BOOT -- measured, and it was authored.
+
+    Anchored on the measurement rather than on the value, so that if the reading
+    is corrected again this fails instead of silently agreeing.
+    """
+    want = "NEW GAME" if re.search(
+        r"\*\*Initial focus on a fresh boot is `NEW GAME`\*\*", h) else None
+    scr = ((jload("authored/flow.json") or {}).get("screens") or {}).get("main_menu", {})
+    bid = scr.get("initial_focus")
+    got = (scr.get("buttons") or {}).get(bid, {}).get("label")
+    kind = scr.get("initial_focus_kind")
+    report("menu opens on (fresh boot)", want, f"{got} [{kind}]",
+           want is not None and got == want and kind == "measured")
+
+
 
 
 
@@ -303,6 +338,14 @@ CONTROLS = [
     (check_splash_dwell, "the splashes are 190 and 145",     "the splashes are 191 and 145"),
     (check_focus_persists, "the main menu remembers its cursor; re-entry is not a reset",
                            "the main menu forgets its cursor; re-entry is a reset"),
+    # The list sits on the line AFTER "times are", so the perturbation has to
+    # carry the newline the check's `\s*` spans. A control whose own anchor is
+    # written from memory of the prose rather than from the prose is the same
+    # class of error the checks exist to catch.
+    (check_splash_times, "times are\n`[0,15,30,45,235,239,251,255]`",
+                         "times are\n`[1,16,31,46,236,240,252,256]`"),
+    (check_initial_focus, "**Initial focus on a fresh boot is `NEW GAME`**",
+                          "**Initial focus on a fresh boot is `TUTORIAL`**"),
 ]
 
 # The walk's controls perturb `navigation.md` instead of HANDOFF, so they are
@@ -324,7 +367,8 @@ def main():
     for fn in (check_fade_quads, check_fade_out, check_plate_period,
                check_bgm_window, check_black_hold, check_menu_bank,
                check_splash_dwell, check_menu_labels, check_extras_labels,
-               check_wrap, check_focus_persists, guard_focus_scope):
+               check_wrap, check_focus_persists, guard_focus_scope,
+               check_splash_times, check_initial_focus):
         fn(h)
     print()
     print("  A passing run means the port agrees with the contract ON THESE VALUES.")