diff --git a/docs/re/data/heap-ledger-stage01.txt b/docs/re/data/heap-ledger-stage01.txt
new file mode 100644
index 00000000..0e306beb
--- /dev/null
+++ b/docs/re/data/heap-ledger-stage01.txt
@@ -0,0 +1,354 @@
+   F 82000890 8284DD3C 0BD ( 189)    MmFreePhysicalMemory
+   F 82000894 8284DD2C 0BA ( 186)    MmAllocatePhysicalMemoryEx
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 03A723D0, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = BC220000 Size: 03A80000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000778F0, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = BC1A0000 Size: 00080000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 070D28B0, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B50C0000 Size: 070E0000
+d> F800002C MmFreePhysicalMemory(00000000, BE078D80)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F8000044 MmFreePhysicalMemory(00000000, BDB18CC0)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BCA44980)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BCD24A00)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BCE24A40)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BD17CAC0)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BD8E0C00)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BDA60C40)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmFreePhysicalMemory(00000000, BC79C900)
+!> F8000008 BaseHeap::Release failed because address is not a region start
+!> F8000008 PhysicalHeap::Release failed due to parent heap failure
+d> F800002C MmFreePhysicalMemory(00000000, BDFB8D40)
+!> F800002C BaseHeap::Release failed because address is not a region start
+!> F800002C PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmFreePhysicalMemory(00000000, BD07CA80)
+!> F8000008 BaseHeap::Release failed because address is not a region start
+!> F8000008 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000801F, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B50B0000 Size: 00010000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00400000, 20000404, 00000000, FFFFFFFF, 00000080)
+d> F8000008 MmAllocatePhysicalMemoryEx = B4CB0000 Size: 00400000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00000020, 00000204, 00000000, FFFFFFFF, 00000020)
+d> F8000008 MmAllocatePhysicalMemoryEx = FFCA8000 Size: 00001000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00398FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B4910000 Size: 003A0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00398FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B4570000 Size: 003A0000
+d> F8000008 MmFreePhysicalMemory(00000001, B4560000)
+d> F8000044 MmFreePhysicalMemory(00000000, BED2A080)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000DF288, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B4490000 Size: 000E0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00F4F80F, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B3540000 Size: 00F50000
+d> F8000044 MmFreePhysicalMemory(00000000, BF26A0C0)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0088E80F, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2CB0000 Size: 00890000
+d> F8000044 MmFreePhysicalMemory(00000000, BE94CF80)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000044 MmFreePhysicalMemory(00000000, BF36A100)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00298810, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000044 MmAllocatePhysicalMemoryEx = B2A10000 Size: 002A0000
+d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00298658, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000044 MmAllocatePhysicalMemoryEx = B2770000 Size: 002A0000
+d> F8000044 MmFreePhysicalMemory(00000000, B2770000)
+d> F8000044 MmFreePhysicalMemory(00000000, BE88CF40)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00155810, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000044 MmAllocatePhysicalMemoryEx = B28B0000 Size: 00160000
+d> F8000094 MmAllocatePhysicalMemoryEx(00000000, 001BF800, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000094 MmAllocatePhysicalMemoryEx = B26F0000 Size: 001C0000
+d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00155531, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000044 MmAllocatePhysicalMemoryEx = B2590000 Size: 00160000
+d> F8000044 MmFreePhysicalMemory(00000000, B2590000)
+d> F8000044 MmFreePhysicalMemory(00000000, BEA7A040)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000094 MmAllocatePhysicalMemoryEx(00000000, 00629000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000094 MmAllocatePhysicalMemoryEx = B20C0000 Size: 00630000
+d> F8000094 MmAllocatePhysicalMemoryEx(00000000, 0004CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000094 MmAllocatePhysicalMemoryEx = B2070000 Size: 00050000
+d> F8000044 MmFreePhysicalMemory(00000000, BE4E8E40)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000044 MmFreePhysicalMemory(00000000, BE378DC0)
+!> F8000044 BaseHeap::Release failed because address is not a region start
+!> F8000044 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000681F9, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2000000 Size: 00070000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1C30000 Size: 003D0000
+d> F8000008 MmFreePhysicalMemory(00000000, B2000000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000F40EB, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1B30000 Size: 00100000
+d> F8000008 MmFreePhysicalMemory(00000000, B1B30000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1B30000 Size: 00100000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1A30000 Size: 00100000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000A8C00, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1980000 Size: 000B0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0002E820, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2040000 Size: 00030000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000E1FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1890000 Size: 000F0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1840000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B17F0000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000E1FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1700000 Size: 000F0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B16B0000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1660000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000E1FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1570000 Size: 000F0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1520000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B14D0000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00697828, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0E30000 Size: 006A0000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0DA0000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0D10000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0C80000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0BF0000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0B60000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0AD0000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B0A40000 Size: 00090000
+d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000154 MmAllocatePhysicalMemoryEx = B09B0000 Size: 00090000
+d> F8000008 MmFreePhysicalMemory(00000000, B0E30000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1B30000)
+d> F8000008 MmFreePhysicalMemory(00000000, B2040000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1980000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0C80000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0D10000)
+d> F8000008 MmFreePhysicalMemory(00000000, B09B0000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0AD0000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0A40000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0DA0000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0B60000)
+d> F8000008 MmFreePhysicalMemory(00000000, B0BF0000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1A30000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1890000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1840000)
+d> F8000008 MmFreePhysicalMemory(00000000, B17F0000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1700000)
+d> F8000008 MmFreePhysicalMemory(00000000, B16B0000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1660000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1570000)
+d> F8000008 MmFreePhysicalMemory(00000000, B1520000)
+d> F8000008 MmFreePhysicalMemory(00000000, B14D0000)
+d> F8000008 MmFreePhysicalMemory(00000000, BE4B0E00)
+!> F8000008 BaseHeap::Release failed because address is not a region start
+!> F8000008 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 007D0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1450000 Size: 007E0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003E8FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B1060000 Size: 003F0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003E8FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0C70000 Size: 003F0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 002F8008, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0970000 Size: 00300000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0870000 Size: 00100000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00140000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0730000 Size: 00140000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0620000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0590000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0480000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B03F0000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B02E0000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0250000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B0140000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B00B0000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 002F8008, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AFDB0000 Size: 00300000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AFCB0000 Size: 00100000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00140000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AFB70000 Size: 00140000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AFA60000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF9D0000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF8C0000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF830000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF720000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF690000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF580000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF4F0000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 002F8008, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF1F0000 Size: 00300000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AF0F0000 Size: 00100000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00140000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AEFB0000 Size: 00140000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AEEA0000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AEE10000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AED00000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AEC70000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AEB60000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AEAD0000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AE9C0000 Size: 00110000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AE930000 Size: 00090000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003E8FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AE540000 Size: 003F0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00046FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2020000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00730FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ADE00000 Size: 00740000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00078FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ADD80000 Size: 00080000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00730FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD640000 Size: 00740000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00398FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD2A0000 Size: 003A0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00078FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD220000 Size: 00080000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00004FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2010000 Size: 00010000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00042FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD1D0000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00042FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD180000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00042FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD130000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000FFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2000000 Size: 00010000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000FFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD120000 Size: 00010000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD0E0000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD0A0000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD060000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AD020000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACFE0000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACFA0000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACF60000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACF20000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACEE0000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACEA0000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACE60000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACE20000 Size: 00040000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACD20000 Size: 00100000
+d> F8000008 MmFreePhysicalMemory(00000000, ACD20000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACD20000 Size: 00100000
+d> F8000008 MmFreePhysicalMemory(00000000, ACD20000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00040FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACDD0000 Size: 00050000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACDC0000 Size: 00010000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACCC0000 Size: 00100000
+d> F8000008 MmFreePhysicalMemory(00000000, ACCC0000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00BB5B9A, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AC200000 Size: 00BC0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ABE30000 Size: 003D0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ABA60000 Size: 003D0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AB690000 Size: 003D0000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AB2C0000 Size: 003D0000
+d> F8000008 MmFreePhysicalMemory(00000000, AC200000)
+d> F8000008 MmFreePhysicalMemory(00000000, B2A10000)
+d> F8000008 MmFreePhysicalMemory(00000000, BE7A8F00)
+!> F8000008 BaseHeap::Release failed because address is not a region start
+!> F8000008 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmFreePhysicalMemory(00000000, BDA98C80)
+!> F8000008 BaseHeap::Release failed because address is not a region start
+!> F8000008 PhysicalHeap::Release failed due to parent heap failure
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2C30000 Size: 00080000
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = B2B30000 Size: 00100000
+d> F8000008 MmFreePhysicalMemory(00000000, B2C30000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00200000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = ACBC0000 Size: 00200000
+d> F8000008 MmFreePhysicalMemory(00000000, B2B30000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00400000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AC7C0000 Size: 00400000
+d> F8000008 MmFreePhysicalMemory(00000000, ACBC0000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00800000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = AAAC0000 Size: 00800000
+d> F8000008 MmFreePhysicalMemory(00000000, AC7C0000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 01000000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = A9AC0000 Size: 01000000
+d> F8000008 MmFreePhysicalMemory(00000000, AAAC0000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 02000000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = A7AC0000 Size: 02000000
+d> F8000008 MmFreePhysicalMemory(00000000, A9AC0000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 04000000, 20000004, 00000000, FFFFFFFF, 00000000)
+d> F8000008 MmAllocatePhysicalMemoryEx = A3AC0000 Size: 04000000
+d> F8000008 MmFreePhysicalMemory(00000000, A7AC0000)
+d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 08000000, 20000004, 00000000, FFFFFFFF, 00000000)
+!> F8000008 PhysicalHeap::AllocRange unable to alloc physical memory in parent heap (requested 134217728 bytes, parent free 28969/131072 pages)
+w> F8000008 MmAllocatePhysicalMemoryEx: Allocation failed: 00000000 Size: 08000000
diff --git a/docs/re/mission-freeze-heap-exhaustion.md b/docs/re/mission-freeze-heap-exhaustion.md
index a7a6282c..f987340b 100644
--- a/docs/re/mission-freeze-heap-exhaustion.md
+++ b/docs/re/mission-freeze-heap-exhaustion.md
@@ -218,3 +218,95 @@ failed releases.
 region start` says the guest is freeing something at an address Xenia's heap does
 not recognise as a region base, which is an **emulator-side** bug rather than a
 game one.
+
+---
+
+# The allocation ledger — and 🔴 my leak hypothesis is wrong
+
+**2026-08-26, same day.** The section above proposed that failed releases leak
+guest pages and drain the console. I built the ledger to test it, and **it
+refutes that**.
+
+`--log_level=3 --log_mask=0` makes `MmAllocatePhysicalMemoryEx` log its request,
+its granted base and its rounded size, and puts `MmFreePhysicalMemory` in the
+export trace, so allocations can be matched to frees. (`log_mask` **disables**
+categories — Kernel=1, Apu=2, Cpu=4, Gpu=8 — so the `--log_mask=13` used
+everywhere in this corpus had the kernel log switched **off**.) Raw ledger:
+[`data/heap-ledger-stage01.txt`](data/heap-ledger-stage01.txt).
+
+## 🔴 There is no leak — the books balance
+
+| | |
+|---|---|
+| live guest physical allocations at the failure | **379.5 MB** in 84 blocks |
+| free, per the failing allocator | **113.2 MB** |
+| sum | **492.7 MB** of the console's 512 MB |
+
+The ~19 MB remainder is allocation paths this filter did not capture (image,
+stacks, kernel structures). Nothing is missing that a leak would explain.
+
+## 🔴 And the 22 "leaked" releases are correct refusals
+
+Every one of the 22 failing frees is an **interior pointer into the same
+allocation** — the 58.5 MB block at `BC220000`:
+
+| freed at | region base | region size | offset into region |
+|---|---|---|---|
+| `BE078D80` | `BC220000` | 58.50 MB | 30.35 MB |
+| `BDB18CC0` | `BC220000` | 58.50 MB | 24.97 MB |
+| `BCA44980` | `BC220000` | 58.50 MB | 8.14 MB |
+| … | | | |
+
+**22 of 22 fall inside a known allocation, all in that one block.** So the game
+sub-allocates out of one big physical pool and calls `MmFreePhysicalMemory` on
+the sub-blocks. Xenia is **right** to refuse them: `BaseHeap::Release` frees a
+whole region, so honouring an interior pointer would free 58.5 MB — and would do
+it twenty-two times. My proposed "fix" would have been a catastrophe.
+
+## 🔴 Rounding is not it either
+
+Requested `480.67 MB`, granted `484.50 MB` — **3.83 MB (0.80 %)** of 64 KB-page
+rounding, against a shortfall of **14.84 MB**. Not the cause.
+
+## ✅ What actually happens: a doubling grow that holds both buffers
+
+The last six ledger lines before the freeze:
+
+    = A7AC0000 Size: 02000000          allocate 32 MB
+    MmFreePhysicalMemory(A9AC0000)     free the previous buffer
+    = A3AC0000 Size: 04000000          allocate 64 MB
+    MmFreePhysicalMemory(A7AC0000)     free the 32 MB
+    MmAllocatePhysicalMemoryEx(08000000)   ask for 128 MB  -> FAILS
+
+The game grows a buffer by doubling and allocates the **new** block before
+freeing the old, so the 128 MB step needs `64 + 128 = 192 MB` live at once for
+that buffer alone, on top of ~315 MB held elsewhere. It comes up **14.84 MB**
+short.
+
+## 🔴 And there is no configuration that fixes it
+
+* **No guest memory-size cvar.** `memory.cc` has only `protect_zero`,
+  `protect_on_release`, `scribble_heap` and the MMIO ones.
+* **The 512 MB is baked into the address map, not a constant.** The parent heap
+  is `Initialize(..., 0x00000000, 0x20000000, 4096)` and its aliases sit at
+  `0xA0000000` and `0xC0000000` — spaced **exactly** `0x20000000` apart. Growing
+  the heap would run the `0xA0000000` window straight into `0xC0000000`. It is
+  not a one-line change.
+* **No `eh_dispatch` cvar in this tree.** `title-crash-stl-tree.md` mentions one;
+  this build has none. `RtlRaiseException_entry` routes `0xE06D7363` to
+  `HandleCppException`, which **logs and returns** — so the guest's
+  out-of-memory throw does not unwind, execution falls through into code that
+  assumed it would not run, and the guest spins. That is the freeze.
+
+## ❔ So the oracle is still broken, and here is what is left
+
+Not fixed. The remaining candidates, in the order I would try them:
+
+1. **Find the ~19 MB the ledger does not see.** If some of it is emulator-side
+   rather than guest-side, recovering 15 MB of it clears the shortfall exactly.
+   Log `NtAllocateVirtualMemory` and the image load as well.
+2. **Make the throw unwind.** Implementing guest EH dispatch would let the game
+   handle its own allocation failure — it evidently expects to, or it would not
+   be probing sizes by doubling.
+3. **Reach flight another way.** The tutorial loads less; two attempts timed out
+   before reaching it, and that is unfinished rather than refuted.