tools: repair launch_mission.sh; Stage 02 now reaches the briefing and stops there

Finding REMAINING OB in RAM means getting to the escort stage, and
launch_mission.sh exists for exactly that. It carried three of the dead patterns
this session has been clearing: six vgamepad calls (the command no longer exists,
so the entire scripted route pressed nothing), the XUID E0300000EFBEA3D4 which
has no profile behind it and therefore opens the sign-in dialog that swallows
every keystroke, and the emulator's stdout going to /dev/null. wait_flight.sh had
a fourth, in the tap that skips the launch cinematic.

Fixed, the route works far past where it used to stop: boot -> title -> LOAD GAME
-> slot 01 -> READY ROOM -> TAKE OFF -> the Stage 02 briefing map, with ACROPOLIS
labelled on it.

And it stops there: 384 dumps at PC 0x82307128 and no flight HUD within 300s. The
briefing is still animating (two shots a minute apart differ by RMSE 2986), so
the emulator is not frozen - flight simply never starts.

One discriminator worth recording: the TUTORIAL reaches flight and has run
completely crash-free, while this path crashes during the briefing, which is
where the stage content loads. That is consistent with the cache-flush shape the
crash has always had, and points at WHAT is being loaded rather than at how far
the navigation gets.

REMAINING OB is therefore still not found - the mission was never entered.

tools/re-capture/launch_mission.sh

@@ -38,7 +38,11 @@ ensure_display(){
   fi
   xdpyinfo -display "$DISPLAY" >/dev/null 2>&1 || { echo "DISPLAY UNAVAILABLE"; exit 1; }
 }
-step(){ vgamepad dpad "$1"; sleep 0.25; vgamepad dpad center; sleep 0.7; }
+# pad.py, NOT `vgamepad`: that command no longer exists (the uinput pad was
+# replaced by the --hid=file driver) and every call here failed silently, so the
+# whole scripted route pressed nothing. See canary-scripted-input-traps.md.
+step(){ python3 "$SD/pad.py" dpad "$1" 0.08; sleep 0.9; }
+tap(){ python3 "$SD/pad.py" tap "$1" 0.3 || { echo "PAD PRESS FAILED"; exit 6; }; }
 shot(){ screenshot "$SHOTS/$1" >/dev/null 2>&1; }
 
 pkill -x xenia_canary 2>/dev/null; sleep 2
@@ -47,29 +51,36 @@ rm -f /dev/shm/xenia_memory_* /dev/shm/xenia_code_cache_* 2>/dev/null
 ensure_display
 
 cd /sylph-home/re
-nohup run-canary --apu=sdl --log_mask=13 \
-  --logged_profile_slot_0_xuid=E0300000EFBEA3D4 </dev/null >/dev/null 2>&1 &
+# Sign in a profile that EXISTS. A XUID with nothing behind it opens a sign-in
+# dialog and IsUIActive() then swallows every keystroke for the whole run — 8.4
+# million of them, measured. And KEEP the log: /dev/null is what hid that.
+XUID="${SYLPH_XUID:-$(ls "${XENIA_CONTENT:-$HOME/.local/share/Xenia/content}" 2>/dev/null | head -1)}"
+[ -n "$XUID" ] || { echo "NO PROFILE on disc"; exit 2; }
+LOG="${LAUNCH_MISSION_LOG:-$SHOTS/launch_mission-canary.stdout}"
+echo "signing in profile $XUID; emulator log: $LOG"
+nohup run-canary --apu=sdl --log_mask="${LOG_MASK:-13}" --log_level="${LOG_LEVEL:-2}" \
+  --logged_profile_slot_0_xuid="$XUID" </dev/null >"$LOG" 2>&1 &
 sleep 5
 "$SD/skip_intro.sh" 600 || { echo "BOOT FAILED (skip_intro exit $?)"; exit 1; }
 sleep 14                       # main menu is not input-ready before this
 
 step down                      # NEW GAME -> LOAD GAME
-vgamepad tap A 250; sleep 8    # save list, slot 01 preselected
-vgamepad tap A 250; sleep 4    # "Load game?" -- cursor starts on NO
+tap A; sleep 8    # save list, slot 01 preselected
+tap A; sleep 4    # "Load game?" -- cursor starts on NO
 step up
-vgamepad tap A 250
+tap A
 sleep 28                       # -> READY ROOM
 shot "lm-readyroom.png"
 
 if [ "$MODE" = "--hangar" ]; then
   step down; step down         # BRIEFINGS -> HANGAR
-  vgamepad tap A 250; sleep 12
+  tap A; sleep 12
   shot "lm-hangar.png"
   echo "STOPPED IN HANGAR"; exit 0
 fi
 
 step up                        # BRIEFINGS -> TAKE OFF
-vgamepad tap A 250
+tap A
 # The launch cinematic + stage load + objective card is NOT a fixed 75 s under
 # lavapipe; wait for the flight HUD itself.
 "$SD/wait_flight.sh" 300 || { echo "NEVER REACHED FLIGHT"; exit 1; }