ci: install the clippy component the Clippy step needs

`dtolnay/rust-toolchain@stable` installs a minimal profile. The `native`
job named no components, so every run that reached the Clippy step died
on

    error: 'cargo-clippy' is not installed for the toolchain
           'stable-aarch64-unknown-linux-gnu'

before clippy read a line of source. That is not a lint result; the step
had never run. The `fmt` job below always named `components: rustfmt`
correctly — this one never did.

Two lines of behaviour change. The rest is the comment explaining why the
step is left gating on `-D warnings` rather than softened: the workspace
is not clippy-clean (run 203's build alone emits ~13 rustc warnings that
`-D warnings` promotes to errors), and `continue-on-error` cannot tell
"debt not yet paid" from "debt paid". That debt is scoped in #13, the way
the rustfmt debt is in #12.

Run 203 is what made this visible. With the aarch64 fix in 64bb7da the
native job got all the way through:

    cargo check  --workspace   ok  10m01s
    cargo build  --workspace   ok  19m04s
    cargo test   --workspace   ok  16m22s   214 passed, 0 failed
    cargo clippy --workspace   toolchain error

Refs #13

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McNbzUeq1KRBWs4G6X2YVj

.github/workflows/ci.yml

@@ -10,36 +10,53 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
 
+# ── What this file may assume about where it runs ────────────────────────────
+#
+# It runs on ONE self-hosted runner: `rpi5-runner`, aarch64, advertising
+# ["ubuntu-latest", "ubuntu-24.04", "ubuntu-22.04"]. Nothing else exists.
+#
+# This file was written for GitHub's hosted fleet — three operating systems and
+# x86_64 throughout — and had never once gone green here: 23 runs cancelled, 2
+# waiting, zero successes. Two separate reasons, and both are configuration
+# describing a world that is not this one:
+#
+#   * `windows-latest` / `macos-latest` match no runner label, so those jobs sit
+#     in WAITING for ever. The run therefore never reaches a terminal state, and
+#     a pull request's checks never resolve either way — not red, just never
+#     finished. That is worse than a failure: a red check tells you something.
+#   * `--target x86_64-unknown-linux-gnu` on an aarch64 host makes every build a
+#     cross-compile, and `wayland-sys`'s build script dies on it —
+#     "pkg-config has not been configured to support cross-compilation".
+#
+# So: one job, on the machine that exists, building for the machine that exists.
+# If a second architecture is ever wanted here it needs a second RUNNER, not a
+# second matrix row.
+
 jobs:
-  # ── Native builds: Windows, macOS, Linux ────────────────────────────────────
+  # ── Native build, on the one runner there is ────────────────────────────────
   native:
-    name: Native — ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-          - os: windows-latest
-            target: x86_64-pc-windows-msvc
-          - os: macos-latest
-            target: aarch64-apple-darwin
+    name: Native — linux
+    runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
+        # `stable` installs a MINIMAL profile: rustc, cargo, rust-std and no
+        # more. Components have to be named. Without this line the Clippy step
+        # below dies on "'cargo-clippy' is not installed for the toolchain
+        # 'stable-aarch64-unknown-linux-gnu'" — which is not a lint result, it
+        # is the step never having run. The `fmt` job below always got this
+        # right; this one never did.
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: ${{ matrix.target }}
+          components: clippy
 
       - name: Cache Cargo registry and build
         uses: Swatinem/rust-cache@v2
 
       # Linux: install Bevy's system dependencies (X11, Wayland, audio)
       - name: Install Linux system dependencies
-        if: matrix.os == 'ubuntu-latest'
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -52,16 +69,30 @@ jobs:
             pkg-config
 
       - name: Check (fast compile check)
-        run: cargo check --workspace --target ${{ matrix.target }}
+        run: cargo check --workspace
 
       - name: Build (debug)
-        run: cargo build --workspace --target ${{ matrix.target }}
+        run: cargo build --workspace
 
       - name: Run tests
-        run: cargo test --workspace --target ${{ matrix.target }}
+        run: cargo test --workspace
 
+      # This step has never once executed on this codebase: the toolchain above
+      # shipped without the component, so every run died on "not installed"
+      # before clippy saw a line of source. Its result was never pass or fail,
+      # only unmeasured. With the component installed it becomes a real check,
+      # and the first honest thing it will report is that the workspace is not
+      # clean — the build already emits ~13 plain rustc warnings (unused
+      # imports, unused variables, needless `mut`, dead fields) that
+      # `-D warnings` promotes to errors, before clippy's own lints are counted.
+      #
+      # Left gating on purpose. A red check that measures something is worth
+      # more than a green one that measures nothing, and the alternative —
+      # `continue-on-error`, or dropping `-D warnings` — cannot tell "debt not
+      # yet paid" from "debt paid", which is the shape PROTOCOL.md forbids.
+      # The debt is scoped in #13, as the rustfmt debt is in #12.
       - name: Clippy
-        run: cargo clippy --workspace --target ${{ matrix.target }} -- -D warnings
+        run: cargo clippy --workspace -- -D warnings
 
   # ── WASM / Web build ─────────────────────────────────────────────────────────
   wasm:

.gitignore

@@ -25,10 +25,41 @@ __pycache__/
 # ── The port ────────────────────────────────────────────────────────────────
 # Generated from the user's own disc. This repo stays clean-room: code, schemas,
 # authored mappings and documentation only -- never game content.
+#
+# BOTH names are ignored on purpose. `export/` is what the exporter writes and
+# what `ExportTree.locate()` reads today; `data/base/` is the name MODDING.md
+# gives that same tree. Only one of them existed here, and it was the one
+# nothing writes -- so the live output directory was tracked while MISSION §4
+# said it was ignored. Ignoring both means renaming the tree to match the docs
+# cannot silently start committing the disc.
+/export/
 /data/base/
+#
+# ⚠️ Enumerating names is what FAILED. The two rules above were written --
+# carefully, with the comment above -- while 850 files and 299 MB of extracted
+# sprites, audio and transcoded video sat committed under `export-probe/` and
+# `export-probe2/`, a third name nobody had thought to list. So ignore the
+# SHAPE, not the instances: any top-level directory whose name starts `export`,
+# and game media anywhere it lands.
+/export*/
+*.ogv
+*.ogg
+*.wav
+*.xpr
+*.pak
+# Loose capture output at the repo root -- 246 MB of it arrived this way.
+/*.tsv
+/*.log
 # Transient inter-agent files. Deliberately outside history: they are working
 # artefacts with provenance in their manifest, not results.
 /exchange/
 !/exchange/.gitkeep
 .godot/
 port/.godot/
+
+# A mod is usually an EDITED GAME ASSET, and this repository never holds game
+# assets. `data/mods/` is the user's own directory -- the exporter never touches
+# it and neither does git, except for the README that explains the rule.
+/data/mods/*
+!/data/mods/README.md
+!/data/mods/.gitkeep

Cargo.lock

@@ -4611,7 +4611,7 @@ dependencies = [
  "colored",
  "image",
  "indicatif",
- "sylpheed-formats",
+ "sylpheed-formats 0.1.0",
  "texpresso",
  "tokio",
  "tracing",
@@ -4627,7 +4627,7 @@ dependencies = [
  "image",
  "serde",
  "serde_json",
- "sylpheed-formats",
+ "sylpheed-formats 0.1.0 (git+https://git.mc02.dev/fabi/Sylpheed.git?tag=formats-pin-2026-09-01)",
 ]
 
 [[package]]
@@ -4648,6 +4648,25 @@ dependencies = [
  "xdvdfs",
 ]
 
+[[package]]
+name = "sylpheed-formats"
+version = "0.1.0"
+source = "git+https://git.mc02.dev/fabi/Sylpheed.git?tag=formats-pin-2026-09-01#1cd5b8b1cb1f02eefc0865e1a1fe280e44831c9d"
+dependencies = [
+ "anyhow",
+ "binrw",
+ "flate2",
+ "futures",
+ "rayon",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "ttf-parser 0.24.1",
+ "xdvdfs",
+]
+
 [[package]]
 name = "sylpheed-viewer"
 version = "0.1.0"
@@ -4659,7 +4678,7 @@ dependencies = [
  "image",
  "rfd",
  "rodio",
- "sylpheed-formats",
+ "sylpheed-formats 0.1.0",
  "thiserror 2.0.18",
  "tracing",
  "tracing-subscriber",

README.md

@@ -42,6 +42,7 @@ docs/
   re/                 the corpus: findings, refutations, method traps
   game/               how the game is navigated -- menus, modals, flight
   port/               the port's mission, its handoff contract, modding rules
+                      -- and RUNNING.md, which is how you actually start it
   agents/             how the agent team works together
 tools/                capture harnesses, probes, the share tool
 exchange/             transient inter-agent files. NOT in git

authored/audio.json

@@ -0,0 +1,384 @@
+{
+ "format": "sylpheed.audio/1",
+ "_": [
+  "Menu audio. EVERY VALUE IN THIS FILE IS MEASURED OR CHOSEN -- none of it is",
+  "in a data file the exporter can read, which is why it is here and not in the",
+  "exporter. `measured` and `chosen` are NOT the same thing and this file keeps",
+  "them apart: a measurement is deleted when the disc states it, a choice is",
+  "deleted when somebody measures it.",
+  "",
+  "Two different kinds of not-on-the-disc live in this file and they are not",
+  "interchangeable:",
+  "",
+  "  * `se` -- MEASURED. `Static.slb` is a delimiter-less run of whole 2048-byte",
+  "    XMA1 packets: no RIFF, no seek chunk, no XACT container. A wave is defined",
+  "    ONLY by (offset, packet_count), and both numbers come from the running",
+  "    game, not from the file. HANDOFF Q8. Delete a row the day a table on the",
+  "    disc states the same thing.",
+  "",
+  "  * `bgm` -- MEASURED, and only the LOOP POLICY beside it is chosen. HANDOFF",
+  "    Q10's negative is about the TABLES: `SOUNDS`, `FILES` and the bank headers",
+  "    name no screen. The executable does -- cue 1103 = `BGM_103`, corroborated",
+  "    by a byte-for-byte match against what the XMA probe saw at the main menu.",
+  "    An earlier draft read the negative as unbounded, picked a track at random",
+  "    and called it authored. See the `bgm._` block for what that cost.",
+  "",
+  "The exporter reads this file and emits `export/audio/**` from it. It holds no",
+  "cue table of its own: a measured offset compiled into a Rust `const` is a",
+  "measurement wearing the costume of a decoded field, and MISSION section 3 is",
+  "explicit that measured values live here."
+ ],
+ "se": {
+  "_": [
+   "MEASURED, HANDOFF Q8, and the RE agent retracted an earlier 'cannot be",
+   "extracted' to publish these. The waves were located BY PLAYING THEM: Canary",
+   "with `--xma_param_probe=true` prints a stream's packet count and first 32",
+   "bytes when it is played, and searching those bytes in the bank gives the",
+   "offset.",
+   "",
+   "WARNING, from the same finding: the file order is NOT cue-id order. These",
+   "cannot be counted out, and an index here would be a fabrication.",
+   "",
+   "`name_match` is the authors' own identifier GUESSED BY NAME. It is carried",
+   "so the guess is not lost and is never presented as the measurement. Where",
+   "the RE agent did not separate two candidates, there is no name at all --",
+   "an absent `name_match` means nobody has claimed one, never that the",
+   "BINDING is unknown. The binding is the measured part.",
+   "",
+   "All three are mono 48 kHz; that is the RE agent's statement in",
+   "`sylpheed_formats::media::se_wave_riff`, not something re-derived here."
+  ],
+  "move": {
+   "bank": "Static.slb",
+   "offset": "0x1ec0",
+   "packets": 4,
+   "channels": 1,
+   "rate": 48000,
+   "name_match": "SE_UI_CURSOR",
+   "why": "HANDOFF Q8, measured: the d-pad move cue, 8 192 B / 0.533 s, reproduced across two boots. Left/right play nothing at all, which is a measurement too and is why there is no `left`/`right` row here rather than a silent file.",
+   "kind": "measured"
+  },
+  "confirm": {
+   "bank": "Static.slb",
+   "offset": "0x5d6c0",
+   "packets": 6,
+   "channels": 1,
+   "rate": 48000,
+   "why": "HANDOFF Q8, measured: the (A) confirm cue, 12 288 B / 1.016 s. NO `name_match`: Q8 is explicit that (A)'s wave was not separated between `SE_UI_DECIDE` and `SE_UI_SUB_WIN_OPN`, so naming it would invent the one thing the measurement did not settle.",
+   "kind": "measured"
+  },
+  "back": {
+   "bank": "Static.slb",
+   "offset": "0x0ec0",
+   "packets": 2,
+   "channels": 1,
+   "rate": 48000,
+   "why": "HANDOFF Q8, measured: the (B) back cue, 4 096 B / 0.344 s, reproduced across two boots. No `name_match` for the same reason as `confirm` -- Q8 names no identifier for it.",
+   "kind": "measured"
+  }
+ },
+ "bgm": {
+  "_": [
+   "MEASURED, NOT CHOSEN -- and the port got this wrong for one iteration.",
+   "",
+   "`docs/port/BLOCKED.md` carried a row reading 'not on the disc ... the port",
+   "is choosing a track, and that choice is authored', and the first draft of",
+   "this file duly picked BGM_001 and labelled it arbitrary. That row was not",
+   "stale: `BGM_103` is in HANDOFF at `9ca1eb5`, which is the exact commit the",
+   "row says it was reconciled against. It was WRONG WHEN WRITTEN.",
+   "",
+   "What HANDOFF actually says is a negative with a stated reach, and the reach",
+   "is what the port dropped: the *tables* cannot say which BGM a screen plays",
+   "-- `SOUNDS`, `FILES` and the bank headers name no screen. The EXECUTABLE",
+   "can. `GamePart_Title`'s phase handler `sub_821C5580` carries `li r5, 1103`",
+   "into a sound call, cue 1103 is `BGM_103`, and `BGM_103.slb`'s two declared",
+   "waves (3 876 864 / 3 930 112 B) are byte-for-byte the two streams the XMA",
+   "probe saw decoding at the main menu. Static code, disc census and runtime",
+   "agree. HANDOFF's own words: 'The port does not have to choose a track.'",
+   "",
+   "So this section is a CITATION, not a decision. It lives in `authored/`",
+   "only because the binding is in the .xex and the exporter reads data files,",
+   "not code -- and it must be deleted the day something the exporter can read",
+   "states it. The loop policy below IS still a decision."
+  ],
+  "main_menu": {
+   "bank": "BGM_103.slb",
+   "loop": "restart",
+   "kind": "measured",
+   "why": "MEASURED, HANDOFF Q10 -- NOT a port choice. `GamePart_Title`'s phase handler `sub_821C5580` plays cue 1103 = `BGM_103`, and `BGM_103.slb`'s two declared waves (3 876 864 / 3 930 112 B) are byte-for-byte the two streams the XMA probe saw decoding at the main menu. Static code, disc census and runtime all agree; see docs/re/menu-audio-cues.md and docs/re/structures/bgm-two-stems.md. The name carries its `.slb` extension because that is what `sound.pak` hashes -- `BGM_103` alone resolves to nothing, which is how the first draft of this file failed. ✅ AUDITED 2026-08-31 -- the THREE legs are three, and that is now measured rather than asserted. Prompted by the Decoder's point that a decorative second support is worse than none, since a conclusion with two supports reads as better evidenced than one and apparent redundancy is itself the misinformation. Read literally, 'disc census' and 'runtime' could be ONE comparison -- declared wave sizes matched byte-for-byte against the probe -- which would make three legs two. It is a real third leg only if the census EXCLUDES alternatives: if another bank carried the same two sizes, the byte match would not distinguish BGM_103. Measured with this port's own reader (`crates/sylpheed-export/examples/bgm_size_census.rs`): of 32 readable BGM_* banks on the disc, EXACTLY ONE carries waves of that size. The census therefore excludes, the static-code leg names the cue independently, and the three legs stand. ✅ AND THE EXCLUSION IS TIGHTER THAN I STATED. The Decoder attempted to refute it from their own census tool rather than this port's reader: of 32 census rows, exactly one bank carries EITHER of those wave sizes -- not merely both together, which is what I measured. A collision would therefore need to reproduce a single size, not a pair, and none does.",
+   "loop_why": "MEASURED, and this field's own history is why it says so first. The bed loops; the loop is a RUNTIME field -- `loop_start`/`loop_end` in the XMA decoder context, set by `XMASetLoopData` and logged by Xenia -- and the cycle was watched directly: three wraps, both contexts wrapping at the same instant every time, mean 61.81 s against the 61.93 s authored in `loop_end_s`, 0.2 % apart from instruments sharing nothing. The export is TRIMMED to that window, because Godot loops a whole file and a loop region therefore has to BE the file. ⚠️ The window's START is not measured and is authored as 0, which is known to be wrong -- see `loop_start_why`. 🔴 EVERY SENTENCE THAT PRECEDED THIS ONE WAS REFUTED, and the previous text survived in the manifest for two days after the corrections were written. It said the loop would be `AUDIBLY WRONG AT THE SEAM [refuted]`, that `no loop-point field has been identified [refuted] anywhere`, and that trimming `would INVENT a loop point`. All three are false: the field exists, the 3.4 s of near-silence was the PORT'S loop and not the game's, and the trim is now what the measurement says. The corrections went into `loop_end_why` and `loop_start_why`; this field is the one the exporter concatenates into `manifest.json`, so the export went on telling readers the refuted story. A correction that does not reach the artifact a consumer reads has not been made. 📌 CITATIONS ADDED 2026-09-01, and their absence was found by `audit-kinds` the moment this field got a `kind` -- it had 1 400 characters of prose and nothing openable, which is exactly the state the audit exists to catch and could not see while the field was unlabelled. The wrap measurement is docs/re/data/menu-bgm-loop-measured.txt and the start is docs/re/data/menu-bgm-loop-start.txt; the bank's two-stem structure is docs/re/structures/bgm-two-stems.md.",
+   "loop_kind": "measured",
+   "stems": "sum",
+   "stems_why": "MEASURED, HANDOFF Q10: a bank is exactly TWO waves of identical duration (32/32 banks on the disc), sample-synchronous -- transient correlation peaks at lag 0.00 s over +/-5 s and both stop at the same millisecond. Concatenating them plays the piece twice, the second time as a bass-less stem; that was the previous reading and it is refuted. Emitting two files would be wrong for a second reason: MODDING rule 1 is one logical asset, one file, and handing a modder two stems to line up by hand is the reassembly the exporter exists to have already done. WHAT IS SUMMED IS SETTLED; WHAT WAVE 1 IS, IS NOT -- HANDOFF calls it quieter, far more L/R-decorrelated and almost bass-free, so it reads as a surround-rear pair OR a second intensity layer, and `ChannelMask` is 0x0002 on both so the file will not say. A unity sum is right under either reading; a weighting would only be justified once that is settled.",
+   "stems_kind": "measured",
+   "loop_start_s": 9.44,
+   "loop_start_why": [
+    "MEASURED 2026-08-30 -- 9.44 s. The loop region is [9.44 s, 71.31 s] of an",
+    "87.744 s wave: the first 9.44 s is an intro played ONCE, and the last 16.4 s",
+    "is a fade-out never played at all.",
+    "",
+    "Two derivations, both stems, and NEITHER converts bits to seconds -- the",
+    "conversion that refuted itself earlier by giving two sample-synchronous stems",
+    "62.34 and 63.29 s. (a) time to `read_offset` crossing `loop_start`, plus a",
+    "1.33 s head correction at a LOCALLY measured rate; (b) first pass minus cycle.",
+    "9.44 s on both stems either way.",
+    "",
+    "⚠️ ONE BOOT, ONE BANK. The decoder reads ahead of playback, but both endpoints",
+    "are `read_offset` events so the lead cancels in the difference.",
+    "",
+    "🔴 THIS FIELD WAS 0.0 AND FLAGGED WRONG FOR ONE ITERATION, deliberately. The",
+    "value was not guessable -- linear back-extrapolation said 9-13 s and linearity",
+    "is refuted by a 4.4 % rate variation within one stream. What made the wait",
+    "cheap was that the field EXISTED and the `-ss`/`-t` ordering had been proved",
+    "with a stand-in value, so arriving at 9.44 was a one-value edit.",
+    "",
+    "📌 CITATION ADDED 2026-09-01 -- found the moment this field got a `kind`. It",
+    "carried 1 041 characters describing two derivations and cited no file. The",
+    "numbers are in docs/re/data/menu-bgm-loop-start.txt, and the loop region's",
+    "wrap timing is in docs/re/data/menu-bgm-loop-measured.txt.",
+    "",
+    "⚠️ Second uncited MEASURED field in this one entry, after `loop_why`. Both",
+    "described their evidence carefully in prose and pointed at nothing. A why that",
+    "recounts a measurement reads as well-sourced precisely because it is detailed,",
+    "which is why neither looked wrong.",
+    "",
+    "✅ AUDITED 2026-09-01 with the exclusion test: could either derivation have come",
+    "out differently given the other? YES, and they discriminate different errors --",
+    "(a) depends on a locally measured RATE and (b) on the CYCLE, so a wrong rate",
+    "breaks (a) and leaves (b) standing, and a wrong cycle does the reverse. Two legs",
+    "that fail independently, which is what 'two derivations' was claiming.",
+    "",
+    "⚠️ BOUND: they share one trace. A systematic error in the read_offset stream",
+    "moves both, and the ONE BOOT, ONE BANK caveat above is that limit stated. What",
+    "they exclude is arithmetic error, not trace error."
+   ],
+   "loop_start_kind": "measured",
+   "loop_end_s": 61.87,
+   "loop_end_why": [
+    "MEASURED off the running game 2026-08-30, 240 s parked on the menu",
+    "(docs/re/structures/menu-bgm-loop-measured.md). The bed loops at 61.93 s, NOT",
+    "at the summed wave's 87.744 s length, and the last ~25.8 s is never played --",
+    "exactly the fade-out and trailing silence bgm-two-stems.md found. The game",
+    "loops BEFORE the fade.",
+    "",
+    "🔴 THIS CORRECTS AN AUTHORED VALUE THAT WAS WRONG IN BOTH DIRECTIONS. `restart`",
+    "at the wave's end produced a seam of about 3.4 SECONDS of near-silence, and",
+    "this port measured that seam off its own Master bus and recorded it as the",
+    "cost of a missing loop point. It was not the game's seam; it was OURS. Zero",
+    "runs of >=0.3 s below median-18 dB appear in 232 s of the real menu.",
+    "",
+    "Two instruments agree: correlation gives a top lag of 61.909 s and r = -0.009",
+    "at 87.750 s, and locating 30 s slices inside the decoded waves shows playback",
+    "advancing exactly +5.00 s per 5 s and wrapping at 61.93 s, three times, with a",
+    "control that finds slices cut at 10/45/70 s at 10.00/45.00/70.00.",
+    "",
+    "⚠️ The loop START is inferred, not measured: [0.0, 61.93) and [0.25, 62.18) are",
+    "not separated at their resolution. The port takes 0 because a bank's own start",
+    "is where its data begins, and records that the choice was not measured.",
+    "",
+    "⚠️ Godot loops a WHOLE FILE, so the export is TRIMMED to 61.93 s rather than",
+    "carrying a loop point the runtime could not honour. The trimmed tail is",
+    "content the game never reaches, so nothing playable is lost -- but a modder",
+    "replacing this file is replacing the loop region, not the whole bank.",
+    "",
+    "🔴 CONFLICT, OPEN AS OF 2026-08-30. The loop IS a runtime field: `loop_start`",
+    "and `loop_end` live in the XMA decoder context, set by `XMASetLoopData`, and",
+    "the RE agent read 8734 records off the menu. Converted, they imply a cycle of",
+    "roughly [10 s, 72 s] against the [0.25, 57.18] their audio tracking reported.",
+    "BOTH CANNOT BE RIGHT and neither has been withdrawn.",
+    "",
+    "They judge the weak link probably theirs: the locator's control matched slices",
+    "cut from the wave ITSELF -- exact copies -- which is an easier problem than",
+    "matching a capture that differs by decoder, gain and mix. A control easier than",
+    "the measurement does not bound the measurement's error, and music with repeated",
+    "sections is where a locator aliases.",
+    "",
+    "⚠️ THE VALUE IS KEPT ON THEIR INSTRUCTION, and because the LENGTH survives",
+    "better than the PLACEMENT: 61.93 has an autocorrelation behind it that used no",
+    "wave at all, and the trimmed loop has no seam in this port's own output.",
+    "",
+    "This port added one check neither of their instruments ran: whether the trim",
+    "JOINS SMOOTHLY. Over 126.5 s the wrap at 61.93 s and again at 123.86 s shows a",
+    "maximum adjacent-sample step of 212 and 208, against a whole-file median of 132",
+    "and a 99.9th percentile of 3737. So the join is not a click and nothing is",
+    "audibly broken.",
+    "",
+    "⚠️ THAT DOES NOT DISCRIMINATE THE TWO READINGS. A smooth join says the waveform",
+    "does not jump; it does not say the loop is at the musically right point, and a",
+    "cut landing near a zero crossing is smooth wherever it falls.",
+    "",
+    "🔴 What the conflict would COST if their runtime fields win: under [10 s, 72 s]",
+    "this export is about 10 SECONDS SHORT -- the content in [61.93, 72] is played",
+    "by the game and absent here. That is the number to weigh when it resolves, and",
+    "it is why this entry is not being treated as settled.",
+    "",
+    "✅ CONFIRMED 2026-08-30 BY A SECOND INSTRUMENT SHARING NOTHING WITH THE FIRST.",
+    "The RE agent stopped converting the runtime fields and TIMED them instead --",
+    "a probe tailing the Apu debug log and stamping `read_offset` on arrival --",
+    "and watched THREE wraps, each from its own `loop_end` to its own `loop_start`,",
+    "with both contexts wrapping at the SAME INSTANT every time. Cycle 61.56 and",
+    "62.06 s, mean 61.81 s: 0.2 % from the 61.93 authored here, measured by wall",
+    "clock between decoder events against an autocorrelation that never touched",
+    "the wave. Both contexts wrapping together is the sample-synchrony the linear",
+    "bit conversion could not produce.",
+    "",
+    "So the LENGTH is settled and the WINDOW is not. See `loop_start_why`.",
+    "",
+    "✅ 61.87 ADOPTED 2026-08-30, replacing 61.93. Their wrap timing gives 61.87 --",
+    "wraps at 96.46 / 158.33 / 220.21 s, gaps 61.87 and 61.87 -- against the 61.93",
+    "this port's autocorrelation gave. 0.1 % apart. The measured value is taken",
+    "because it is the one with the loop's own endpoints under it; the",
+    "autocorrelation never touched the wave and agreed to a tenth of a percent,",
+    "which is what makes both worth having."
+   ],
+   "loop_end_kind": "measured"
+  }
+ },
+ "voice": {
+  "_": [
+   "🔴 KNOWN WRONG, HELD DELIBERATELY. Which of a voice region's streams to",
+   "export. The premise this entry was built on has been REFUTED BY THE RUNNING",
+   "GAME and the entry is kept, escalated, rather than swapped for another guess.",
+   "",
+   "The premise was: a region carries THREE PRESENTATIONS OF ONE TAKE, so the",
+   "exporter picks one. The Decoder booted with `--xma_param_probe=true` -- the",
+   "cvar that reports which sub-wave the game decodes -- and the game decodes",
+   "ALL THREE, CONCURRENTLY, in three separate XMA contexts, with byte sizes",
+   "matching the three disc payloads exactly (1294336 / 1118208 / 1171456",
+   "against RIFF size - 60 of 1294396 / 1118268 / 1171516).",
+   "",
+   "SO THERE IS NO 'WHICH ONE' TO ANSWER. `presentation` below discards two of",
+   "three streams the game plays. It is not a preference between rules any more;",
+   "it is a known-incomplete export.",
+   "",
+   "WHY IT IS NOT CHANGED TODAY. Reverting to the 1/n sum is not obviously less",
+   "wrong: an equal-gain sum of channel pairs is not a downmix -- MISSION",
+   "section 6 makes exactly that point when it pins an explicit matrix for the",
+   "movies' 5.1 fold rather than letting ffmpeg default -- and the 6.02 dB the",
+   "sum cost S00A was a real defect. Swapping one guess for another on a message",
+   "is what produced this entry twice already.",
+   "",
+   "🟡 HYPOTHESIS, NOT A RESULT, and it is the Decoder's: three concurrent stereo",
+   "streams is six channels, and N stereo streams is how XMA carries",
+   "multichannel on the 360, so 5.1 would explain the differing byte rates, the",
+   "near-silent stream and why cues are 1-stream or 3-stream and never 2. AGAINST",
+   "IT: all three declare ChannelMask = 0x0002 identically, which is odd for",
+   "distinct channel roles. Do not build on it.",
+   "",
+   "WHAT SETTLES IT: a recording of the game's own output over the intro,",
+   "through the PulseAudio null sink (AUDIO-VERIFICATION section 3). Candidate",
+   "combinations of the three decoded streams can then be correlated against",
+   "what the game actually played. Asked 2026-08-29.",
+   "",
+   "🔴 REFUTED FROM THE OUTPUT SIDE, 2026-08-30, not merely suspected.",
+   "",
+   "The RE agent recorded 148 s of the game's own output over the boot intro",
+   "(ALSA tee, --gpu=null, 0.15 % silence -- cleaner than the recipe page's own",
+   "reference run), with provenance from the XMA probe rather than a screenshot:",
+   "`ADV`'s three contexts appear byte-exact, then the `BGM_102` pair.",
+   "",
+   "FIVE OF SIX CHANNELS CARRY DISTINCT CONTENT. No channel is a copy of another;",
+   "the largest pairwise correlation is 0.70, between FL and FR, which is what a",
+   "stereo pair looks like. BR is 82 % silent and 11 dB down.",
+   "",
+   "So `presentation: \"loudest\"` -- keeping ONE stream -- cannot be right. That",
+   "was already labelled known-wrong here on the strength of the game decoding",
+   "all three concurrently; it is now refuted by what the game PLAYS.",
+   "",
+   "⚠️ AND IT IS STILL NOT FIXED, DELIBERATELY, on the RE agent's own instruction.",
+   "Three limits they state:",
+   "  * it does not make summing right -- the output is multichannel, which says",
+   "    nothing about which stream lands where;",
+   "  * '6 channels' is NOT evidence the game is 5.1 -- that count is Xenia's",
+   "    hardcoded kFrameChannelsDefault. The evidence is that five of them DIFFER,",
+   "    which a stereo guest cannot produce;",
+   "  * 🔴 the stream-to-channel mapping is NOT RUN. Cross-correlating each",
+   "    captured channel against each decoded `ADV` stream is the step that",
+   "    answers this, and it is their next iteration.",
+   "",
+   "Changing the mapping now would swap one authored guess for another, which is",
+   "a worse position than a guess that is labelled. The value stays; the label is",
+   "upgraded from suspicion to refutation."
+  ],
+  "presentation": "all",
+  "presentation_why": [
+   "`loudest` = the full-length stream whose peak is nearest full scale.",
+   "",
+   "🔴 READ THE BLOCK ABOVE FIRST. This selects one of three streams the game",
+   "decodes concurrently, so whatever it selects, two are missing. The",
+   "paragraphs below are the history of how the value was arrived at, kept",
+   "because the reasoning is what makes the error checkable -- NOT because the",
+   "choice is defensible on its own terms any more.",
+   "",
+   "It was `highest_rate`, on a recommendation withdrawn as self-contradictory:",
+   "'the highest-rate, highest-gain one is chunk 1' selects different streams --",
+   "ADV stream 2 is 1118268 B at 0.0 dBFS, stream 3 is 1171516 B at -8.3.",
+   "",
+   "A structural argument for `loudest` was offered and withdrawn too: ADV",
+   "stream 2 is mono-in-stereo and stream 3 is dual-mono, so the extra bytes",
+   "looked like a duplicated channel rather than fidelity. The CHANNEL",
+   "MEASUREMENT stands and now reads differently -- these are channel pairs, and",
+   "0.60x with the residual 26.8 dB down is what a correlated pair at a lower",
+   "level looks like. The GENERALISATION was refuted by census: the stream-3 /",
+   "stream-2 size ratio over the 28 three-stream cues runs 0.0778 to 2.9163.",
+   "",
+   "⚠️ THE FAILURE MODE HERE IS THAT IT SOUNDS FINE. A single stream decodes to",
+   "clean audible dialogue, so nothing in the output reveals that two streams",
+   "are missing. That is why the manifest says it in words on every voice entry",
+   "rather than leaving it to this file.",
+   "",
+   "📌 WHERE THE OPEN QUESTION LIVES, added 2026-09-01 under this port's own rule:",
+   "an `authored` kind must cite the question it stands in for, or an invented",
+   "value and a placeholder for a measurement read identically. This one stands in",
+   "for the three-concurrent-streams problem, recorded in docs/port/BLOCKED.md and",
+   "delivered in docs/port/HANDOFF.md -- the game decodes all three at once, so",
+   "ANY single selection is missing two, and the export states that per movie",
+   "rather than choosing quietly.",
+   "",
+   "⚠️ 1 402 characters of careful reasoning and nothing openable until now. It is",
+   "the third uncited field in this file, and all three were detailed rather than",
+   "sloppy -- the detail is what made them look sourced."
+  ],
+  "presentation_kind": "authored",
+  "stream_weights": {
+   "_": [
+    "Declared XMA `byte_size` -> the coefficient that stream's position takes in a",
+    "stereo downmix. MEASURED by the RE agent 2026-08-30",
+    "(docs/re/structures/intro-audio-decomposed.md): decomposing the game's own",
+    "6-channel output as capture = 0.600 x movie + residual puts ctx0 at FL/FR,",
+    "ctx1 at FC with LFE silent, and ctx2 at BL/BR.",
+    "",
+    "🔴 KEYED BY BYTE SIZE ON PURPOSE. The assignment is indexed by the decoder's",
+    "own declared size, so the exporter can CHECK that the stream in front of it is",
+    "the one the measurement describes rather than assume it. A region whose chunks",
+    "do not match falls back to the count divisor and says so. That is not defensive",
+    "programming: on 2026-08-30 this table's sizes did NOT fit the region the",
+    "resolver returned, which is what exposed `resolve_movie_voice_region` starting",
+    "238 packets late. Had the weights been applied positionally they would have",
+    "been applied to the wrong streams silently.",
+    "",
+    "⚠️ ONE BOOT, ONE MOVIE. Only `ADV`'s three streams were measured. `S00A`'s",
+    "sizes match nothing here and it keeps the divisor -- extending this by",
+    "POSITION would be assuming the ordering generalises, which is exactly the",
+    "inference the byte-size key exists to avoid.",
+    "",
+    "⚠️ The weights are a stereo downmix's, folded to mono. They sum to 1.0, so the",
+    "total is the movie's own; what they distribute is the balance between three",
+    "positions. Whether the game's 0.600 mixer gain is a constant or a volume",
+    "setting is unknown and the port applies no gain of its own."
+   ],
+   "1294336": {
+    "position": "FL/FR",
+    "weight": 0.4142
+   },
+   "1118208": {
+    "position": "FC (LFE silent)",
+    "weight": 0.2929
+   },
+   "1171456": {
+    "position": "BL/BR",
+    "weight": 0.2929
+   }
+  }
+ }
+}

authored/rendering.json

@@ -0,0 +1,172 @@
+{
+ "format": "sylpheed.rendering/1",
+ "_": [
+  "WHICH decoded rules the runtime applies where. AUTHORED because it is a",
+  "choice about the REACH of somebody else's decode, not about the disc.",
+  "Delete an entry the day the decode covers the case outright.",
+  "",
+  "The exporter flags `leaf_carries_geometry` on 15 elements -- those whose",
+  "nested `.rat` leaf declares a scale or rotation the parent does not. That",
+  "flag is a CENSUS FACT and it is emitted for all 15. What is DECODED is",
+  "narrower: the Decoder fitted the game's own composed alpha (per-draw vertex",
+  "colours C3FFFFFF / B6FFFFFF = 195 and 182) against the ptloop leaves and got",
+  "one consistent time, then PREDICTED the quad centres to ~11 px. That covers",
+  "`ptloop01` and `ptloop02` and nothing else."
+ ],
+ "draw_leaf_for": [
+  "ptloop01",
+  "ptloop02"
+ ],
+ "draw_leaf_why": [
+  "The two the decode covers. `docs/re/structures/ui-leaf-vs-parent-alpha.md`.",
+  "",
+  "NOT DRAWN, though the exporter flags them and ships their data:",
+  "",
+  "  `title_jp/ptlogo_eff2` -- OUT OF SCOPE, which is a better reason than",
+  "  the caution this entry first gave. MISSION section 7 scopes out",
+  "  'localisation beyond English', and this element exists only on the",
+  "  Japanese title. So it is not a thing the menu port has to answer, and the",
+  "  parked Japanese-locale capture does not need reviving on its account --",
+  "  that is the human's call and not something either agent widens quietly.",
+  "",
+  "  It is ALSO undecidable here even if it were in scope. Its 125% is a POP,",
+  "  not a steady scale: scale-0 -> 125% -> scale-0 between t=50 and t=107,",
+  "  about 0.95 s. The leaf draws at 100%, as two superimposed copies at alpha",
+  "  160 and 80, each rotating 360 degrees over 960 units -- 16 s a turn. If",
+  "  parent scale gates the leaf it is a 0.95 s flash; if the leaf runs free it",
+  "  spins for 16 s. Nothing on the disc chooses and title_jp has no oracle",
+  "  capture.",
+  "  `build_12,15/pgloading_loop5` -- STILL NOT DRAWN, but the reason given here",
+  "  was WRONG and is replaced. It read \"leaf scale (0,0). A zero scale is one of",
+  "  the three historical failures this corpus names\" -- which describes t=0 and",
+  "  t=30 and nothing after them.",
+  "",
+  "  What the leaf actually holds, read out of the export: ONE element,",
+  "  `pgloading_ring`, with a sprite, whose scale ramps 0 -> 250 -> 800 -> 1000",
+  "  while its alpha rises to full at t=55 and falls to nothing by t=130. An",
+  "  expanding, fading ring -- a loading pulse, not a degenerate record.",
+  "",
+  "  🔴 And it is VISIBLE at the instant this port poses. `build_12`'s settle",
+  "  window is [40, 48], so the pose lands near t=44, where the ring interpolates",
+  "  to scale 140 at alpha 143. So withholding it is not declining to draw",
+  "  nothing; it is declining to draw something, and the old reason hid that.",
+  "",
+  "  It stays withheld on the reason below, which is the one that always applied:",
+  "  there is no way to adjudicate it here. The loading screens have no oracle",
+  "  capture -- the RE agent records them as not reachable from the title path --",
+  "  and `verify-screen` compares against a renderer that draws no leaves at all.",
+  "  Drawing it would put unadjudicable content on a screen, which is the same",
+  "  test `ptlogo_eff2` fails.",
+  "",
+  "AND THERE IS NO WAY TO ADJUDICATE EITHER HERE. `title_jp` has no oracle",
+  "capture, and `verify-screen` compares against `sylpheed-cli`, which does not",
+  "draw leaves at all -- so ANY leaf drawing increases that divergence whether",
+  "it is right or wrong. Its max went 155 -> 232 when they were drawn, and that",
+  "number is not evidence in either direction.",
+  "",
+  "What deletes this list: a decode covering those cases, or an oracle capture",
+  "of title_jp."
+ ],
+ "draw_leaf_kind": "decoded",
+ "loop_leaf_on_screens": [
+  "title"
+ ],
+ "loop_leaf_why": [
+  "WHICH screens replay a leaf's group instead of letting it run once and park.",
+  "MEASURED on the title, UNRESOLVED on the menus, so it is scoped to the title.",
+  "",
+  "The disc gives one pass: ptloop01's leaf runs t=0..600 and ptloop02's t=0..720,",
+  "each ending parked off-screen at x=1521 / -839. The port ran them once.",
+  "",
+  "THE ORACLE SAYS THEY LOOP ON THE TITLE. Across two title dwells the sweep quad",
+  "oscillates over its whole x range and resets hard to the same start value --",
+  "one reset inside the first dwell, two inside the second. A run-once-and-park",
+  "shows one traverse and then a constant x.",
+  "",
+  "🔴 THE LOOP-LENGTH FIELD CANNOT SETTLE THIS, and I had hoped it would.",
+  "`ptloop01` declares 600 with keyframes to exactly 600; `ptloop02` declares 720",
+  "to 720. SLACK ZERO -- and 'loops at 600' and 'runs once for 600 and stops'",
+  "write the identical header. 92.3% of records on the disc are in that state, so",
+  "the field discriminates loop length only where there IS slack, as the plate's",
+  "105-in-120 had.",
+  "",
+  "⚠️ THE MENUS ARE NOT COVERED, on purpose. Both declare the same 600/720, so",
+  "nothing on the disc distinguishes them -- but the oracle measurement is of the",
+  "title, and my own weak evidence points the other way for the menu: sweeping the",
+  "phase against live-main-menu.png, the port matches best with the sweeps",
+  "OFF-SCREEN (0.061%) and three times worse mid-screen (0.183%). If they looped",
+  "with a 600-unit period the sweep is on screen for roughly 73% of the cycle, so",
+  "a capture showing none is not nothing -- but it is one capture, and 'best",
+  "match' is a weak instrument for an absence. Two weak signals in opposite",
+  "directions is a reason to scope, not to pick.",
+  "",
+  "What settles the menu: a direct capture of it, which the Decoder has offered.",
+  "",
+  "🔴 RE-MEASURED 2026-08-31, BECAUSE THE EVIDENCE ABOVE WAS TAKEN WITH THE WRONG",
+  "BLEND. The phase sweep that produced '0.061 % off-screen, 0.183 % mid-screen'",
+  "drew the sweeps ALPHA-OVER. They are additive -- measured off the running game",
+  "the same day (`additive_elements`) -- so an on-screen sweep composited the wrong",
+  "way was being scored against the capture, and 'mid-screen is worse' could have",
+  "been an artefact of my own compositing rather than of the sweeps being absent.",
+  "",
+  "Re-run with additive sweeps and looping switched on for the menu, against",
+  "`live-main-menu.png`:",
+  "",
+  "    phase   0  0.0208 %   sweeps paint 0 px -- off screen",
+  "    phase 150  0.0851 %   sweeps paint 58 027 px, bbox 884x720",
+  "    phase 300  0.0205 %   sweeps paint 0 px -- off screen",
+  "    phase 75 / 225 / 375 / 450 / 525: 0.086..0.122 %",
+  "    run-once-and-park, which is what the port ships: 0.0208 %",
+  "",
+  "✅ THE CONCLUSION HELD AND GOT STRONGER. The ratio was 3x with the wrong blend",
+  "and is 4-6x with the right one, and the absolute numbers improved everywhere.",
+  "The capture still matches best with the sweeps NOT VISIBLE. So this entry stays",
+  "scoped to the title, and the correction is recorded rather than the scoping",
+  "changed.",
+  "",
+  "⚠️ It is still one capture and 'best match' is still a weak instrument for an",
+  "absence -- that caveat is not repaired by fixing the blend, only cleared of one",
+  "confound.",
+  "",
+  "📌 AND THE NEW DRAW LOG DOES NOT SETTLE IT EITHER, though it looks like it",
+  "should. `docs/re/captures/ui-draws/blend-main-menu-2026-08-31.log` shows both",
+  "sweep strips SUBMITTED on the main menu, in every frame group. That is not",
+  "evidence they animate there: a quad parked off-screen at x=1521 is still a draw",
+  "call. A DRAW IS NOT A VISIBLE ELEMENT, and reading that log as 'the sweeps run",
+  "on the menu' would have contradicted the pixels for no reason."
+ ],
+ "loop_leaf_kind": "measured",
+ "additive_elements_deleted_why": [
+  "✅ DELETED 2026-09-01, and the deletion is the point.",
+  "",
+  "This held `additive_elements`, a per-screen list of element ids transcribed",
+  "from the Decoder's per-draw RB_BLENDCONTROL0 log. PORT-MISSION section 3: 'When",
+  "the RE agent later decodes something you had authored, delete the authored",
+  "entry and let the exporter emit it. That deletion is the measure of progress.'",
+  "",
+  "The blend is now DECODED -- `T8aD +0x04` bit 0x02, docs/re/structures/",
+  "ui-blend-mode-decoded.md -- and reachable since formats-pin-2026-09-01 exposed",
+  "`ui_layout::sprite_blend_additive` and `blend_additive_by_name`. The exporter",
+  "emits `blend_additive` per element and per nested focus/leaf element, and",
+  "ScreenView reads it there.",
+  "",
+  "🔴 CHECKED BEFORE THE SWAP, and the map turned out to be a SUBSET rather than",
+  "the answer. Over main_menu, extras, press_start and title:",
+  "",
+  "  15  the map called additive AND the disc agrees",
+  "   0  the map called additive and the disc does not   <- no contradictions",
+  "  17  the disc calls additive and the map did not",
+  "",
+  "So nothing transcribed was wrong; it was incomplete, and was being read as",
+  "complete. The 17 include `pteff03`/`pteff03a` -- the sweep LEAVES, which are",
+  "what `draw_leaf_for` actually puts on screen while the map listed their parents",
+  "`ptloop01`/`ptloop02` -- and TWELVE on `title`, where this map was deliberately",
+  "empty and the port therefore drew every title effect alpha-over.",
+  "",
+  "A name-keyed map can only answer for a screen somebody drove the game to. That",
+  "is what made the Japanese menus an open question (BLOCKED.md H6): the port drew",
+  "main_menu additive and main_menu_jp alpha-over, asserting by omission that the",
+  "JP build blends differently. The bit is on the disc for every screen at once, so",
+  "that asymmetry is now answered statically and H6 needs no capture."
+ ]
+}

authored/screen_names.json

@@ -1,190 +1,94 @@
 {
-  "format": "sylpheed.screen_names/1",
-  "_": [
-    "Which GP_TITLE pak entry is which screen. AUTHORED: the disc does not name its",
-    "builds, so every name here is a decision. The identifications come from",
-    "HANDOFF Q2 (ui-title-build-map.md), which measured them against framebuffer",
-    "captures of the running game; the exporter stamps the name into the screen",
-    "file with name_source: \"authored\" so a reader can tell a recovered name from",
-    "an invented one.",
-    "",
-    "KEYED BY PAK ENTRY INDEX, not by the enumeration ordinal. It used to be the",
-    "ordinal; widening the enumeration to reach the splash renumbers ordinals, and",
-    "a name that moves when the enumeration rule changes is not a name. The entry",
-    "was always described here as the stronger locator -- now it is the only",
-    "stable one.",
-    "",
-    "Delete an entry here the day the RE agent decodes a name field."
-  ],
-  "export_archives": [
-    "dat/GP_TITLE.pak",
-    "dat/GP_OPTIONS.pak",
-    "dat/GP_SAVE_LOAD.pak"
-  ],
-  "export_archives_why": [
-    "WHICH disc archives the export reads screen builds from.",
-    "",
-    "GP_TITLE was the only one for the whole project, hardcoded in the",
-    "exporter. That single constant is why four of the five main-menu",
-    "destinations are dead: authored/flow.json records LOAD GAME, TUTORIAL,",
-    "OPTIONS and NEW GAME's difficulty chain as MEASURED destinations,",
-    "blocked only because 'there is no screen file to go to'.",
-    "",
-    "GP_OPTIONS ADDED 2026-09-03, and deliberately alone. The probe",
-    "(crates/sylpheed-export/examples/probe_archives.rs) finds screen builds",
-    "in 24 archives with the EXISTING detector -- GP_OPTIONS 14,",
-    "GP_SAVE_LOAD 18, GP_DIALOG 105, GP_TUTORIAL 2. Adding all four at once",
-    "would land 139 new screens together and make any regression",
-    "unattributable, so this takes the smallest archive first.",
-    "",
-    "\u26a0\ufe0f is_build() PARSING IS NOT RENDERING. It says the record is a build,",
-    "not that its sprites resolve or that anyone has identified the screen.",
-    "Unnamed builds export as build_NN by entry index. Expect names to be",
-    "wrong-looking until someone drives the game to them; that is a naming",
-    "gap, not a decode failure.",
-    "",
-    "GP_SAVE_LOAD ADDED 2026-09-03, again alone. 18 builds. It is main_menu",
-    "ptbtn02 (LOAD GAME)'s destination, recorded in authored/flow.json as a",
-    "MEASURED destination blocked only by 'not a GP_TITLE build'. It may also",
-    "hold SELECT DATA, the second screen of the NEW GAME chain, but that is a",
-    "guess from the name until the screens are rendered and read.",
-    "",
-    "\u26a0\ufe0f OUT OF SCOPE ON PURPOSE: GP_HANGAR_ARSENAL (390 builds), the",
-    "GP_MAIN_GAME_* set and the rest of the gameplay archives. MISSION",
-    "section 7 scopes gameplay out, and a screen that parses is not a screen",
-    "this milestone wants."
-  ],
-  "archives": {
-    "dat/GP_TITLE.pak": {
-      "2": {
-        "name": "press_start",
-        "why": "HANDOFF Q2: builds 2/3 are the PRESS (A) BUTTON plate -- a build of its own, composited over the title and faded in a beat later. English of the EN/JP pair. Measured against a live capture. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "3": {
-        "name": "press_start_jp",
-        "why": "HANDOFF Q2: the Japanese twin of build 2. Out of scope for this milestone; named so it is not mistaken for a screen we need. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "4": {
-        "name": "title",
-        "why": "HANDOFF Q2: build 4 is the English title art. Measured against a live capture. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "5": {
-        "name": "main_menu",
-        "why": "HANDOFF Q2: builds 5/8 are the five-button main menu; 5 is English. Measured against a live capture. (An earlier reading called 8 a submenu and was withdrawn -- 8 is the Japanese main menu.) \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "6": {
-        "name": "extras",
-        "why": "HANDOFF Q2: builds 6/9 are the EXTRAS submenu, the only submenu inside this archive. Measured against a fresh EXTRAS capture. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "7": {
-        "name": "title_jp",
-        "why": "HANDOFF Q2: the Japanese twin of build 4. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "8": {
-        "name": "main_menu_jp",
-        "why": "HANDOFF Q2: the Japanese twin of build 5. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "9": {
-        "name": "extras_jp",
-        "why": "HANDOFF Q2: the Japanese twin of build 6. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "10": {
-        "name": "publisher_logo",
-        "why": "The SQUARE ENIX PUBLISHER wordmark -- the FIRST thing the boot sequence shows, before the developer logos. Measured by the RE agent 2026-08-29, render grid at docs/re/captures/title-builds/splash-both-halves-rendered.png. Entries 10/13 are region twins distinguished by the trademark glyph; 10 carries the (TM). \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "13": {
-        "name": "publisher_logo_r",
-        "why": "The region twin of entry 10, carrying (R) where 10 carries (TM). Named so it is not mistaken for a second screen the boot path needs. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "11": {
-        "name": "developer_logos",
-        "why": "The GAME ARTS / SETA / studio anima logos -- the developer splash, shown after the publisher wordmark. HANDOFF Q2 and the RE agent's 2026-08-29 render grid; draws 7/7 elements. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "14": {
-        "name": "developer_logos_r",
-        "why": "The region twin of entry 11, as 13 is to 10. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      }
-    },
-    "dat/GP_OPTIONS.pak": {
-      "3": {
-        "name": "sound_settings",
-        "why": "SOUND SETTINGS -- Music/Movie/Voice/SFX Volume. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "4": {
-        "name": "control_settings",
-        "why": "CONTROL SETTINGS -- Control Type, Throttle, sensitivities, Vibration. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "5": {
-        "name": "sound_settings_jp",
-        "why": "\u30b5\u30a6\u30f3\u30c9\u8a2d\u5b9a, the JP pair of entry 3. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "6": {
-        "name": "screen_settings",
-        "why": "Gamma Correction with R/G/B and a NEXT PAGE affordance. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "7": {
-        "name": "screen_settings_page2",
-        "why": "White Level / Black Level Adjust, PREVIOUS PAGE. Page 2 of entry 6. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "8": {
-        "name": "control_settings_jp",
-        "why": "\u64cd\u4f5c\u8a2d\u5b9a, the JP pair of entry 4. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "9": {
-        "name": "screen_settings_jp",
-        "why": "\u30ac\u30f3\u30de\u88dc\u6b63\u30ec\u30d9\u30eb, the JP pair of entry 6. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "10": {
-        "name": "screen_settings_page2_jp",
-        "why": "\u767d\u30ec\u30d9\u30eb/\u9ed2\u30ec\u30d9\u30eb\u8abf\u6574, the JP pair of entry 7. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "16": {
-        "name": "game_settings",
-        "why": "GAME SETTINGS -- Auto-Save, View Point, Radio Log, Subtitles. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "18": {
-        "name": "game_settings_jp",
-        "why": "\u30b2\u30fc\u30e0\u8a2d\u5b9a, the JP pair of entry 16. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "19": {
-        "name": "options",
-        "why": "\ud83d\udd34 THE OPTIONS ROOT. Rows: GAME SETTINGS, CONTROL SETTINGS, SOUND SETTINGS, SCREEN SETTINGS, BACK -- the four screens named here plus a back row. This is main_menu ptbtn04's destination. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "20": {
-        "name": "control_customize",
-        "why": "CUSTOMIZE -- per-action key remapping, reached from CONTROL SETTINGS. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "21": {
-        "name": "options_jp",
-        "why": "The JP OPTIONS root, pair of entry 19. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      },
-      "22": {
-        "name": "control_customize_jp",
-        "why": "\u30ad\u30fc\u30ab\u30b9\u30bf\u30de\u30a4\u30ba, the JP pair of entry 20. Named from the screen's OWN RENDERED TEXT. Each was exported, rendered by the port at rest and read: the title and row labels are legible English or Japanese. That is identification by CONTENT THE SCREEN STATES ABOUT ITSELF, not by position, size or ordinal -- the three this project has been burned by. Contact sheets were reviewed 2026-09-03; docs/port/options-screens.md."
-      }
-    }
-  },
-  "unnamed": {
-    "dat/GP_TITLE.pak": "Entries 0/1 and 12/15 are plates never seen running -- not in the boot path, not on any title-side screen, not in the attract loop (HANDOFF Q2). They export under their entry index rather than a name we would be inventing."
-  },
-  "also_export": {
-    "dat/GP_TITLE.pak": {
-      "10": {
-        "name": "publisher_logo",
-        "why": "LOCATED BY ENTRY INDEX, not by a rule. These four bundles declare their sprites directly and have no .rat layout child, so `is_build` cannot see them -- and the RE agent established that NO content rule can: design size fails (every extra composable bundle sampled is 1280x720, the same as every screen) and element count fails (fragments run 2..15 elements in GP_OPTIONS/GP_SAVE_LOAD while these are 3 and 7 -- the ranges overlap). Safe here and not in general: in GP_TITLE the widened set adds exactly these four and all four are real screens, zero fragments. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "11": {
-        "name": "developer_logos",
-        "why": "As entry 10: located by index because no content rule distinguishes a splash from a fragment. 7 elements, all drawn. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "13": {
-        "name": "publisher_logo_r",
-        "why": "As entry 10, region twin. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      },
-      "14": {
-        "name": "developer_logos_r",
-        "why": "As entry 11, region twin. \ud83d\udccc SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. \u26a0\ufe0f The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
-      }
-    }
+ "format": "sylpheed.screen_names/1",
+ "_": [
+  "Which GP_TITLE pak entry is which screen. AUTHORED: the disc does not name its",
+  "builds, so every name here is a decision. The identifications come from",
+  "HANDOFF Q2 (ui-title-build-map.md), which measured them against framebuffer",
+  "captures of the running game; the exporter stamps the name into the screen",
+  "file with name_source: \"authored\" so a reader can tell a recovered name from",
+  "an invented one.",
+  "",
+  "KEYED BY PAK ENTRY INDEX, not by the enumeration ordinal. It used to be the",
+  "ordinal; widening the enumeration to reach the splash renumbers ordinals, and",
+  "a name that moves when the enumeration rule changes is not a name. The entry",
+  "was always described here as the stronger locator -- now it is the only",
+  "stable one.",
+  "",
+  "Delete an entry here the day the RE agent decodes a name field."
+ ],
+ "archives": {
+  "dat/GP_TITLE.pak": {
+   "2": {
+    "name": "press_start",
+    "why": "HANDOFF Q2: builds 2/3 are the PRESS (A) BUTTON plate -- a build of its own, composited over the title and faded in a beat later. English of the EN/JP pair. Measured against a live capture. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "3": {
+    "name": "press_start_jp",
+    "why": "HANDOFF Q2: the Japanese twin of build 2. Out of scope for this milestone; named so it is not mistaken for a screen we need. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "4": {
+    "name": "title",
+    "why": "HANDOFF Q2: build 4 is the English title art. Measured against a live capture. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "5": {
+    "name": "main_menu",
+    "why": "HANDOFF Q2: builds 5/8 are the five-button main menu; 5 is English. Measured against a live capture. (An earlier reading called 8 a submenu and was withdrawn -- 8 is the Japanese main menu.) 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "6": {
+    "name": "extras",
+    "why": "HANDOFF Q2: builds 6/9 are the EXTRAS submenu, the only submenu inside this archive. Measured against a fresh EXTRAS capture. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "7": {
+    "name": "title_jp",
+    "why": "HANDOFF Q2: the Japanese twin of build 4. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "8": {
+    "name": "main_menu_jp",
+    "why": "HANDOFF Q2: the Japanese twin of build 5. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "9": {
+    "name": "extras_jp",
+    "why": "HANDOFF Q2: the Japanese twin of build 6. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "10": {
+    "name": "publisher_logo",
+    "why": "The SQUARE ENIX PUBLISHER wordmark -- the FIRST thing the boot sequence shows, before the developer logos. Measured by the RE agent 2026-08-29, render grid at docs/re/captures/title-builds/splash-both-halves-rendered.png. Entries 10/13 are region twins distinguished by the trademark glyph; 10 carries the (TM). 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "13": {
+    "name": "publisher_logo_r",
+    "why": "The region twin of entry 10, carrying (R) where 10 carries (TM). Named so it is not mistaken for a second screen the boot path needs. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "11": {
+    "name": "developer_logos",
+    "why": "The GAME ARTS / SETA / studio anima logos -- the developer splash, shown after the publisher wordmark. HANDOFF Q2 and the RE agent's 2026-08-29 render grid; draws 7/7 elements. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "14": {
+    "name": "developer_logos_r",
+    "why": "The region twin of entry 11, as 13 is to 10. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   }
   }
+ },
+ "unnamed": {
+  "dat/GP_TITLE.pak": "Entries 0/1 and 12/15 are plates never seen running -- not in the boot path, not on any title-side screen, not in the attract loop (HANDOFF Q2). They export under their entry index rather than a name we would be inventing."
+ },
+ "also_export": {
+  "dat/GP_TITLE.pak": {
+   "10": {
+    "name": "publisher_logo",
+    "why": "LOCATED BY ENTRY INDEX, not by a rule. These four bundles declare their sprites directly and have no .rat layout child, so `is_build` cannot see them -- and the RE agent established that NO content rule can: design size fails (every extra composable bundle sampled is 1280x720, the same as every screen) and element count fails (fragments run 2..15 elements in GP_OPTIONS/GP_SAVE_LOAD while these are 3 and 7 -- the ranges overlap). Safe here and not in general: in GP_TITLE the widened set adds exactly these four and all four are real screens, zero fragments. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "11": {
+    "name": "developer_logos",
+    "why": "As entry 10: located by index because no content rule distinguishes a splash from a fragment. 7 elements, all drawn. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "13": {
+    "name": "publisher_logo_r",
+    "why": "As entry 10, region twin. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   },
+   "14": {
+    "name": "developer_logos_r",
+    "why": "As entry 11, region twin. 📌 SOURCE, added 2026-09-01 in the uncited-why backfill: the four bundles are identified in docs/re/ui-title-build-map.md, and the ordinal-versus-entry distinction this entry depends on is docs/re/structures/build-ordinal-vs-entry.md. ⚠️ The sibling references below (\"as entry 10, region twin\") are a citation form too -- they point at another entry in this file rather than at a document, and forcing a path onto them would be mislabelling to satisfy a counter."
+   }
+  }
+ }
 }

authored/timing.json

@@ -1,59 +1,604 @@
 {
-  "format": "sylpheed.timing/1",
-  "keyframe_units_per_second": 60,
-  "why": [
-    "HANDOFF Q1. The disc says a keyframe is at `t=30`; it does not say what a",
-    "`t` is. The unit was MEASURED off the running game, not decoded: a declared",
-    "15-unit fade lands on round(255*k/15) for all seven of its samples with k",
-    "stepping 2,4,6,8,10,12,14 on seven consecutive submitted frames -- so 2",
-    "units per rendered frame -- and the idle title presents at 28.3-28.8 fps,",
-    "a 30 Hz game, giving 60 units per second. A second line agrees: the",
-    "transition quad is declared black for 12 units, and a capture measured the",
-    "pure-black plateau at 0.17-0.23 s, where 12/60 = 0.20 s.",
-    "",
-    "Expressed as units-per-second rather than seconds-per-unit so the value is",
-    "exact rather than a repeating decimal a reader has to recognise.",
-    "",
-    "DELETE THIS FILE when a field on the disc is found that states the unit.",
-    "Nothing here is on the disc."
+ "format": "sylpheed.timing/1",
+ "keyframe_units_per_second": 60,
+ "why": [
+  "HANDOFF Q1. The disc says a keyframe is at `t=30`; it does not say what a",
+  "`t` is. The unit was MEASURED off the running game, not decoded: a declared",
+  "15-unit fade lands on round(255*k/15) for all seven of its samples with k",
+  "stepping 2,4,6,8,10,12,14 on seven consecutive submitted frames -- so 2",
+  "units per rendered frame -- and the idle title presents at 28.3-28.8 fps,",
+  "a 30 Hz game, giving 60 units per second. A second line agrees: the",
+  "transition quad is declared black for 12 units, and a capture measured the",
+  "pure-black plateau at 0.17-0.23 s, where 12/60 = 0.20 s.",
+  "",
+  "Expressed as units-per-second rather than seconds-per-unit so the value is",
+  "exact rather than a repeating decimal a reader has to recognise.",
+  "",
+  "DELETE THIS FILE when a field on the disc is found that states the unit.",
+  "Nothing here is on the disc.",
+  "",
+  "🔴 DO NOT 'CORRECT' THIS AGAINST AN EMULATOR FRAME RATE. A draw-stream",
+  "measurement on 2026-08-29 found the presented units-per-frame rising 33 % over",
+  "a single boot (1.765 early, 2.357 late) and three independent readings of one",
+  "container's rate disagreeing with each other. That is the EMULATOR's",
+  "presentation pacing drifting, and no single units-per-frame figure describes a",
+  "run there.",
+  "",
+  "60 is a different quantity: the GAME's logical unit rate, measured off the",
+  "running game as HANDOFF Q1 (a declared t=30 landing on the linear value at",
+  "every one of seven sampled frames). The port renders at its own frame rate and",
+  "converts through this constant, so guest pacing cannot reach it. The two",
+  "numbers are not comparable and one is not evidence about the other.",
+  "",
+  "🔴 2026-09-01 — THE FIRST LEG ABOVE IS RETIRED. THE VALUE IS NOT.",
+  "",
+  "'2 units per rendered frame ... a 30 Hz game, giving 60 units per second' is a",
+  "FRAME-COUNT derivation, and the Decoder retired that mechanism the same day",
+  "(docs/re/units-per-second-measured.md): the same animation takes 21 frame",
+  "labels in one capture and 33 in another, and one splash logo steps +136,+34 in",
+  "one run and +17,+51,+34,+34,+17,+17 in the other. A fixed per-frame increment",
+  "cannot do that. The clock is TIME-INTEGRATED, not frame-counted, so `units =",
+  "2 x frames` computes an emulator artefact. The 2 was that run's frame pacing.",
+  "",
+  "✅ The port's RUNTIME was already right: `boot.gd` advances",
+  "`time_units += delta * units_per_second`, off delta time. Nothing in this port",
+  "derives a unit from a frame count. Audited 2026-09-01, and it is why the",
+  "retirement cost a justification and not a behaviour.",
+  "",
+  "✅ AND THE SECOND LEG NEVER TOUCHED A FRAME COUNT, which is why 60 survives:",
+  "the transition quad is declared black for 12 units and the capture bracketed",
+  "the pure-black plateau at 0.14-0.30 s (title-plate-delay-measured.md, at a",
+  "0.125 s sampling resolution). 12 units in 0.14-0.30 s is 40-86 units/s. That",
+  "is a declared unit count against a wall-clock duration, with no frames in the",
+  "chain -- and it EXCLUDES 120 units/s, which would need 0.10 s.",
+  "",
+  "✅ MEASURED DIRECTLY 2026-09-01: 56.8 units per guest second, control passing",
+  "at 1.15 %, from two elements agreeing at one clock (`ptbtn00` 657.9 alpha/s,",
+  "`ptcopyright` 650.4 alpha/s, which puts ptcopyright's segment at T = 22.25 --",
+  "a rate agreement AND a round declared length). 30 and 120 are both excluded.",
+  "",
+  "60 IS KEPT. 56.8 is 5.6 % away against a ~5 % quantisation resolution, so it",
+  "does not refute 60, and the Decoder explicitly did not ask for a change. The",
+  "reach is the TITLE: the splashes are a different GamePart and nothing yet shows",
+  "they tick at the same rate.",
+  "",
+  "⚠️ If anyone re-fits this from alpha: DROP THE LAST STEP of a ramp. It clamps",
+  "at 255 and reports more elapsed time than it consumed -- worth 4 % on the plate.",
+  "",
+  "🔴 2026-09-01 (later) — A PER-SCREEN RATE WAS PROPOSED AND NOT ADOPTED.",
+  "",
+  "docs/re/splash-declared-vs-captured.md proposes ~57 units/s for the title and",
+  "~35-40 for the splashes, i.e. that one constant cannot be right and that a",
+  "splash at 60 runs 1.5-1.7x too fast. THE PORT DID NOT MOVE, and the reason is",
+  "arithmetic on a measurement already cited in this file:",
+  "",
+  "  the 160-unit hold is the DEVELOPER splash's a=255 plateau, t=30..190, and it",
+  "  is measured at 4.514 s. The 210-unit group CONTAINING it is measured at",
+  "  3.37/3.50/3.51 s over three cold boots (the dwell_why block below). A",
+  "  sub-interval cannot outlast the interval containing it.",
+  "",
+  "The same three boots put the splashes at 57.7 and 60.7 units/s -- corroborating",
+  "60 on exactly the two screens the new figure puts at 35-39. At 35.4 the declared",
+  "groups would run 5.93 s and 7.20 s against corpus dwells of 3.37-3.51 and",
+  "4.30-4.60, i.e. each splash ~70 % longer than measured.",
+  "",
+  "⚠️ DO NOT ADOPT EITHER NUMBER UNTIL THAT IS RESOLVED, and do not split the",
+  "difference -- averaging two measurements that cannot both be true is not a",
+  "third measurement. docs/port/splash-rate-contradiction.md, asked as BLOCKED H7.",
+  "",
+  "⚠️ AND THE STRUCTURAL CLAIM MAY STILL BE RIGHT. 'One rate cannot cover every",
+  "screen' is a claim about the format, and the title's 56.8 does sit ~5 % off the",
+  "splashes' 58-61. If a per-screen rate is real this file should carry a MECHANISM",
+  "-- a field or a GamePart constant -- not two authored numbers. The Decoder has",
+  "'where the per-GamePart rate comes from' as its next item.",
+  "",
+  "🔴 2026-09-01 (later still) — RECLASSIFIED measured -> authored. THE VALUE DOES",
+  "NOT MOVE; THE LABEL WAS FALSE.",
+  "",
+  "The Decoder withdrew their guest-frame-rate finding the same day they published",
+  "it. ⚠️ THAT DOCUMENT IS NOT IN THIS CHECKOUT -- it is `guest-frame-rate-WITHDRAWN.md`",
+  "on their branch, named here in prose deliberately rather than in `source`:",
+  "`audit-kinds` flagged the first version of this entry DANGLING because I cited",
+  "a file I cannot read, which is exactly the check doing its job. The reading",
+  "below is from their message and is labelled as such.",
+  "It read the guest's presentation as 30 fps from a movie-frame ruler and",
+  "concluded 2 x 30 = 60. This file carried `kind: measured` on that strength.",
+  "`kind: measured` on the strength of it. It cannot any more.",
+  "",
+  "Three routes now disagree and at most one can be right:",
+  "",
+  "  withdrawn movie cadence          60 units/s",
+  "  vblank cadence (Xenia, 60 Hz)   ~120",
+  "  title-plate-delay, 120 units      ~56   -- two runs agreeing to 6 ms",
+  "",
+  "⚠️ 60 IS KEPT ANYWAY, and it is not a coin toss between the three. The one leg",
+  "of this file's own reasoning that never touched a frame count still stands and",
+  "still brackets it: the transition quad is declared black for 12 units and the",
+  "capture measured the plateau at 0.14-0.30 s, i.e. 40-86 units/s. 60 sits inside",
+  "that; 120 does not. And ~56 is 7 % from 60, inside the same bracket.",
+  "",
+  "So the honest statement is: 60 is AUTHORED, bracketed by one surviving",
+  "frame-free measurement, and consistent with the nearest of the three live",
+  "routes. It is no longer 'measured', and anything that cited it as measured is",
+  "citing a withdrawal.",
+  "",
+  "📌 THE METHOD NOTE IS WORTH MORE THAN THE NUMBER, and it is the Decoder's: their",
+  "pre-registration named three ways the ruler could lie and guarded two. The third",
+  "occurred, and a PERFECT 1.0000 is exactly what it produces -- a triple buffer",
+  "rotating once per present gives run-length 1 at any frame rate. Both guards",
+  "tested how the buffer was READ, neither tested whether a change meant a decode.",
+  "",
+  "  A clean result on an instrument whose key assumption is unguarded is not",
+  "  confirmation. The cleanness may be the failure mode's own signature.",
+  "",
+  "Same family as this port's non-inverting latch check, which passed for the wrong",
+  "reason until its control failed.",
+  "",
+  "🔴 2026-09-01 — THE 12-UNIT BRACKET ABOVE IS WITHDRAWN. IT EXCLUDES NOTHING.",
+  "",
+  "I kept 60 on the ground that '12 declared units measured at 0.14-0.30 s gives",
+  "40-86 units/s, so 120 is excluded'. The Decoder refuted it and the refutation",
+  "holds on arithmetic I checked myself:",
+  "",
+  "  the source doc says of that number, in its own words, 'at a sampling",
+  "  resolution (0.125 s) that cannot do better'. 120 units/s predicts 12 units in",
+  "  0.100 s -- BELOW one sample interval. A 0.125 s sampler cannot resolve it and",
+  "  reports about one sample, ~0.125-0.14 s. The 0.14 s low end is the",
+  "  INSTRUMENT'S FLOOR, and 12/0.14 = 85.7 is an upper bound produced by dividing",
+  "  by a floored duration. It is the value 120 predicts once the sampler is",
+  "  accounted for.",
+  "",
+  "🔴 AND THE DEEPER ERROR IS MINE, NOT THE ARITHMETIC. I argued the leg survived",
+  "because it 'never touched a frame count'. True, and INSUFFICIENT: every",
+  "wall-clock duration off Canary is true/speed_factor, so apparent units/s =",
+  "true x speed -- and the speed factor is precisely what makes the three routes",
+  "disagree. I checked the leg for the WRONG CONTAMINANT. Frame-free is not",
+  "clock-free, and on this emulator clock-free is the property that matters.",
+  "",
+  "What actually survives from that leg, and it is the half I did not lead with:",
+  "the declared 12 units are independently confirmed as SIX FRAMES by",
+  "screen-transitions.md's 255/6-per-frame ramp. No wall clock in it at all. That",
+  "is evidence about units per FRAME -- which was never in dispute -- and silent",
+  "about units per second.",
+  "",
+  "SO 60 HAS NO SURVIVING BRACKET. It stays because nothing supports 120 either and",
+  "moving a shipped timeline on no evidence is worse than leaving it. That is a",
+  "default, not a derivation, and this entry now says so. `kind` is already",
+  "`authored`, which is the honest label for a default.",
+  "",
+  "🟡 2026-09-01 — 120 units/s IS NOW MEASURED, AND THIS PORT HAS NOT MOVED.",
+  "",
+  "The Decoder's content-hash experiment gives 120 (2 units/present x 60",
+  "presents/s), with the controls the withdrawn version lacked -- a static texture",
+  "hashing constant, 1 change in 403 samples, and movie luma not constant, 102",
+  "distinct hashes. Pre-registered bands, and the observed 0.5739 falls inside",
+  "them. It is a better experiment than either of the two it replaces.",
+  "",
+  "IT IS ALSO THEIR THIRD POSITION ON THIS NUMBER IN ONE DAY, reach is one boot,",
+  "and they said themselves that a second independent boot before a timeline is",
+  "rewritten is the defensible call. Agreed. 60 stays for now.",
+  "",
+  "⚠️ 60 IS NOT DEFENDED EITHER -- its bracket was withdrawn this morning. Both",
+  "numbers are undefended; the port keeps the one it ships because switching on a",
+  "single capture is a worse failure than holding on none. That is the whole",
+  "reasoning and it is not evidence about the game.",
+  "",
+  "✅ AUDITED, SO THE SWITCH IS CHEAP WHEN IT COMES: no seconds are baked into the",
+  "timeline anywhere. Every second this port prints or acts on is computed as",
+  "units / keyframe_units_per_second at the point of use. audio.json's loop_start_s",
+  "and loop_end_s ARE seconds and correctly do NOT follow this constant -- they are",
+  "positions in an audio file with no keyframe unit in them.",
+  "",
+  "🔴 One exception found and fixed: tools/port/verify-dwell read black_hold_units",
+  "from this file 'so it cannot drift again' and then divided by a literal 60.0.",
+  "The value could not drift; the conversion could.",
+  "",
+  "📌 THE FALSIFIER IS PRE-REGISTERED in docs/port/units-per-second-switch-readiness.md:",
+  "at 120 the publisher splash runs 2.13 s and the developer 1.75 s, against three",
+  "cold boots measuring 4.30/4.60/4.37 and 3.51/3.50/3.37. 120 and the dwell corpus",
+  "cannot both be right in wall-clock seconds -- the same collision that killed the",
+  "35 units/s proposal from the other direction.",
+  "",
+  "✅ 2026-09-01 (final position of the day) — 120 IS WITHDRAWN BY ITS AUTHOR AND 60",
+  "IS POSITIVELY SUPPORTED. The port never moved, so nothing has to be undone.",
+  "",
+  "The mechanism is worth more than the number: `units per present` HALVED when the",
+  "present rate doubled (Δα +34 at 27.2 presents/s, +17 at 51.4) while units per",
+  "second did not move (54.4 vs 51.4). The UI clock advances by elapsed TIME, not",
+  "by frame count -- so '2 units per frame' was never a property of the game, only",
+  "of a capture that happened to run at 27 fps. The 120 was 2 units/present x 60",
+  "presents/s, and the first factor is not a constant, so the product was not a",
+  "rate.",
+  "",
+  "Their write-up is `units-per-frame-is-not-a-constant.md`, under docs/re/ on",
+  "their branch. 🔴 NOT IN THIS CHECKOUT, so it is named WITHOUT a resolvable",
+  "path -- `tools/port/check-citations` flagged the first version of this very",
+  "paragraph as DANGLING, in the entry where I was recording the lesson about",
+  "dangling citations. The check does not care about a disclaimer, which is",
+  "correct: a path that does not resolve does not resolve.",
+  "",
+  "✅ 2026-09-01 (settled) — THE GAME'S CLOCK IS FRAME-BASED, 1 UNIT PER PRESENT.",
+  "Measured by the Decoder with a DESIGNED experiment rather than an inference:",
+  "`--framerate_limit=30` halved units/second to 30.2, doubled the publisher dwell",
+  "to 8.450 s, and left the modal alpha step at 17 where a time-based clock",
+  "predicts 34. Both controls passed first -- the limiter demonstrably took effect,",
+  "and all 8 splash quad rects were identical, so nothing but the frame rate",
+  "differed. `255 x 1 / 15 = 17` at 28.4, 51.4 and 54.8 presents/s alike.",
+  "",
+  "⚠️ THIS CHANGES WHAT 60 MEANS HERE, AND MAKES IT MORE FALSIFIABLE. If the game",
+  "advances 1 unit per present, its units/second IS its present rate. So",
+  "`keyframe_units_per_second = 60` is now equivalent to the claim:",
+  "",
+  "    the game presented these screens at 60 Hz on the console.",
+  "",
+  "That is a sharper statement than 'the unit is 1/60 s' and it is checkable.",
+  "",
+  "✅ AND IT IS SUPPORTED, which the constant has not been until now. Canary",
+  "unlimited presents at 51-55 Hz and the splash dwell is 4.30/4.60/4.37 s over",
+  "three cold boots. A natively 30 Hz game would present at ~30 in Canary too --",
+  "which the framerate_limit run confirms, since forcing 30 made the same splash",
+  "take 8.45 s. It does not take 8.45 s unforced. So the game asks for ~60, not 30.",
+  "",
+  "🔴 AND THAT CLOSES THE CONSTANT AS A CAUSE OF 'THE PLATE IS LATE', for a NEW",
+  "reason and in the direction that matters. Under the frame-based model the only",
+  "alternative console rate is 30 Hz, which puts the plate at 236/30 = 7.87 s --",
+  "LATER than the 3.93 s the port ships, not earlier. There is no console present",
+  "rate that makes the plate arrive sooner than it already does here.",
+  "",
+  "⚠️ KEPT AS `authored`, NOT PROMOTED TO `measured`. The chain is inference over",
+  "three measurements (frame-based clock; Canary's unlimited present rate; the",
+  "dwell corpus) rather than a measurement of units per second. It becomes",
+  "`measured` the day someone reads the console's present rate for these screens",
+  "directly.",
+  "",
+  "📌 AND THE PORT'S OWN DESIGN IS DELIBERATELY NOT THE GAME'S, which is worth",
+  "stating so nobody 'fixes' it. The game is frame-based; this port is time-based",
+  "(`time_units += delta * units_per_second`). They agree at 60 fps, which is the",
+  "only rate the console ever asked the game to be right at. A time-based port",
+  "reproduces a 60 Hz console on hardware that is not 60 Hz; a frame-based port",
+  "would drift on every machine that is not -- and this port has measured itself at",
+  "9.7 to 69.4 fps depending on the renderer. DO NOT make the port frame-based to",
+  "match the game.",
+  "",
+  "✅ 2026-09-02 — 60 NOW STANDS ON A THIRD INDEPENDENT ROUTE, and the REASON",
+  "changed again while the value did not.",
+  "",
+  "The Decoder reconciled three of their own pages that held incompatible",
+  "positions -- 2 units per guest frame, time-integrated at 56.8, and 1 unit per",
+  "present -- with one mechanism: THE CLOCK ADVANCES ONE UNIT PER VBLANK, and",
+  "presents may be dropped without the clock caring. That explains steps that are",
+  "always multiples of 17 (1, 2 or 3 vblanks between two logged presents), and the",
+  "same animation spanning 21 labels in one capture and 33 in another, which a",
+  "strict per-present clock cannot produce.",
+  "",
+  "Their rate result is a MANIPULATION rather than an observation: 255 declared",
+  "units take 4.263/4.162 s at a 60 Hz vblank and 8.450 s at --framerate_limit=30",
+  "-- 59.8/61.3 against 30.2 units/s. So the vblank rate sets the unit rate, and a",
+  "console vblanks at 60.",
+  "",
+  "So the justification for 60 has now been: '2 units per rendered frame' (retired),",
+  "'the game presents at 60 Hz' (superseded), and now 'one unit per 60 Hz vblank'.",
+  "THE NUMBER HAS NEVER MOVED. That is worth noticing rather than celebrating -- a",
+  "value whose reason changes three times while it survives is either robust or",
+  "under-constrained, and the honest label is still `authored`.",
+  "",
+  "📌 THIS PORT INSTANTIATES THEIR NULL MODEL, which is the one thing this side can",
+  "contribute to that argument. Their reasoning turns on 'a time-integrated clock",
+  "predicts 4.25 s in BOTH conditions'. This port IS a working time-integrated",
+  "clock at 60 units/s, and its splash dwell across a 4.0x change in its own",
+  "rendering rate is 4.28 / 4.26 / 4.27 / 4.26 s -- flat to 0.5 %. So their",
+  "counterfactual is demonstrated rather than assumed. ⚠️ It is evidence about the",
+  "NULL, not about the game; it says what a time-integrated clock does, not what",
+  "the game's clock is.",
+  "",
+  "🟡 PER-VBLANK VS PER-PRESENT IS STILL OPEN, and they name the discriminating",
+  "experiment (log Xenia's vblank counter beside each present). ⚠️ IT IS",
+  "IMMATERIAL TO THIS PORT AND THEY SHOULD NOT RUN IT ON THE PORT'S ACCOUNT. The",
+  "two models differ only when the console DROPS a present: per-vblank keeps",
+  "real-time pace through a drop, per-present slows. This port is time-based, so",
+  "it matches per-vblank exactly and would run marginally ahead of per-present",
+  "during drops only. On a console presenting every vblank the two coincide, and",
+  "the screens in question are a handful of quads.",
+  "",
+  "🔴 2026-09-02 (later) — 'A THIRD INDEPENDENT ROUTE' IS WITHDRAWN BY ITS AUTHOR.",
+  "The paragraph above says 60 now stands three ways. It does not, and I recorded",
+  "the claim before challenging it hard enough.",
+  "",
+  "I raised that three routes to one number are weaker than they look if they share",
+  "an upstream assumption -- vblank rate, present rate and declared dwell are not",
+  "obviously independent. The Decoder audited it and agreed: route B needs 'the",
+  "guest presents 60x/s', which comes from the vblank histogram UNDER XENIA'S 60 Hz",
+  "LIMITER; route C needs 'the vblank is 60 Hz', which is that limiter's cvar; route",
+  "D is a wall-clock duration that lands on 60 only BECAUSE the vblank is 60 Hz.",
+  "All three reduce to one upstream fact: the display refreshes 60 times a second",
+  "on that emulator. One witness in three coats.",
+  "",
+  "✅ WHAT SURVIVES IS CONDITIONAL AND BETTER, and it is established by MANIPULATION",
+  "rather than agreement -- forcing 30 Hz gave 30.2 units/s, 60 Hz gives 59.8/61.3:",
+  "",
+  "    units per second = THE DISPLAY REFRESH RATE.",
+  "",
+  "It becomes '60' only through a fact this corpus has never measured: an Xbox 360",
+  "outputs 60 Hz. That is a hardware specification. It is solid, and it belongs",
+  "CITED as a spec rather than folded in as a third measurement.",
+  "",
+  "📌 And the conditional form is the one that justifies this port's construction",
+  "rather than excusing it. 'units/s = refresh rate' says what to do on hardware",
+  "that is NOT 60 Hz, which is exactly why a time-based clock at a fixed 60 units/s",
+  "is right and a frame-based one would drift. `kind` stays `authored`: nothing",
+  "here promotes it, and the reason it is not `measured` is now sharper -- the",
+  "measurement is of a RELATIONSHIP, and the constant that closes it comes from a",
+  "datasheet."
+ ],
+ "kind": "authored",
+ "source": "docs/re/ui-keyframe-time-unit.md, docs/port/HANDOFF.md",
+ "ramp": "linear",
+ "ramp_why": [
+  "Also HANDOFF Q1, and part of the same measurement: the fade lands on the",
+  "linear value at every one of the seven sampled frames, so there is no ease."
+ ],
+ "ramp_kind": "measured",
+ "dwell_seconds": null,
+ "dwell_why": [
+  "NOT SET -- because the dwell is DECLARED, and the port already plays it.",
+  "",
+  "This key has now been wrong in two opposite directions, and the second was",
+  "mine, so both are recorded.",
+  "",
+  "It first said 'a screen's dwell is its OWN keyframe group'. Then GP_TITLE",
+  "build 4 was measured dwelling ~1100 presented frames against a declared ~120,",
+  "and I generalised that into 'the boot is KNOWN TOO FAST [refuted] on both splashes'.",
+  "🔴 THAT WAS AN OVER-CORRECTION and it is withdrawn. Build 4 is the title: its",
+  "exit is caused by something outside its timeline, so it holds. A splash's exit",
+  "is caused by nothing, so it plays its declared timeline and leaves. The title",
+  "is the exception, not the rule, and one screen was never enough to overturn",
+  "the other two.",
+  "",
+  "MEASURED 2026-08-29 by the Decoder over 3 cold boots",
+  "(docs/re/structures/boot-splash-dwells-are-declared.md):",
+  "",
+  "  publisher  declared t=0..255 = 4.250 s   corpus 4.30 / 4.60 / 4.37",
+  "  developer  declared t=0..210 = 3.500 s   corpus 3.51 / 3.50 / 3.37",
+  "",
+  "The developer agrees to 1.1 %, two of its three runs to 0.3 %.",
+  "",
+  "🔴 CORRECTED 2026-09-01. This said: 'The port emits 4.400 s and 3.650 s -- each",
+  "declared value plus the 9-unit black hold, exactly. So the pacing was right all",
+  "along and nothing changes in the code.' THE PORT DOES NOT DO THAT, and this",
+  "file is what stops it: `black_hold_units` is 0, set deliberately (see",
+  "black_hold_why -- a uniform value is positively excluded and only an",
+  "ordered-pair key survives). There is no 9-unit hold to add, so the sentence",
+  "described a behaviour asserted three keys above it and refused one key below.",
+  "",
+  "MEASURED off the shipping boot, three runs, 2026-09-01:",
+  "",
+  "  publisher  declared 255 units = 4.250 s   4.28 / 4.26 / 4.27  mean 4.270 s",
+  "  developer  declared 210 units = 3.500 s   3.50 / 3.57 / 3.51  mean 3.527 s",
+  "",
+  "Residuals +1.2 and +1.6 units -- frame granularity on the exit check, not a",
+  "hold. The claimed 4.400 and 3.650 are each ~0.13 s longer than what has been",
+  "shipping since P3. Against the corpus (4.42 and 3.46 means) neither the claimed",
+  "nor the measured figure dominates: the port is 3.4 % short on the publisher and",
+  "2.0 % long on the developer, the claim would be 0.5 % short and 5.5 % long. So",
+  "this corrects a false statement about our own behaviour; it does not settle",
+  "whether a hold belongs there. That is still black_hold_why's ordered-pair ask.",
+  "",
+  "🔴 AND THE UNIT STAYS UNITS, NOT SECONDS. The same two dwells timed in the",
+  "Decoder's own container came out 15-20 % LONGER than both the declared values",
+  "and the corpus -- same disc, same timeline -- and three independent readings",
+  "of that container's rate disagree with each other. A seconds figure records",
+  "one emulator's pacing on one run. The units are on the disc. If anything ever",
+  "goes in `dwell` it is an extra hold in UNITS, and only for a screen that is",
+  "measured to wait beyond its group.",
+  "",
+  "🔴 2026-09-01 (later) — 'So the pacing was right all along and nothing changes in",
+  "the code' IS CONDITIONAL, AND MAY BE A COINCIDENCE OF TWO CANCELLING ERRORS.",
+  "",
+  "That sentence rests on the port's total screen time matching the corpus dwells.",
+  "It does: 4.270 s against 4.30/4.60/4.37 and 3.527 s against 3.51/3.50/3.37.",
+  "",
+  "But a TOTAL cannot see two errors of opposite sign inside it. Measured:",
+  "",
+  "  the port's screen time IS its animation time. publisher 4.270 s against a",
+  "  4.250 s animation -- a hold of +0.020 s, i.e. none. The port does not hold",
+  "  after a splash timeline at all.",
+  "",
+  "  the GAME does: the Decoder counts the publisher on screen for 219 presents and",
+  "  animating for ~128 of them, about 42 % hold.",
+  "",
+  "So IF keyframe_units_per_second is 120 rather than 60, this port animates every",
+  "splash 2x too slow AND omits the hold entirely, and the two sum to almost exactly",
+  "the right total. The agreement above would then be evidence of nothing.",
+  "",
+  "⚠️ THE HOLD AND THE CONSTANT ARE COUPLED. At 60 the port must NOT gain a hold --",
+  "the animation already fills the screen time and a hold would overshoot by ~40 %.",
+  "The missing hold is a defect only if 120 is right. They stand or fall together,",
+  "which is another reason not to move on one capture.",
+  "",
+  "📌 And when it does move it is TWO changes, not one: the constant, and a hold",
+  "measured as (screen presents - animation presents). It must NOT be inferred from",
+  "the total, because the total is precisely the quantity that cannot distinguish",
+  "the two errors. docs/port/units-per-second-switch-readiness.md.",
+  "",
+  "✅ 2026-09-01 (later still) — THE PARAGRAPH ABOVE IS WITHDRAWN. 'The pacing was",
+  "right all along' WAS right all along.",
+  "",
+  "I claimed the dwell agreement might be a coincidence of two cancelling errors --",
+  "a 2x-slow animation plus a missing hold. There is no missing hold. I misread a",
+  "presents split from the Decoder's instrument ('219 on screen, ~128 animating')",
+  "as a hold OUTSIDE the declared timeline. It is a split WITHIN it: the publisher",
+  "ramps 0-30, HOLDS 30-235 (205 units, 80.4 % of the screen) and fades 235-255,",
+  "and this port plays all three.",
+  "",
+  "Measured rather than read -- frozen samples of the logo region across the",
+  "publisher splash: 0.405488 at t=60, 120, 180 and 228 units, identical to six",
+  "decimals across 168 units, with 0.391 at t=15 (mid-ramp) and 0.038 at t=252",
+  "(in the exit fade). The hold is there and it is played.",
+  "",
+  "⚠️ The failure was not a mis-measurement. I took a two-part split from someone",
+  "else's instrument and assumed its boundary sat where my own model put it.",
+  "Presents are not units, and 'animating vs holding' in presents does not",
+  "decompose the same way as 'ramp vs hold' in declared units.",
+  "",
+  "AND THE DWELL FIGURES HERE ARE NOW POSITIVE EVIDENCE, not merely survivors. A",
+  "time-based clock is immune to dropped frames, so a dwell measured in seconds is",
+  "stable across runs at different frame rates. This port's own splash dwell across",
+  "a 4.0x change in its rendering rate: 4.28 s at 17.3 fps, 4.26 at 19.6, 4.27 at",
+  "25.0, 4.26 at 69.4 -- a 0.5 % spread, putting 255 units at 59.6-59.9 units/s",
+  "every time. That establishes these dwells are frame-rate-independent",
+  "MEASUREMENTS rather than artefacts of whatever rate a run hit, which is the",
+  "property the Decoder's argument needs of them.",
+  "",
+  "✅ 2026-09-02 — THE +1.2 / +1.6 UNIT RESIDUAL WAS FRAME GRANULARITY, and that is",
+  "now measured rather than inferred.",
+  "",
+  "The dwells were recorded as 4.270 s and 3.527 s against declared 4.250 and 3.500",
+  "-- residuals of +1.2 and +1.6 units -- and I attributed them to the granularity",
+  "of the exit check without testing it. A hardware GPU makes that testable: same",
+  "boot, same declared groups, three runs at 65-66 fps instead of 17-25.",
+  "",
+  "Pre-registered: if the residual is frame granularity it should shrink roughly",
+  "with the frame rate, so <= 0.5 units at 65 fps. Measured:",
+  "",
+  "  publisher  4.27 / 4.26 / 4.27  mean 4.253 s  residual +0.20 units",
+  "  developer  3.50 / 3.52 / 3.50  mean 3.500 s  residual +0.00 units",
+  "",
+  "From +1.2 and +1.6 down to +0.20 and +0.00. The prediction held and the",
+  "attribution is no longer an assumption. ⚠️ It also means the figures quoted",
+  "elsewhere in this corpus as 4.270 / 3.527 carry a rendering-rate term; the",
+  "declared values are what the port actually targets and 4.250 / 3.500 is what it",
+  "hits when the renderer keeps up."
+ ],
+ "dwell_kind": "measured",
+ "looping_focus_records": {
+  "_": [
+   "WHICH focus records the port draws, unconditionally and on a loop, OVER the",
+   "element's own sprite rather than instead of it.",
+   "",
+   "RESTORED 2026-08-30 on a MEASUREMENT, having been deleted on 2026-08-29 for",
+   "a real defect that was in the RENDERER, not in this table. The old entry made",
+   "`_draw` substitute the glow for the plate's own bright sprite, so the plate",
+   "was invisible at every instant (max 0 against max 252.5). `ScreenView` now",
+   "draws the base and the record over it, and the entry comes back."
   ],
-  "kind": "measured",
-  "source": "/reborn docs/port/HANDOFF.md Q1, docs/re/ui-keyframe-time-unit.md",
-  "ramp": "linear",
-  "ramp_why": [
-    "Also HANDOFF Q1, and part of the same measurement: the fade lands on the",
-    "linear value at every one of the seven sampled frames, so there is no ease."
-  ],
-  "exit_ramp_seconds": 0.4,
-  "exit_ramp_why": [
-    "HANDOFF Q7 + the RE agent's 2026-08-29 answer. MEASURED, not on the disc.",
+  "press_start/ptbtn00": {
+   "record_element": "ptbtn00f",
+   "period_units": 120,
+   "kind": "measured",
+   "source": "docs/re/structures/plate-pulse-measured.md, RE agent 2026-08-30",
+   "why": [
+    "MEASURED off the running game, held at the title with NO INPUT: the plate",
+    "oscillates continuously -- two windows in one boot of 58 s and 57 s, about",
+    "23 cycles each, with no decay and no settling.",
     "",
-    "Every element of a screen ends on exactly ONE untimed keyframe, so there is",
-    "exactly one unknown duration per screen -- the ramp INTO that final keyframe.",
-    "This is that duration. ~0.4 s, which is 24 units at 60 units/s.",
+    "🔴 IT NEVER GOES OFF. The plate-absent floor is 159 thresholded green",
+    "pixels -- the title art's own, measured on live-title-build4-no-plate.png --",
+    "and the pulse bottoms at 714, four and a half times that. So `ptbtn00`",
+    "going transparent at t=244 is not the end of the plate; that is its EXIT",
+    "ramp, which plays when the screen leaves. While the screen is held the base",
+    "sits at its own hold (alpha 255 at t=238) and `ptbtn00f`'s cycle runs over",
+    "it. Base-only and base-plus-glow are what the 714 and the 1520 are.",
     "",
-    "The alternative readings were tested and refuted. It is not a black quad laid",
-    "over a frozen screen: under that model a black rect scales every region by the",
-    "same 1-alpha, so the button-region / background-region brightness RATIO would",
-    "be constant through the fade. Measured on the RE agent's filmstrip it falls",
-    "6.495 -> 5.574 -> 3.105 -> 2.125 -> 1.935, a 3.4x monotonic drop. The screen",
-    "itself plays out: pteff00.prm ramps to opaque black while the button labels,",
-    "ptmsg, pteff10 and pteff12 all ramp to transparent, and ptframe1/2 hold.",
-    "",
-    "REACH, quoted from the RE agent rather than smoothed over: the filmstrip is",
-    "downsampled and the button region contains some background, so this pins the",
-    "DIRECTION, not 0.4 s to +/-0.05 s, and it is one transition pair. Treat the",
-    "number as approximate and the model as established."
-  ],
-  "exit_ramp_units": 24,
-  "dwell_seconds": null,
-  "dwell_why": [
-    "NOT SET, and not needed. A screen's dwell is its OWN keyframe group: the",
-    "publisher wordmark reaches its hold at t=235 (3.92 s) and the developer logos",
-    "at t=190 (3.17 s), both read from the disc. Adding a hold on top of that would",
-    "be inventing a number nobody measured, so the sequencer holds for zero extra",
-    "time and the pacing you see is the disc's own.",
-    "",
-    "If a capture ever times the real boot, this is where that number goes."
-  ]
+    "⚠️ 120 UNITS, NOT SECONDS, and that is the RE agent's own instruction. Their",
+    "run measured 2.530 and 2.540 s; an earlier corpus run measured 2.24 s. Same",
+    "declared number, different emulator pacing -- x1.27 and x1.12 against a",
+    "nominal 2.000 s, which IS 120 units at 60 units/s. Hardcoding 2.5 s would",
+    "author one loaded container's clock."
+   ],
+   "limits": [
+    "ONE BOOT. Two windows inside it are not two boots.",
+    "It does NOT distinguish the boot title from an attract-loop title: run 1",
+    "opens at t~255 s against Q9's ~193 s no-input baseline, so it may already",
+    "be the attract title. Both are 'the title, held, no input' -- which is what",
+    "was asked -- but it is not proof about the first appearance.",
+    "🔴 714/1520 IS NOT AN ALPHA RATIO. The counter is thresholded pixels, so dim",
+    "pixels drop out first. No duty cycle and no ramp shape may be read off it;",
+    "the port draws the record's own declared alpha ramp and infers nothing."
+   ]
+  }
+ },
+ "exit_ramp_deleted_why": [
+  "DELETED 2026-08-29, and the deletion is the point.",
+  "",
+  "`exit_ramp_seconds` (~0.4 s) and `exit_ramp_units` (24) were AUTHORED because",
+  "the disc had no time slot on a group's final keyframe, so the ramp into it was",
+  "the one unknown duration per screen. Under the corrected record layout",
+  "(formats-pin-2026-08-29c onward) there IS no untimed keyframe -- a group is an",
+  "8-byte header then frames x {u32 time; 36-byte pose}, so every pose is timed",
+  "including the last. The unknown the constant stood in for does not exist.",
+  "",
+  "MISSION section 3: 'When the RE agent later decodes something you had",
+  "authored, delete the authored entry and let the exporter emit it. That",
+  "deletion is the measure of progress.'",
+  "",
+  "VERIFIED DEAD BEFORE DELETING, not assumed: setting it to 9999 (166 seconds)",
+  "changed the boot's transitions by 0.04 s -- wall-clock jitter, not a 166 s",
+  "ramp. Both of its uses in ScreenView were gated on `not last_frame.has('t')`,",
+  "which no longer fires on any of the export's 866 keyframes.",
+  "",
+  "The measurement it recorded is not lost: HANDOFF Q7's ~0.4 s fade-out and the",
+  "0.17-0.23 s black hold are still measured facts, and the hold is still used --",
+  "`tools/port/verify-dwell` compares a transition INTERVAL against the oracle's",
+  "visible SPAN plus that hold. What is deleted is the port's need to invent a",
+  "duration the disc now states."
+ ],
+ "black_hold_units": 0,
+ "black_hold_why": [
+  "0 = NOT MODELLED. The escalation is resolved: a uniform value is positively",
+  "EXCLUDED, so 0 is no longer one option among several -- it is the only honest",
+  "uniform choice, because it is the one that does not claim a constant exists.",
+  "",
+  "UPDATE: TWO candidate models are now excluded, not one. The Decoder has five",
+  "replicates with NO variation -- title->menu 3,3,3 and EXTRAS->menu 2,2 -- and",
+  "every differing value comes from a different ORDERED PAIR. The same origin",
+  "gives different values to different destinations (menu 0 vs 1, EXTRAS 2 vs 3).",
+  "So a constant is excluded AND keying on the outgoing screen is excluded; only",
+  "an ordered-pair key survives, with a measured value needed per pair.",
+  "",
+  "I checked independently whether anything DECLARED predicts it, from the",
+  "quantities in my export. None does: outgoing close (15,10,10,10), incoming",
+  "clear (12,12,16,12), outgoing span (269,74,80,80) and incoming span",
+  "(80,80,269,74) each have two rows sharing a value with different gaps.",
+  "",
+  "I did NOT search combinations of them. Four intra-archive pairs against many",
+  "candidate two-screen functions fits by construction -- that is the error this",
+  "corpus has catalogued five times, and finding a formula here would be",
+  "indistinguishable from finding one in noise.",
+  "",
+  "The Decoder ordered the gaps by the screen being LEFT (frames): menu 0 and 1,",
+  "EXTRAS 2, title 3. Three hypotheses are positively ruled out, not merely",
+  "unsupported. DIRECTION: EXTRAS->menu (2) and menu->EXTRAS (1) are the same",
+  "pair both ways and differ. BUTTON: (B) gives 0 and 2, (A) gives 1 and 3.",
+  "INCOMING SCREEN: an incoming menu takes 3 from the title and 2 from EXTRAS.",
+  "",
+  "So the quantity varies 0-3 frames by outgoing screen, and any uniform non-zero",
+  "value is wrong as a MODEL rather than merely off in magnitude. 0 models the",
+  "gap as absent; 6 would model it as constant, which the data excludes.",
+  "",
+  "MY OWN RULE IS REFUTED, not just unadopted. It was gap + the incoming",
+  "screen's opening black-clear = a constant, holding at 16/16/18 on three",
+  "transitions. Their fourth gives 16, 14, 16, 18 -- and decisively, the two",
+  "transitions with the SAME incoming screen (main_menu) have different gaps,",
+  "so the incoming screen cannot determine it. A fourth point did to a",
+  "three-point fit exactly what it should.",
+  "",
+  "DO NOT key this per outgoing screen yet. Three outgoing screens with one",
+  "value each restates the data rather than predicting it -- the same objection",
+  "I raised against my own 16/16/18. Key it when a screen has more than one",
+  "measured value, and key it on the screen being LEFT.",
+  "",
+  "📌 CITATION ADDED 2026-09-01, and its absence propagated from the delivery.",
+  "This why carried over a thousand characters and NOTHING OPENABLE. The Decoder",
+  "sent the `(B)`-from-EXTRAS leg as an inline frame table with no file cited,",
+  "while docs/re/data/fade-four-transitions.txt -- which carries that leg and",
+  "eight others -- had been committed the whole time. They found it in their own",
+  "audit and cited it; it had already landed here uncited.",
+  "",
+  "⚠️ An uncited measurement propagates as an uncited value. The receiving end",
+  "cannot tell a summarised measurement from a recalled one, and both read as",
+  "prose.",
+  "",
+  "✅ AUDITED 2026-09-01 and this one needed nothing: it was already an EXCLUSION argument rather than a count. It excludes a constant, excludes keying on the outgoing screen, and excludes every declared quantity in the export as a predictor -- four of them named, each shown not to separate the pairs. That is the form the week's other claims were found to be missing."
+ ],
+ "black_hold_kind": "measured"
 }

crates/sylpheed-export/Cargo.toml

@@ -55,7 +55,33 @@ license.workspace = true
 # a squash-merge can orphan, and no way for the exporter to be built against a
 # decoder it was never tested with. A decoder change and the exporter change it
 # requires now land in the same commit or not at all.
-sylpheed-formats = { path = "../sylpheed-formats" }
+# PINNED BY TAG, which is what MISSION section 2 prescribes and what the tagging
+# rule exists for: "the RE agent tags when it lands something you need and tells
+# you over the message channel -- that is how you stay current without floating."
+# That is exactly what happened here.
+#
+# The tag carries the CORRECTED keyframe association: a placement group is an
+# 8-byte header then `frames` x {u32 time; 36-byte pose}, so pose 0's time is the
+# group's lead-in word and EVERY POSE IS TIMED, including the last. The working
+# tree's copy still has the retired `SYLPHEED_KF_TIME_SHIFT` knob -- a superseded
+# partial fix that got the association right but left pose 0 untimed, which is
+# why testing it moved the untimed frame from last to first instead of removing
+# it. The old reading is behind `SYLPHEED_KF_TIME_LEGACY=1` here.
+#
+# 🔴 THE COST, STATED: `sylpheed-cli` builds from the WORKSPACE crate, so until
+# this lands on `main` the exporter and the reference renderer read DIFFERENT
+# decoders and `tools/port/verify-screen` is comparing two eras rather than
+# detecting drift. `tools/port/verify-capture` is unaffected -- it compares the
+# port against oracle CAPTURES and never touches the CLI -- and it is the check
+# that matters. Revert to the path dependency the day the tag is an ancestor of
+# `main`.
+# Bumped c -> d 2026-08-29. What I wanted from the new state: `d` carries parser
+# and `audio.rs` changes on top of `c`. ⚠️ Its headline change -- Reborn's
+# renderer drawing `rotation_deg`, and `compose` drawing a leaf that carries
+# geometry -- does NOT reach this port from here: `sylpheed-cli` builds from the
+# WORKSPACE crate, so the reference renderer stays unrotated until the tag lands
+# on `main`. This bump is for the parser, not for the renderer.
+sylpheed-formats = { git = "https://git.mc02.dev/fabi/Sylpheed.git", tag = "formats-pin-2026-09-01" }
 
 serde      = { version = "1", features = ["derive"] }
 serde_json = "1"

crates/sylpheed-export/examples/bank_chunks.rs

@@ -0,0 +1,45 @@
+//! Throwaway probe: what are a music bank's sub-waves, decoded and timed?
+//!
+//! `export_bgm` sums every sub-wave `media` returns and scales by 1/n. If one of
+//! them is not music, the divisor is wrong and every real stem is attenuated for
+//! nothing -- the same defect already found and fixed in `export_voice`.
+use std::process::Command;
+use sylpheed_formats::media;
+
+fn main() {
+    let disc = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let src = media::DirectorySource::new(&disc);
+    for bank in ["BGM_103.slb", "BGM_102.slb", "BGM_001.slb"] {
+        match media::sound_bank_riffs(&src, bank) {
+            Ok(riffs) => {
+                println!("{bank}: {} sub-wave(s)", riffs.len());
+                for (i, r) in riffs.iter().enumerate() {
+                    let p = std::env::temp_dir().join(format!("bk_{i}.xma.wav"));
+                    std::fs::write(&p, r).unwrap();
+                    let w = std::env::temp_dir().join(format!("bk_{i}.wav"));
+                    let _ = Command::new("ffmpeg")
+                        .args(["-hide_banner", "-loglevel", "error", "-y", "-i"])
+                        .arg(&p).arg(&w).output();
+                    let out = Command::new("ffmpeg")
+                        .args(["-hide_banner", "-v", "info", "-i"])
+                        .arg(&w)
+                        .args(["-af", "astats=measure_perchannel=none", "-f", "null", "-"])
+                        .output().unwrap();
+                    let t = String::from_utf8_lossy(&out.stderr).into_owned();
+                    let get = |k: &str| t.lines().find_map(|l| l.split_once(k).map(|x| x.1.trim().to_string()))
+                        .unwrap_or_else(|| "?".into());
+                    let dur = Command::new("ffprobe")
+                        .args(["-v","error","-show_entries","format=duration","-of","csv=p=0"])
+                        .arg(&w).output().ok()
+                        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+                        .unwrap_or_default();
+                    println!("   sub-wave {i}: {:>9} B  ->  {:>10} s   peak {:>10}   rms {}",
+                             r.len(), dur, get("Peak level dB:"), get("RMS level dB:"));
+                    let _ = std::fs::remove_file(&p);
+                    let _ = std::fs::remove_file(&w);
+                }
+            }
+            Err(e) => println!("{bank}: {e}"),
+        }
+    }
+}

crates/sylpheed-export/examples/bgm_size_census.rs

@@ -0,0 +1,47 @@
+//! Is `BGM_103` the ONLY bank with those two wave sizes?
+//!
+//! `authored/audio.json` says *"Static code, disc census and runtime all agree"*
+//! — three legs. Reading the sentence beneath it, legs two and three are **one**
+//! comparison: the disc's declared wave sizes matched byte-for-byte against what
+//! the XMA probe saw at the menu. That is a disc-to-runtime match, not two
+//! independent confirmations.
+//!
+//! It is a third leg only if the census independently EXCLUDES alternatives — if
+//! some other bank carried the same two sizes, the byte match would not
+//! distinguish it. So the sizes are counted across every `BGM_*` bank on the
+//! disc.
+//!
+//! Prompted by the Decoder's point that a decorative second support is worse
+//! than none: **a conclusion with two supports reads as better evidenced than
+//! one with a single support, so apparent redundancy is itself the
+//! misinformation.**
+use sylpheed_formats::media;
+
+fn main() {
+    let root = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let src = media::DirectorySource::new(&root);
+    const WANT: [usize; 2] = [3_876_864, 3_930_112];
+    let (mut found, mut matches) = (0usize, Vec::new());
+    for n in 0..=199u32 {
+        let name = format!("BGM_{n:03}.slb");
+        let Ok(riffs) = media::sound_bank_riffs(&src, &name) else { continue };
+        if riffs.is_empty() { continue }
+        found += 1;
+        let sizes: Vec<usize> = riffs.iter().map(|r| r.len()).collect();
+        // Compare on the DATA payload the port sums, not on the RIFF wrapper:
+        // a wrapper differs by header bytes and would hide a real collision.
+        let near = sizes.iter().any(|s| WANT.iter().any(|w| s.abs_diff(*w) < 4096));
+        if near {
+            matches.push((name.clone(), sizes.clone()));
+        }
+    }
+    println!("  {found} BGM_* bank(s) readable on this disc");
+    for (n, s) in &matches {
+        println!("    {n:<14} wave sizes {s:?}");
+    }
+    println!("\n  {} bank(s) carry a wave within 4 KiB of {WANT:?}", matches.len());
+    println!("  Exactly 1 means the census EXCLUDES alternatives and is a real third");
+    println!("  leg. More than 1 means the byte match does not distinguish BGM_103,");
+    println!("  and \"three legs\" is two. Zero means this reader cannot see the");
+    println!("  incumbent and its answer means nothing.");
+}

crates/sylpheed-export/examples/dialog_pairs.rs

@@ -0,0 +1,87 @@
+//! Test the Decoder's UNTESTED reading of a residual they recorded as odd.
+//!
+//! `GP_DIALOG` holds 140 entries against a 70-record dialog table — a 2:1 ratio
+//! that would make the id→entry join an ordering question. It does not hold:
+//! adjacent pairing gives identical element-name sets on **2 of 65** pairs,
+//! halves pairing on **0**. In `GP_TITLE` a language pair shares its element set
+//! exactly, so identical sets are the signature there and almost nothing matches
+//! here.
+//!
+//! The residual: the only two adjacent pairs that DO match are entries `0/1` and
+//! `2/3` — and `2/3` is the DIFFICULTY build. Their plausible reading is that
+//! dialog text is baked into language-specific sprites, so EN/JP entries differ
+//! by construction. ⚠️ **They flagged it as untested and did not assert it**, and
+//! it has a hole they named themselves: it would explain the 63 that differ and
+//! leave the 2 that match needing their own explanation.
+//!
+//! This prints what the differences actually look like, so the reading is judged
+//! against the names rather than accepted as plausible.
+use sylpheed_formats::{pak, ratc, ui_layout};
+use std::collections::BTreeSet;
+
+fn main() {
+    let root = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let ar = pak::PakArchive::open(format!("{root}/dat/GP_DIALOG.pak")).expect("GP_DIALOG.pak");
+    let sets: Vec<Option<BTreeSet<String>>> = ar.entries().iter().map(|e| {
+        let by = ar.read(e).ok()?;
+        if !ratc::is_ratc(&by) { return None }
+        let b = ui_layout::parse_build(&by)?;
+        Some(b.elements.iter().map(|el| el.name.clone()).collect())
+    }).collect();
+
+    let (mut same, mut diff, mut pairs) = (0usize, 0usize, 0usize);
+    let mut shown = 0;
+    for i in (0..sets.len().saturating_sub(1)).step_by(2) {
+        let (Some(a), Some(b)) = (&sets[i], &sets[i + 1]) else { continue };
+        pairs += 1;
+        if a == b {
+            same += 1;
+            println!("  entries {i:>3}/{:<3} IDENTICAL sets, {} element(s)", i + 1, a.len());
+            continue;
+        }
+        diff += 1;
+        // The stage-dialog pairs, checked by name and by SPRITE COUNT. A
+        // translation of one dialog carries the same amount of text; a
+        // different stage does not. This is the Decoder's closing evidence for
+        // the 37 pairs that differ WITHOUT a button-count mismatch, re-derived
+        // here because it settles a bound I had recorded as unlikely to be
+        // tested -- and saying so is what got it tested.
+        if (10..=15).contains(&i) {
+            let sp = |x: &BTreeSet<String>| x.iter().filter(|n| n.ends_with(".t32")).count();
+            let stage = |x: &BTreeSet<String>| -> Vec<String> {
+                let mut v: Vec<String> = x.iter().filter_map(|n| n.strip_prefix("pzstg")
+                    .and_then(|r| r.get(..2)).map(|s| s.to_string())).collect();
+                v.sort(); v.dedup(); v
+            };
+            println!("  entries {i:>3}/{:<3} stages {:?} vs {:?}   sprites {} vs {}",
+                     i + 1, stage(a), stage(b), sp(a), sp(b));
+        }
+        if shown < 3 {
+            shown += 1;
+            let only_a: Vec<_> = a.difference(b).cloned().collect();
+            let only_b: Vec<_> = b.difference(a).cloned().collect();
+            println!("  entries {i:>3}/{:<3} differ: {} only-in-first, {} only-in-second",
+                     i + 1, only_a.len(), only_b.len());
+            println!("      first  : {:?}", &only_a[..only_a.len().min(4)]);
+            println!("      second : {:?}", &only_b[..only_b.len().min(4)]);
+        }
+    }
+    // 🔴 THE DECISIVE DETAIL, not the impressionistic one. Two languages of one
+    // dialog cannot differ in BUTTON COUNT. If adjacent entries do, they are
+    // different dialogs and the whole adjacent-pairing premise is wrong -- which
+    // is a stronger statement than "the language reading is untested".
+    let btns = |s: &Option<BTreeSet<String>>| -> usize {
+        s.as_ref().map_or(0, |x| x.iter().filter(|n| n.contains("btn")).count())
+    };
+    let mut mismatched = 0;
+    for i in (0..sets.len().saturating_sub(1)).step_by(2) {
+        if sets[i].is_none() || sets[i + 1].is_none() { continue }
+        if btns(&sets[i]) != btns(&sets[i + 1]) { mismatched += 1 }
+    }
+    println!("\n  adjacent pairs whose BUTTON COUNTS differ: {mismatched}");
+    println!("  A language pair cannot. Every one of these is two different dialogs.");
+    println!("\n  {pairs} adjacent pair(s): {same} identical, {diff} differing");
+    println!("  Their reading -- text baked into language-specific sprites -- predicts");
+    println!("  the differing names look SYSTEMATIC (a locale suffix, a parallel set).");
+    println!("  Judge it against the names above rather than against its plausibility.");
+}

crates/sylpheed-export/examples/dialog_rows.rs

@@ -0,0 +1,67 @@
+//! Independent check of "DIFFICULTY is a dialog: GP_DIALOG entries 2/3".
+//!
+//! The Decoder identified `DLG_SELECT_DIFFICULTY` as `GP_DIALOG.pak` entries 2/3
+//! by TWO arguments, one of them compound — corrected from "three routes", which
+//! was taking credit for the exclusion scan. The image leg names no entry, and
+//! the disc and oracle legs are one argument, since the capture is compared
+//! against the disc's rows. One of them is button count and geometry. That half is
+//! readable from the disc with this port's own reader, so it is checked here
+//! rather than taken on their word — the same form as re-deriving `ptbtn11`'s
+//! row order from my export when they offered it.
+//!
+//! ⚠️ What this CANNOT check is their binding claim, and they flagged it first:
+//! entries 2/3 are identified by button count and geometry, **not** by a binding
+//! from the `DLG_` name to a pak entry. Another four-button dialog with the same
+//! rows would be indistinguishable by this evidence. Reproducing the geometry
+//! confirms the geometry; it does not name the screen.
+use sylpheed_formats::{pak, ratc, ui_layout};
+
+fn main() {
+    let root = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    // 🔴 WIDENED 2026-08-31 to every pak, to check the Decoder's rival search
+    // independently. They report zero four-button builds within 6 px of
+    // 259/329/399/469 anywhere on the disc, which turns "another dialog with
+    // these rows would be indistinguishable" from a standing reach into a
+    // bounded one. A disc-wide negative is exactly the claim worth re-running
+    // with a different reader, because its whole content is an absence.
+    const WANT: [i32; 4] = [259, 329, 399, 469];
+    const TOL: i32 = 6;
+    let mut paks: Vec<_> = std::fs::read_dir(format!("{root}/dat")).expect("dat/")
+        .flatten().map(|e| e.path())
+        .filter(|p| p.extension().and_then(|s| s.to_str()) == Some("pak")).collect();
+    paks.sort();
+    let (mut hits, mut scanned) = (0usize, 0usize);
+    for path in &paks {
+    let Ok(ar) = pak::PakArchive::open(path) else { continue };
+    let arch = path.file_name().unwrap().to_string_lossy().to_string();
+    for (i, e) in ar.entries().iter().enumerate() {
+        let Ok(by) = ar.read(e) else { continue };
+        if !ratc::is_ratc(&by) { continue }
+        let Some(b) = ui_layout::parse_build(&by) else { continue };
+        scanned += 1;
+        // Any button-shaped record, not just `pcbtn`: a rival need not share the
+        // naming convention, and restricting by name would answer a narrower
+        // question than the one asked.
+        let mut rows: Vec<(String, i32)> = b.elements.iter()
+            .filter(|el| el.name.contains("btn"))
+            .filter_map(|el| el.rest().map(|r| (el.name.clone(), r.y)))
+            .collect();
+        if rows.is_empty() { continue }
+        rows.sort_by(|a, b| a.1.cmp(&b.1));
+        let ys: Vec<i32> = rows.iter().map(|r| r.1).collect();
+        let gaps: Vec<i32> = ys.windows(2).map(|w| w[1] - w[0]).collect();
+        if rows.len() == 4 && ys.iter().zip(WANT.iter()).all(|(a, b)| (a - b).abs() <= TOL) {
+            hits += 1;
+            println!("  {arch} entry {i:>2}  {} record(s): {}", rows.len(),
+                     rows.iter().map(|r| r.0.as_str()).collect::<Vec<_>>().join(" "));
+            println!("            rows {ys:?}  gaps {gaps:?}");
+        }
+    }
+    }
+    println!("\n  {scanned} build(s) scanned across {} pak(s); {hits} match the",
+             paks.len());
+    println!("  DIFFICULTY row signature within +/-{TOL} px.");
+    println!("  Expected: exactly 2 -- the EN/JP pair. More means a RIVAL exists and");
+    println!("  the geometric identification is not unique; fewer means this reader");
+    println!("  cannot see the incumbents and its zero would mean nothing.");
+}

crates/sylpheed-export/examples/probe_archives.rs

@@ -1,42 +0,0 @@
-//! Which disc archives contain UI screen builds?
-//!
-//! The exporter reads `dat/GP_TITLE.pak` and nothing else, so four of the five
-//! main-menu destinations have no screen file to go to: `authored/flow.json`
-//! records LOAD GAME as `GP_SAVE_LOAD`, OPTIONS as `GP_OPTIONS`, and NEW GAME's
-//! chain as `DLG_SELECT_DIFFICULTY` -> `SELECT DATA`, all measured destinations
-//! that this export cannot reach.
-//!
-//! This asks the cheap question before anyone refactors the exporter: does the
-//! EXISTING build detector find anything in those archives? It changes nothing
-//! and writes nothing.
-//!
-//!   cargo run --release -p sylpheed-export --example probe_archives
-use sylpheed_formats::{pak::PakArchive, ui_layout};
-
-fn main() -> anyhow::Result<()> {
-    let disc = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
-    let mut names: Vec<String> = std::fs::read_dir(format!("{disc}/dat"))?
-        .filter_map(|e| e.ok())
-        .map(|e| e.file_name().to_string_lossy().into_owned())
-        .filter(|n| n.ends_with(".pak"))
-        .collect();
-    names.sort();
-    println!("{:<32} {:>7} {:>8}", "archive", "entries", "builds");
-    for n in names {
-        let path = format!("{disc}/dat/{n}");
-        let Ok(ar) = PakArchive::open(&path) else {
-            println!("{n:<32} {:>7} {:>8}", "-", "open failed");
-            continue;
-        };
-        let total = ar.entries().len();
-        let builds = ar
-            .entries()
-            .iter()
-            .filter(|e| ar.read(e).map(|b| ui_layout::is_build(&b)).unwrap_or(false))
-            .count();
-        if builds > 0 || n.contains("OPTIONS") || n.contains("SAVE") || n.contains("DIALOG") {
-            println!("{n:<32} {total:>7} {builds:>8}");
-        }
-    }
-    Ok(())
-}

crates/sylpheed-export/examples/rat_leaf.rs

@@ -0,0 +1,49 @@
+//! Probe: does a `.rat` leaf record carry geometry the parent element does not?
+//!
+//! The GPU capture says the title submits `ptloop01`/`ptloop02` scaled 600 %/800 %
+//! and rotated +30.26°/−45.28°, while the export writes scale 100 % and rotation
+//! 0 for both. `ui_layout`'s own note says the rotated quads come from the
+//! **nested `.rat` leaf records**, which is where `export_screen` already looks
+//! for focus records and nowhere else.
+use sylpheed_formats::{pak::PakArchive, ui_layout};
+
+fn main() {
+    let disc = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let ar = PakArchive::open(format!("{disc}/dat/GP_TITLE.pak")).expect("open");
+    let e = &ar.entries()[4]; // entry 4 = the English title
+    let bundle = ar.read(e).expect("read");
+    let b = ui_layout::parse_build(&bundle).expect("parse");
+    println!("build has {} elements, {} records", b.elements.len(), b.records.len());
+    let mut names: Vec<&String> = b.records.keys().collect();
+    names.sort();
+    println!("records: {names:?}");
+    for el in &b.elements {
+        if !el.name.starts_with("ptloop") { continue; }
+        let r = el.rest();
+        println!("\nPARENT {} sprite={:?} -> rest scale {:?} rot {:?}", el.name, el.sprite,
+            r.map(|r| (r.scale_x, r.scale_y)), r.map(|r| r.rotation_deg));
+        if let Some(&(off, size)) = b.records.get(&el.name) {
+            match ui_layout::parse_build(&bundle[off..off + size]) {
+                Some(leaf) => {
+                    println!("  LEAF {} parses: {} element(s)", el.name, leaf.elements.len());
+                    for le in &leaf.elements {
+                        let lr = le.rest();
+                        println!("    {:<20} rest scale {:?} rot {:?} pos {:?}",
+                            le.name,
+                            lr.map(|r| (r.scale_x, r.scale_y)),
+                            lr.map(|r| r.rotation_deg),
+                            lr.map(|r| (r.x, r.y)));
+                        for k in &le.keyframes {
+                            println!("       t={:?} scale=({},{}) rot={} pos=({},{}) fade={:#010x} u4={} u8={}",
+                                k.time, k.scale_x, k.scale_y, k.rotation_deg, k.x, k.y,
+                                k.fade, k.unknown_4, k.unknown_8);
+                        }
+                    }
+                }
+                None => println!("  LEAF {} does NOT parse as a build", el.name),
+            }
+        } else {
+            println!("  no record named {}", el.name);
+        }
+    }
+}

crates/sylpheed-export/examples/record_loop_control.rs

@@ -0,0 +1,130 @@
+//! Run the Decoder's own falsifier for "a nested record's `+0x08` is its loop
+//! length" against the bundles THIS PORT SHIPS, before shipping 120 for 105.
+//!
+//! HANDOFF (`27938aa`, delivered at `07e93ce`) says the plate's glow cycles over
+//! **120** units while its keyframes end at 105, and instructs the port to stop
+//! shipping 105. The port's `ScreenView` derives a looping record's period from
+//! the element's largest keyframe time, so it does ship 105 — and the field that
+//! would fix it is decoded in an *example* and a *test* on the Decoder's branch
+//! and **exposed in `sylpheed_formats`' public API on no ref at all**.
+//!
+//! ✅ **Since then the crate exposes it** — `ui_layout::loop_length_units`, taken
+//! at `formats-pin-2026-08-30b` — and `screen.rs` has deleted its local copy.
+//!
+//! 🔴 **This file deliberately did NOT follow it.** The read below is still the
+//! raw four bytes, because the moment a control calls the API it is meant to
+//! check, it stops being a control and becomes the API tested against itself. It
+//! is the independent reading that makes the falsifier mean anything.
+//!
+//! So this re-runs both of their controls:
+//!
+//!   * **the falsifier** — `+0x08 < max keyframe time` must never occur; an
+//!     animation cannot restart before its own last pose;
+//!   * **non-triviality** — if every record had `+0x08 == max t` the field would
+//!     carry nothing and the name would be a relabelling of the keyframes.
+//!
+//! and adds the one they could not run: the same two, restricted to the records
+//! **this port actually animates**. A disc-wide 0.00 % violation rate says
+//! nothing about my six screens if all six sit in the exceptional tail.
+use sylpheed_formats::{pak, ratc, ui_layout};
+use std::collections::BTreeMap;
+
+/// The records the port animates: the plate glow, the five menu focus records,
+/// and the title's two sweeps. Named rather than pattern-matched, because the
+/// point is to check the ones that are shipped, not the ones that match a glob.
+const SHIPPED: &[&str] = &[
+    "ptbtn00f", "ptbtn01f", "ptbtn02f", "ptbtn03f", "ptbtn04f", "ptbtn05f",
+    "ptloop01", "ptloop02",
+];
+
+/// Which header word to read as the loop length. `0x08` is the decoded one;
+/// `--offset=N` re-runs the same falsifier at a neighbour, which is the only way
+/// to learn whether the falsifier is evidence for the offset or just for the
+/// disc.
+static mut OFFSET: usize = 8;
+
+fn main() {
+    let off: usize = std::env::args().find_map(|a| a.strip_prefix("--offset=")
+        .and_then(|v| v.parse().ok())).unwrap_or(8);
+    unsafe { OFFSET = off };
+    println!("  reading the loop length at header +0x{off:02x}");
+    let root = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let mut paks: Vec<_> = std::fs::read_dir(format!("{root}/dat")).expect("dat/")
+        .flatten().map(|e| e.path())
+        .filter(|p| p.extension().and_then(|s| s.to_str()) == Some("pak")).collect();
+    paks.sort();
+
+    let (mut total, mut exact, mut holds, mut violations) = (0usize, 0usize, 0usize, 0usize);
+    let mut slack_hist: BTreeMap<i64, usize> = BTreeMap::new();
+    let mut shipped: BTreeMap<String, (i64, i64)> = BTreeMap::new();
+
+    for p in &paks {
+        let Ok(ar) = pak::PakArchive::open(p) else { continue };
+        for e in ar.entries() {
+            let Ok(by) = ar.read(e) else { continue };
+            if !ratc::is_ratc(&by) { continue }
+            let Some(b) = ui_layout::parse_build(&by) else { continue };
+            for (rn, &(o, s)) in &b.records {
+                if o + off + 4 > by.len() || o + s > by.len() { continue }
+                if &by[o..o + 4] != b"RATC" { continue }
+                // 🔴 THE FALSIFIER IS RUN AT NEIGHBOURING OFFSETS TOO. The
+                // Decoder's struct-layout control showed that a homogeneous
+                // repeated table type-checks at every field boundary, so an
+                // interior test carries no information about phase -- 69 of 70
+                // records passed under BOTH shifted alignments of their dialog
+                // table. My falsifier (`+0x08 >= max keyframe time`) is an
+                // interior test of exactly that kind, and I re-ran it as
+                // "confirmation" without asking whether it discriminates the
+                // OFFSET or merely the file.
+                let len = u32::from_be_bytes(by[o + off..o + off + 4].try_into().unwrap()) as i64;
+                let Some(lb) = ui_layout::parse_build(&by[o..o + s]) else { continue };
+                let maxt = lb.elements.iter()
+                    .flat_map(|el| el.keyframes.iter().filter_map(|k| k.time))
+                    .max().unwrap_or(0) as i64;
+                if maxt == 0 { continue }        // static: declares no cycle at all
+                total += 1;
+                let slack = len - maxt;
+                *slack_hist.entry(slack).or_default() += 1;
+                if slack == 0 { exact += 1 } else if slack > 0 { holds += 1 } else { violations += 1 }
+                let stem = rn.trim_end_matches(".rat");
+                if SHIPPED.contains(&stem) {
+                    shipped.entry(stem.to_string()).or_insert((len, maxt));
+                }
+            }
+        }
+    }
+
+    println!("disc-wide, records with timed keyframes: {total}");
+    println!("  +08 == max t (exact)   : {exact:5}  {:5.1} %", pc(exact, total));
+    println!("  +08 >  max t (a hold)  : {holds:5}  {:5.1} %", pc(holds, total));
+    println!("  +08 <  max t  <- FALSIFIER : {violations:5}  {:5.2} %", pc(violations, total));
+    println!("\nslack distribution, most common first:");
+    let mut h: Vec<_> = slack_hist.iter().collect();
+    h.sort_by_key(|&(_, n)| std::cmp::Reverse(*n));
+    for (k, n) in h.iter().take(8) { println!("   slack {k:>6} : {n}"); }
+
+    println!("\nthe records THIS PORT animates:");
+    println!("   {:<12} {:>6} {:>7} {:>7}", "record", "+0x08", "max t", "slack");
+    let (mut ship_exact, mut ship_hold, mut ship_bad) = (0, 0, 0);
+    for (n, (len, maxt)) in &shipped {
+        let slack = len - maxt;
+        match slack { 0 => ship_exact += 1, s if s > 0 => ship_hold += 1, _ => ship_bad += 1 }
+        println!("   {n:<12} {len:>6} {maxt:>7} {slack:>7}{}",
+                 if slack < 0 { "   🔴 FALSIFIED" } else { "" });
+    }
+    println!("\n   shipped: {ship_exact} exact, {ship_hold} hold, {ship_bad} falsified");
+    if shipped.len() < SHIPPED.len() {
+        let missing: Vec<_> = SHIPPED.iter().filter(|s| !shipped.contains_key(**s)).collect();
+        println!("   ⚠️  not found on the disc: {missing:?} -- a name the port ships and");
+        println!("       this control never checked is worse than a violation it found.");
+    }
+    println!("\n   verdict: {}", if ship_bad > 0 {
+        "🔴 the reading fails on a record the port animates -- do NOT adopt"
+    } else if ship_hold == 0 {
+        "⚠️ every shipped record is exact, so this port cannot tell loop length\n            from max keyframe time -- adopting 120 would change nothing here"
+    } else {
+        "✅ falsifier clean and the field is non-trivial ON THE SHIPPED SET"
+    });
+}
+
+fn pc(n: usize, d: usize) -> f64 { if d == 0 { 0.0 } else { 100.0 * n as f64 / d as f64 } }

crates/sylpheed-export/examples/record_population.rs

@@ -0,0 +1,65 @@
+//! Why do two "every pak, every timed record" scans disagree by 86 %?
+//!
+//! This port counts 1 781 timed nested records and reports `+0x08 == max t` at
+//! 92.3 %. The Decoder counts 3 311 and reports 49.6 %. Both scans are described
+//! the same way, so at least one of them is narrower than its own description --
+//! and the exactness figure this port has quoted repeatedly is a property of
+//! whichever subset it actually walks.
+//!
+//! Counts the survivors at each filter, so the gap is located rather than
+//! guessed at.
+use sylpheed_formats::{pak, ratc, ui_layout};
+
+fn main() {
+    let root = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let mut paks: Vec<_> = std::fs::read_dir(format!("{root}/dat")).expect("dat/")
+        .flatten().map(|e| e.path())
+        .filter(|p| p.extension().and_then(|s| s.to_str()) == Some("pak")).collect();
+    paks.sort();
+    let (mut records, mut in_bounds, mut magic, mut parsed, mut timed) = (0, 0, 0, 0, 0);
+    let (mut untimed, mut all_at_zero) = (0usize, 0usize);
+    for p in &paks {
+        let Ok(ar) = pak::PakArchive::open(p) else { continue };
+        for e in ar.entries() {
+            let Ok(by) = ar.read(e) else { continue };
+            if !ratc::is_ratc(&by) { continue }
+            let Some(b) = ui_layout::parse_build(&by) else { continue };
+            for (_, &(o, s)) in &b.records {
+                records += 1;
+                if o + 12 > by.len() || o + s > by.len() { continue }
+                in_bounds += 1;
+                if &by[o..o + 4] != b"RATC" { continue }
+                magic += 1;
+                let Some(lb) = ui_layout::parse_build(&by[o..o + s]) else { continue };
+                parsed += 1;
+                let maxt = lb.elements.iter()
+                    .flat_map(|el| el.keyframes.iter().filter_map(|k| k.time))
+                    .max().unwrap_or(0);
+                // 🔴 `maxt == 0` merges two different populations, and the
+                // Decoder's cause -- `.max()` returning `Some(0)` -- is only one
+                // of them. A record with NO timed keyframe has no largest
+                // keyframe time; a record whose keyframes all sit at t=0 has
+                // one, and it is 0. Only the first is a question without
+                // content. Both of us called all 1 530 "the question has no
+                // meaning"; that is true of one group and an assumption about
+                // the other.
+                let any_timed = lb.elements.iter()
+                    .any(|el| el.keyframes.iter().any(|k| k.time.is_some()));
+                if maxt == 0 {
+                    if any_timed { all_at_zero += 1 } else { untimed += 1 }
+                    continue;
+                }
+                timed += 1;
+            }
+        }
+    }
+    println!("  records declared by parse_build : {records}");
+    println!("  within the entry's bounds       : {in_bounds}");
+    println!("  carrying the RATC magic         : {magic}   <- {} dropped here",
+             in_bounds - magic);
+    println!("  parsing as a nested build       : {parsed}");
+    println!("  with a largest keyframe time > 0: {timed}");
+    println!("    of the {} excluded:", untimed + all_at_zero);
+    println!("      NO timed keyframe at all      : {untimed}  <- the question has no content");
+    println!("      timed, but every pose at t=0  : {all_at_zero}  <- a largest time EXISTS, and it is 0");
+}

crates/sylpheed-export/examples/static_with_cycle.rs

@@ -0,0 +1,46 @@
+//! Do any screens THIS PORT SHIPS carry a record that declares a cycle while all
+//! its poses sit at t = 0?
+//!
+//! The substantive finding from the denominator thread: 1 530 nested records
+//! disc-wide are timed with every pose at t = 0 and still declare a nonzero
+//! `+0x08`. A static record that declares a cycle length is a real thing, not a
+//! counting artefact — so the question for the port is whether it holds one of
+//! those still while the disc says it cycles.
+//!
+//! Scoped to `GP_TITLE`, because that is the archive the port exports.
+use sylpheed_formats::{pak, ratc, ui_layout};
+
+fn main() {
+    let root = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let ar = pak::PakArchive::open(format!("{root}/dat/GP_TITLE.pak")).expect("GP_TITLE.pak");
+    let (mut total, mut hits, mut multipose) = (0usize, 0usize, 0usize);
+    for (i, e) in ar.entries().iter().enumerate() {
+        let Ok(by) = ar.read(e) else { continue };
+        if !ratc::is_ratc(&by) { continue }
+        let Some(b) = ui_layout::parse_build(&by) else { continue };
+        for (name, &(o, s)) in &b.records {
+            if o + 12 > by.len() || o + s > by.len() || &by[o..o + 4] != b"RATC" { continue }
+            let Some(lb) = ui_layout::parse_build(&by[o..o + s]) else { continue };
+            let maxt = lb.elements.iter()
+                .flat_map(|el| el.keyframes.iter().filter_map(|k| k.time)).max().unwrap_or(0);
+            let len = ui_layout::loop_length_units(&by[o..o + s]).unwrap_or(0);
+            total += 1;
+            if maxt == 0 && len > 0 {
+                hits += 1;
+                // A cycle can only produce motion if there is more than one pose
+                // to move between. All-at-t=0 with a single keyframe per element
+                // is visually inert however it is played.
+                let kf: usize = lb.elements.iter().map(|el| el.keyframes.len()).sum();
+                let multi = lb.elements.iter().filter(|el| el.keyframes.len() > 1).count();
+                if multi > 0 { multipose += 1 }
+                println!("  entry {i:>2}  {name:<16} {len}-unit cycle, {kf} keyframe(s) \
+across {} element(s), {multi} with >1 pose", lb.elements.len());
+            }
+        }
+    }
+    println!("\n  {total} nested record(s) in GP_TITLE; {hits} declare a cycle while static.");
+    println!("  Of those, {multipose} have an element with MORE THAN ONE pose -- the only");
+    println!("  ones where looping could differ visibly from holding. A record whose");
+    println!("  elements each carry a single pose renders identically either way, so a");
+    println!("  declared cycle there is inert rather than a defect.");
+}

crates/sylpheed-export/examples/voice_chunks.rs

@@ -0,0 +1,48 @@
+//! Throwaway probe: how long is each region chunk of a movie's voice?
+//!
+//! The question it answers is whether the chunks of a resolved voice region are
+//! CONSECUTIVE SEGMENTS (concatenate them) or ALTERNATE TAKES (chunk 0 is the
+//! whole track). Getting that backwards plays the dialogue three times over.
+use std::process::Command;
+use sylpheed_formats::{media, slb::VoiceLang};
+
+fn main() {
+    let disc = std::env::var("SYLPHEED_DISC").unwrap_or_else(|_| "/disc".into());
+    let src = media::DirectorySource::new(&disc);
+    for movie in ["ADV", "S00A", "RT01A"] {
+        let Some((s, e)) = media::resolve_movie_voice_region(&src, movie, VoiceLang::English)
+        else {
+            println!("{movie}: no region");
+            continue;
+        };
+        let riffs = media::voice_region_riffs(&src, s, e).expect("riffs");
+        println!("{movie}: region [{s}, {e}) = {} bytes, {} chunk(s)", e - s, riffs.len());
+        for (i, r) in riffs.iter().enumerate() {
+            let p = std::env::temp_dir().join(format!("vc_{movie}_{i}.xma.wav"));
+            std::fs::write(&p, r).unwrap();
+            // XMA declares no duration, so DECODE it and measure the result.
+            let w = std::env::temp_dir().join(format!("vc_{movie}_{i}.wav"));
+            let _ = Command::new("ffmpeg")
+                .args(["-hide_banner", "-loglevel", "error", "-y", "-i"])
+                .arg(&p)
+                .arg(&w)
+                .output();
+            let out = Command::new("ffprobe")
+                .args(["-v", "error", "-show_entries", "format=duration", "-of", "csv=p=0"])
+                .arg(&w)
+                .output()
+                .unwrap();
+            let dur = String::from_utf8_lossy(&out.stdout).trim().to_string();
+            if std::env::var("KEEP_WAV").is_ok() {
+                let keep = std::path::Path::new(&std::env::var("KEEP_WAV").unwrap())
+                    .join(format!("{movie}_chunk{i}.wav"));
+                let _ = std::fs::rename(&w, &keep);
+                println!("      kept -> {}", keep.display());
+            } else {
+                let _ = std::fs::remove_file(&w);
+            }
+            println!("   chunk {i}: {} bytes -> {dur} s", r.len());
+            let _ = std::fs::remove_file(&p);
+        }
+    }
+}

crates/sylpheed-export/src/check.rs

@@ -12,7 +12,9 @@
 //! * a `buttons` entry naming an element that is not a button, or out of
 //!   resting-Y order;
 //! * a sprite path that does not exist, or a PNG that does not decode;
-//! * a name presented as recovered when it was authored.
+//! * a name presented as recovered when it was authored;
+//! * an audio file that is silent or clips -- the two audio failures that pass
+//!   every check that is not looking for them.
 //!
 //! It deliberately does **not** check that the export matches the disc. That is
 //! what `sylpheed-cli screen render` is for.
@@ -184,10 +186,26 @@ fn check_screen(root: &Path, rel: &str, errors: &mut Vec<String>) -> Result<()>
             for (k, kf) in kfs.iter().enumerate() {
                 check_pose(&mut c, &format!("{at} keyframe {k}"), kf);
             }
-            // The last keyframe of a group carries no time slot on the disc, and
-            // an invented one is exactly the kind of value this format refuses.
-            if kfs.len() > 1 && kfs.last().is_some_and(|k| k.get("t").is_some()) {
-                c.err(format!("{at}: the final keyframe has a `t`; the disc has no time slot there"));
+            // 🔴 INVERTED 2026-08-29, and the old rule is the more interesting
+            // half. It read: "the last keyframe of a group carries no time slot
+            // on the disc, and an invented one is exactly the kind of value this
+            // format refuses." That was true of the OLD keyframe association,
+            // where a group's data stopped four bytes short of its final block's
+            // time slot.
+            //
+            // Under the corrected layout (`formats-pin-2026-08-29c` onward) a
+            // group is an 8-byte header then `frames` x {u32 time; 36-byte
+            // pose}, so **pose 0's time is the group's lead-in word and EVERY
+            // POSE IS TIMED, including the last.** The rule now says the
+            // opposite, and an untimed keyframe is the thing to refuse.
+            //
+            // ⚠️ This fired 150 times on a re-export and I had not run `check`
+            // between pinning the tag and measuring against the oracle -- the
+            // pixel harness was green while the format validator was failing on
+            // every screen with a multi-keyframe group. A correctness harness
+            // does not replace a format one; they fail at different layers.
+            if kfs.len() > 1 && kfs.iter().any(|k| k.get("t").is_none()) {
+                c.err(format!("{at}: a keyframe has no `t`; every pose is timed under the corrected record layout"));
             }
         }
     }
@@ -267,6 +285,8 @@ pub fn run(root: &Path) -> Result<usize> {
         check_screen(root, file, &mut errors)?;
     }
 
+    check_audio(root, &m, &mut errors);
+
     if !errors.is_empty() {
         for e in &errors {
             eprintln!("  ✗ {e}");
@@ -275,3 +295,88 @@ pub fn run(root: &Path) -> Result<usize> {
     }
     Ok(screens.len())
 }
+
+/// The `audio` array, checked the way a consumer would have to.
+///
+/// Two of these are content checks rather than schema checks, and they are here
+/// on purpose. `docs/port/AUDIO-VERIFICATION.md` names silence as "the failure
+/// that looks like success": a file of exactly the right duration, the right
+/// channel count and the right size, full of zeroes, because something opened
+/// the wrong thing. Every structural check passes it. So does clipping, which
+/// the BGM can produce because it is a **sum of two stems** at unity gain.
+///
+/// The exporter measures both at export time and writes them here; this refuses
+/// the tree if what it wrote is a file nobody would want to play. Neither is a
+/// judgement about whether the audio is the RIGHT audio — nothing in this
+/// binary can know that, and `docs/port/BLOCKED.md` says which parts are still
+/// authored guesses.
+fn check_audio(root: &Path, m: &Value, errors: &mut Vec<String>) {
+    let Some(audio) = m.get("audio").and_then(Value::as_array) else {
+        // Absent is correct for every export taken before P6.
+        return;
+    };
+    for a in audio {
+        let name = a.get("name").and_then(Value::as_str).unwrap_or("?");
+        let kind = a.get("kind").and_then(Value::as_str).unwrap_or("");
+        if !matches!(kind, "se" | "bgm" | "voice") {
+            errors.push(format!(
+                "manifest.json: audio `{name}` has kind {kind:?}, which a consumer cannot dispatch on"
+            ));
+        }
+        for key in ["file", "command", "why"] {
+            if a.get(key).and_then(Value::as_str).is_none_or(str::is_empty) {
+                errors.push(format!("manifest.json: audio `{name}` has no `{key}`"));
+            }
+        }
+        let Some(file) = a.get("file").and_then(Value::as_str) else { continue };
+        if !root.join(file).exists() {
+            errors.push(format!("manifest.json: lists audio {file}, which does not exist"));
+            continue;
+        }
+        match a.get("peak_dbfs").and_then(Value::as_f64) {
+            None => errors.push(format!(
+                "manifest.json: audio `{name}` carries no `peak_dbfs` -- it was not measured, \
+                 and silence is the audio failure that passes every check that is not looking \
+                 for it"
+            )),
+            Some(p) if p <= -90.0 => errors.push(format!(
+                "{file}: peak is {p:.1} dBFS -- this file is silent"
+            )),
+            // The bound differs by kind, and the difference is the point. A
+            // `bgm` is something WE combined -- a sum of stems -- so a peak at
+            // or above full scale is our arithmetic and is refused outright. An
+            // `se` is a single wave off the disc: it is mastered near full
+            // scale, and a lossy decode of a near-full-scale signal overshoots
+            // by a fraction of a dB (`confirm` lands at +0.18). Refusing that
+            // would be refusing the disc's own mastering, and "fixing" it would
+            // mean attenuating a game asset to make a number smaller.
+            //
+            // 🟡 +1.0 dB is a JUDGEMENT, not a measurement: a few tenths is
+            // reconstruction overshoot, a whole dB is not. Nobody has measured
+            // the overshoot distribution across a corpus of cues, and if a cue
+            // ever trips this the right response is that measurement, not a
+            // looser bound.
+            // `voice` was on the strict side of this bound while it was a SUM of a
+            // region's chunks. It no longer is: a region carries three
+            // presentations of one take, so the exporter keeps ONE stream and
+            // performs no arithmetic on it. That puts `voice` with `se` -- a
+            // single wave off the disc, mastered near full scale, whose lossy
+            // decode overshoots by a fraction of a dB. `ADV`'s louder
+            // presentation measures +0.0003 dBFS at source; refusing that would
+            // be refusing the disc's own mastering.
+            Some(p) if kind == "bgm" && p >= 0.0 => errors.push(format!(
+                "{file}: peak is {p:.1} dBFS -- a SUM we produced clips"
+            )),
+            Some(p) if kind != "bgm" && p > 1.0 => errors.push(format!(
+                "{file}: peak is {p:.1} dBFS -- too far over full scale to be decode overshoot"
+            )),
+            Some(_) => {}
+        }
+        match a.get("duration_s").and_then(Value::as_f64) {
+            Some(d) if d > 0.0 => {}
+            _ => errors.push(format!(
+                "{file}: no positive `duration_s` -- a zero-length asset plays as silence"
+            )),
+        }
+    }
+}

crates/sylpheed-export/src/main.rs

@@ -208,54 +208,6 @@ fn load_also_export(authored: &Path) -> Result<AlsoExport> {
 /// exactly four bundles and all four are real screens, with zero fragments. In
 /// another archive it would not be, which is why this is an allow-list and not
 /// a widened predicate.
-/// Which archives the export reads, from `authored/screen_names.json`
-/// `export_archives`.
-///
-/// 🔴 THIS WAS ONE HARDCODED CONSTANT AND IT COST FOUR MENU DESTINATIONS.
-/// `authored/flow.json` records LOAD GAME, TUTORIAL, OPTIONS and NEW GAME's
-/// difficulty chain as MEASURED destinations that are `blocked` because "not a
-/// GP_TITLE build, so there is no screen file to go to". The blocker was never
-/// the disc or the reader -- `examples/probe_archives.rs` finds screen builds in
-/// 24 archives using the EXISTING detector. It was this line.
-///
-/// Absent from the authored file, it stays exactly what it was, so an old
-/// `authored/` tree exports what it always did.
-fn load_export_archives(authored: &Path) -> Result<Vec<String>> {
-    let path = authored.join("screen_names.json");
-    let Ok(text) = std::fs::read_to_string(&path) else {
-        return Ok(vec!["dat/GP_TITLE.pak".into()]);
-    };
-    let v: serde_json::Value = serde_json::from_str(&text)
-        .with_context(|| format!("parse {}", path.display()))?;
-    match v.get("export_archives").and_then(|a| a.as_array()) {
-        None => Ok(vec!["dat/GP_TITLE.pak".into()]),
-        Some(list) => Ok(list
-            .iter()
-            .filter_map(|e| e.as_str().map(str::to_owned))
-            .collect()),
-    }
-}
-
-/// The sprite subdirectory for an archive: `dat/GP_OPTIONS.pak` -> `options`.
-///
-/// ⚠️ NOT cosmetic. Sprites are written to `sprites/<group>/<screen>/`, so two
-/// archives sharing a group would collide by screen name -- and unnamed builds
-/// are named `build_NN` by ENTRY INDEX, which restarts at 0 in every archive.
-/// `GP_TITLE` keeps its historical `title` so no existing path moves.
-fn group_for(archive: &str) -> &'static str {
-    match archive {
-        "dat/GP_TITLE.pak" => "title",
-        "dat/GP_OPTIONS.pak" => "options",
-        "dat/GP_SAVE_LOAD.pak" => "save_load",
-        "dat/GP_TUTORIAL.pak" => "tutorial",
-        "dat/GP_DIALOG.pak" => "dialog",
-        // Deliberately not derived from the filename: a new archive should be a
-        // decision someone made, not a directory that appears because a string
-        // parsed. An unmapped archive is rejected below.
-        _ => "",
-    }
-}
-
 fn screen_builds(ar: &PakArchive, also: Option<&std::collections::BTreeMap<String, NameEntry>>)
     -> Vec<(usize, Vec<u8>)>
 {
@@ -292,7 +244,9 @@ fn run_export(disc: &Path, out: &Path, authored_dir: &Path) -> Result<()> {
     // has to know about; it is not an error, and it is not a log line, because
     // the person who needs it reads `manifest.json` and never sees stdout.
     let mut warnings: Vec<String> = vec![
-        String::new(), // replaced below once the archive list is known
+        "GP_TITLE screen builds only. No other archive, and only the two movies \
+         MISSION section 6 puts in scope."
+            .into(),
         "The four splash bundles (entries 10/13 publisher, 11/14 developer) have no .rat \
          layout child, so `is_build` cannot see them and no content rule can: element \
          count and design size both overlap with two-element fragments in other archives. \
@@ -336,76 +290,60 @@ fn run_export(disc: &Path, out: &Path, authored_dir: &Path) -> Result<()> {
     }
     std::fs::create_dir_all(&out)?;
 
+    let archive = "dat/GP_TITLE.pak";
+    let pak = disc.join(archive);
+    let ar = PakArchive::open(&pak).with_context(|| format!("open {}", pak.display()))?;
     let also = load_also_export(authored_dir)?;
-    let archives = load_export_archives(authored_dir)?;
-    warnings[0] = format!(
-        "Screen builds from {} only ({}). Other archives on the disc also contain UI \
-         builds and are not exported. Only the two movies MISSION section 6 puts in scope.",
-        archives.len(),
-        archives.join(", ")
-    );
-    let mut screens = Vec::new();
-    for archive in archives.iter().map(String::as_str) {
-        let group = group_for(archive);
-        if group.is_empty() {
-            anyhow::bail!(
-                "authored/screen_names.json export_archives lists {archive}, which has no \
-                 sprite group in group_for(). Add one deliberately -- deriving it from the \
-                 filename would let a typo create a directory."
-            );
-        }
-        let pak = disc.join(archive);
-        let ar = PakArchive::open(&pak).with_context(|| format!("open {}", pak.display()))?;
-        let archive_also = also.get(archive);
-        let builds = screen_builds(&ar, archive_also);
-        println!("{archive}: {} screen build(s) -> sprites/{group}/", builds.len());
+    let archive_also = also.get(archive);
+    let builds = screen_builds(&ar, archive_also);
+    println!("{archive}: {} screen build(s)", builds.len());
 
-        let archive_names = names.get(archive);
-        for (build_idx, (entry, bytes)) in builds.iter().enumerate() {
-            // Keyed by ENTRY, not by the ordinal: widening the enumeration to reach
-            // the splash renumbers ordinals, and a name that moves when the rule
-            // changes is not a name.
-            let key = entry.to_string();
-            let named = archive_names
-                .and_then(|m| m.get(&key))
-                .or_else(|| archive_also.and_then(|m| m.get(&key)));
-            let (name, name_source, why) = match named {
-                Some(e) => (e.name.clone(), "authored", e.why.clone()),
-                // Nobody has identified this build. Emit a stable synthetic id and
-                // say in the file that the name is not a recovered one.
-                None => (format!("build_{entry:02}"), "index", None),
-            };
-            let ex = screen::export_build(
-                &out,
-                archive,
-                *entry,
-                build_idx,
-                bytes,
-                &name,
-                name_source,
-                why,
-                group,
-                EXPORTER,
-                FORMATS_REV,
-            )
-            .with_context(|| format!("export build {build_idx} of {archive}"))?;
-            println!(
-                "  [{build_idx}] entry {entry:<3} -> {}  ({} sprites{})",
-                ex.json_path,
-                ex.sprites,
-                if ex.missing.is_empty() {
-                    String::new()
-                } else {
-                    format!(", {} missing", ex.missing.len())
-                }
-            );
-            screens.push(ManifestScreen {
-                name: ex.name,
-                file: ex.json_path,
-                sprites: ex.sprites,
-                missing_sprites: ex.missing,
-            });
-        }
+    let archive_names = names.get(archive);
+    let mut screens = Vec::new();
+    for (build_idx, (entry, bytes)) in builds.iter().enumerate() {
+        // Keyed by ENTRY, not by the ordinal: widening the enumeration to reach
+        // the splash renumbers ordinals, and a name that moves when the rule
+        // changes is not a name.
+        let key = entry.to_string();
+        let named = archive_names
+            .and_then(|m| m.get(&key))
+            .or_else(|| archive_also.and_then(|m| m.get(&key)));
+        let (name, name_source, why) = match named {
+            Some(e) => (e.name.clone(), "authored", e.why.clone()),
+            // Nobody has identified this build. Emit a stable synthetic id and
+            // say in the file that the name is not a recovered one.
+            None => (format!("build_{entry:02}"), "index", None),
+        };
+        let ex = screen::export_build(
+            &out,
+            archive,
+            *entry,
+            build_idx,
+            bytes,
+            &name,
+            name_source,
+            why,
+            "title",
+            EXPORTER,
+            FORMATS_REV,
+        )
+        .with_context(|| format!("export build {build_idx} of {archive}"))?;
+        println!(
+            "  [{build_idx}] entry {entry:<3} -> {}  ({} sprites{})",
+            ex.json_path,
+            ex.sprites,
+            if ex.missing.is_empty() {
+                String::new()
+            } else {
+                format!(", {} missing", ex.missing.len())
+            }
+        );
+        screens.push(ManifestScreen {
+            name: ex.name,
+            file: ex.json_path,
+            sprites: ex.sprites,
+            missing_sprites: ex.missing,
+        });
     }
 
     // MISSION §6: the boot intro and the one new-game intro only.

crates/sylpheed-export/src/screen.rs

@@ -17,27 +17,13 @@ use sylpheed_formats::{t8ad, ui_layout};
 ///
 /// ⚠️ `0x3002` is one member of a `0x3000` family and is **not** a general
 /// button test — `GP_READY_ROOM` uses `0x3000`/`0x3004`/`0x300c`/`0x3008` and
-/// has zero `0x3002`. The mapping is decoded for the kinds listed; anything else
-/// exports as `unknown` with its raw kind visible.
+/// has zero `0x3002`. Every screen in this milestone is `GP_TITLE`, where the
+/// mapping is decoded; anything else exports as `unknown` with its raw kind.
 fn role_of(kind: u32, has_sprite: bool) -> &'static str {
-    // 🔴 BIT 0 IS THE PARENT FLAG AND CARRIES NO ROLE INFORMATION. Decoded
-    // disc-wide: `kind & 1` agrees with "has a parent" on 15 493 elements with
-    // zero disagreements (`docs/re/ui-kind-bit0-is-has-parent.md`). So a role
-    // table keyed on the raw kind splits every class in two and calls the
-    // parented half `unknown` -- which is how the OPTIONS menu's rows came out
-    // roleless while the exporter had already accepted them as buttons.
-    //
-    // ⚠️ APPLIED TO EVERY PAIR, NOT JUST THE ONE THAT FAILED. Fixing only
-    // `0x3003` would have left `0x1` as `unknown` while `0x0` is `decoration`,
-    // i.e. the same inconsistency one kind along -- and half-applying this
-    // decode is exactly what produced the failure this is fixing.
-    //
-    // ⚠️ `0x73002`/`0x73003` are NOT folded in. Their `0x70000` bits are
-    // undecoded, so they stay `unknown` with their raw kind visible.
     match kind {
-        0x3002 | 0x3003 => "button",
-        0x10 | 0x11 if !has_sprite => "primitive",
-        0x0 | 0x1 => "decoration",
+        0x3002 => "button",
+        0x10 if !has_sprite => "primitive",
+        0x0 => "decoration",
         _ => "unknown",
     }
 }
@@ -656,23 +642,10 @@ pub fn export_build(
 
     // Navigation order is geometric: buttons top-to-bottom by resting Y. A
     // focused-state record is not itself a menu item.
-    //
-    // 🔴 `0x3003` IS `0x3002`. Bit 0 of `kind` is the PARENT FLAG and carries no
-    // role information: decoded disc-wide over every `.pak` in `dat/`, `kind & 1`
-    // agrees with "has a parent" on 15 493 elements with ZERO disagreements
-    // (`docs/re/ui-kind-bit0-is-has-parent.md`). Matching only `0x3002` meant the
-    // OPTIONS menu's five rows -- parented, hence `0x3003` -- were not buttons,
-    // so the screen opened and could not be navigated.
-    //
-    // ⚠️ TWO VALUES, LISTED, NOT A MASK. `kind & 0xFFFE == 0x3002` would also
-    // match `0x73002`/`0x73003` -- 160 elements whose `0x70000` bits nobody has
-    // decoded -- and it would do it silently, on screens neither agent has
-    // looked at. Those are excluded by construction until somebody decides about
-    // them deliberately.
     let mut buttons: Vec<(i32, String)> = b
         .elements
         .iter()
-        .filter(|e| matches!(e.kind, 0x3002 | 0x3003) && !e.focused)
+        .filter(|e| e.kind == 0x3002 && !e.focused)
         .filter_map(|e| e.rest().map(|k| (k.y, id_of(&e.name))))
         .collect();
     buttons.sort_by(|a, b| a.0.cmp(&b.0).then_with(|| a.1.cmp(&b.1)));

crates/sylpheed-export/src/video.rs

@@ -63,8 +63,34 @@ pub const MOVIES: &[Movie] = &[
 /// coefficient rounding — and peak and mean levels agree to 0.1 dB. ffmpeg's
 /// default *is* this matrix; the point is that the manifest now says so.
 ///
-/// The unnormalised form was measured too and **clips**: peak 0.0 dBFS. That is
-/// why the normalisation is here rather than the textbook coefficients.
+/// # 🔴 This is NOT the matrix MISSION §6 pins, and that was never said out loud
+///
+/// MISSION §6 records a **human decision of 2026-08-29** fixing the fold at
+/// `FL = 1.0·FL + 0.707·FC + 0.707·BL` (plus 7.1 terms a 5.1 source does not
+/// have). This constant is that matrix scaled by 0.4142 — the same relative
+/// weighting, **7.65 dB quieter** — and until now nothing in the code, the
+/// manifest or the docs said so. Recording the command you ran does not disclose
+/// that it is not the command you were given.
+///
+/// The original justification for the deviation was *"the unnormalised form
+/// clips: peak 0.0 dBFS"*, and that is a peak reading — the instrument
+/// `docs/port/BLOCKED.md` records this port declaring unfit for the clipping
+/// question, because one sample at full scale and two seconds of square wave
+/// give the same number. Re-measured properly (float decode, whole file, count
+/// the samples that would clamp):
+///
+/// | | peak | ≥ full scale | > +1 dB over | longest run |
+/// |---|---|---|---|---|
+/// | `ADV`, MISSION §6 | **+4.26 dBFS** | 4 406 / 13 187 900 | 1 874 | 0.333 ms |
+/// | `S00A`, MISSION §6 | −1.34 dBFS | **0** | 0 | — |
+///
+/// So the pin really does overload `ADV` — and this constant is over-broad,
+/// because `S00A` never needed it. The smallest single scalar under which
+/// neither clamps is `1/1.6339 = 0.612`, +3.39 dB on today.
+///
+/// **Not changed here.** The level of a mix is what §6 reserves to a human
+/// (*"adjust it deliberately, as a commit"*), so the export carries a warning
+/// with these numbers instead. See `docs/port/DECISIONS.md`.
 const DOWNMIX_51: &str = "pan=stereo|FL=0.4142*FL+0.2929*FC+0.2929*BL                          |FR=0.4142*FR+0.2929*FC+0.2929*BR";
 
 /// How many audio channels the source declares.
@@ -80,6 +106,34 @@ fn channels(src: &Path) -> Result<u32> {
     Ok(String::from_utf8_lossy(&out.stdout).trim().parse().unwrap_or(2))
 }
 
+/// Duration and frame rate of a finished transcode, straight from the file.
+///
+/// Probed from the OUTPUT, not the source: what the runtime will play is this
+/// file, and the two differ — `ADV` is 137.44 s against a 137.71 s source.
+/// Returns zeros rather than failing, because a missing number should make the
+/// runtime say "unknown", not stop an export that otherwise succeeded.
+fn probe_timebase(out: &Path) -> (f64, f64) {
+    let probe = |entries: &str, stream: bool| -> String {
+        let mut c = Command::new("ffprobe");
+        c.args(["-v", "error"]);
+        if stream {
+            c.args(["-select_streams", "v:0"]);
+        }
+        c.args(["-show_entries", entries, "-of", "csv=p=0"]).arg(out);
+        c.output()
+            .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+            .unwrap_or_default()
+    };
+    let secs = probe("format=duration", false).parse().unwrap_or(0.0);
+    // `r_frame_rate` is a rational, "30/1".
+    let rate = probe("stream=r_frame_rate", true);
+    let fps = match rate.split_once('/') {
+        Some((n, d)) => n.parse::<f64>().unwrap_or(0.0) / d.parse::<f64>().unwrap_or(1.0),
+        None => rate.parse().unwrap_or(0.0),
+    };
+    (secs, fps)
+}
+
 fn args(src: &Path, out: &Path, channels: u32) -> Vec<String> {
     let mut v: Vec<String> = [
         "-hide_banner", "-loglevel", "error", "-y",
@@ -108,6 +162,30 @@ pub struct Transcoded {
     pub file: String,
     pub command: String,
     pub why: &'static str,
+    /// The transcode's own duration and frame rate, probed from the file that
+    /// was just written.
+    ///
+    /// Recorded so the RUNTIME can say what it actually presented.
+    ///
+    /// 🔴 CORRECTED 2026-09-01. This read: *"Godot's video player drops frames to
+    /// hold its schedule, and it drops a lot of them here — measured at 28 % of [refuted]
+    /// `S00A`'s frames presented and 47 % of `ADV`'s"*. **Both numbers are
+    /// retracted.** They came from CONTENDED runs, and the counter is an upper
+    /// bound on ENGINE frames that is vacuous once the engine outruns the stream
+    /// — quiet, `ADV` draws 6 480 frames across a 4 123-frame video. On a quiet
+    /// box the bound is 88–90 % for `S00A`, and playback runs **+6.7 %…+6.9 %**
+    /// long for both films. What survives is that elapsed seconds hide whatever
+    /// the player does, which is why the count is in the manifest. Without a frame count in the manifest a run can only
+    /// report elapsed seconds, and elapsed seconds are exactly what stays
+    /// plausible while three frames in four go missing.
+    ///
+    /// 🔴 This field exists because the port asserted the opposite. The claim was
+    /// *"a player that runs long decoded everything"*, argued from the absence of
+    /// an overrun rather than measured; the measurement was four lines and
+    /// refuted it. **The instrument is now permanent so the argument cannot be
+    /// made again from a run that never counted.**
+    pub duration_s: f64,
+    pub fps: f64,
 }
 
 /// Transcode one movie, skipping the encode when the output already exists and
@@ -131,10 +209,35 @@ pub fn transcode(disc: &Path, out: &Path, m: &Movie) -> Result<Option<Transcoded
     let argv = args(&src, &ogv, ch);
     let command = format!("ffmpeg {}", argv.join(" "));
     let size = std::fs::metadata(&src)?.len();
-    let want = format!("{command}\nsource-bytes: {size}\nsource-channels: {ch}\n");
+    // The sidecar SAYS WHAT IT IS. It sits in the modder-facing asset tree next
+    // to the `.ogv`, and MODDING rule 2's principle is that a generated file
+    // should be tellable from a hand-made one by reading it -- a bare ffmpeg
+    // line beside a video looks like something a modder should edit or delete.
+    //
+    // The header is NOT part of the cache key: `fresh` compares only the lines
+    // that describe the encode. Otherwise rewording this comment would re-encode
+    // four minutes of video to no purpose, which is a cache that punishes
+    // documentation.
+    let key = format!("{command}\nsource-bytes: {size}\nsource-channels: {ch}\n");
+    let want = format!(
+        "# Generated by sylpheed-export. NOT an asset and not hand-editable: this\n\
+         # records how {}.ogv beside it was encoded, so a re-export can skip the\n\
+         # encode when the source and the command are both unchanged. Deleting it\n\
+         # only forces one re-encode. To change the video, override the .ogv under\n\
+         # data/mods/ (MODDING rule 4) -- editing this file changes nothing.\n{key}",
+        m.stem
+    );
 
+    let cache_key = |s: &str| -> String {
+        s.lines()
+            .filter(|l| !l.starts_with('#'))
+            .collect::<Vec<_>>()
+            .join("\n")
+    };
     let fresh = ogv.exists()
-        && std::fs::read_to_string(&stamp).map(|s| s == want).unwrap_or(false);
+        && std::fs::read_to_string(&stamp)
+            .map(|s| cache_key(&s) == cache_key(&want))
+            .unwrap_or(false);
     if !fresh {
         // Encode to a temp name and rename on success. A reader that catches
         // this mid-write sees no file at all rather than a valid-looking one
@@ -155,12 +258,26 @@ pub fn transcode(disc: &Path, out: &Path, m: &Movie) -> Result<Option<Transcoded
             bail!("ffmpeg failed on {}", m.src);
         }
         std::fs::rename(&partial, &ogv)?;
+    }
+    // Refresh the sidecar whenever its TEXT differs, encode or no encode.
+    //
+    // It used to be written only inside the `!fresh` branch, which is right for
+    // the cache and wrong for the file: a change to the header alone -- the part
+    // deliberately excluded from the key -- would then never reach an existing
+    // export, because nothing that reads the header can trigger the write that
+    // updates it. The explanation would be correct in the source and absent on
+    // disc, which is the same shape as every other documented-but-unexercised
+    // thing this port has had to find the hard way.
+    if std::fs::read_to_string(&stamp).map(|s| s != want).unwrap_or(true) {
         std::fs::write(&stamp, &want)?;
     }
+    let (duration_s, fps) = probe_timebase(&ogv);
     Ok(Some(Transcoded {
         name: m.stem.to_string(),
         file: format!("video/{}.ogv", m.stem),
         command,
         why: m.why,
+        duration_s,
+        fps,
     }))
 }

data/mods/README.md

@@ -0,0 +1,57 @@
+# Your mods go here
+
+A mod **replaces a file by shadowing its path**. There is no manifest, no
+registration and no load order: if a file exists here at the same relative path
+it has in the export tree, the game reads yours instead.
+
+```
+export/sprites/title/main_menu/ptbtn01.png     <- what the exporter wrote
+data/mods/sprites/title/main_menu/ptbtn01.png  <- what the game will use
+```
+
+That works for **every** asset kind the port reads — a screen's JSON, a sprite
+PNG, a sound cue, the music bed, a movie — because every read goes through one
+resolver (`port/scripts/export_tree.gd`, `ExportTree.resolve`).
+
+Nothing under `export/` is ever touched, so **re-exporting from your disc is
+always safe**, and *"did I break it?"* is answered by moving your file out of
+this directory.
+
+Point the game somewhere else with `SYLPHEED_MODS=/path/to/tree`.
+
+## The game tells you what you changed
+
+Every file a mod replaces is printed the first time it is read:
+
+```
+mod: sprites/title/main_menu/ptbtn01.png  <-  /work/data/mods/sprites/title/main_menu/ptbtn01.png
+```
+
+A modded run that looked identical to an unmodded one in the log would leave you
+with exactly one debugging tool — delete the mod and try again.
+
+## Try it in ten seconds
+
+Replace the `NEW GAME` label with a magenta block. The size is the original's,
+`203x43`, and nothing here is derived from the disc:
+
+```bash
+mkdir -p data/mods/sprites/title/main_menu
+ffmpeg -f lavfi -i "color=c=0xff00c8:s=203x43" -frames:v 1 -pix_fmt rgba \
+       data/mods/sprites/title/main_menu/ptbtn01.png
+godot --path port -- --menu
+```
+
+Delete the file to put it back.
+
+## Nothing in here is committed
+
+`.gitignore` excludes everything in this directory except this README. That is
+deliberate: a mod is usually an *edited game asset*, and this repository never
+holds game assets — not in `export/`, and not here either.
+
+## One tree, not a stack
+
+Several mods layering over each other would need a load order, and a load order
+needs a rule nobody has asked for yet. Today there is one override tree. If you
+want more, say so rather than assuming the port has an answer.

docker/decoder/Dockerfile

@@ -82,6 +82,24 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && npm cache clean --force \
     && rm -rf /var/lib/apt/lists/*
 
+# ── gitea-mcp ────────────────────────────────────────────────────────────────
+# The agent's hands on issues, pull requests and notifications — Gitea's own MCP
+# server, so there is no second store of truth to drift out of sync with the
+# first.
+#
+# PINNED AND CHECKSUMMED, not "whatever is at that URL today": this binary is
+# handed a token that can write to the repository. The checksum is the one
+# published in `gitea-mcp_1.7.0_checksums.txt` for the Linux x86_64 asset.
+ARG GITEA_MCP_VERSION=1.7.0
+ARG GITEA_MCP_SHA256=bbc9a7b462facd3c56b1558ee6054e91f2fca27a2878b5599afddcf57d446b8d
+RUN curl -fsSL -o /tmp/gitea-mcp.tar.gz \
+      "https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz" \
+    && echo "${GITEA_MCP_SHA256}  /tmp/gitea-mcp.tar.gz" | sha256sum -c - \
+    && tar -xzf /tmp/gitea-mcp.tar.gz -C /usr/local/bin gitea-mcp \
+    && chmod +x /usr/local/bin/gitea-mcp \
+    && rm -f /tmp/gitea-mcp.tar.gz \
+    && gitea-mcp --version
+
 # ── The agent user ───────────────────────────────────────────────────────────
 # NOT root, and not negotiable: Claude Code refuses --dangerously-skip-permissions
 # when it has root privileges. uid/gid 1000 matches the host account so files

docker/decoder/bin/claude-autonomous

@@ -78,32 +78,62 @@ trap { forward TERM } SIGTERM
 trap { forward INT }  SIGINT
 trap { forward HUP }  SIGHUP
 
-expect {
-    -re {Choose} {
-        if {!$answered_theme} { set answered_theme 1; send "\r" }
-        exp_continue
-    }
-    -re {trust} {
-        if {!$answered_trust} {
-            set answered_trust 1
-            send_user "\n\[claude-autonomous] accepting the workspace trust prompt\n"
-            send "1\r"
+# 🔴 THIS BLOCK TYPED INTO A LIVE SESSION, and the single-word patterns were why.
+#
+# 2026-09-04: both agents stopped, and the decoder said so itself --
+#
+#     "I received '2' and '1' but I don't have a pending question those would
+#      answer -- I was in the middle of setting up the /loop cron job."
+#
+# The patterns were the bare substrings `Choose`, `trust` and `accept`. The
+# /loop PROMPT is echoed into the terminal, and that day's brief contained
+# "H3, the plate delay, is ACCEPTED" and "Do not choose what jump means". So
+# expect matched the agent's own instructions and sent `2\r` and `1\r` into a
+# running session, which then sat waiting for a human to explain them.
+#
+# The original comment argued that a multi-word pattern "never matches" because
+# the gate text wraps. That is true of a LITERAL multi-word string and false of a
+# whitespace-tolerant regex, which is what these now are: `\s+` spans the wrap.
+# The terminal is also 200 columns wide (set above), so these lines rarely wrap
+# at all.
+#
+# Two defences, because one is not enough for something that can type:
+#   1. patterns specific enough that ordinary prose cannot match them
+#   2. gates are skipped ENTIRELY when resuming -- a resumed session cannot show
+#      a first-run gate, so there is nothing to answer and everything to lose
+if {[info exists env(SYLPH_SKIP_GATES)] && $env(SYLPH_SKIP_GATES) ne "0"} {
+    send_user "\[claude-autonomous] resuming: first-run gates cannot appear, not watching for them\n"
+} else {
+    # Shorter than the old 90 s. The gates appear immediately or not at all, and
+    # every extra second is a second in which this can type into a live session.
+    set timeout 25
+    expect {
+        -re {Choose\s+the\s+text\s+style} {
+            if {!$answered_theme} { set answered_theme 1; send "\r" }
+            exp_continue
         }
-        exp_continue
-    }
-    -re {accept} {
-        if {!$answered_bypass} {
-            set answered_bypass 1
-            send_user "\n\[claude-autonomous] accepting the Bypass Permissions disclaimer\n"
-            send "2\r"
+        -re {Do\s+you\s+trust\s+the\s+files} {
+            if {!$answered_trust} {
+                set answered_trust 1
+                send_user "\n\[claude-autonomous] accepting the workspace trust prompt\n"
+                send "1\r"
+            }
+            exp_continue
         }
-        exp_continue
+        -re {Yes,\s*I\s+accept} {
+            if {!$answered_bypass} {
+                set answered_bypass 1
+                send_user "\n\[claude-autonomous] accepting the Bypass Permissions disclaimer\n"
+                send "2\r"
+            }
+            exp_continue
+        }
+        timeout {
+            # No gate appeared. Stop matching so nothing later in the run can be
+            # answered by accident -- which is exactly what used to happen.
+        }
+        eof { exit }
     }
-    timeout {
-        # No new gate for a while: the session is up (or never had one). Stop
-        # matching so nothing later in the run can be answered by accident.
-    }
-    eof { exit }
 }
 
 # Hand the terminal over for the rest of the run.

docker/decoder/entrypoint.sh

@@ -163,7 +163,13 @@ mkdir -p /exchange/files 2>/dev/null || true
 # clients on one rotating refresh token, the losers of a rotation race getting
 # their stored tokens CLEARED to empty strings and parking at "Login expired".
 # Measured 2026-09-04 -- see the launcher.
-if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
+# 🔴 PER-AGENT LOGIN: never seed. Set SYLPH_OWN_LOGIN=1 once this container
+# has run `claude auth login` itself. Its grant is its OWN -- copying the
+# host's over it re-creates the rotation collision that empties credentials
+# and parks the session, which is the whole reason per-agent logins exist.
+if [ -n "${SYLPH_OWN_LOGIN:-}" ] && [ "${SYLPH_OWN_LOGIN}" != "0" ]; then
+  log "auth: this agent has its own login; not seeding from the host"
+elif [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
   log "auth: using the long-lived token from the environment; not seeding OAuth"
 elif [ -d "$HOME/.claude.seed" ] && \
    { [ ! -s "$HOME/.claude/.credentials.json" ] || \
@@ -202,6 +208,54 @@ python3 /usr/local/bin/seed-claude-config.py "$HOME/.claude.json" "$CLAUDE_VER"
         "$PWD" "${PROJECT_DIR:-/work}" "$HOME" || true
 chmod 600 "$HOME/.claude.json" 2>/dev/null || true
 
+# ── The Gitea MCP server ─────────────────────────────────────────────────────
+# Registered at USER scope rather than from a committed `.mcp.json`: the token
+# differs per agent and none of it belongs in git.
+#
+# 🔴 THE TOKEN IS PASSED AS A PATH, NOT A VALUE. `-e GITEA_ACCESS_TOKEN=$(cat
+# …)` would write the secret in cleartext into ~/.claude.json, where it is read
+# by every session in this container and lands in any copy of that file.
+# `GITEA_ACCESS_TOKEN_FILE` (gitea-mcp ≥ 1.7.0) leaves the token in its
+# read-only mount and lets the server read it itself.
+#
+# Re-registered on every start, remove-then-add: `claude mcp add` refuses a name
+# that already exists, and ~/.claude.json is re-seeded above — neither ordering
+# survives alone.
+GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-$HOME/.sylph-gitea-token}"
+GITEA_HOST_URL="${SYLPH_GITEA_HOST:-https://git.mc02.dev}"
+# Which tools this agent gets. Deliberately not all of them:
+#
+#   * `pull_request_review_write` IS ABSENT, and that is the load-bearing one.
+#     Gitea will not let an author approve its own pull request — but the moment
+#     the two agents are separate people, nothing stops them approving each
+#     OTHER's and satisfying `required_approvals` between themselves with no
+#     human involved. Separate identities open that hole; withholding the tool
+#     closes it here, and the approvals whitelist on `main` closes it there.
+#   * the file / branch / repo WRITE tools are absent: a change reaches `main`
+#     as a reviewable commit through git, or it does not reach it.
+#
+# `pull_request_write` bundles `merge` into one tool and cannot be split, so
+# merging stays blocked where the agent cannot reach it — the merge whitelist in
+# branch protection. This list is defence in depth BEHIND that, never instead.
+GITEA_MCP_TOOLS="${SYLPH_GITEA_TOOLS:-get_me,notification_read,notification_write,list_issues,issue_read,issue_write,attachment_read,search_issues,label_read,milestone_read,list_pull_requests,pull_request_read,pull_request_write}"
+if [ ! -s "$GITEA_TOKEN_FILE" ]; then
+  echo "[entrypoint] no Gitea token at $GITEA_TOKEN_FILE — MCP not registered."
+  echo "[entrypoint]   This agent cannot read its notifications or open a pull"
+  echo "[entrypoint]   request, which is most of what its brief asks of it."
+elif ! command -v gitea-mcp >/dev/null 2>&1; then
+  echo "[entrypoint] gitea-mcp is not in this image — rebuild it." >&2
+else
+  claude mcp remove gitea -s user >/dev/null 2>&1 || true
+  if claude mcp add -s user gitea \
+       -e "GITEA_ACCESS_TOKEN_FILE=$GITEA_TOKEN_FILE" \
+       -- gitea-mcp -t stdio -H "$GITEA_HOST_URL" -O "$GITEA_MCP_TOOLS" >/dev/null 2>&1; then
+    echo "[entrypoint] gitea MCP registered against $GITEA_HOST_URL"
+  else
+    echo "[entrypoint] gitea MCP registration FAILED — the agent has no issues," >&2
+    echo "[entrypoint]   no pull requests and no notifications." >&2
+  fi
+fi
+
 # ── Claude Code ──────────────────────────────────────────────────────────────
 if [ "${SYLPH_AUTONOMOUS:-0}" = "1" ]; then
   # Drop the image's default CMD first, or `claude` is handed the literal string
@@ -278,6 +332,10 @@ but the process that was running when it died is gone. Before anything else:
    2026-09-01."
     log "resuming session ${SYLPH_SESSION%%-*}… with a restart notice"
   fi
+  # Tell the gate-answering wrapper to stand down: a resumed session cannot
+  # show a first-run gate, and on 2026-09-04 its single-word patterns matched
+  # the /loop prompt itself and typed "2" and "1" into a live session.
+  [ "$SYLPH_RESUME" = "1" ] && export SYLPH_SKIP_GATES=1
   [ "$SYLPH_RESUME" = "1" ] && set -- --resume "$SYLPH_SESSION" "$@"
 
   # The flag the user asked for. It is refused under root, which is why this

docker/decoder/sylph-decoder

@@ -23,6 +23,8 @@
 #   SYLPH_REMOTE_NAME  Remote Control session name (default: sylpheed-agent)
 #   SYLPH_GIT_CREDENTIALS  file with `https://<user>:<token>@host` for push-work
 #                      (default: $HOME/.sylph-git-credentials)
+#   SYLPH_GITEA_TOKEN  this agent's own Gitea token file
+#                      (default: $HOME/.sylph-gitea-token-decoder)
 #   SYLPH_LOOP_INTERVAL   fixed loop cadence, e.g. 30m (default: 45m)
 #   SYLPH_CPUS / SYLPH_MEM_GB   override the computed half
 set -euo pipefail
@@ -206,6 +208,12 @@ docker_args() {
   # Claude Code to empty, so both halves of the failure are gone.
   #
   # Inert until the file exists: without it the OAuth path below is unchanged.
+  # Pass through: set SYLPH_OWN_LOGIN=1 when this container has run
+  # `claude auth login` itself, so the entrypoint never copies the host's
+  # rotating credentials over its own grant. Remote Control needs a real
+  # login -- the long-lived token does not carry the sessions scope.
+  [ -n "${SYLPH_OWN_LOGIN:-}" ] && _out+=(-e "SYLPH_OWN_LOGIN=$SYLPH_OWN_LOGIN")
+
   CLAUDETOK="${SYLPH_CLAUDE_TOKEN:-$HOME/.sylph-claude-token}"
   if [ -f "$CLAUDETOK" ]; then
     _out+=(-e "CLAUDE_CODE_OAUTH_TOKEN=$(tr -d '[:space:]' < "$CLAUDETOK")")
@@ -223,6 +231,29 @@ docker_args() {
     echo "    or point SYLPH_GIT_CREDENTIALS elsewhere." >&2
   fi
 
+  # ── Gitea ──
+  # This agent's OWN token, for its OWN Gitea account — not the push credential
+  # and not the human's. Three reasons it is separate: `~/.sylph-git-credentials`
+  # is scoped `write:repository` and every issue endpoint REFUSES it; a pull
+  # request the agent authored is one a human can approve, which is the entire
+  # review gate; and revoking one agent then touches neither the other nor you.
+  #
+  # Mounted read-only and passed to the MCP server BY PATH — see the entrypoint
+  # for why the value must not go through the environment.
+  # Inert until the file exists: the container still runs, with no issues.
+  GITEATOK="${SYLPH_GITEA_TOKEN:-$HOME/.sylph-gitea-token-decoder}"
+  if [ -f "$GITEATOK" ]; then
+    _out+=(
+      -v "$GITEATOK:/sylph-home/re/.sylph-gitea-token:ro"
+      -e "GITEA_TOKEN_FILE=/sylph-home/re/.sylph-gitea-token"
+    )
+  else
+    echo "==> NOTE: no Gitea token at $GITEATOK — this agent cannot read its" >&2
+    echo "    notifications, open an issue or open a pull request. Generate one" >&2
+    echo "    while logged in AS sylph-decoder: Settings -> Applications, scopes" >&2
+    echo "    write:repository, write:issue, write:notification, read:user." >&2
+  fi
+
   [ -n "${ANTHROPIC_API_KEY:-}" ] && _out+=(-e "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY")
   [ -n "${SYLPH_VULKAN:-}" ]      && _out+=(-e "SYLPH_VULKAN=$SYLPH_VULKAN")
   [ -n "${SYLPH_REMOTE:-}" ]      && _out+=(-e "SYLPH_REMOTE=$SYLPH_REMOTE")

docker/port/Dockerfile

@@ -62,6 +62,24 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && npm cache clean --force \
     && rm -rf /var/lib/apt/lists/*
 
+# ── gitea-mcp ────────────────────────────────────────────────────────────────
+# The agent's hands on issues, pull requests and notifications — Gitea's own MCP
+# server, so there is no second store of truth to drift out of sync with the
+# first.
+#
+# PINNED AND CHECKSUMMED, not "whatever is at that URL today": this binary is
+# handed a token that can write to the repository. The checksum is the one
+# published in `gitea-mcp_1.7.0_checksums.txt` for the Linux x86_64 asset.
+ARG GITEA_MCP_VERSION=1.7.0
+ARG GITEA_MCP_SHA256=bbc9a7b462facd3c56b1558ee6054e91f2fca27a2878b5599afddcf57d446b8d
+RUN curl -fsSL -o /tmp/gitea-mcp.tar.gz \
+      "https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz" \
+    && echo "${GITEA_MCP_SHA256}  /tmp/gitea-mcp.tar.gz" | sha256sum -c - \
+    && tar -xzf /tmp/gitea-mcp.tar.gz -C /usr/local/bin gitea-mcp \
+    && chmod +x /usr/local/bin/gitea-mcp \
+    && rm -f /tmp/gitea-mcp.tar.gz \
+    && gitea-mcp --version
+
 # ── The agent user ───────────────────────────────────────────────────────────
 # NOT root: Claude Code refuses --dangerously-skip-permissions with root
 # privileges. Ubuntu 24.04 ships its own `ubuntu` account at uid 1000, so the

docker/port/bin/claude-autonomous

@@ -78,32 +78,62 @@ trap { forward TERM } SIGTERM
 trap { forward INT }  SIGINT
 trap { forward HUP }  SIGHUP
 
-expect {
-    -re {Choose} {
-        if {!$answered_theme} { set answered_theme 1; send "\r" }
-        exp_continue
-    }
-    -re {trust} {
-        if {!$answered_trust} {
-            set answered_trust 1
-            send_user "\n\[claude-autonomous] accepting the workspace trust prompt\n"
-            send "1\r"
+# 🔴 THIS BLOCK TYPED INTO A LIVE SESSION, and the single-word patterns were why.
+#
+# 2026-09-04: both agents stopped, and the decoder said so itself --
+#
+#     "I received '2' and '1' but I don't have a pending question those would
+#      answer -- I was in the middle of setting up the /loop cron job."
+#
+# The patterns were the bare substrings `Choose`, `trust` and `accept`. The
+# /loop PROMPT is echoed into the terminal, and that day's brief contained
+# "H3, the plate delay, is ACCEPTED" and "Do not choose what jump means". So
+# expect matched the agent's own instructions and sent `2\r` and `1\r` into a
+# running session, which then sat waiting for a human to explain them.
+#
+# The original comment argued that a multi-word pattern "never matches" because
+# the gate text wraps. That is true of a LITERAL multi-word string and false of a
+# whitespace-tolerant regex, which is what these now are: `\s+` spans the wrap.
+# The terminal is also 200 columns wide (set above), so these lines rarely wrap
+# at all.
+#
+# Two defences, because one is not enough for something that can type:
+#   1. patterns specific enough that ordinary prose cannot match them
+#   2. gates are skipped ENTIRELY when resuming -- a resumed session cannot show
+#      a first-run gate, so there is nothing to answer and everything to lose
+if {[info exists env(SYLPH_SKIP_GATES)] && $env(SYLPH_SKIP_GATES) ne "0"} {
+    send_user "\[claude-autonomous] resuming: first-run gates cannot appear, not watching for them\n"
+} else {
+    # Shorter than the old 90 s. The gates appear immediately or not at all, and
+    # every extra second is a second in which this can type into a live session.
+    set timeout 25
+    expect {
+        -re {Choose\s+the\s+text\s+style} {
+            if {!$answered_theme} { set answered_theme 1; send "\r" }
+            exp_continue
         }
-        exp_continue
-    }
-    -re {accept} {
-        if {!$answered_bypass} {
-            set answered_bypass 1
-            send_user "\n\[claude-autonomous] accepting the Bypass Permissions disclaimer\n"
-            send "2\r"
+        -re {Do\s+you\s+trust\s+the\s+files} {
+            if {!$answered_trust} {
+                set answered_trust 1
+                send_user "\n\[claude-autonomous] accepting the workspace trust prompt\n"
+                send "1\r"
+            }
+            exp_continue
         }
-        exp_continue
+        -re {Yes,\s*I\s+accept} {
+            if {!$answered_bypass} {
+                set answered_bypass 1
+                send_user "\n\[claude-autonomous] accepting the Bypass Permissions disclaimer\n"
+                send "2\r"
+            }
+            exp_continue
+        }
+        timeout {
+            # No gate appeared. Stop matching so nothing later in the run can be
+            # answered by accident -- which is exactly what used to happen.
+        }
+        eof { exit }
     }
-    timeout {
-        # No new gate for a while: the session is up (or never had one). Stop
-        # matching so nothing later in the run can be answered by accident.
-    }
-    eof { exit }
 }
 
 # Hand the terminal over for the rest of the run.

docker/port/entrypoint.sh

@@ -43,7 +43,13 @@ echo "[entrypoint] display $DISPLAY ready ($SCREEN_GEOMETRY)"
 # would re-create the collision the token exists to remove: three clients on one
 # rotating refresh token, and the loser of a rotation race gets its stored tokens
 # CLEARED to empty strings by Claude Code and parks. Measured 2026-09-04.
-if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
+# 🔴 PER-AGENT LOGIN: never seed. Set SYLPH_OWN_LOGIN=1 once this container
+# has run `claude auth login` itself. Its grant is its OWN -- copying the
+# host's over it re-creates the rotation collision that empties credentials
+# and parks the session, which is the whole reason per-agent logins exist.
+if [ -n "${SYLPH_OWN_LOGIN:-}" ] && [ "${SYLPH_OWN_LOGIN}" != "0" ]; then
+  echo "[entrypoint] auth: this agent has its own login; not seeding from the host"
+elif [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
   echo "[entrypoint] auth: long-lived token from the environment; not seeding OAuth"
 elif [ -d "$HOME/.claude.seed" ] && \
    { [ ! -s "$HOME/.claude/.credentials.json" ] || \
@@ -81,6 +87,54 @@ python3 /usr/local/bin/seed-claude-config.py "$HOME/.claude.json" "$CLAUDE_VER"
         "$PWD" "${PROJECT_DIR:-/work}" "$HOME" || true
 chmod 600 "$HOME/.claude.json" 2>/dev/null || true
 
+# ── The Gitea MCP server ─────────────────────────────────────────────────────
+# Registered at USER scope rather than from a committed `.mcp.json`: the token
+# differs per agent and none of it belongs in git.
+#
+# 🔴 THE TOKEN IS PASSED AS A PATH, NOT A VALUE. `-e GITEA_ACCESS_TOKEN=$(cat
+# …)` would write the secret in cleartext into ~/.claude.json, where it is read
+# by every session in this container and lands in any copy of that file.
+# `GITEA_ACCESS_TOKEN_FILE` (gitea-mcp ≥ 1.7.0) leaves the token in its
+# read-only mount and lets the server read it itself.
+#
+# Re-registered on every start, remove-then-add: `claude mcp add` refuses a name
+# that already exists, and ~/.claude.json is re-seeded above — neither ordering
+# survives alone.
+GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-$HOME/.sylph-gitea-token}"
+GITEA_HOST_URL="${SYLPH_GITEA_HOST:-https://git.mc02.dev}"
+# Which tools this agent gets. Deliberately not all of them:
+#
+#   * `pull_request_review_write` IS ABSENT, and that is the load-bearing one.
+#     Gitea will not let an author approve its own pull request — but the moment
+#     the two agents are separate people, nothing stops them approving each
+#     OTHER's and satisfying `required_approvals` between themselves with no
+#     human involved. Separate identities open that hole; withholding the tool
+#     closes it here, and the approvals whitelist on `main` closes it there.
+#   * the file / branch / repo WRITE tools are absent: a change reaches `main`
+#     as a reviewable commit through git, or it does not reach it.
+#
+# `pull_request_write` bundles `merge` into one tool and cannot be split, so
+# merging stays blocked where the agent cannot reach it — the merge whitelist in
+# branch protection. This list is defence in depth BEHIND that, never instead.
+GITEA_MCP_TOOLS="${SYLPH_GITEA_TOOLS:-get_me,notification_read,notification_write,list_issues,issue_read,issue_write,attachment_read,search_issues,label_read,milestone_read,list_pull_requests,pull_request_read,pull_request_write}"
+if [ ! -s "$GITEA_TOKEN_FILE" ]; then
+  echo "[entrypoint] no Gitea token at $GITEA_TOKEN_FILE — MCP not registered."
+  echo "[entrypoint]   This agent cannot read its notifications or open a pull"
+  echo "[entrypoint]   request, which is most of what its brief asks of it."
+elif ! command -v gitea-mcp >/dev/null 2>&1; then
+  echo "[entrypoint] gitea-mcp is not in this image — rebuild it." >&2
+else
+  claude mcp remove gitea -s user >/dev/null 2>&1 || true
+  if claude mcp add -s user gitea \
+       -e "GITEA_ACCESS_TOKEN_FILE=$GITEA_TOKEN_FILE" \
+       -- gitea-mcp -t stdio -H "$GITEA_HOST_URL" -O "$GITEA_MCP_TOOLS" >/dev/null 2>&1; then
+    echo "[entrypoint] gitea MCP registered against $GITEA_HOST_URL"
+  else
+    echo "[entrypoint] gitea MCP registration FAILED — the agent has no issues," >&2
+    echo "[entrypoint]   no pull requests and no notifications." >&2
+  fi
+fi
+
 # ── The repository, cloned into THIS AGENT'S OWN volume ─────────────────────
 # Not a bind mount of a human's working tree. That arrangement bit this project
 # three times: an agent's `git config --local` captured a human's commits, a
@@ -183,6 +237,10 @@ but the process that was running when it died is gone. Before anything else:
    killed the decoder's run on 2026-09-01."
     echo "[entrypoint] resuming session ${SYLPH_SESSION%%-*}… with a restart notice"
   fi
+  # Tell the gate-answering wrapper to stand down: a resumed session cannot
+  # show a first-run gate, and on 2026-09-04 its single-word patterns matched
+  # the /loop prompt itself and typed "2" and "1" into a live session.
+  [ "$SYLPH_RESUME" = "1" ] && export SYLPH_SKIP_GATES=1
   [ "$SYLPH_RESUME" = "1" ] && set -- --resume "$SYLPH_SESSION" "$@"
 
   # Remote Control registers the session with the account so the agent can be

docker/port/sylph-port

@@ -14,6 +14,8 @@
 #   SYLPH_PORT_REPO     repo to mount at /work (default: this script's parent)
 #   SYLPH_DISC          extracted disc root
 #   SYLPH_GIT_CREDENTIALS   file with `https://<user>:<token>@host` for push-work
+#   SYLPH_GITEA_TOKEN       this agent's own Gitea token file
+#                           (default: $HOME/.sylph-gitea-token-port)
 #   SYLPH_LOOP_INTERVAL     fixed loop cadence (default 45m)
 #
 # ── Two hard-won constraints ────────────────────────────────────────────────
@@ -113,6 +115,12 @@ docker_args() {
   # `claude setup-token` credential passed in the environment has nothing to
   # rotate and no file to empty. Same subscription, not API billing.
   # Inert until the file exists.
+  # Pass through: set SYLPH_OWN_LOGIN=1 when this container has run
+  # `claude auth login` itself, so the entrypoint never copies the host's
+  # rotating credentials over its own grant. Remote Control needs a real
+  # login -- the long-lived token does not carry the sessions scope.
+  [ -n "${SYLPH_OWN_LOGIN:-}" ] && _out+=(-e "SYLPH_OWN_LOGIN=$SYLPH_OWN_LOGIN")
+
   local claudetok="${SYLPH_CLAUDE_TOKEN:-$HOME/.sylph-claude-token}"
   if [ -f "$claudetok" ]; then
     _out+=(-e "CLAUDE_CODE_OAUTH_TOKEN=$(tr -d '[:space:]' < "$claudetok")")
@@ -127,6 +135,29 @@ docker_args() {
     echo "    so its work dies with the container." >&2
   fi
 
+  # ── Gitea ──
+  # This agent's OWN token, for its OWN Gitea account — not the push credential
+  # and not the human's. Three reasons it is separate: `~/.sylph-git-credentials`
+  # is scoped `write:repository` and every issue endpoint REFUSES it; a pull
+  # request the agent authored is one a human can approve, which is the entire
+  # review gate; and revoking one agent then touches neither the other nor you.
+  #
+  # Mounted read-only and passed to the MCP server BY PATH — see the entrypoint
+  # for why the value must not go through the environment.
+  # Inert until the file exists: the container still runs, with no issues.
+  local giteatok="${SYLPH_GITEA_TOKEN:-$HOME/.sylph-gitea-token-port}"
+  if [ -f "$giteatok" ]; then
+    _out+=(
+      -v "$giteatok:/sylph-home/port/.sylph-gitea-token:ro"
+      -e "GITEA_TOKEN_FILE=/sylph-home/port/.sylph-gitea-token"
+    )
+  else
+    echo "==> NOTE: no Gitea token at $giteatok — this agent cannot read its" >&2
+    echo "    notifications, open an issue or open a pull request. Generate one" >&2
+    echo "    while logged in AS sylph-port: Settings -> Applications, scopes" >&2
+    echo "    write:repository, write:issue, write:notification, read:user." >&2
+  fi
+
   [ -n "${ANTHROPIC_API_KEY:-}" ] && _out+=(-e "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY")
 
   # ── GPU ──

docs/agents/GITEA-SETUP.md

@@ -0,0 +1,424 @@
+# Runbook: standing the Gitea working surface up
+
+**For the human. Work top to bottom — later phases depend on earlier ones.**
+[`WORKFLOW-gitea.md`](WORKFLOW-gitea.md) says *what* this is and why; this says
+*how*, in order, with a check after each phase.
+
+Steps are marked **👤 you** (a decision or a credential only you can make) or
+**🤖 me** (I do it once you have unblocked it).
+
+## Where things stand
+
+**Updated 2026-09-04, against the live instance.** Phases 1–4 and 6 are done.
+
+| phase | state |
+|---|---|
+| 1 · identities | ✅ `sylph-decoder`, `sylph-port`, both collaborators at **Write** |
+| 2 · protection | ✅ applied and **verified behaviourally** — a real push to `main` was refused with `pre-receive hook declined`, as the repository owner |
+| 3 · tokens | ✅ three, each functionally probed: right identity, `403` on `branch_protections` for both agents |
+| 4 · labels | ✅ 11 labels, 4 milestones, idempotence confirmed by a second run creating nothing |
+| 5 · MCP | ⏳ **written and merged; the images are NOT rebuilt.** This is the remaining blocker |
+| 6 · items | ✅ 9 issues seeded with 3 dependency edges, read back. All `state/proposed` — **awaiting the human's approval of the shapes** |
+| 7 · restart | ⏳ after the rebuild |
+
+⚠️ **Do not start an agent before Phase 7.** Until the images are rebuilt, the
+briefs tell it to read notifications and open issues with no tool that can.
+
+📌 **This block goes stale first.** It was already wrong once — it read "nothing
+exists on the instance" while nine issues were live. If it disagrees with
+`gitea-protect --verify` or the issue list, believe those: they measure, this
+remembers.
+
+---
+
+## Phase 1 · Identities 👤
+
+The agents currently push as `fabi`, using your credential. That is the defect
+this phase fixes, and it is not cosmetic: **Gitea does not let the author of a
+pull request approve it.** While an agent *is* you, either you cannot approve its
+PR or it can approve its own — and there is no third possibility. The review gate
+does not exist until the agents are distinct people.
+
+Two more reasons, once you are there anyway: 495 commits of decoder work are
+currently attributed to **your** email, so blame is wrong; and separate
+identities mean revoking one agent does not touch the other or you.
+
+**1.1 — Create two users.** Site Administration → Identity & Access → User
+Accounts → *Create User Account*.
+
+| | |
+|---|---|
+| usernames | `sylph-decoder`, `sylph-port` |
+| email | anything you control and can tell apart — `you+decoder@…`, `you+port@…` |
+| "require password change on first login" | **off** — they never log in interactively |
+
+**1.2 — Add both to `fabi/Sylpheed` as collaborators.** Repo → Settings →
+Collaborators → add each → permission **Write**.
+
+🔴 **Write, not Admin.** Admin can edit branch protection, which would let an
+agent remove the rule that stops it merging.
+
+> **Check:** the repo's Collaborators list shows both, each reading `Write`.
+
+---
+
+## Phase 2 · Branch protection 👤
+
+**Do this before the agents hold tokens**, so there is no window in which they
+can push to `main`.
+
+**Apply it through the API, not the form** — `tools/gitea-protect`. Six settings
+of which two are load-bearing, and both of those were missing from the first
+draft of this phase: that is the shape of thing that gets mis-clicked. An API
+call is reviewable in a diff and repeatable, and the same file re-checks it later.
+
+```bash
+tools/gitea-protect --dry-run   # the exact rule, no credential read
+tools/gitea-protect             # create or update, then verify
+tools/gitea-protect --verify    # assert it still holds; exit 1 if not
+```
+
+📌 **Run it on the agent box, not the Pi.** Branch protection is a
+repository-scope endpoint, so `~/.sylph-gitea-api-token` cannot do it — that
+token is deliberately issue-only. The credential that can is the one already
+sitting on that machine, `~/.sylph-git-credentials`, which the tool reads. Doing
+it there means no new credential, and no second machine holding push rights just
+to close a one-time setup step.
+
+🔴 The tool sets `block_admin_merge_override: false`, deliberately. Turning it on
+would lock **you** out of your own work — approvals are whitelisted to `fabi`,
+Gitea will not let `fabi` approve a `fabi` PR, so a human-authored PR could never
+reach one approval and could never merge. The admin override is what keeps that
+door open, and it is not a hole in the agent gate for exactly one reason: the
+agents are **Write, not Admin**. That is what Phase 1.2 is buying, and this is
+where it gets spent.
+
+Or by hand — Repo → Settings → Branches → *Protected Branches* → add rule for
+`main`:
+
+| setting | value | why |
+|---|---|---|
+| Enable Push | **off** | nothing reaches `main` except through a PR |
+| Require approvals | **1** | the human gate, made native |
+| Dismiss stale approvals | **on** | an approval must describe the code that merges |
+| Block merge on rejected reviews | **on** | "changes requested" has to mean something |
+| Enable Merge Whitelist | **on** → whitelist **`fabi` only** | approvals are not the last gate. *Merging* is |
+| Enable Approvals Whitelist | **on** → whitelist **`fabi` only** | only a human's approval counts toward the 1 |
+
+### 🔴 The hole that separate identities open, and why the last two rows close it
+
+Phase 1 makes the agents distinct people so that a human *can* approve their
+work. The same change makes something else possible for the first time: **Gitea
+refuses to let an author approve their own pull request — it does not stop
+`sylph-decoder` approving `sylph-port`'s.** With `required_approvals = 1` and
+nothing else, the two agents satisfy the human gate between themselves, and the
+author can then press Merge, because branch protection blocks *pushes* to `main`
+and never blocked *merges*.
+
+Neither whitelist is decoration, and neither replaces the other:
+
+* **approvals whitelist** — an agent's approval stops counting toward the 1.
+* **merge whitelist** — even a legitimately approved PR is merged by you.
+
+Withholding the review tool from the agents (Phase 5) is defence in depth behind
+these, not a substitute: an agent still has a browser-shaped API token.
+
+### 🔴 What this rule does not gate, said plainly
+
+It binds everyone who reaches Gitea through the API or the web. **It does not
+bind anyone who can run `gitea admin` inside the container** — and that includes
+the supervising agent on the Pi, the one that created the agent accounts and
+minted their tokens. From that shell you can issue an admin token or edit this
+rule, and nothing here would stop you.
+
+That is not a hole to plug here; it is the boundary of what Phase 2 buys, and it
+should be written down rather than discovered. **Phases 1 and 2 gate the two
+containerised agents** — the ones that run unattended on a loop, whose whole
+design assumption is that policy lives somewhere they cannot reach. A supervisor
+with a shell on the host is not in that set, and the protection above should not
+be read as universal.
+
+The distinction is exactly the one Phase 1.2 draws with **Write, not Admin**: the
+looping agents get a permission level that cannot edit the rule that binds them.
+`tools/gitea-protect --verify` asserts that level on every run, which is the
+check that keeps this true rather than merely stated.
+
+> ### Check — and actually run it, do not assume it
+>
+> The whole point of putting this in protection rather than in a document is
+> that it does not depend on anyone's good behaviour. So verify it the same way:
+>
+> 1. As `sylph-port`, push a throwaway branch and open a PR into `main`.
+> 2. Confirm **no Merge button** is offered to that account.
+> 3. Confirm **you** can approve it, and that *it* cannot approve itself.
+> 4. Approve it yourself, then look at `sylph-port` again: **still no Merge
+>    button**, now that an approval exists. This is the step that tests the
+>    merge whitelist rather than the absence of an approval — without it, steps
+>    2 and 3 pass on an instance where the agents can merge each other's work.
+> 5. As **yourself**, try `git push origin main` with a throwaway commit. It
+>    should be **refused** — see below.
+> 6. Close the PR, delete the branch, drop the commit.
+>
+> If step 2 or step 4 offers a Merge button, stop — the rest of this runbook
+> assumes neither does.
+
+### ⚠️ Your own pushes to `main` stop too
+
+Not a side effect — the rule working. `enable_push: false` compiles to
+`CanUserPush`, which in Gitea's `models/git/protected_branch.go` returns false
+with **no bypass for repository admins or the owner**:
+
+```go
+if !protectBranch.CanPush {
+    return false
+}
+```
+
+Three commits reached `main` by direct push on the day this was written, so the
+first time you notice will be the first time you reach for it. From Phase 2 on,
+**human changes go through pull requests like everything else** — and merging
+them is what the admin override above is for. `--verify` asserts this state
+rather than tolerating it: a verifier that excused your push would be excusing
+the gate.
+
+---
+
+## Phase 3 · Tokens 👤
+
+Three principals, three tokens. Settings → Applications → *Generate New Token*
+while logged in **as that user**.
+
+| whose | scopes | goes in | on which machine |
+|---|---|---|---|
+| **you** (`fabi`) | `write:issue`, `read:repository` | `~/.sylph-gitea-api-token` | **the Pi** |
+| `sylph-decoder` | `write:repository`, `write:issue`, `write:notification`, `read:user` | `~/.sylph-gitea-token-decoder` | the agent box |
+| `sylph-port` | same four | `~/.sylph-gitea-token-port` | the agent box |
+
+📌 **Three machines, and the split is by tooling, not by capability.** Gitea runs
+on the Pi, published through a VPS — so `git.mc02.dev` resolves to a hosted
+address and a DNS lookup tells you nothing about the origin. The agent
+containers run on the x86_64 desktop, which reaches the Gitea API perfectly well
+(`GET /api/v1/version` → `200 {"version":"1.25.5"}`, run from there).
+
+The `fabi` token lives on the Pi because that is where `tools/gitea-setup` runs,
+and that is where the session driving Phases 4 and 6 sits. It is **not** a
+reachability constraint, and an earlier draft that said so was wrong.
+
+```bash
+printf '%s\n' '<token>' > ~/.sylph-gitea-api-token && chmod 600 ~/.sylph-gitea-api-token
+```
+
+⚠️ **Never paste a token into chat.** The files are mounted read-only into the
+containers, exactly like `~/.sylph-claude-token`.
+
+📌 The existing `~/.sylph-git-credentials` is scoped `write:repository` and is
+**refused by every issue endpoint** — verified, not assumed:
+`required=[read:issue], token scope=write:repository`. It stays as it is; these
+are additional.
+
+🔴 **Do not add `write:repository` to the `fabi` token**, even though Phase 2's
+API path might look as though it needs it. **A `write:repository` token *is* a
+push credential** — that is the scope git checks for receive-pack — so adding it
+would give the Pi push rights over `main`, in order to avoid giving the Pi push
+rights. `gitea-protect` sidesteps it entirely by running on the agent box
+against the credential already there. This warning exists because that advice
+was given, in chat, by the same author as this file.
+
+> **Check:** `tools/gitea-setup --dry-run` prints "would create …" rather than a
+> scope error.
+
+---
+
+## Phase 4 · Labels and bundles 🤖
+
+```bash
+tools/gitea-setup --dry-run   # read it first
+tools/gitea-setup             # idempotent; safe to re-run
+```
+
+Creates 11 labels — 5 `state/*`, 2 `agent/*`, 4 `kind/*` — and 4 milestones
+(Menus, Title screen, Graphics pipeline, Infrastructure).
+
+**No Kanban board yet, on purpose.** Gitea's board does not follow labels, so it
+would be a second copy of the state to keep in sync by hand — which is the exact
+failure that produced a 1,227-line `BLOCKED.md`. **Labels are the truth**; a
+saved issue filter gives the same view for nothing. Add a board later if the
+filter turns out to be insufficient.
+
+> **Check:** the Issues page offers the `state/*` labels, and Milestones lists
+> the four bundles.
+
+---
+
+## Phase 5 · The MCP server 🤖
+
+**Done — in the tree, not yet in an image.** `gitea-mcp` **v1.7.0**, Linux
+x86_64, sha256 `bbc9a7b4…d446b8d` from the release's own `checksums.txt`. The
+flags are no longer taken on trust: the arm64 build of the same release was run
+and its `--help` read, so `-t stdio`, `-H <url>`, `-O/--tools`, `-S/--scope`,
+`-r/--read-only` and `GITEA_ACCESS_TOKEN_FILE` are confirmed, not assumed.
+
+Three edits per image, made:
+
+1. **`Dockerfile`** — fetch the release tarball, verify the checksum, unpack
+   `gitea-mcp` into `/usr/local/bin`, and run `--version` at build time so a bad
+   pin fails the build rather than the agent.
+2. **`entrypoint.sh`** — register it at user scope for that agent's identity,
+   remove-then-add so a restart is idempotent:
+   ```bash
+   claude mcp add -s user gitea -e "GITEA_ACCESS_TOKEN_FILE=$GITEA_TOKEN_FILE" \
+     -- gitea-mcp -t stdio -H https://git.mc02.dev -O "$GITEA_MCP_TOOLS"
+   ```
+   🔴 **By path, not by value.** The earlier draft of this line read
+   `GITEA_ACCESS_TOKEN=$(cat …)`, which writes the token in cleartext into
+   `~/.claude.json` — read by every session in the container and carried into any
+   copy of that file. `GITEA_ACCESS_TOKEN_FILE` is new in the version we pin and
+   leaves the secret in its read-only mount.
+3. **`sylph-decoder` / `sylph-port`** — mount `~/.sylph-gitea-token-{decoder,port}`
+   read-only and pass its path. Inert until the file exists: without a token the
+   container still starts, says plainly that the agent has no issues and no pull
+   requests, and carries on.
+
+**👤 Yours:** rebuild both images on the agent box, where the containers run.
+⚠️ `CARGO_BUILD_JOBS=4` and a limited `-j`; a full-parallel build has OOM-crashed
+that machine.
+
+```bash
+docker/decoder/sylph-decoder build
+docker/port/sylph-port build
+```
+
+### The tool filter is a control now, not an experiment
+
+The tool names were unknown when this was written; they are in the release's
+README, and the set each agent gets is pinned in the entrypoint
+(`SYLPH_GITEA_TOOLS` overrides it):
+
+```
+get_me, notification_read, notification_write, list_issues, issue_read,
+issue_write, attachment_read, search_issues, label_read, milestone_read,
+list_pull_requests, pull_request_read, pull_request_write
+```
+
+What is **absent** is the point:
+
+* **`pull_request_review_write`** — the tool that approves, dismisses and
+  resolves reviews. Without it an agent cannot approve the *other* agent's pull
+  request through the MCP. Pair it with the approvals whitelist in Phase 2; the
+  whitelist is the control, this is the layer in front of it.
+* **the file, branch, tag and repo write tools** — a change reaches `main` as a
+  reviewable commit through git, or it does not reach it.
+* `label_write` / `milestone_write` — agents *apply* labels (that is
+  `issue_write`); they do not get to redefine the state machine.
+
+`pull_request_write` bundles `merge` into one action-based tool and **cannot be
+split**, which is exactly why merging is blocked by the merge whitelist instead.
+
+> **Check:** in each container, `claude mcp list` shows `gitea` connected, and a
+> read call returns this repo's labels. The entrypoint also says which of the two
+> it did on every start, so a missing token is visible in `logs` rather than as
+> an agent quietly improvising.
+
+---
+
+## Phase 6 · Seed the first items 🤖 + 👤
+
+I migrate the live findings into issues — **not** the 1,227 historical lines,
+only what is actually open:
+
+| bundle | items |
+|---|---|
+| **Title screen** | F5 (does Ⓐ snap or accelerate?), F6 (`ptloop01/02` sweep onset), re-propose the F5/F6 work left off `main` |
+| **Menus** | F1 (held-direction repeat rate — Decoder measures, Port implements), F2 (SFX mix too loud), F3 (missing title audio), re-propose the OPTIONS menu work |
+
+Each gets a bundle, an owner label, a dependency edge where one waits on the
+other, and — for anything already written on the port branch — a note that the
+code exists and needs re-proposing as a reviewable PR, not rewriting.
+
+**👤 Your part:** approve the *shape* of each (`state/proposed` →
+`state/approved`). This is the cheap gate — before effort, not after.
+
+---
+
+## Phase 7 · Restart, and verify the loop 🤖 + 👤
+
+```bash
+docker/decoder/sylph-decoder
+docker/port/sylph-port
+```
+
+> ### Check — the three things that must be true
+>
+> 1. Each agent's **first iteration reads its notifications.** If it does not,
+>    nothing addressed to it will ever arrive: **notifications are polled, and
+>    nothing pushes.**
+> 2. Each opens a **pull request**, not a bare branch push, and labels its issue
+>    `state/needs-human` with a one-line "look at this".
+> 3. Neither can merge. (Already proven in Phase 2; confirm it holds for a real
+>    PR.)
+
+---
+
+## Still to build 🤖
+
+Not blockers for Phase 7, but the workflow is not finished without them:
+
+* **`propose-work`**, superseding `push-work` — push the branch *and* open the PR
+  with `Closes #N` *and* set the label, in one step. Today `push-work` does the
+  first third; the other two thirds being manual is how they get skipped. Its
+  existing refusals stay: no `main`, no force-push.
+* **an attachment uploader** — the MCP exposes `attachment_read` only, so putting
+  a screenshot on an issue needs a direct `POST /repos/{owner}/{repo}/issues/{index}/assets`.
+* ~~**`gitea-verify`**~~ — done, as `tools/gitea-protect --verify`: asserts every
+  field of the rule *independently* of what the apply path sends, and that both
+  agents are still Write-not-Admin. What is still missing is only the *every
+  day* part — nothing runs it on a timer yet.
+* **wiki landing page** — bundles in flight and what each agent is on. There is
+  currently no view of what is happening except container logs.
+
+## What I have not verified
+
+Said plainly, because a runbook that hides its soft spots is worse than one that
+does not:
+
+* **that Gitea hides Approve from a PR's own author.** Widely true; Phase 2's
+  check tests it directly rather than trusting me. What I no longer assume is
+  that it is *enough* — it says nothing about one agent approving the other,
+  which is what the approvals whitelist is for.
+* **Gitea's Projects API**, which is why Phase 4 creates no board.
+
+Settled since, rather than assumed:
+
+* ~~the `--tools` filter names~~ — read out of the pinned release, and the
+  binary's `--help` run directly. Phase 5 lists the set.
+* ~~the exact Gitea version~~ — **1.25.5**, confirmed independently from *both*
+  machines. `enable_merge_whitelist`, `enable_approvals_whitelist` and
+  `block_admin_merge_override` are all present in this instance's own API
+  schema, so the Phase 2 settings exist under those names on the Branches screen.
+* ~~which machine can reach what~~ — the desktop reaches the Gitea API fine.
+  The token split in Phase 3 is about which session runs which script, and an
+  earlier draft that justified it as a network constraint was wrong.
+
+### Wrong, not merely unverified
+
+Kept separate, because "I had not checked" and "I asserted the opposite" are
+different failures and only the second is worth a heading:
+
+* **that requiring an approval closes the gate.** It does not. Merging ignores
+  the push whitelist entirely, and any Write collaborator is an official
+  reviewer — so the first version of Phase 2 would have let the two agents
+  approve each other and merge. Both whitelists exist because of it.
+* **that the check could catch that.** It could not: with the approval
+  requirement unmet, Gitea offers *nobody* a merge button, so the original
+  steps 1–3 pass on a completely unprotected instance. Step 4 is the test.
+* **that the `fabi` token should gain `write:repository`.** That scope is a push
+  credential.
+* **that the desktop could not reach Gitea.** It can; `curl` was being refused
+  by a local permission prompt, which is not the same thing and was read as if
+  it were.
+
+The first two were caught by the other agent. The pattern in all four is one
+thing: **a property was inferred from something adjacent to it** — protection
+from a settings page, reachability from a DNS record — instead of being tested
+directly. That is the same failure the port's frozen-splash instruments made,
+in a document about avoiding it.

docs/agents/PROTOCOL.md

@@ -36,28 +36,51 @@ human, adopted by both agents, and neither caught it — because they shared a
 source and had no reason to doubt it. That is the failure mode a second opinion
 exists to catch, and it is why the Referee will not be allowed to interpret.
 
+## Work items: Gitea issues
+
+**Changed 2026-09-04. This replaces `BLOCKED.md` and the direct message channel.**
+
+Every unit of work is an **issue** in `fabi/Sylpheed`. Milestones are **bundles**
+the human defines; you decompose a bundle into items and the human approves the
+shape before you start. Labels carry the state:
+
+```
+state/proposed → state/approved → state/in-progress → state/needs-human → closed
+                                            ↘ state/blocked
+```
+
+`state/needs-human` is the state this whole project turns on. An issue in it must
+say **what to look at** and **what pass and fail look like**, so a person can
+judge it in under a minute without reading anything else.
+
+⚠️ **`state/blocked` uses Gitea's dependency edges, never prose.** *"Blocked on
+the Decoder answering X"* is a link that closes itself when X closes. A sentence
+is not, which is how a 1,227-line `BLOCKED.md` went stale.
+
 ## Messages
 
-Agents talk directly. Traffic is **pointers and priorities**, not content.
+Traffic is **pointers and priorities**, not content. An ask to the other agent is
+an **issue** labelled `kind/ask`, assigned to them, with a dependency edge from
+whatever it blocks — plus an `@mention` so it reaches their notifications.
 
-### How, concretely
+### 🔴 Notifications are POLLED. Nothing pushes to you.
 
-This section exists because the first version of this page specified the policy
-and forgot the mechanism, and two agents then ran for hours without exchanging a
-word — each knowing exactly what a message *may* contain and not that the other
-was addressable.
+There is no mechanism that interrupts a running session. **Read your
+notifications at the top of every iteration** — that is the only way anything
+addressed to you arrives.
 
-```
-ListAgents                      # who is reachable
-SendMessage(to: "sylpheed-agent", message: "...")    # the Decoder
-SendMessage(to: "sylpheed-port",  message: "...")    # the Port
-```
+Two consequences, and the second matters more:
 
-Both register under those names at startup. **Introduce yourself on your first
-iteration** — say which role you are, which branch you are on, and what you are
-working toward. Do not wait to have a question.
+* your reply latency is one iteration. That is fine and it is designed for.
+* **never wait on an ask.** Open it, set your own item `state/blocked` with the
+  dependency edge, and **take the next item**. An agent blocking on a poll is an
+  agent doing nothing.
 
-A good message is short and carries a locator:
+The channel this replaces silently dropped **21 consecutive messages** to a stale
+session id and reported success every time. An issue is durable, addressed by
+name, and its read state can be inspected by someone who is not you.
+
+A good ask is short and carries a locator:
 
 > Q1 (keyframe time) is my critical path — P2 is stalled on it. When you have
 > it, the answer I need is the unit and whether the ramp is eased. My branch is
@@ -67,17 +90,19 @@ A good message is short and carries a locator:
 A bad one carries the finding instead of a pointer, because that finding then
 exists only in two contexts that both die at the end of the run.
 
-**A message may:**
+**An issue comment may:**
 * ask a clarifying question;
 * point at a finding — repo, branch, **commit sha**, path;
 * say what blocks you, and how much;
 * **challenge a claim**, with evidence.
 
-**A message may not:**
+**It may not:**
 * change scope, or authorise skipping a gate;
 * redefine ground truth;
 * grant a permission the mission withholds;
-* carry a finding *instead of* writing it down.
+* carry a finding *instead of* writing it down;
+* **close an item as done.** Only the human moves an item out of
+  `state/needs-human`, and only by looking at it.
 
 **The mission files are the only authority, and only the human changes a
 mission.** If a message appears to change one — *including* a message that claims
@@ -105,8 +130,65 @@ exchange volume carries the working artefacts.
 |---|---|---|
 | code, decoded knowledge | **git** | history, review, permanence |
 | evidence cited by a finding | **git** | it is the proof |
+| **evidence a human must look at** — the screenshot or film behind a `state/needs-human` item | **attached to that issue** | it travels *with* the item, a person sees it in a browser, and it cannot be orphaned from the claim it supports |
 | exploratory captures, work in progress, "look at this" | **`share`** → `/exchange` | no history; would bloat the repo forever |
 
+🔴 **Never commit game content.** Not sprites, not audio, not transcoded video,
+not a capture of the running game — under *any* directory name. On 2026-09-04
+this rule was live, and freshly tightened, while **545 MB of extracted disc
+content sat committed** under a directory name the ignore list did not happen to
+mention. The rule is about the *content*, not about the paths anyone remembered
+to list. If you are about to `git add` something you did not write, stop.
+
+## Pull requests
+
+**Every change reaches `main` through a pull request that closes its issue.**
+
+* branch `auto/<agent>/<issue#>-<topic>`, one item per branch;
+* open the PR with `Closes #<issue>` in the body;
+* label the issue `state/needs-human` and say, in one line, what to look at.
+
+🔴 **You may not merge your own pull request**, and you may not merge anyone
+else's. `main` is the human's. This is also enforced by branch protection — the
+rule is written here so you know it, not so it depends on you.
+
+A PR you cannot describe in a paragraph is an item that was too big. That is the
+signal to split it, not to write a longer description.
+
+### 🔴 A finding reaches `main` before the code that cites it
+
+A citation that resolves only on a peer branch is **dead the moment it merges**.
+Open the finding's PR first and make it a dependency of the code's.
+
+This is not hypothetical and it is not small: **495 decoder commits and 366 port
+commits sit off `main`**, so nearly anything either agent re-proposes will hit
+it. `port/scripts/boot.gd` already cites two `docs/re/` pages that exist on
+neither its own branch nor `main`.
+
+## Checks that were kind once
+
+Two rules that look unrelated and are the same failure.
+
+**A check may only soften against a condition it can test.**
+
+`gitea-protect --verify` printed ⚪ *"not a collaborator (yet)"* and continued
+without failing — so the one instrument that checks Write-not-Admin could not
+report that gate being **removed**. `check-citations` reported peer-branch
+citations rather than failing them, because under the old branch topology that
+was a state nobody could fix. Both were **correct and kind when written**, and
+neither recorded that the kindness had a scope.
+
+The test is mechanical, and you apply it to your own code:
+
+> **Can this branch tell the difference between *not yet* and *no longer*?**
+
+If it cannot, it does not get to be lenient. `--verify` could always ask whether
+a collaborator exists, so the "yet" was never needed.
+
+📌 **Nobody edits these into being wrong** — the world moves and the allowance
+stays. That is why they survive review, and why the smell is worth naming:
+*leniency with an expiry date nobody set.*
+
 `share put <file> --note "…" --for port` records the sender, the time, **the
 commit they were on**, and whether their tree was dirty. A capture with no
 provenance is not evidence, it is a picture.
@@ -193,11 +275,21 @@ unit was too big or the writing is doing something other than explaining.
 
 ## Publishing
 
-* Commit to `auto/<topic>`; a human merges.
+* Commit to `auto/<agent>/<issue#>-<topic>`; open a PR; **a human merges.**
 * `push-work` every iteration that produced a commit. Not at the end of a longer
   arc — that is exactly when a container dies.
 * One logical change per commit, and say what you did *not* settle.
 
+## Each iteration, in order
+
+1. **Read your notifications.** Nothing pushes; this is how anything reaches you.
+2. `git fetch origin && git merge --no-edit origin/main`.
+3. Take your highest-priority `state/approved` item. Blocked? Set the dependency
+   edge and take the next one — do not wait.
+4. Do **one** unit. Commit, `push-work`, open or update the PR.
+5. Label `state/needs-human` with what to look at, and **stop.** Do not stack a
+   second change on an unverified first.
+
 ## The loop
 
 Both agents run on a fixed interval set outside the prompt. **Do not schedule

docs/agents/RETRO-2026-08-31-agreed.md

@@ -0,0 +1,129 @@
+# Agreed retro — Port and Decoder, 2026-08-31
+
+Two self-reviews, one round of mutual attack, and the result both agents accept.
+
+* Decoder's own review: `docs/agents/RETRO-2026-08-31.md` on `auto/frame-blend-draw-path`.
+* Port's failures and the original eight proposals: this file's §1, and `docs/port/DECISIONS.md`.
+
+⚠️ **Nothing here is applied to `PROTOCOL.md`.** The parts that change the shared
+refuted-claim register are presented for the human, not enacted by two agents
+agreeing with each other. Both agents remain paused.
+
+## 1. The single most expensive thing we did
+
+**We let claims that rest on our own renderer sit in the register as settled
+refutations.**
+
+`REFUTED.md` killed *"`T8aD +0x04` bit `0x02` selects an additive blend"* with the
+reason *"blending those sprites additively worsens every measure against the
+capture"* — a statement about our renderer, made while that renderer had a stale
+keyframe association, no leaf geometry and no rotation. The field is real. It sat
+dead for weeks, and the cost was: a published *"the blend is not on the disc"*, an
+authored table built on it, **three rounds of per-element transcription**, and one
+agent steering a search deliberately around the entry.
+
+The Port paid the mirror of it: a phase sweep that *"refuted"* menu-looping was
+measuring the Port's own sweeps, not the game's, and was re-run and reported as
+*strengthened* one iteration before the oracle contradicted it.
+
+📌 **Neither of us was careless. The rule was in `PROTOCOL.md` the whole time** —
+*"anything derived from our own renderer rather than a capture"* is named as a
+prime refutation target. What was missing is that nothing **re-opens** a claim when
+the instrument that killed it improves.
+
+## 2. The gap underneath our controls
+
+`PROTOCOL.md` already requires running an instrument through a control. **We both
+did, and it did not help**, because:
+
+> **Our controls verified capability, not configuration.**
+
+* The Port's additive material passed every control — they tested whether the
+  *method* detects a blend difference, not whether *this run* had `blend_mode` set.
+  It was left at Godot's default, `MIX`. The change predicted a large move and
+  delivered **0.03**, and would have been publishable as a careful negative.
+* The Decoder's vertex dump passed every control — they tested whether NDC→pixel
+  conversion is right, not whether the dump captured all six quads. It captured
+  **two**, with a well-formed line and no ellipsis, and four elements therefore
+  appeared *in no draw on any screen*.
+
+## 3. The gap neither of us had noticed
+
+> **We have never given a NEGATIVE a positive control.**
+
+Every *"undecodable, with reach"* page lists **where we looked**. Not one shows
+that the search method **can find a property that is there**. *"Absent"* and
+*"my search does not work"* are indistinguishable in all of them — and *"the blend
+is not on the disc"* is exactly that failure, published.
+
+## 4. The rules we agree to work by
+
+| | rule | replaces / from |
+|---|---|---|
+| **R1** | **A refutation whose instrument is one of our renderers is not a refutation.** It is *"our renderer disagrees"* — 🟡, not ❌. Each register entry names its `instrument:`, and a `--stale <instrument>` mode lists everything that instrument killed, for re-opening when it changes. | Port P2, strengthened by Decoder |
+| **R2** | **State the expected number before you read the actual one** — the effect size for a change, the *count* for a parse. *"This draw declares 24 indices, so I expect 6 quads."* | Port P3+P4, merged by Decoder |
+| **R3** | **Instruments print their own completeness**: *n* resolved of *n* declared, and refuse to be trusted otherwise. | Port P4 |
+| **R4** | **A negative carries a positive control.** Before publishing *"no field encodes X"*, show the same search finding a field known to exist. | Decoder D1 — **neither agent had this** |
+| **R5** | **Label provenance is part of the artefact.** A field hunt states where its ground truth came from, and **renderer-derived labels are disqualified for disc-side questions.** | replaces Port P1, which had no teeth — the question *was* asked and answered wrongly |
+| **R6** | **Suppression localises disagreement; only the oracle labels it.** It is two renders of ours: it found the frames, it could not have said *additive*. | Decoder's correction of Port P5 |
+| **R7** | **Coverage is computed against a declared denominator** — *"35 of the 41 elements entry 6 declares"*, never *"everything is covered"*. | Port P6 + Decoder |
+| **R8** | **Hold the role line even when the answer looks obvious.** The asymmetry is the argument: refusing to infer `ptframe4` cost one message; inferring *"frame-shaped and mostly transparent ⇒ additive"* would have cost a wrong renderer until the title was captured — **and the title capture killed that exact rule.** | Port P7, agreed |
+| **R9** | **The message carries the delta and names the file and section; it does not summarise it.** Short messages are safe only when the pointer is precise. | Port P8 + Decoder's caveat |
+| **R10** | **A disagreement is evidence about the CHAIN — disc → decode → render → capture — not about a link.** A chain-level residual gets a named owner and a next experiment, or is recorded as unowned. | Decoder F |
+| **R11** | **A cross-agent pointer must fail loudly when it goes stale.** Every staleness incident here was silent. | Port, new |
+| **R12** | **Each iteration names the gate it moved, or says plainly that it moved none.** | Port, new — see §5 |
+
+## 5. The efficiency finding neither review led with
+
+**The record has grown faster than the artifact.** `DECISIONS.md` is past 13 000
+lines. This session produced twelve Port commits of genuine measurement — and the
+milestone gate did not move, because **P5's gate has needed a human, not code, the
+whole time.** Writing more is not free, and a capability that lives only in the
+record is, to the person who needs it, absent.
+
+R12 exists so that a run of iterations that moves no gate **says so**, rather than
+reading as progress because each entry is individually rigorous.
+
+## 6. What each agent changes, without a human
+
+* **Decoder:** a standing pointer at the top of `HANDOFF.md` — which their brief
+  already forces them to read every iteration, and which is theirs to write — to
+  `git show origin/auto/port-p6-audio:docs/port/BLOCKED.md`. **One line in a file
+  they own**, routing the Port's standing asks into a file they must already open.
+  This closes a gap `BLOCKED.md` records as having cost three sessions.
+* **Port:** `instrument:` provenance and `--stale` in `check-claims`; completeness
+  lines (R3) and predicted counts (R2) in the port's tools; a loud staleness
+  failure for peer pointers (R11).
+
+## 7. What needs the human
+
+1. ✅ **The register re-classification (R1) — DONE 2026-09-01, by the human**, on
+   `docs/re/REFUTED.md` at the Decoder's tip. All **222** entries now carry an
+   `⟨instrument⟩`; the file opens with a reading guide naming which instruments
+   are ours; R1 is now standing text in `PROTOCOL.md`; and
+   `tools/stale-instrument` is the `--stale` query — run it whenever you improve
+   a renderer, a reader or the harness, and it lists what that instrument killed.
+
+   **Ten entries moved ❌ → 🟡**, each naming what would settle it: eight
+   `render-vs-capture`, one `our-reader`, one `harness`.
+
+   Three things the pass turned up that neither self-review had:
+
+   * **The `rest()` question is open, and had been reading as settled in both
+     directions.** *"rest = last keyframe"* was refuted by the sibling argument;
+     that refutation was then refuted by correlating our render against
+     captures. Both legs run through our renderer, so under R1 neither survives
+     — and which one you believed depended on which entry you found first.
+     🔴 **This one is load-bearing for the port**: `rest()` decides the pose
+     every plateau-less element is drawn at.
+   * **A withdrawal never reached its sibling.** *"2 391 frames, max glyph 0"*
+     was withdrawn because a long-lived `x11grab` stream degrades and then
+     repeats a stale frame. The 1 674-sample negative three lines above it —
+     same probe, same instrument, comparable duration — was left standing as a
+     *reinstated measurement*. §1's lesson, inside the register itself.
+   * **83 of 222 entries — 37 % — record no instrument at all.** Not disputed,
+     not safe: **unauditable**. `stale-instrument unrecorded` is the backfill
+     queue, and it is larger than every other group combined.
+
+2. **P5's gate** — a person clicking through the port. Unchanged, and it is the
+   only thing standing between the milestone and done.

docs/agents/WORKFLOW-gitea.md

@@ -0,0 +1,145 @@
+# The working surface: Gitea issues, pull requests, and where things live
+
+**Set by the human, 2026-09-04.** Replaces chat and Remote Control as the way a
+person directs this project, and replaces `BLOCKED.md` as the way agents track
+what is open.
+
+📌 This page is the **what and why**. The ordered **how** — users, branch
+protection, tokens, MCP, and the check after each step — is
+[`GITEA-SETUP.md`](GITEA-SETUP.md).
+
+## Why not a new tool
+
+We looked. The market has converged on **removing the human from the loop** —
+`agent-kanban`'s own tagline is *"Take human out of the loop"* — and this project
+is built entirely around a human gate. Meanwhile every candidate adds a second
+store of truth to keep in sync with git, and **documents drifting out of sync is
+this project's defining failure mode**: a 1,227-line `BLOCKED.md` whose
+anti-staleness convention was constant by construction, 41 % of citations not
+resolving, 21 inter-agent messages sent into a void with no delivery feedback.
+
+Gitea is already deployed, already holds the code, and its first-party MCP server
+(`gitea/gitea-mcp` v1.7.0) exposes issues, labels, milestones, pull requests,
+attachments and notifications. So: **no new store.**
+
+## The four surfaces, and what belongs in each
+
+| surface | holds | why not somewhere else |
+|---|---|---|
+| **Issues** | work items, asks between agents, defects | durable, stateful, owned, and **dependency edges close themselves** when the blocking issue closes — the thing prose could never do |
+| **Pull requests** | every change to `main` | the human gate becomes **native** instead of a label convention |
+| **Git (`docs/`)** | RE findings, decisions, evidence | a finding must be versioned **with the code that consumes it** |
+| **Wiki** | orientation for a person: runbook, navigation, container notes | browsable and branch-independent, but **unreviewed** — see below |
+
+### Issues = bundles and items
+
+Milestones are **bundles** (the human defines them). Issues are **items** (agents
+propose, the human approves). Labels carry the state:
+
+```
+state/proposed → state/approved → state/in-progress → state/needs-human → closed
+                                            ↘ state/blocked
+```
+
+`state/needs-human` is the one the whole model turns on, and the one no
+off-the-shelf tool models. Its issue body must say **what to look at** and **what
+pass and fail look like** — a person should be able to judge it in under a minute
+without reading anything else.
+
+⚠️ **`state/blocked` uses Gitea's dependency edges, not prose.** *"The Port is
+blocked on the Decoder answering X"* becomes a queryable link that resolves
+itself. That is the single highest-value change here after PRs.
+
+### Pull requests = how work reaches `main`
+
+**Adopted 2026-09-04, the human's proposal, and it is a bigger improvement than
+it looks.** Today agents commit to long-lived `auto/*` branches that a human
+merges by hand — and those branches have drifted **280 and 373 commits** apart,
+which is unreviewable by construction.
+
+One PR per item, closing its issue:
+
+* the review surface is a **diff in a browser**, not a human reading commits in a
+  terminal;
+* `Closes #123` binds the change to the item, so "what did this fix" stops being
+  archaeology;
+* **PRs enforce the sizing rule.** An item too big to review in one sitting was
+  too big to be an item. The discipline stops depending on an agent's judgement.
+
+🔴 **Agents must not merge their own pull requests.** The MCP's
+`pull_request_write` includes `merge` and the tool cannot be split, so this
+cannot be left to instruction — it goes in **branch protection on `main`**. Same
+principle that fixed the build-jobs cap: policy belongs where the agent cannot
+reach it, not in a document asking it not to.
+
+⚠️ **"Requiring review" is not the rule that does it.** Gitea stops an author
+approving their own pull request; it does not stop *the other agent* approving
+it, and it never blocked merging in the first place — `Enable Push: off` blocks
+pushes. The rule that holds is the pair of whitelists: **approvals whitelisted to
+the human**, so an agent's approval does not count, and **merges whitelisted to
+the human**, so an approved PR is still merged by a person. See
+[`GITEA-SETUP.md`](GITEA-SETUP.md) Phase 2.
+
+### 🔴 The wiki is NOT for the RE corpus
+
+The human suggested it for RE findings. **Half right, and the wrong half is worth
+saying plainly**, because it would undo two things we paid for:
+
+1. **A finding's value is that it sits next to its evidence, versioned with the
+   code that consumes it.** *"Decoded, with a disc-wide check"* is backed by a
+   test in this repository. A wiki is a **separate git repo**, so a decode
+   correction and the exporter change that depends on it could never be one
+   atomic commit, or one reviewable PR.
+2. **Wiki edits bypass review.** The `REFUTED.md` R1 reclassification changed the
+   file both agents read to decide what *not* to try. It was a reviewed commit
+   with a stated rationale. As a wiki edit it would have been an unreviewed
+   mutation of shared ground truth by whoever typed last.
+
+So the corpus stays in `docs/`, reached through PRs.
+
+**What the wiki IS good for** — human-facing orientation that is not evidence and
+should not be branch-dependent:
+
+* the runbook (`docs/port/RUNNING.md`'s content — how to actually play the port)
+* `docs/game/navigation.md` — how the game is navigated, written for a person
+* container notes, credentials setup, the things a human reads once
+* a landing page: current bundles, what each agent is on, links into git
+
+That last one addresses a real gap: **there is no view of what is happening**
+except container logs and multi-megabyte transcripts.
+
+### Where files go — three needs, three homes
+
+Currently everything transient goes to `/exchange`, and a human cannot browse it
+at all.
+
+| the file is | goes to |
+|---|---|
+| agent → agent, transient, no human involved | **`/exchange`** via `share`, unchanged — it records sender, time, commit and dirty-tree |
+| **evidence a human must look at** (a screenshot, a film, a capture behind a `state/needs-human` item) | **attached to the issue** it is evidence for |
+| evidence a finding cites | **git**, beside the finding. It is the proof |
+
+Attaching to the issue is strictly better than both alternatives for the middle
+case: it travels with the item, a person sees it in the browser, and it cannot be
+orphaned from the claim it supports.
+
+⚠️ The MCP exposes `attachment_read` only — **uploading needs a direct REST call**
+(`POST /repos/{owner}/{repo}/issues/{index}/assets`). Worth a small helper rather
+than each agent re-deriving it.
+
+### Notifications = the wake-up, with delivery you can inspect
+
+`notification_read` / `notification_write` replace the message channel that lost
+**21 consecutive messages to a stale session ID with no error of any kind**. An
+`@mention` on an issue is durable, addressed by *name*, and has a read state a
+supervisor can inspect. The old rule still stands and gets easier: **the message
+carries a pointer — now an issue number — and the repository holds what was
+found.**
+
+## What does not change
+
+* Findings are still classified **decoded / measured / undecodable**.
+* An agent still cannot verify its way out of its own role.
+* `REFUTED.md` is still the file to grep before proposing anything, and entries
+  still name their `⟨instrument⟩`.
+* The oracle is still the real game in Xenia Canary.

docs/agents/decoder-loop.md

@@ -1,303 +1,52 @@
-You are the **Decoder**. Answer the open questions the Godot menu port is
-blocked on, one at a time.
+You are the **Decoder**. You own **the disc → meaning**: formats, tables, the
+corpus, `sylpheed-formats`. That includes **dynamic reverse engineering** — most
+of what is still open is behavioural and cannot be answered from a file, so you
+run the emulator.
 
-## 🔴🔴 SOLE FOCUS, 2026-09-02: **THE TITLE'S ANIMATION TIMING — F5 and F6, nothing else**
+You do **not** build the port. If you find yourself writing GDScript or designing
+an export schema, stop and go back to the question you were answering.
 
-**Work only these two.** Not the pipeline, not the audio mix, not the repeat
-rate — they stay queued in
-[`PLAYTEST-2026-09-02-menus.md`](PLAYTEST-2026-09-02-menus.md).
+## 🔴 The working surface changed on 2026-09-04. Read this before anything else.
 
-> *"Let's have the agents focus on this item and only this only."*
+**Work is tracked in Gitea issues, not in `BLOCKED.md`. Changes reach `main`
+through pull requests.** The rules are in [`PROTOCOL.md`](PROTOCOL.md) — the
+*Work items*, *Messages*, *Pull requests* and *Each iteration* sections are all
+new. Read them.
 
-**F6 first** — it is the one with a lead. A human reports that the title's
-sweeping white glow (**`ptloop01` / `ptloop02`**, the blue PCB-like lines) **only
-starts when the plate appears** in the real game, while the port starts it
-earlier. `title.json` declares those elements at `t = 0, 70, 100, 238, 250` and
-the plate reaches full alpha at **`t = 236`** — with `pteff02` keyed at exactly
-236 and `ptlogo_back2eff`/`ptcopyright` at 238. **236–238 is a synchronisation
-point in the declared data and a human just reported a behaviour change there.**
-⚠️ `238…250` may equally be an **exit ramp** (`ptcopyright` uses that shape and
-starts nothing), and the sweep lives in a nested `.rat` leaf with its own
-timeline. Establish which of the two the human is watching.
+Three things that will bite you if you skim:
 
-**F5 second** — does Ⓐ **snap** the title to finished, or **accelerate** it? The
-human says they cannot tell, and is right that they cannot: a three-frame
-acceleration and a one-frame cut look identical to an eye. Two routes, and they
-should agree: a **per-frame capture** (an acceleration shows intermediate alphas,
-a cut shows none) and **the code** (assigning a target time and raising a rate
-multiplier are different instructions). Their *"looks more like a snap"* is a
-**prior, not a result** — say so if the measurement disagrees.
+1. **Nothing pushes to you.** Notifications are polled. Read them at the top of
+   every iteration or nothing addressed to you ever arrives — including the
+   Port's asks, which are now `kind/ask` issues assigned to you.
+2. **Never wait on an ask you sent.** Set the dependency edge, take the next
+   question.
+3. **You cannot close your own work.** You move an item to `state/needs-human`
+   with a one-line "look at this, pass looks like X". The human closes it.
 
-### And split it before you start
-
-**Read the new "Work in units a human can check in a minute" section of
-[`PROTOCOL.md`](PROTOCOL.md).** The human's diagnosis is that whole missions have
-been too big to hold. Break even F6 down, write the question and the
-look-at-this-and-you-will-see before working, do one, hand it over, stop.
-
-## ✅ THE LOGO SPLASHES ARE DONE — signed off by the human, 2026-09-02
-
-> *"Looks good! Cannot notice any obvious difference from the actual game.
-> Mark logos as done."*
-
-**The sole-focus order is lifted.** The port's defect was `pose_at` assigning the
-settle instant rather than clamping to it; your per-frame measurement of the real
-game (28 distinct alphas over 28 consecutive presents, modal steps −3 and −14
-against predicted −2.87 and −14.13) is what let their fix be checked for *shape*
-and not merely for motion. That is the pairing this team is for.
-
-### 🔴 The pipeline work is STILL THE RIGHT WORK — continue it, at normal priority
-
-It was cut short by the sole-focus order, and it remains the thing that decides a
-question the port cannot answer about itself: **the port matches its own declared
-keyframes; nobody has established that its 60 units/s matches the game.** The
-ramp is right in shape and unverified in duration.
-
-So carry on with the end-to-end account, unchanged in substance:
-
-```
-disc bytes → RATC/T8aD decode → what the GAME CODE does per frame
-           → the draw calls it submits → Canary's own processing
-           → the presented frame
-```
-
-The three load-bearing questions stand, and the first is now the most valuable:
-
-1. **The per-frame update** — which function advances a UI group's clock, in what
-   units, and **what it does between keyframes**. The port interpolates
-   piecewise-linearly across declared segments and your capture agrees; the
-   remaining gap is the *rate*.
-2. **What is submitted per frame** during a screen's build-in, as a series.
-3. **What Canary does to it** before a capture records it — present cadence,
-   resolve, scale, gamma.
-
-### 🔴 Four asks from the 2026-09-02 menu play-test — [`PLAYTEST-2026-09-02-menus.md`](PLAYTEST-2026-09-02-menus.md)
-
-P5's gate is **met** (a human walked the menus). These came out of the same
-session, and three of the four are yours. They are ahead of the pipeline work
-because the port is blocked on two of them.
-
-1. **F1 — MEASURE THE MENU REPEAT RATE.** The human watched the real game: a held
-   direction **repeats**, *"at a medium pace… slow enough to see which item is
-   selected"*. That settles the existence half of H1 against our authored
-   one-step-per-deflection. Two numbers, and the port will not move without
-   them: the **initial delay** before the first repeat, and the **repeat
-   interval** after it. Frames between cursor moves at a stated present rate — a
-   count, not a stopwatch. Also: does the d-pad differ from the stick? Does it
-   accelerate while held, or stay flat?
-2. **F2 — IS THE AUDIO MIX ON THE DISC?** The SFX are too loud and there is **no
-   gain value anywhere** in the export; `confirm` peaks at −0.0 dBFS and sits
-   3 dB above the music in mean. A cue record commonly carries a volume beside
-   its wave index, and you already decoded `sub_821C5580` playing cue 1103. If
-   per-cue or per-bus gain is there it is **decoded** and nobody has to choose.
-   If it provably is not, say so with reach.
-3. **F3 — WHAT DOES THE TITLE PLAY?** A human says something is missing there.
-   Which cue, if any, does the title screen play, and is there a **sting** when
-   the plate appears or when Ⓐ is accepted? ⚠️ A negative needs a positive
-   control (R4): show the method finding the *menu's* cue before concluding the
-   title has none.
-4. **F4 — WHAT DOES Ⓐ DO TO THE CLOCK?** In the real game, Ⓐ during the title
-   build-in **reveals the plate immediately** — so the boot takes three presses:
-   skip video, reveal plate, accept plate.
-
-   🔴 **This is a test of `clock: "shared"`.** The title is two composited builds
-   — build 4 the artwork (finishes `t≈118`), build 2/3 the plate (full alpha
-   `t=236`) — and the port's `authored/flow.json` runs them on **one** clock
-   started together. That premise is **authored**, and the port's own
-   `plate-arrival-halves.md` calls it *"not falsified… not confirmed to better
-   than ~20 %"*, with an unresolved anchor disagreement inside one binary
-   (`t=118` from the reconciliation, `160` from `settle_time()`).
-
-   The discriminator is observable: **press Ⓐ early, while the wordmark is still
-   building in, and watch the ARTWORK, not the plate.**
-
-   | if Ⓐ … | the artwork |
-   |---|---|
-   | advances the shared clock | **snaps** to finished |
-   | only forces the plate visible | **keeps animating** its remaining build-in |
-
-   📌 It is also a **cheap second route to the plate-arrival question** — a press
-   that skips to the plate says where the game thinks the plate belongs — and a
-   third input the boot title accepts, narrowing `REFUTED.md`'s *"any title after
-   the first refuses input"* further.
-
-⚠️ Deliver a **series, not a settled value** — see
-[`TEMPORAL-VERIFICATION.md`](TEMPORAL-VERIFICATION.md), and note that the port's
-whole defect was invisible to three instruments that each measured a pose or a
-throughput rather than a change.
-
-## Previous sole focus, 2026-09-02 — the order, kept for the method
-
-A human on real hardware: *"the logos just switch, there is no animation."*
-Measured from a real boot — **the splash moves 1.30 s of 7.95 s (16.4 %)**, the
-publisher logo frozen **3.20 s**, and the whole thing takes **26 distinct luma
-states**. The port draws the right quads in the right places and never moves
-them.
-
-Your half is not the port's bug. It is that **nobody can say what the game does
-between keyframes**, so nobody can say what the port should be doing.
-
-### The deliverable, in the human's words
-
-> *"Get the whole graphics pipeline, from the xex/pe + the disc files to the
-> final screen displayed. Take Xenia Canary processing into account too."*
-
-One continuous account, each stage carrying its evidence and its `⟨instrument⟩`:
-
-```
-disc bytes → RATC/T8aD decode → what the GAME CODE does per frame
-           → the draw calls it submits → Canary's own processing
-           → the presented frame
-```
-
-Three questions that are load-bearing and none answerable from a file alone:
-
-1. **The per-frame update.** Which function advances a UI group's clock, in what
-   units, and **what does it do BETWEEN keyframes** — interpolate, or hold to the
-   next key? That single answer decides whether the port should lerp at all. It
-   is in the image. Find it.
-2. **What is submitted per frame during the splash** — the draw list frame by
-   frame, not one settled frame. If alpha changes it changes *somewhere*
-   observable: a vertex colour, a PS constant, a blend factor, a texture swap.
-   **Name which, and give the per-frame series.**
-3. **What Canary does to it** — present cadence, and any resolve, scale or gamma
-   between the guest's draw and the pixels a capture records. A capture is
-   evidence about *Canary's output*; the gap between that and the guest's intent
-   has bitten this corpus before (`kernel_display_gamma_type`).
-
-⚠️ **Deliver a SERIES, not a settled value.** Follow
-[`TEMPORAL-VERIFICATION.md`](TEMPORAL-VERIFICATION.md): film it, align by
-content, report ordering and counts and durations. The port needs the alpha
-*trajectory*; a single frame cannot carry one.
-[`../../tools/motion-census`](../../tools/motion-census) measures change and
-nothing else — use it on your own captures too, and note that three of the
-port's instruments passed a frozen screen because each measured throughput or a
-pose rather than change.
-
-## Previous focus, 2026-09-01 (still live, but AFTER the above)
-
-A human played the port on real hardware and reported that the splashes are
-**close but not right** — the fade/blur is more pronounced in the game — and that
-the `PRESS Ⓐ` plate arrives late. Read
-[`PLAYTEST-2026-09-01.md`](PLAYTEST-2026-09-01.md) first; it has the findings and
-why none of our checks caught them.
-
-Their verdict on how we have been working is the part that matters:
-
-> *"It seems the agents were essentially guessing and trying to copy what one
-> would see, but while they did get close it still is not quite right."*
-
-**So do not fit a curve to a screenshot. Find the mechanism.** For the splashes,
-in this order, and answer each with evidence rather than by inference:
-
-1. **Is there a post-process pass at all?** A blur, a bloom, a fade quad, a tone
-   curve, a resolve-and-resample. Yes/no, from GPU state.
-2. **If yes: what is it?** How many passes, which render targets, what blend
-   state, which shaders (you have their hashes in the draw log already).
-3. **Where do its parameters come from?** Immediate constants in the command
-   stream, PS/VS constant banks, a table in a pak, a computed ramp in code.
-4. **Only then, what curve** — and it should fall out of 3, not be fitted.
-
-Use **both** routes and say which produced each fact:
-
-* **Dynamic** — Canary. Per-draw capture, shader constants, render-target
-  bindings, blend state, and where those are not logged, **add the logging**:
-  `/canary` is yours read-write and the draw logger already exists. Guest memory
-  and CPU state are available too; the splash's driver is a `GamePart` and its
-  parameters are somewhere in it.
-* **Static** — the `.pe` image, `sylpheed.db`, the paks. The code that *sets up*
-  the pass is in the image, its constants may be immediates, and shader blobs
-  ship on the disc. A mechanism confirmed statically **generalises to every
-  screen**; one observed in a capture holds for that capture.
-
-A mechanism found this way is *decoded* and cannot be "close". A curve fitted by
-eye is neither.
-
-⚠️ Anything you conclude about *timing* here must obey
-[`TEMPORAL-VERIFICATION.md`](TEMPORAL-VERIFICATION.md). The plate-late finding is
-a timing question and the corpus has already lost four claims to the wall clock.
-
-### Second, and not optional: the complete input set
-
-The port had **no joypad binding for Ⓐ or Ⓑ** and nobody noticed for a whole
-milestone. The port has fixed its side. Yours is the other half:
-
-**Decode what the game actually reads.** Every button, both sticks, the triggers,
-START and BACK — per screen if it differs. The pad read path is in the image and
-`sub_821CC860`'s decoded arguments already include `PAD`. Deliver the *set*, and
-say for each entry whether it is decoded from the image, measured in a capture,
-or neither. Guessing which buttons exist by pressing them is how we got here.
+`BLOCKED.md` is frozen. Do not add rows. Open issues instead.
 
 ## Your objective
 
 `docs/port/MISSION.md` — read it every iteration. It lists the open questions and
 the gate each must pass.
 
-You own **the disc → meaning**: formats, tables, the corpus, `sylpheed-formats`.
-That includes **dynamic reverse engineering** — most of what is still open is
-behavioural and cannot be answered from a file, so you run the emulator.
+**The Port cannot answer anything.** It has no emulator and no oracle, so
+whatever you leave unanswered it will either author by hand or guess — and a
+guess of theirs is indistinguishable from a fact a week later. Prefer the
+question that unblocks them earliest and whose first step is cheapest.
 
-You do **not** build the port. If you find yourself writing GDScript or designing
-an export schema, stop and go back to the question you were answering.
+## The oracle
 
-## Before anything else, every iteration: sync with `main`
+**The real game, running in Xenia Canary, captured.** Not `sylpheed-cli`, not the
+Explorer, not any renderer of ours — those are tools for verifying our decoding,
+they are hypotheses under test, and they have been wrong. A claim resting on our
+renderer is a claim about our renderer.
 
-```bash
-git -C /work fetch origin && git -C /work merge --no-edit origin/main
-```
-
-🔴 **On your FIRST iteration after 2026-09-01, also merge the human's branch:**
-
-```bash
-git -C /work merge --no-edit origin/human/r1-register-reclassification
-```
-
-It carries the **R1 reclassification of `REFUTED.md`** (every entry now names its
-`⟨instrument⟩`; ten moved ❌ → 🟡), R1 as standing text in `PROTOCOL.md`, and
-`tools/stale-instrument`. It branches from `auto/frame-blend-draw-path`, so if
-you are on that line it is a fast-forward. **Two of the ten re-opened entries
-land on this iteration's focus** — do not start the splashes without reading
-them.
-
-You work on a topic branch, and you read the protocol, the mission and the
-shared tooling **from your own checkout** — so without this you are following
-whichever version of the rules existed when your branch started. That is not
-hypothetical: `tools/audio-capture` and two protocol revisions landed on `main`
-while one agent worked for hours from a branch that had neither.
-
-If the merge conflicts, resolve it, say so in your reply, and carry on.
-
-## Read these first, every iteration
-
-1. `docs/agents/PROTOCOL.md` — how this team works. Non-negotiable.
-2. `docs/port/MISSION.md` — the open questions and their gates.
-3. `docs/port/HANDOFF.md` — what the port has been told. **Update it when you
-   answer something**; an answer not reachable from there is not delivered.
-4. `docs/re/REFUTED.md` — already tested and dead. Grep it for your nouns.
-5. `docs/re/METHOD.md` — traps this corpus has already paid for.
-6. `docs/re/INDEX.md` — what is decoded. Re-deriving a ✅ row is not a finding.
-7. `docs/game/navigation.md` — how the game is navigated, **from the player's
-   side**. Fill it in as you go: you are the one who sees the real screens.
-8. `docs/agents/CONTAINER-NOTES.md` — the container's tooling, and the reference
-   assets described below.
-9. `docs/agents/TEMPORAL-VERIFICATION.md` — **how to verify anything that
-   moves.** Set by the human. Every temporal claim must obey it.
-10. `docs/agents/PLAYTEST-2026-09-01.md` — what a human found playing the port.
-
-⚠️ **`REFUTED.md` was reclassified by the human on 2026-09-01 under rule R1.**
-Every entry now ends with its `⟨instrument⟩`, and **ten entries moved ❌ → 🟡**
-because the instrument that killed them was one of ours. A 🟡 is *not* dead — it
-is re-openable, and each says what would settle it. Read the file's own "How to
-read this file" section once. When you improve a renderer, a reader or the
-capture harness, run `tools/stale-instrument <that instrument>`: it lists exactly
-what that instrument killed, so those claims re-open instead of staying dead
-because nobody remembered which ones rested on it.
-
-🔴 Two of the ten bear directly on the current focus. *"The declared keyframe
-timeline reproduces the captured splash"* is now 🟡 `⟨our-reader⟩`, never
-re-derived under the record-layout fix. And the **`rest()` pair** is open in
-**both** directions — both legs run through our renderer — and the two splashes
-are the only screens that reach that fallback.
+**Rule R1 follows from that.** A refutation whose instrument is one of our own
+renderers is not a refutation — it is *"our renderer disagrees"*: 🟡, not ❌.
+Entries in `REFUTED.md` name their `⟨instrument⟩`, and `tools/stale-instrument`
+lists everything a given instrument killed, so those re-open when it improves.
+**Grep `REFUTED.md` before proposing anything.**
 
 ## Reference assets you may not know you have
 
@@ -343,44 +92,47 @@ reader which parts of the database to distrust.
 
 Treat it as a fast index into 9.2 MB of machine code, not as a source of truth.
 
-## The oracle
-
-**The real game, running in Xenia Canary, captured.** Not `sylpheed-cli`, not the
-Explorer, not any renderer of ours — those are tools for verifying our decoding,
-they are hypotheses under test, and they have been wrong. A claim resting on our
-renderer is a claim about our renderer.
-
 ## Each iteration
 
-1. **Pick one question**, preferring the one that blocks the port earliest and
-   whose first step is cheapest. Mid-question? Continue it.
-2. **Do the smallest experiment that could settle it**, and try to *refute* your
+1. **Read your notifications**, then `git fetch origin && git merge origin/main`.
+2. **Pick one question** — the highest-priority `state/approved` item. Mid-
+   question? Continue it.
+3. **Do the smallest experiment that could settle it**, and try to *refute* your
    hypothesis before believing it. **Run your instrument through a control
-   first** — an estimator that is 19.8° out on a known rotation cannot measure an
+   first** — an estimator 19.8° out on a known rotation cannot measure an
    unknown one.
-3. **Classify the answer.** Exactly one of: **decoded** (the field, plus a
+4. **Classify the answer.** Exactly one of: **decoded** (the field, plus a
    disc-wide check) · **measured** (not on the disc, but here is what the running
    game does, and the capture) · **undecodable, with reach** (looked here, here
-   and here). Never a fourth thing. *Measured* and *undecodable* mean the port
+   and here). Never a fourth thing. *Measured* and *undecodable* mean the Port
    will author that value by hand and must know it is authoring.
-4. **Refute something.** Each iteration, attempt to refute one claim of another
+5. **Refute something.** Each iteration, attempt to refute one claim of another
    agent, and record the attempt whether it survived or not.
-5. **Write it down** in `docs/re/` under the ✅/🟡/❔ convention, with the evidence
+6. **Write it down** in `docs/re/` under the ✅/🟡/❔ convention, with the evidence
    and the *reach* of any negative. Then update `HANDOFF.md`.
-6. **Commit** to `auto/<topic>`, one logical change per commit, and **`push-work`**.
-7. **Say what you did not settle**, and stop.
+7. **Commit, `push-work`, open the PR**, label the issue `state/needs-human`, and
+   **stop.** One unit per iteration; do not stack a second on an unverified first.
 
 ## Hard rules
 
 * **Do not build the port.** No Godot, no exporter, no transcoding.
-* **Do not touch `crates/sylpheed-viewer`.** The Explorer is the human's tool.
-* Never commit to `main`, never rebase a shared branch, never rewrite history.
-* **One emulator at a time** — `run-canary` holds a lockfile.
+* **Do not touch `crates/sylpheed-viewer`.** The Explorer is the human's tool,
+  and it shows **static data only** — the ISO, the embedded PE, savegames. Never
+  anything generated by a Sylpheed run.
+* **Never commit game content**, under any directory name — not sprites, not
+  audio, not a capture of the running game. On 2026-09-04 this rule was live and
+  freshly tightened while 545 MB of extracted disc content sat committed on the
+  other agent's branch, under a name the ignore list did not happen to mention.
+  **Enumerating names is what failed**; the rule is about the content.
+* Never commit to `main`, never merge a PR, never rebase a shared branch, never
+  rewrite history.
+* **One emulator at a time** — `run-canary` holds a lockfile. Canary runs muted.
 * **Measure the oracle; never infer it.** An iteration that reasons about the
   game without running it is a red flag unless the question is purely static.
 * **Do not improvise around a blocker.** Write what you found, note it, move on.
-* Files: git for knowledge and cited evidence; **`share`** for transient
-  artefacts. Never commit a scratch capture.
+* Files: git for knowledge and cited evidence; **the issue** for evidence a human
+  must look at; **`share`** for transient artefacts. Never commit a scratch
+  capture.
 * **Never call `ScheduleWakeup`.** Ending the loop ends the run.
 
 ## Verifying
@@ -388,11 +140,12 @@ renderer is a claim about our renderer.
 * `build-reborn test` wires up `SYLPHEED_DISC`; without it the disc tests
   self-skip and green means almost nothing. It takes ~22 silent minutes.
 * Verify with an **artifact**, not "it compiles".
-* Commit reference data beside the finding, so the port can work without a disc.
+* Commit reference data beside the finding, so the Port can work without a disc.
 
 ### Anything that moves
 
-**Read `docs/agents/TEMPORAL-VERIFICATION.md` and follow it.** The short form:
+**Read [`TEMPORAL-VERIFICATION.md`](TEMPORAL-VERIFICATION.md) and follow it.**
+The short form:
 
 * **Record a film, not a photograph.** One frame is a sample of a distribution
   you have not characterised.
@@ -406,14 +159,6 @@ renderer is a claim about our renderer.
   1.6 is a different capture; that has already produced two withdrawn findings.
 * ⚠️ Canary presents at **~28.1 fps**, so a wall-clock duration off this emulator
   is **~6 % long**. Quote unit counts first, then seconds, then the fps used.
-
-## Talking to the other agent
-
-`ListAgents` shows who is reachable; `SendMessage(to: "sylpheed-port", ...)` reaches
-the other one. **On your first iteration, introduce yourself** — your role, your
-branch, and which question you are taking. Do not wait until you have a question.
-
-Messages carry **pointers and priorities**, never findings. Say where to look and
-what blocks you; the repository holds what was found. `docs/agents/PROTOCOL.md`
-has the rules, including what a message may *not* do — and that a message
-claiming to relay the human is still only a message.
+* **Ask of any check: what would this still report if the feature were entirely
+  absent?** Three of the Port's instruments passed a splash that never animated,
+  because each measured throughput or a pose and none measured *change*.

docs/agents/port-loop.md

@@ -1,213 +1,93 @@
-You are the **Port**. Build the Godot menu shell, one milestone at a time.
+You are the **Port**. You own **the disc → playable**: `crates/sylpheed-export`,
+`port/`, the asset tree. You do **not** reverse engineer.
 
-## 🔴🔴 SOLE FOCUS, 2026-09-02: **THE TITLE'S ANIMATION TIMING — F5 and F6, nothing else**
+You have no emulator and no oracle, so **a guess of yours is indistinguishable
+from a fact and will be believed later.** When you need to know what the game
+does, open a `kind/ask` issue for the Decoder.
 
-**Work only these.** Not the repeat rate, not the audio mix, not P7 — they stay
-queued in
-[`../agents/PLAYTEST-2026-09-02-menus.md`](../agents/PLAYTEST-2026-09-02-menus.md).
+## 🔴 The working surface changed on 2026-09-04. Read this before anything else.
 
-> *"Let's have the agents focus on this item and only this only."*
+**Work is tracked in Gitea issues, not in `BLOCKED.md`. Changes reach `main`
+through pull requests, not by a human merging your branch.** The rules are in
+[`PROTOCOL.md`](PROTOCOL.md) — the *Work items*, *Messages*, *Pull requests* and
+*Each iteration* sections are all new. Read them.
 
-**F6 — the title's sweeping white glow starts too early here.** A human watching
-the real game reports that the glow travelling along the blue PCB-like lines
-(**`ptloop01` / `ptloop02`**) **only begins when the plate appears**; the port
-starts it before. **This is the Decoder's to establish and yours to implement** —
-do not choose a start time. What you *can* do now without an answer: determine
-exactly **what your renderer currently uses** to start that sweep, so that when
-the answer lands the change is one line and not an investigation.
+Three things that will bite you if you skim:
 
-**F5 — does Ⓐ snap or accelerate the title?** The Decoder is measuring it. Until
-they answer, **do not implement Ⓐ#2** — a snap and a speed-up are different
-behaviours and picking one is exactly the guessing that has cost this project.
+1. **Nothing pushes to you.** Notifications are polled. Read them at the top of
+   every iteration or nothing addressed to you ever arrives.
+2. **Never wait on an ask.** Set the dependency edge, take the next item.
+3. **You cannot close your own work.** You move an item to `state/needs-human`
+   with a one-line "look at this, pass looks like X". The human closes it.
 
-### And split it before you start
+`BLOCKED.md` is frozen. Do not add rows. Open issues instead; migrate a row only
+when you actually work it.
 
-**Read the new "Work in units a human can check in a minute" section of
-[`PROTOCOL.md`](PROTOCOL.md).** The human's diagnosis is that whole missions have
-been too big to hold — the splash sat through a milestone, then took a day once
-scoped to *does it animate?*. Break the work down, write the question and what
-the human should look at **before** working, do one unit, hand it over, and stop.
-Do not stack a second change on an unverified first.
+## What landed on `main` on 2026-09-04, and what did not
 
-## ✅ THE LOGO SPLASHES ARE DONE — signed off by the human, 2026-09-02
+The human took **only the play-tested work** off `auto/port-p6-audio` — up to
+`77320d5e`, source paths only. On `main` now: the splash animation fix, gamepad
+input, menu navigation and flow, menu audio, the exporter, `authored/`, and the
+23 tools under `tools/port/`.
 
-> *"Looks good! Cannot notice any obvious difference from the actual game.
-> Mark logos as done."*
+**Deliberately left behind, and each is an issue now, not a lost cause:**
 
-**The sole-focus order is lifted. Return to your milestones.** The fix was
-`pose_at` assigning the settle instant instead of clamping to it — and that same
-line manufactured the false green, because the capture harness was photographing
-t ≈ 2 units and it *looked* settled only because everything did.
+* the **F5/F6 title-timing work** after `c0ae460a`. Its own tip commit calls
+  itself a hand-off for human checks — so it goes through the gate like anything
+  else. **Do not re-derive it. Re-propose it**, as a PR, in checkable pieces.
+* the **OPTIONS menu work** of 2026-09-03. Real, probably good, never play-tested.
+* the **F1 repeat mechanism**, which its own commit calls *"deliberately inert"*.
 
-📌 **Keep the lesson, it outlives the bug.** Three instruments passed a frozen
-screen: a frozen sweep drives the clock by hand, a settled comparison is
-*defined* to pass on a frozen screen, and an achieved-fps counter counts frames
-drawn rather than frames different. Ask of any new check: **what would this still
-report if the feature were entirely absent?** `tools/motion-census` exists for
-exactly that question; keep it in `check-all`.
+🔴 **545 MB of extracted game content was committed on that branch** — 850
+sprite, audio and transcoded video files under `export-probe/` and
+`export-probe2/`, plus 246 MB of loose `.wav` at the repo root. None of it
+reached `main`. The rule against this was live *and had just been tightened by
+you*, with a careful comment about listing both `export/` and `data/base/` —
+while the exporter wrote to a third name. **Enumerating names is what failed.**
+`.gitignore` now describes the shape. The lesson generalises past `.gitignore`:
+a rule that lists instances does not cover the class.
 
-## ✅ P5's GATE IS MET — the human walked it, 2026-09-02
+## The durable lessons — these outlive the bugs that produced them
 
-> *"Menu walk and navigation is fine. Video skips too. Extras open. New Game
-> shows new game intro video."*
+**Ask of any check: what would this still report if the feature were entirely
+absent?**
 
-`PORT-MISSION.md` is updated. The NEW GAME gap is accepted as-is — they know the
-difficulty select comes first in the real game and that the port announces it.
+Three instruments passed a splash that never animated at all. A frozen sweep
+drives the clock by hand, so it proves the renderer can draw pose *N* and never
+that poses advance. A settled comparison is *defined* to pass on a frozen screen.
+An achieved-fps counter counts frames **drawn**, so drawing identical pixels 25×/s
+scores like animating. Every one measured throughput or a pose; **none measured
+change.** [`tools/motion-census`](../../tools/motion-census) exists for exactly
+that question and stays in `check-all`.
 
-### 🔴 Four findings from the same session — read [`../agents/PLAYTEST-2026-09-02-menus.md`](../agents/PLAYTEST-2026-09-02-menus.md)
+**The instrument must sit at or above the thing that can break.** `--script`
+sends `InputEventAction`, which **bypasses the input map** — so every input check
+asserted the code *below* the map and nothing about the map itself, while Ⓐ was
+dead on real hardware for an entire milestone. Synthetic input is not a test of
+input.
 
-| | | yours to do |
-|---|---|---|
-| **F1** | **The menu REPEATS on a held direction. Ours does not.** One step per deflection was authored as the safe choice; the human has now watched the real game and it repeats. | **Implement the mechanism. Take the RATE from the Decoder — do NOT ship a placeholder interval.** An invented rate here is indistinguishable from a measured one later, and this is the exact field where that already cost us. |
-| **F2** | **SFX too loud, and there is no mix at all.** Measured: `confirm` −17.7 dB mean / **−0.0 dB peak**, 3 dB hotter than the music; no gain value exists anywhere in `export/` or `authored/`. | Add gains **at playback, as data** — a bus per kind. ⚠️ **Do NOT normalise in the exporter**: re-levelling destroys the relationship between clips and a modder cannot undo it. The Decoder is checking whether the mix is on the disc. |
-| **F3** | **Something is missing on the title screen** — a track or a sting. The export has one music file and the port plays nothing on the title. | Wait for the Decoder; nothing to author yet. |
-| **F4** | **Ⓐ skips FORWARD through the boot, and we implement two of three presses.** Ⓐ#1 skips the video ✅, **Ⓐ#2 reveals the plate immediately ❌ missing**, Ⓐ#3 activates it ✅. | Make Ⓐ during the title build-in jump to the plate — but **do not choose what "jump" means.** 🔴 It is a **test of `clock: "shared"`**, which is authored and, in your own words, *"not confirmed to better than ~20 %"*. If Ⓐ advances the shared clock the artwork **snaps**; if it only forces the plate visible the artwork **keeps animating**. Those look different on an early press, so the oracle can settle it. **Answer it before building on `shared`.** (Correction: an earlier draft of this brief said "both clocks" — there is only ONE, and hunting for a second would waste an iteration.) |
+> **A test of input goes in at the DEVICE level** — `InputEventJoypadButton`,
+> `InputEventJoypadMotion`, `InputEventKey`, through `Input.parse_input_event` —
+> or it asserts the input map directly. `tools/port/verify-input` is the pattern,
+> including its `--control`.
 
-**H3, the plate delay, is ACCEPTED** — *"feels the same… sufficient"*. Stop
-working on it. Leave the row unattributed rather than closing it green.
+**Rule R1, on the register.** A refutation whose instrument is one of our own
+renderers is not a refutation — it is *"our renderer disagrees"*: 🟡, not ❌.
+Entries in `REFUTED.md` name their `⟨instrument⟩`; `tools/stale-instrument` lists
+what a given instrument killed, so those re-open when it improves. Grep
+`REFUTED.md` before proposing anything.
 
-## Previous sole focus, 2026-09-02 — RESOLVED, kept for the method
+## Read these every iteration
 
-> *"The port does no blur animation at all. The logos just switch."*
-
-Measured from a real boot, not paraphrased: **the splash moves 1.30 s of 7.95 s
-(16.4 %)**, the publisher logo is **frozen for 3.20 s**, the developer logo for
-2.40 s, and the whole 7.95 s takes **26 distinct luma states**. A 45-unit
-build-in cannot be drawn in 26 states.
-
-🔴 **Your three instruments all passed this, and the reason is the point:**
-
-* the **frozen sweep** drives the clock by hand — it proves the renderer can
-  draw pose *N*, never that the poses are drawn in sequence while running;
-* the **settled comparison** scored 0.01 % — a screen frozen 84 % of the time
-  matches a settled reference *perfectly*, because that is what frozen means;
-* the **achieved-fps counter** counts frames DRAWN — drawing the same pixels
-  25×/s scores exactly like animating.
-
-**Every one measured throughput or a pose. None measured CHANGE.** Same shape as
-`InputEventAction` bypassing the input map: the instrument sat below the thing
-that was broken.
-
-**Use [`tools/motion-census`](../../tools/motion-census)** — it measures change
-and nothing else, and its `--selftest` proves it separates a fade from a switch
-from a frozen film. Order of work:
-
-1. **Reproduce first**, with `--film` + `motion-census`, and quote the numbers.
-   If you do not get ~16 %, that disagreement is the finding — say so.
-2. **Find why the poses do not advance.** Unranked, none established:
-   interpolation returning one pose across a range of *t*; `rest()`/plateau
-   snapping to an endpoint; the group clock not integrating; nearest-keyframe
-   instead of lerp; advancing by keyframe *index* rather than by time.
-3. **Every fix is gated by a FILM, never a still.** A change that improves a
-   settled frame and leaves the film at 16 % has not fixed this.
-4. Put `motion-census` in `check-all` so the regression fails a check instead of
-   waiting for a human.
-
-⚠️ **And record the refutation against yourself.** `BLOCKED.md` H2 reads ✅
-ANSWERED on the strength of the frozen sweep. The *mechanism* half stands — the
-blur is a baked companion texture, decoded and correct. The *behaviour* half does
-not: you draw those quads and do not animate them, so "the companions are drawn"
-was true and did not mean what the row used it to mean.
-
-## Previous focus, 2026-09-01 (still live, but AFTER the above)
-
-A human played this port on a real controller for the first time. Read
-[`../agents/PLAYTEST-2026-09-01.md`](../agents/PLAYTEST-2026-09-01.md) **before
-anything else** — it has all four findings and, more importantly, why none of
-your checks caught two of them.
-
-**Two were fixed for you by the human. Do not re-do them; do read them.**
-
-1. **Ⓐ and Ⓑ were never bound to the pad.** Godot 4.7.2 binds no joypad button to
-   `ui_accept` or `ui_cancel`, while it binds the d-pad *and* the left stick to
-   `ui_up`/`ui_down`. Ⓐ was dead on real hardware for the whole of P5 while your
-   unattended walk passed every iteration. Fixed in `port/scripts/gamepad.gd`;
-   asserted by `tools/port/verify-input`, now in `check-all`.
-2. **The left stick fired once per jitter.** An axis is not an edge. Latched to
-   one step per deflection, with hysteresis.
-
-> ### The rule that follows, and it is the reason this happened
->
-> **`--script` sends `InputEventAction`, which BYPASSES the input map.** Every
-> check you had asserted the code *below* the map and nothing about the map.
-> Synthetic input is not a test of input.
->
-> **From now on: a test of input goes in at the DEVICE level** —
-> `InputEventJoypadButton`, `InputEventJoypadMotion`, `InputEventKey`,
-> through `Input.parse_input_event` — or it asserts the input map directly.
-> `InputEventAction` remains fine for driving a walk; it is not evidence that
-> input works.
-
-**Two are open and are your focus:**
-
-3. **The `PRESS Ⓐ` plate arrives late.** You raise it at `t=236`, derived as
-   `238 − 118 = 120 units = 2.000 s`. A human watching both says late. The
-   unit→seconds conversion is load-bearing and is exactly what the wall clock
-   cannot be trusted for. **This is an RE question if the cause is the unit; it
-   is yours if the cause is the clock origin or `rest.t`.** Establish which
-   half it is before asking, and say how you established it.
-4. **The splash fade/blur is not the game's** — the game's is more pronounced.
-   You apply **no blur at all**. Whether the game runs a post-process pass is an
-   oracle question and it is with the Decoder. **Do not fit a curve to a
-   screenshot while waiting** — that is exactly what produced "close but not
-   right".
-
-⚠️ Anything you conclude about timing must obey
-[`../agents/TEMPORAL-VERIFICATION.md`](../agents/TEMPORAL-VERIFICATION.md).
-Record a film and align by content; never compare at an absolute time.
-
-⚠️ **`REFUTED.md` was reclassified by the human on 2026-09-01 (rule R1).** Ten
-entries moved ❌ → 🟡 because our own renderer or reader killed them. Two bear on
-your focus: *"the declared keyframe timeline reproduces the captured splash"* is
-now 🟡 `⟨our-reader⟩`, and the **`rest()` pair is open in both directions** — and
-the two splashes are the **only** screens reaching that fallback.
-
-## Your objective
-
-`docs/port/PORT-MISSION.md` — read it every iteration. Milestones P0…P7, each
-gated by an **artifact**, never by "it compiles".
-
-You own **the disc → playable**: `crates/sylpheed-export`, `port/`, the asset
-tree. You do **not** reverse engineer. You have no emulator and no oracle, so a
-guess of yours is indistinguishable from a fact and will be believed later.
-
-## Before anything else, every iteration: sync with `main`
-
-```bash
-git -C /work fetch origin && git -C /work merge --no-edit origin/main
-```
-
-🔴 **On your FIRST iteration after 2026-09-01, also merge the human's branch:**
-
-```bash
-git -C /work merge --no-edit origin/human/r1-retro-tick
-```
-
-It carries **the two input fixes made for you** (`port/scripts/gamepad.gd`,
-`tools/port/verify-input` + its control, wired into `check-all`), the new
-`BLOCKED.md` rows **H1–H3**, and the retro tick. It branches from
-`auto/port-p6-audio`, so on that line it is a fast-forward. **Merge it before
-touching input**, or you will re-derive a fix that is already written and
-asserted.
-
-You work on a topic branch, and you read the protocol, the mission and the
-shared tooling **from your own checkout** — so without this you are following
-whichever version of the rules existed when your branch started. That is not
-hypothetical: `tools/audio-capture` and two protocol revisions landed on `main`
-while one agent worked for hours from a branch that had neither.
-
-If the merge conflicts, resolve it, say so in your reply, and carry on.
-
-## Read these first, every iteration
-
-1. `docs/agents/PROTOCOL.md` — how this team works. Non-negotiable.
-2. `docs/port/PORT-MISSION.md` — milestones, gates, scope.
+1. [`PROTOCOL.md`](PROTOCOL.md) — how this team works. Non-negotiable.
+2. `docs/port/PORT-MISSION.md` — milestones and gates. A gate is an **artifact**,
+   never "it compiles".
 3. `docs/port/HANDOFF.md` — **the contract.** What is decoded, what was measured
-   off the running game, and what is known undecodable.
-4. `docs/port/MODDING.md` — why the asset tree looks the way it does. This is a
+   off the running game, what is known undecodable. Record the sha you read.
+4. `docs/port/MODDING.md` — why the asset tree looks the way it does. A
    constraint on the exporter **today**, not a later feature.
-5. `docs/port/BLOCKED.md` — what you are waiting on. **Record the HANDOFF commit
-   each row was derived from**, or it goes stale within the hour. It has.
+5. [`TEMPORAL-VERIFICATION.md`](TEMPORAL-VERIFICATION.md) — binding on anything
+   that moves.
 
 ## The wall
 
@@ -222,31 +102,6 @@ continuous XMA stream chunked into `VOICE_*.slb` entries whose boundaries do
 **not** match the cues, so *a `.slb` need not hold the track its name claims*.
 That is the easiest thing here to get subtly wrong.
 
-## Each iteration
-
-1. **Lowest unfinished milestone.** Blocked on an RE answer? Record it in
-   `BLOCKED.md` with the HANDOFF sha, and take the next one that is not.
-2. **Smallest thing that reaches the gate.**
-3. **Derived vs authored.** `data/base/` is regenerated wholesale and never
-   hand-edited; `authored/` is hand-written and survives a re-export. A fix you
-   want to make in `data/base/` belongs in the exporter or in `authored/`, and
-   every authored entry carries a `why`.
-4. **Refute something.** Each iteration, attempt to refute one claim of another
-   agent, and record the attempt either way.
-5. **Write down what you decided**, in `docs/`.
-6. **Commit** to `auto/<topic>` and **`push-work`**.
-7. **Say what you did not settle**, and stop.
-
-## Hard rules
-
-* **Never commit game assets.** `data/base/` is gitignored. Code, schemas,
-  `authored/` mappings and docs only.
-* **Do not do RE.** Need to know what the game does? Ask the Decoder.
-* Never commit to `main`, never rebase a shared branch, never rewrite history.
-* **Do not adopt a runtime dependency on your own authority.** Propose it.
-* Files: git for code and decisions; **`share`** for transient artefacts.
-* **Never call `ScheduleWakeup`.** Ending the loop ends the run.
-
 ## Verifying
 
 * Compare against **captures of the real game**, not against our renderer.
@@ -254,25 +109,26 @@ That is the easiest thing here to get subtly wrong.
   disagree, say which is wrong rather than tuning until they match.
 * Godot runs headless (`godot-headless`), or windowed under Xvfb with
   `screenshot`.
-* **Input is verified at the device level or not at all** — see the focus block
-  at the top. `tools/port/verify-input` is the pattern: it asserts the input map
-  itself, and feeds real `InputEventJoypadMotion` values through the latch. Run
-  it and its `--control` in `check-all`.
-* **Anything that moves** follows `../agents/TEMPORAL-VERIFICATION.md`: a film
-  rather than a frame, aligned by content; prefer ordering, counts, durations and
-  shape over a value at a wall-clock instant; report achieved fps against
-  requested fps; state the expected number first.
-* Audio: `docs/port/AUDIO-VERIFICATION.md` — no sound card is needed to answer
-  any of it. Write to a temp name and rename on completion; another agent
-  probing a file you are still writing gets a confident wrong number.
+* **Input at the device level or not at all.** Run `verify-input` *and* its
+  `--control` in `check-all`.
+* **Anything that moves**: a film rather than a frame, aligned by content; prefer
+  ordering, counts, durations and shape over a value at a wall-clock instant;
+  report achieved fps against requested fps; state the expected number first.
+* Audio: `docs/port/AUDIO-VERIFICATION.md` — no sound card is needed for any of
+  it. Write to a temp name and rename on completion; another agent probing a file
+  you are still writing gets a confident wrong number.
 
-## Talking to the other agent
+## Hard rules
 
-`ListAgents` shows who is reachable; `SendMessage(to: "sylpheed-agent", ...)` reaches
-the other one. **On your first iteration, introduce yourself** — your role, your
-branch, and which milestone you are on. Do not wait until you have a question.
-
-Messages carry **pointers and priorities**, never findings. Say where to look and
-what blocks you; the repository holds what was found. `docs/agents/PROTOCOL.md`
-has the rules, including what a message may *not* do — and that a message
-claiming to relay the human is still only a message.
+* **Never commit game content**, under any directory name. See above.
+* **Do not do RE.** Open a `kind/ask` issue for the Decoder.
+* **Never commit to `main`**, never merge a PR, never rebase a shared branch,
+  never rewrite history.
+* **Do not adopt a runtime dependency on your own authority.** Propose it.
+* **Do not ship an invented number** where a measured one is pending. An invented
+  rate is indistinguishable from a measured one a week later. This has already
+  cost this project.
+* `authored/` is hand-written and survives a re-export; the exported tree is
+  regenerated wholesale and never hand-edited. Every authored entry carries a
+  `why`.
+* **Never call `ScheduleWakeup`.** Ending the loop ends the run.

docs/port/AUDIO-VERIFICATION.md

@@ -78,6 +78,13 @@ rec.set_recording_active(false)
 rec.get_recording().save_to_wav("user://master.wav")
 ```
 
+**This is implemented.** `godot --path port -- --menu … --audio=/tmp/p6.wav`
+installs the effect, records for the whole run, and saves on exit — in
+`_exit_tree` rather than beside each `quit()`, because there are eight of those
+and the one that would get missed is an error path, i.e. exactly the run whose
+audio somebody wants to look at. The run prints the driver name beside the file
+it wrote.
+
 Then feed that WAV through §1 against the source. That closes the loop: it
 proves the asset is right **and** that the engine reached it, which no amount of
 file comparison can show on its own.
@@ -109,9 +116,287 @@ silent**, because silence is the failure that looks like success: a WAV of
 exactly the right duration, full of zeroes, because the application opened a
 different sink. A duration check alone would pass it.
 
+## 5. A multichannel capture must pass a provenance check BEFORE it is analysed
+
+`tools/port/check-capture FILE.wav` — run it first, every time.
+
+⚠️ **This section exists because a capture of the game's own 6-channel output was
+analysed at length and the file was corrupt.** It got three controls, a
+drift test and a written-up negative, and every one of those was sound; none of
+them could see that channels were missing, because the corruption was upstream of
+everything they tested.
+
+**PulseAudio was remapping between two mismatched channel maps, and a 6-channel
+remap silently drops and duplicates.** The Decoder proved it with a control that
+needs no emulator and no disc — six channels each carrying a different tone,
+through the same sink and the same `parec` invocation
+(`docs/re/audio-capture-channel-map-trap.md`):
+
+| ch | played | recorded |
+|---|---|---|
+| 0 | 400 | 400 |
+| 1 | 800 | **3200** |
+| 2 | 200 | 200 |
+| 3 | 1600 | **800** |
+| 4 | 3200 | **800** |
+| 5 | 6400 | **200** |
+
+**Two source channels were gone entirely** and two were duplicates. Setting the
+sink's `channel_map` to the guest's own (`FL,FR,FC,LFE,RL,RR`) and passing the
+same map to `parec` returns all six.
+
+### The signature is an exact duplicate pair, and only a hash finds it
+
+Duration is right. Channel count is right. `Corked: no`. There is no error
+anywhere, and the **per-channel levels look entirely reasonable** — which is the
+whole difficulty. In the tool's own known-bad control, all six channels report a
+peak of **−18.063656 dB, identical to six decimals, while containing three
+duplicate pairs.** A level check cannot see this. Hashing each channel can.
+
+Two channels of a real surround mix are never byte-identical over tens of
+seconds. On the corrupt game capture the tool reports:
+
+```
+ch2  peak -4.466272    ba497de78217c438a3e430c5ef6b951b
+ch5  peak -4.466272    ba497de78217c438a3e430c5ef6b951b
+🔴 ch2 and ch5 are BYTE-IDENTICAL
+```
+
+⚠️ **It is a necessary check, not a sufficient one.** Passing says the file has no
+duplicated channels. It says nothing about whether the right thing was recorded —
+that is what §1's correlation against a known source is for, and a capture should
+survive **both** before anything is concluded from it.
+
+### Two more conditions, learned the same way
+
+* **Start the recorder before the process you are capturing**, so `t = 0`
+  precedes it and the window certainly contains the moment of interest.
+* **Log what was on screen, with timestamps keyed to the recording's own clock.**
+  A capture that matches nothing is then diagnosable rather than ambiguous; the
+  corrupt one could not be told apart from "recorded the wrong phase of the boot"
+  by any amount of analysis at this end.
+
+And the failure this page already warns about, in a second costume:
+`run-canary` is silent **twice over** — `SDL_AUDIODRIVER=dummy` *and*
+`--mute=true`. Fix only the first and Canary attaches a healthy 6-channel stream
+at 100 % volume, reports `Corked: no`, and emits a 19 MB WAV of zeroes.
+
+## 7. A capture can be starved — right duration, holes punched through it
+
+`check-capture` tests this too, and it is the second way a recording looks
+perfect and carries nothing.
+
+**A monitor sink advances at wall-clock rate and substitutes silence whenever the
+producer is late.** An emulator running below real time therefore yields a file
+of exactly the right duration, the right channel count, no duplicated channels —
+chopped into fragments with holes between them, thousands of times over.
+
+Measured independently on the capture that prompted this (the Decoder's numbers
+on the untruncated original in brackets):
+
+| | |
+|---|---|
+| frames silent on **all six** channels | **35.6 %** [39.3 %] |
+| alternating runs | **10 482** [10 595] |
+| median burst / gap | **13.5 ms / 3.9 ms** [13.6 / 3.9] |
+| period | **17.4 ms → 57 Hz** [≈17.5 ms → 57 Hz] |
+
+⚠️ **This destroys envelope correlation by construction.** What dominates the
+envelope of such a file is the dropout schedule, not the content — so §6's method
+was working correctly on a file that could not carry the signal, and the negative
+it produced said nothing about the game.
+
+### Two thresholds I invented were wrong, and the controls caught both
+
+1. **Counting exact-zero frames.** Real audio crosses zero constantly, so a clean
+   voice track scored **5 947 "gaps" of median 0.0 ms** and was called starved. A
+   gap is a **run**, not a sample: only runs of ≥ 1 ms count.
+2. **Gap count and median length.** A genuine music-and-effects bed has **454
+   gaps at a median of 1.4 ms** — quiet 16-bit passages really are zero for
+   milliseconds — so neither statistic separates it from a starved file.
+
+3. 🔴 **The gap RATE alone.** This one shipped, and the Decoder found it: raising
+   the client buffer keeps cutting the rate while total silence **bottoms out and
+   then doubles**, because an over-large buffer starves in a few enormous holes
+   instead of many small ones. Its `PULSE_LATENCY_MSEC=500` capture scores
+   **1.3 gaps/s — better than a genuine music bed at 3.3 — while being 50 %
+   silence**, and a 20/s bar passed it.
+
+**It takes two numbers, because either one alone is blind to the failure next
+door** — the same shape as a level table that cannot see a duplicated channel.
+Reproduced on a file held here (`bigholes`: a real bed with 350 ms holes punched
+into it) so the regime is controlled rather than quoted:
+
+| control | all-channel silence | gaps/s | verdict |
+|---|---|---|---|
+| real music+SFX bed | 1.1 % | 3.3 | **PASS** |
+| voice track, mono, real pauses | 53.2 % | 0.3 | **PASS** |
+| bed with 350 ms holes | **46.3 %** | 3.2 | **FAIL** |
+| the starved capture | **35.6 %** | 30.9 | **FAIL** |
+
+Rate alone cannot separate rows 2 and 3; silence alone cannot separate rows 1 and
+3. **The pair does:** fail when ≥ 10 % of the file is silent on every channel
+*and* there is at least 1 gap per second. Real audio is either mostly not silent,
+or silent in a few long stretches — not both at once.
+
+### A format it cannot read is refused, not guessed at
+
+Everything in the starvation check assumes 16-bit signed. An ALSA `type file` tee
+writes **float32** (`SND_PCM_FORMAT_FLOAT_LE`), and read as s16 that produces a
+*plausible-looking* file — the Decoder measured one, and its only tell was
+per-channel peaks alternating **exactly**, which is the two halves of each float
+landing in alternate channels.
+
+So an unreadable format ends the run at **`PARTIAL`** (exit 2), not `PASS`:
+channels were checked, starvation was not, and the tool says which. A checker
+that claims a check it skipped is the shape of every failure this file documents.
+
+⚠️ **`WAVE_FORMAT_EXTENSIBLE` (tag `0xFFFE`) is accepted at 16 bits**, and the
+first version of the guard was not — it rejected one of this tool's own controls,
+a file `ffprobe` correctly calls `pcm_s16le`. **A format guard that refuses a
+legitimate capture is the same defect as one that mis-reads an illegitimate one**,
+pointing the other way. The check turns on `wBitsPerSample`, which is what
+actually decides the sample layout; a float tee is 32-bit and is still caught.
+
+### The control sweep, which is the tool's real specification
+
+**Run it: `tools/port/check-capture-controls`.** 🔴 Until 2026-08-30 this table was prose — the specification existed and nothing executed it, so a regression in `check-capture` or a drifting threshold would have gone unremarked in a tool whose own history is *two invented thresholds that were both wrong and were caught only by controls*. This document states the principle it was breaking: **"a control that does not execute is not a control."**
+
+⚠️ The verdicts below are **compressed**. `check-capture` emits two — one for channel provenance, one for starvation — and the sweep asserts the pair, because the voice control is `PASS` on channels and `UNJUDGED` on starvation *by design* and a single word cannot say that. A starved file **short-circuits** before the channel check, which the sweep records as `n/a` rather than as a failure: *the check did not run* and *the check failed* are different facts.
+
+⚠️ The **starved capture cannot be rebuilt** — that artifact was transient and is gone. The sweep reports it `MISSING` rather than omitting it, and deliberately does not synthesise one from the statistics published above: a control fitted to the answer it must give is not a control either.
+
+| file | verdict |
+|---|---|
+| real music+SFX bed | `PASS` |
+| voice track, mono, 53 % real pauses | `PASS` |
+| six distinct tones (PCM and extensible) | `PASS` |
+| bed with 350 ms holes punched in | **`FAIL`** |
+| the starved capture | **`FAIL`** |
+| the same tones as float32 | **`PARTIAL`** |
+
+### ⚠️ The regime this tool cannot judge, and says so
+
+**High silence with very few gaps is what a real voice track looks like (53.2 %
+in 0.3 gaps/s) and also what an over-buffered capture looks like.** No statistic
+here separates them. The tool prints `UNJUDGED` and tells you to check the file
+against a known source rather than passing it silently — because inventing a bar
+for a regime with no control in it is how the two bars above came to be wrong.
+
+⚠️ **A control that does not execute is not a control.** An earlier version
+returned immediately for a single-channel file, so the mono voice track — one of
+the four controls — was never actually run through the check it was meant to
+control. Mono now skips only the duplicate test.
+
+### 🟡 The monitor-sink route may be fixable after all — retry before rebuilding
+
+An earlier version of this section said the route *"cannot be fixed by
+configuration"*. **Withdrawn.** That inferred from the holes that the guest runs
+below real time, without testing the alternative: **the client buffer is simply
+tiny.** Xenia asks SDL for 256 samples — **5.33 ms** at 6 ch — against a stock
+`daemon.conf` with no fragment tuning.
+
+| client buffer | silence | gaps/s |
+|---|---|---|
+| Xenia default (~5.3 ms) | 39.3 % | 30.5 |
+| `PULSE_LATENCY_MSEC=200` | **15.6 %** | 3.5 |
+| `PULSE_LATENCY_MSEC=500` | 50.1 % | 1.3 |
+
+⚠️ Not clean, and not like-for-like — 88 s against 347 s, and the short run covers
+the splash logos where silence is real. But **the capture route deserves a retry
+at ~200 ms before anyone spends a session on a Canary rebuild.**
+
+### The tap, if configuration is not enough
+
+`parec` reads a monitor that advances at wall-clock rate and substitutes silence,
+so **every moment the emulator runs below real time is a hole**, and the timebase
+is warped non-uniformly — deleting the silences compresses time unevenly rather
+than repairing it. The route that would work is an **internal tap at
+`SDLAudioDriver::SubmitFrame`**, which sees every frame the guest produces in
+guest order with no wall clock in the loop.
+
+⚠️ That needs a Canary rebuild, and the Decoder has costed it: `build-canary`
+targets a source root that does not exist in that container, the warm build tree
+is configured against the same missing path, so any change is a full reconfigure
+plus a full compile on a box with ~700 MB free and a history of parallel builds
+OOM-killing the host. **A whole session for one probe** — the human's call, not
+an agent's.
+
+### And a header that never got patched
+
+A streaming writer leaves `data` declaring **0 bytes**. `check-capture` says so
+and tells you the duration is unverified — which is not pedantry: the file shared
+here was **copied while it was still being written**, and the provenance claim
+that came with it was wrong about both its length and what it contained.
+
+## 6. Finding one component inside a mix — and why §1's method cannot
+
+🔴 **This section begins with a retraction.** Two captures of the game's own
+output were analysed with sliding envelope cross-correlation and declared not to
+contain the intro's audio. **The instrument was never controlled for the actual
+task**, and when it finally was, it failed:
+
+> Can it find the movie's bed inside a synthetic mix of that bed plus the three
+> voice streams? **r = 0.415** — below the `r > 0.8` bar those negatives were
+> judged against.
+
+The first negative happened to be right (the file was independently proved
+corrupt by a tone control). **It was right by luck, and the reasoning behind it
+was not supported.** A filter that fails its own known-positive is dead, not
+tuneable.
+
+### What was wrong: the threshold, not the idea
+
+`r > 0.8` was calibrated on **clean-against-clean** comparisons, where it is
+correct — a transcode against its source scores 1.000. A *component inside a
+mix* can never score that, because everything else in the mix is uncorrelated
+noise from the component's point of view. Judging one task by the other's bar
+guarantees a false negative.
+
+**Judge on the LAG and the MARGIN instead.** A real match lands at the *right*
+lag with a clear gap to the runner-up; a false one is a plateau. And **band-limit
+first**, so the component you are hunting dominates what you measure.
+
+### The calibration, on a known-present and a known-absent pair
+
+Both bands, both directions, envelope at 0.1 s, minimum 60 s overlap:
+
+| hunting | band | against | *r* | lag | **margin** |
+|---|---|---|---|---|---|
+| the movie bed | 40–180 Hz | mix containing it | 0.663 | **0.0 s** ✓ | **+0.111** |
+| the movie bed | 40–180 Hz | voice-only mix | 0.262 | −31.9 s ✗ | +0.005 |
+| voice stream 2 | 300–3000 Hz | mix containing it | 0.810 | **0.0 s** ✓ | **+0.248** |
+| voice stream 2 | 300–3000 Hz | the bed alone | 0.358 | −58.4 s ✗ | +0.005 |
+
+**A 20–50× separation in the margin, and the lag is right or absurd.** That is a
+decision rule set by controls rather than by tuning until the data agreed —
+which is the distinction that matters, and the one the first version of this
+method skipped.
+
+⚠️ **Reach.** The known-positive is a *synthetic* mix at equal gains. A real game
+mix weights its components differently, so this bounds the method rather than
+modelling the real case exactly. It is enough to separate present from absent; it
+is not a level measurement.
+
 ## What none of this establishes
 
 That it *sounds right*. Every method here shows correspondence to a source, not
 that the source is the audio the game plays at that moment, and not that levels
 are sane in a mix. A ten-second human listen still answers something no
 measurement above does — so when a result rests on one of these, say which one.
+
+## 4. What the exporter checks, so nobody has to remember to
+
+`sylpheed-export` measures **peak level and duration** of every audio file it
+writes and records both in `manifest.json`; `sylpheed-export check` refuses a
+tree whose peak is ≤ −90 dBFS (silent) or ≥ 0 dBFS (clipping).
+
+Those are content checks in a format validator on purpose. Silence is the failure
+this page opens by naming — right duration, right channel count, right size, full
+of zeroes — and every structural check passes it. Clipping is the other one, and
+the BGM can produce it, because a music bank is two stems summed at unity gain
+(HANDOFF Q10).
+
+⚠️ Neither says the audio is the **right** audio. `docs/port/BLOCKED.md` says
+which bindings are measured and which are still authored, and no measurement on
+this page can move a row there.

docs/port/FORMAT.md

@@ -147,7 +147,7 @@ for a long time.
 > grossly (`ptlogo_back2`, 1118×262, pivot 500,117 where half is 559,131). It is
 > not a problem for this port — the exporter emits the declared pivot and never
 > derives one — but it is a claim a consumer should not lean on. Raised in
-> `docs/BLOCKED.md`.
+> `docs/port/BLOCKED.md`.
 
 **`sprite`** / **`focus_sprite`** are paths relative to `export/`. The highlight
 pairs **by name** on the sprite — `ptbtn01.t32` ↔ `ptbtn01f.t32` — which is 🟡 a
@@ -212,10 +212,25 @@ from: the quad is `pivot × 2`, and its colour is the keyframe's `fade_argb`.
 
 **`keyframes`** carry the on-disc time verbatim in `t`. A keyframe is the
 **start of a ramp toward the next**, not a pose that is held, and the ramp is
-linear. The **last keyframe of a group has no `t`** — the disc has no time slot
-there — and a file that puts one on it is wrong, not merely odd. The unit of `t`
-is measured, not on the disc, and so lives in `authored/` and is applied in
-exactly one place.
+linear.
+
+🔴 **Every keyframe has a `t`, including the last**, and this paragraph said the
+exact opposite until 2026-08-29. A placement group is an 8-byte header followed
+by `frames` × `{u32 time; 36-byte pose}`, so **pose 0's time is the group's
+lead-in word** and no pose is untimed. The old reading — that a group's data
+stopped four bytes short of its final block's time slot — paired every pose with
+the *next* pose's time, and `sylpheed-export check` enforced it as a rule. A file
+with an untimed keyframe is now the wrong one.
+
+⚠️ Two things went with that correction. The **exit ramp is gone**: there is no
+untimed final keyframe to give a synthetic time to, so `authored/timing.json`'s
+`exit_ramp_units` — an authored *measured* constant since P3 — is **deleted**,
+which is what MISSION §3 means by a deletion being the measure of progress. And
+`rest.t` moved on several screens: `publisher_logo` settles at t=30 rather than
+t=235.
+
+The unit of `t` is still measured rather than on the disc, so it stays in
+`authored/` and is applied in exactly one place.
 
 **`rotation_deg`** is screen-plane rotation in degrees, clockwise-positive,
 decoded from the keyframe's `+12`. **The game renders it**, confirmed twice by
@@ -257,7 +272,7 @@ keyframe *k* means the screen spends that time *arriving at* `k+1`.
 > A consumer that wants the pose after arrival should therefore take **the last
 > timed keyframe**, not `rest`. `rest` is kept in the format because it is what
 > the pinned decoders say and removing it would hide the disagreement — see
-> `docs/DECISIONS.md`. The format is unchanged at **v2**: no field changed
+> `docs/port/DECISIONS.md`. The format is unchanged at **v2**: no field changed
 > meaning, this is a warning about one of them.
 
 **`paint_order`** is back-to-front, as declaration indices, and is a permutation
@@ -309,13 +324,56 @@ reaches which entry is Q4 and is not).
   "disc": "/disc",
   "screens": [{ "name": "main_menu", "file": "screens/title/main_menu.json",
                 "sprites": 18, "missing_sprites": [] }],
-  "video_transcode": "ffmpeg -i ADV.wmv -c:v libtheora -q:v 8 -c:a libvorbis -q:a 5 ADV.ogv",
+  "videos": [{ "name": "ADV", "file": "video/ADV.ogv",
+               "command": "ffmpeg -i …", "why": "HANDOFF Q9: …" }],
+  "audio":  [{ "kind": "se", "name": "move", "file": "audio/se/move.ogg",
+               "command": "ffmpeg -i …", "why": "HANDOFF Q8, measured: …",
+               "peak_dbfs": -3.2, "duration_s": 0.533,
+               "name_match": "SE_UI_CURSOR" },
+             { "kind": "bgm", "name": "main_menu", "file": "audio/bgm/main_menu.ogg",
+               "command": "ffmpeg -i …", "why": "AUTHORED, an arbitrary choice: …",
+               "peak_dbfs": -1.1, "duration_s": 173.8, "loop_mode": "restart" }],
   "warnings": ["GP_READY_ROOM not exported -- out of scope"]
 }
 ```
 
-`video_transcode` will record the exact command so a modder can re-run it rather
-than reverse-engineer what was done. It is absent until P4 writes a video.
+`videos` and `audio` are **absent** until a milestone writes one, rather than
+present and empty: an empty array reads as "we looked and there is none", and
+that is not what an export taken before P4 or P6 means.
+
+### `command` and `why`, on every media entry
+
+`command` is the exact ffmpeg invocation that produced the file. MISSION §6: a
+modder who dislikes the quality re-runs one line rather than reverse-engineering
+what was done to their asset. `why` is where the value came from, in the
+project's three-way vocabulary — **decoded** off the disc, **measured** off the
+running game, or **chosen**. A `why` that does not say which of those it is has
+not done its job.
+
+### `audio`, field by field
+
+| field | |
+|---|---|
+| `kind` | `se`, `bgm` or `voice`. The runtime dispatches on it, so it is a field rather than a prefix on `name` that a consumer would have to parse |
+| `name` | the **role**, not the disc asset: `move`, `confirm`, `back`, `main_menu`. Which bank plays a role is authored and expected to change; a rename on the disc side must not be a change to the Godot project. ⚠️ **`voice` is the exception and keys by MOVIE NAME** (`ADV`, `S00A`), because there is no role to name: the binding of recording to picture came off the disc's own movie manifest, so unlike a music bed nothing about it was chosen |
+| `peak_dbfs` | measured off the finished file. **Required.** Silence is the audio failure that looks like success — right duration, right channel count, right size, full of zeroes — and clipping is the other one, which the BGM can produce because it is a sum of two stems at unity gain. `sylpheed-export check` refuses a tree whose peak is ≤ −90 dBFS, and applies a **kind-dependent** upper bound. 🔴 This paragraph used to state a flat *≥ 0 dBFS* and was wrong about the port's own export: `confirm` ships at **+0.18** and the `ADV` voice at **+0.31**, so a consumer implementing a validator from this file would have rejected a valid tree. The rule is: a **`bgm`** is a sum *we* produced, so a peak at or above full scale is our arithmetic and is refused outright; an **`se`** or **`voice`** is a single wave off the disc, mastered near full scale, and a lossy decode of it overshoots by a fraction of a dB — those are allowed to **+1.0 dB**. ⚠️ The +1.0 is a judgement, not a measurement: a few tenths is reconstruction overshoot and a whole dB is not, and if a cue ever trips it the right response is to measure the overshoot distribution, not to loosen the bound |
+| `duration_s` | measured off the finished file, so that a claim about a cue's length can be checked against the finding that produced it |
+| `name_match` | the game's own cue identifier **guessed by name**. Absent means nobody claimed one — never that the binding is unknown. The binding is the measured part; the name is not |
+| `loop_mode` | what the runtime does at the end of the file, where that was authored. Absent on a cue: a cue ends |
+
+**A `voice` entry is a cutscene's dialogue, and it is a separate file on
+purpose.** On this disc a movie's `.wmv` carries music and effects only; the
+voice is a byte region of one continuous XMA stream in `sound.pak`, bound by the
+movie manifest. A consumer plays the two together, **from the same instant** —
+there is no offset and none is authored. A movie with no `voice` entry is
+genuinely unvoiced, which is the honest answer for most `hokyu_*` cutscenes;
+nothing is substituted, and the manifest carries a warning naming the movie.
+
+⚠️ The `why` on a `voice` entry names every region chunk the exporter **dropped**
+and its measured length. That is not commentary: which chunks of a region are the
+track is an open decoding question (see `docs/port/BLOCKED.md`), and a consumer
+reading a shorter file than it expected should be able to see what was left out
+rather than infer it.
 
 ## Changes from v2
 

docs/port/PORT-MISSION.md

@@ -97,15 +97,15 @@ A milestone is done when its **artifact** exists, not when the code compiles.
 |---|---|---|
 | **P0** | Exporter skeleton; one screen and its sprites to `export/` | `export/screens/title/main_menu.json` validates against FORMAT.md and the PNGs open |
 | **P1** | Godot renders that screen statically at 1280×720 | A Godot screenshot beside `sylpheed-cli screen render` of the same build — they should agree, and where they do not, say which is wrong |
-| **P2** | Keyframe animation | Buttons slide in. **Blocked on HANDOFF Q1** (the time unit). Do not invent it |
+| **P2** | Keyframe animation | Buttons slide in. ~~Blocked on HANDOFF Q1 (the time unit). Do not invent it~~ — **Q1 is answered**: ramp linear, 2 units per rendered frame, 1 unit = 1/60 s. Gate met |
 | **P3** | Splash → title, with the transition | Both screens back to back, unattended |
 | **P4** | Intro video | `ADV.wmv` plays with audio (§6) |
 | **P5** | Main menu: navigation, focus states, Ⓐ into a submenu, B back | ~~A human clicks through it~~ — ✅ **GATE MET 2026-09-02.** A human walked it: *"Menu walk and navigation is fine. Video skips too. Extras open."* [`../agents/PLAYTEST-2026-09-02-menus.md`](../agents/PLAYTEST-2026-09-02-menus.md) |
-| **P6** | Audio — menu BGM and move/confirm SFX | Sound on the P5 gate. **Looping is blocked on HANDOFF Q10** |
+| **P6** | Audio — menu BGM and move/confirm SFX | Sound on the P5 gate. ~~Looping is blocked on HANDOFF Q10~~ — **Q10 is answered**: two stems of one performance, played together. 🔴 **Gate NOT claimed**: the same play-test found the SFX mix wrong (F2), and "sound on the P5 gate" means the right sound. |
 | **P7** | New-game intro video after NEW GAME | Plays, then returns to a defined state |
 
 Work the lowest unfinished milestone. When one is blocked on an RE answer, say so
-in `docs/BLOCKED.md`, and take the next milestone that is not.
+in `docs/port/BLOCKED.md`, and take the next milestone that is not.
 
 ## 6. The video problem
 

docs/port/RUNNING.md

@@ -0,0 +1,158 @@
+# Running the port
+
+**P5's gate is *"a human clicks through it"*, and until now there was no page
+telling a human how.** The commands existed — in `boot.gd`'s header comment and
+scattered through a twelve-thousand-line `DECISIONS.md`. A capability that lives
+only in the record is, to the person who needs it, absent.
+
+Everything below has been run. Where a number is quoted it was measured in this
+container, and where the container distorts it that is said rather than left for
+the reader to discover.
+
+## 1. Build the asset tree
+
+The Godot project reads `export/`, never the disc.
+
+```bash
+cargo run --release -p sylpheed-export -- export --disc /disc --out export
+```
+
+Roughly four minutes, most of it transcoding two movies. It **rewrites `export/`
+wholesale** — never hand-edit anything in there; hand-written decisions live in
+`authored/` beside it, and survive a re-export.
+
+## 2. The P5 walk, from a cold start
+
+```bash
+godot --path port -- --boot --play
+```
+
+This is the one a human should judge. It boots the way the game does — two
+splashes, the `ADV` intro, the title — hands over to the menu on Ⓐ, and then
+**stays live and waits for input**.
+
+| you press | what should happen |
+|---|---|
+| Ⓐ on the title | the main menu opens on **NEW GAME** |
+| ⬆ / ⬇ | one item, wrapping at both ends |
+| ⬅ / ➡ | **nothing** — measured, and implemented as an explicit no-op |
+| Ⓐ on **EXTRAS** | the EXTRAS submenu, opening on **MISSION SELECT** |
+| Ⓑ in EXTRAS | back to the main menu, **on the item you left** |
+| Ⓑ on the main menu | back to the title |
+| Ⓐ on the title again | the menu, **still on the item you left** |
+
+That last row is the one worth checking deliberately: the main menu **remembers
+its cursor**, and every submenu **resets** to its own opening item. Both are
+measured, and they disagree on purpose.
+
+⏱ **The intro is ~157 s.** To skip straight to the menu:
+
+```bash
+godot --path port -- --menu=main_menu
+```
+
+and to drive it unattended:
+
+```bash
+godot --path port -- --menu=main_menu --script=down,down,down,down,accept,cancel
+```
+
+🔴 **This example used to say `down,down,accept,cancel`, and it walked the wrong
+path.** Two ⬇ from the opening item lands on **`TUTORIAL`**, whose destination this
+export does not carry — so the example exercised a *not-carried* message and
+returned, never opening a submenu at all. **`EXTRAS` is the fifth item**, so it
+takes four. The one submenu P5's gate rests on was the one the runbook's own
+command did not reach. Verified 2026-08-31 by running both.
+
+🔴 `--script` **without** `--play` or `--menu` refuses and says so. It used to
+parse, be stored, and do nothing.
+
+## 3. What is knowingly missing — not bugs
+
+Four of the five main-menu destinations are **measured but not in this export**:
+they live in other archives (`GP_SAVE_LOAD`, `GP_OPTIONS`, …). Pressing Ⓐ on them
+prints what it would have opened and why it cannot:
+
+```
+(LOAD GAME) opens a screen this export does not carry:
+   The save-slot list is GP_SAVE_LOAD, not in this export. Destination MEASURED.
+```
+
+**EXTRAS is the only Ⓐ-into-a-submenu this milestone can walk**, which is why the
+P5 gate rests on it.
+
+`NEW GAME` is a deliberate gap of a different kind: the real chain is
+NEW GAME → DIFFICULTY → SELECT DATA → the `S00A` movie, and the port **jumps to
+the movie**, printing the two screens it skipped. That is a gap, stated out loud;
+nobody should read the port's behaviour there as the game's.
+
+## 4. What this container distorts
+
+* **No GPU.** 720p Theora decodes **+6.7 % … +6.9 % slower than real time** here
+  (5 runs, both movies, on a quiet box). The boot's printed seconds carry that
+  deficit. It is a property of the machine, not of the port.
+* **No sound card.** Godot falls back to a dummy driver, so **you will hear
+  nothing**. The audio is present and measurable —
+  `docs/port/AUDIO-VERIFICATION.md` answers every audio question without a
+  device, and `tools/port/verify-menu-audio` asserts it — but *"I heard it"* is
+  not available in here.
+* **A leaked-object warning at exit** is engine-side, not the port's. Measured:
+  releasing every reference the port owns moves the count from 8 to 8.
+
+## 5. Modding
+
+`data/mods/` shadows `export/` by path. Each override is announced as it is read,
+and at the end of a run any file that **can never apply** is listed:
+
+```
+mod:   sprites/title/main_menu/ptbase.png  <-  data/mods/...
+mods:  1 file(s) in data/mods can shadow NOTHING -- no such path in the export:
+  inert: sprites/title/TYPO_menu/pteff05.png
+```
+
+A file whose path exists in the export but was simply not read this run is **not**
+listed. See `docs/port/MODDING.md` for the five rules the asset tree keeps.
+
+## 6. Where the work is, and what P5's gate is waiting on
+
+**P5's gate is the only one that needs a person, and it is not waiting on code.**
+
+Everything above runs from `auto/port-p6-audio`.
+
+🔴 **This section used to quote counts — "256 commits ahead, 58 files" — and they
+were stale the moment they were committed, because committing them incremented
+the count.** By the time anyone read it, it said 256 and the answer was 258. A
+number written into a document meant to inform a decision **decays with every
+commit either agent makes**, and the Decoder hit the same thing in their own
+merge-state page one message after recording the class.
+
+**So what follows are the invariants, which do not move, and the commands to
+re-derive anything that does.**
+
+| invariant | check | **passes when** |
+|---|---|---|
+| `main` is an **ancestor** of this branch — a fast-forward, nothing to resolve | `git merge-base --is-ancestor origin/main HEAD; echo $?` | prints **`0`**. ⚠️ The command itself prints **nothing** on success — without the `echo` a reader cannot tell success from failure |
+| `main` is an ancestor of the Decoder's branch too | `git merge-base --is-ancestor origin/main origin/auto/build-ordinal-audit; echo $?` | prints **`0`**, same caveat |
+| the two change sets touch **zero files in common** | `comm -12 <(git diff --name-only origin/main...HEAD \| sort) <(git diff --name-only origin/main...origin/auto/build-ordinal-audit \| sort) \| wc -l` | prints **`0`** |
+| merging both produces **no conflicts** | `git merge-tree --write-tree HEAD origin/auto/build-ordinal-audit \| wc -l` | prints **`1`** — one line is the tree id; conflicts would follow it. **Read-only: this merges nothing** |
+
+**Last run here: `0`, `0`, `0`, `1`.** A command published without a pass
+condition is half a check — the reader gets a number and no way to know whether it
+is the right one — so each row states what the right one is.
+
+📌 **So the sentence is not "N commits behind", which sounds like something to
+schedule. It is: two fast-forwards over disjoint file sets, mergeable in either
+order with zero conflicts.** Counts if you want them:
+`git rev-list --count origin/main..HEAD`.
+
+### What a person is actually being asked to do
+
+1. `godot --path port -- --boot --play`, then walk §2's table.
+2. Say whether it behaves as described. **Not whether it matches the game** —
+   that comparison is the oracle's job and is already asserted by
+   `tools/port/check-all`.
+3. If it does, P5's gate is met and nothing else is blocking P6, which asserts its
+   own audio and has no human step.
+
+⚠️ **You will hear nothing** (§4), and the intro takes ~157 s. `--menu=main_menu`
+skips straight to the part being judged.

docs/port/blend-decoded-adoption.md

@@ -0,0 +1,228 @@
+# The blend map is deleted — and adopting the decoded field found a counter-example
+
+**Status:** ✅ **adopted.** ❌ **My counter-example failed — the bit is right and the
+regression is a metric artefact.** See the last two sections.
+Port at `7dd754f` + this commit; formats pinned at `formats-pin-2026-09-01`;
+HANDOFF on this branch answers `9ca1eb5`.
+
+`PORT-MISSION` §3: *"When the RE agent later decodes something you had authored,
+delete the authored entry and let the exporter emit it. That deletion is the
+measure of progress."* This is that deletion.
+
+## What changed
+
+| | before | after |
+|---|---|---|
+| source | `authored/rendering.json` → `additive_elements`, keyed by **screen name** | `blend_additive` per element, emitted by the exporter |
+| origin | transcribed from the Decoder's per-draw `RB_BLENDCONTROL0` log | **decoded** — `T8aD +0x04` bit `0x02` |
+| reach | three screens somebody drove the game to | every screen on the disc |
+
+The pin bump is its own commit (`7dd754f`). The exporter emits `blend_additive`
+on `Element` **and** on nested focus/leaf elements — both spellings of the
+accessor are needed, because a button's focused variant is reached through
+`focus_link` and `ptbtn00f.t32` is in `build.sprites` while no element carries it
+as `sprite`. `ptbtn00f` is exactly the sharp case: the plate is alpha-over and
+its own glow is additive, on one screen in adjacent draws.
+
+## The check before the swap — the map was a subset, not the answer
+
+Over `main_menu`, `extras`, `press_start` and `title`:
+
+| | count |
+|---|---|
+| map says additive **and** the disc agrees | **15** |
+| map says additive and the disc does **not** | **0** — no contradictions |
+| disc says additive and the map did not | **17** |
+
+Nothing transcribed was wrong. It was **incomplete and was being read as
+complete**. The 17 include:
+
+* `pteff03` / `pteff03a` — the sweep **leaves**. `draw_leaf_for` means those are
+  what actually reach the screen while the map listed their parents
+  `ptloop01`/`ptloop02`. (Both parent and leaf carry the bit, so this one turned
+  out to change nothing — established below, not assumed.)
+* **twelve on `title`**, where the map was deliberately empty. The port has been
+  drawing every title effect alpha-over.
+
+**And it answers `BLOCKED.md` H6 with no capture at all.** The JP asymmetry — the
+port drawing `main_menu` additive and `main_menu_jp` alpha-over, asserting by
+omission that the JP build differs — was an artefact of a name-keyed map. The bit
+is on the disc for every screen at once.
+
+## 🔴 The regression, which is one element
+
+Scored against the oracle captures, on the GPU, before and after:
+
+| screen | before | after | Δ |
+|---|---|---|---|
+| **`main_menu`** | 10.88 | **13.02** | **+2.14** |
+| **`main_menu_options`** | 11.56 | **13.57** | **+2.01** |
+| `extras` | 13.10 | 13.10 | — |
+| `title` | 14.11 | 14.11 | — |
+| `title_plate`, `title_band`, both splashes | unchanged | unchanged | — |
+
+**The scores are deterministic** — two further runs gave 13.02 / 13.10 / 13.57
+to the digit — so this is a real change, not sampling noise.
+
+### It is `pteff10`, isolated
+
+* `main_menu`'s only newly-additive **top-level** element is `pteff10`.
+* `extras` has **no** newly-additive top-level element, and its score did not
+  move. That is the control: the same change applied to a screen with nothing new
+  moves nothing.
+* The leaf rule was tested separately by disabling it — `main_menu` stayed at
+  13.02, so `pteff03`/`pteff03a` are **not** the cause. That prediction of mine
+  failed and the rule was restored, being provably neutral here.
+
+`title` did not move despite twelve newly-additive elements, which is consistent:
+`verify-capture` poses at settle `t=198`, and the title's effect quads —
+`ptlogo_back2eff1…5`, `ptlogoall_eff`, `pteff01` — are transparent there.
+
+### 🔴 WHY I THOUGHT THIS WAS A COUNTER-EXAMPLE — and it was not. Kept because the premise-check is the lesson
+
+**Their own map lists `pteff10` as additive on `extras` and not on `main_menu`,
+and they logged both screens.** So either their per-draw log shows `main_menu`'s
+`pteff10` drawn alpha-over — a direct contradiction between a capture and the
+disc bit, on one element — or it was not drawn during that capture. The oracle
+comparison independently prefers alpha-over there.
+
+❌ **Wrong, and the premise was the failure.** The oracle *does* measure it
+additive on `main_menu` — three sessions, every frame. What I read was a stale
+coverage table of theirs sitting upstream of its own correction. **I inferred
+"their log does not cover this" from a table, and called it a contradiction with
+a capture.** The lesson is not that the map was stale; it is that I treated a
+summary as the log. See the resolution at the foot of this page.
+
+## Why the change ships anyway, stated rather than assumed
+
+1. `main_menu` carries a **±3.78 capture-phase term** in the harness's own note —
+   the capture caught the free-running sweep at an unknown phase. **+2.14 is
+   inside that stated uncertainty** and cannot adjudicate a disc fact.
+   `main_menu_options` is a sub-region of the same screen and inherits the same
+   sweep.
+2. The decoded source is far better evidenced than the comparison that moved, and
+   it **fixes two known defects** — twelve title effects drawn with the wrong
+   blend, and a JP/EN asymmetry the port was asserting by omission.
+3. Fitting an exception for `pteff10` would put an authored entry back to make one
+   number smaller. That is the move this project keeps having to undo.
+
+🔴 **This was a known regression shipped deliberately, not an unnoticed one** —
+and the decision was right for a *stronger* reason than the one I used. Not only
+is +2.14 inside the ±3.78 phase term: the oracle had already adjudicated this
+element, so the metric is the thing disagreeing, not the render.
+
+## What this does not claim
+
+* That the bit is wrong. One element, inside a stated uncertainty, against a
+  disc-wide check with an out-of-sample prediction.
+* That `pteff10` on `main_menu` and on `extras` are the same sprite. Not checked.
+* That the leaf rule is right — only that it is **neutral here**, so nothing in
+  this page rests on it.
+
+
+---
+
+# ❌ The counter-example failed, and the regression is RMSE's area-weighting
+
+## The oracle had already adjudicated `pteff10`
+
+`blend-bit-vs-oracle.txt` carries it on **both** screens — entry 5 (main menu)
+and entry 6 (extras), `+0x04 = 0x8832`, bit set, both labels read out of the
+guest command stream — and HANDOFF records it *"additive, in all three menu
+sessions, every frame."*
+
+**My premise was a stale coverage table**, not a reading of the log. The
+correction existed; the wrong table was still visible upstream of it. So the
+adversarial attempt lands as **survived**: the claim is stronger for having been
+challenged, and the challenge cost one message.
+
+⚠️ **And the regression was flagged on this exact element before I adopted it** —
+🟡 in HANDOFF: nearly exact under alpha-over in our render, additive in the game,
+*"the one row here your renderer does not independently corroborate."*
+
+## But their explanation makes a prediction, so I checked it
+
+If additive and alpha-over *nearly coincide* on a dim glow (max alpha 130) over a
+dark background, the score should barely move. **Mine moved 20 %.** That is a
+real tension and it was worth one measurement.
+
+Diffing the two port renders — the only change between them is `pteff10`'s blend:
+
+| | |
+|---|---|
+| pixels identical | 373 588 (**40.5 %**) |
+| pixels differing by > 3 | 330 794 (**35.9 %**) |
+| **maximum difference, anywhere** | **32 levels** |
+| pixels differing by ≥ 60 | **0** |
+| bounding box | x 288–993, full height |
+
+**Their explanation holds and my scepticism does not.** No pixel moves by more
+than 32/255 — 12.5 % — which is "nearly coincide" measured rather than asserted.
+What moved the RMSE is **area**: a third of the frame shifting slightly.
+
+## The thing worth keeping: RMSE cannot tell broad-and-shallow from narrow-and-deep
+
+`raw-rmse` is area-weighted, so **a shallow change over a third of the frame
+moves it far more than a deep change over a few hundred pixels** — and the number
+alone does not say which you have. 10.88 → 13.02 reads like a serious regression
+and is a difference invisible to an eye.
+
+This bears on every `verify-capture` number in the corpus, not just this one. A
+row that moves should be asked *"broad or deep?"* before it is called a
+regression, and that costs one histogram.
+
+## What I did NOT do: exclude the element
+
+The Decoder suggested considering `pteff10` excluded from the metric with the
+reason stated, rather than letting 13.02 sit as debt. **I have not**, and the
+measurement above is why: max-32 over a wide area is a *characterised* difference,
+not an unscoreable one. Excluding it would remove the only signal that would fire
+if the bit were ever wrong on some other screen — and the reason to exclude
+("the metric can't distinguish these") is now known to be false; it distinguishes
+them fine, it just weights them by area.
+
+**The 13.02 stands, with its explanation attached.** That is cheaper than an
+exclusion nobody will revisit.
+
+
+---
+
+# 🔴 Provenance: the oracle behind this adoption had a container-only instrument
+
+Recorded 2026-09-01 at shutdown, from the Decoder's own audit of their `/canary`
+checkout, not from anything visible on this side.
+
+This page deleted an authored map on the strength of `ui-blend-mode-decoded.md` —
+35 elements against `RB_BLENDCONTROL0` read out of the guest command stream, zero
+errors both ways, plus an out-of-sample prediction. **That evidence was not
+reproducible by anyone who cloned this repository.** The Canary logger commit
+that emits `blend=` per draw lived only in their container; without it a draw log
+records **no blend state at all**, so the oracle could not be re-derived at all —
+not approximately, not at reduced confidence. Not at all.
+
+It is reproducible now: four container-only logger commits are exported as
+patches under `tools/canary-patches/` **on `auto/frame-blend-draw-path`**, with a
+rebuild recipe. ⚠️ Named without a resolvable path on purpose — that directory is
+not in this checkout, and citing it as one would be the exact defect
+`check-citations` exists to catch.
+
+## What this does and does not change
+
+* **It does not weaken the adoption.** The measurement was real when made and is
+  now reproducible. Nothing here is retracted.
+* **It does change what "decoded" was resting on.** For the window between the
+  adoption and the export, this port had deleted an authored entry in favour of a
+  field whose supporting oracle no one else could regenerate. The map was the
+  *worse* of the two — a screen-name table that could not answer for a screen
+  nobody drove to — so the trade was still right. But it was a trade made against
+  an instrument, and the instrument's reach was smaller than the finding's.
+
+📌 **The generalisation, and it is theirs:** a finding is only as portable as the
+tool that produced it, and a reproduce recipe that reads as complete is the
+dangerous kind. Theirs *looked* complete — it named shas — which is why four
+commits sat unexported while one was noticed.
+
+⚠️ And the port cannot check this class from here. `check-citations` scans repo
+paths; an instrument living in another container is not a path at all. **The only
+defence available on this side is asking what produced a number before adopting
+it**, which is not a check and does not run.

docs/port/captures-are-crops-not-resamples.md

@@ -0,0 +1,85 @@
+# The committed captures are CROPS, not resamples — so pixel comparisons are like-for-like
+
+**Status:** ✅ **measured, and it refutes a consequence rather than a finding.**
+Written 2026-09-02 by the Port; HANDOFF on this branch answers `9ca1eb5`.
+
+## The claim under test
+
+The Decoder read Canary's cvars — `present_letterbox` defaults true,
+`present_safe_area_x/y` default to 100 — and concluded that the guest's
+1280×720 is scaled to the host window and letterboxed, which would explain the
+1279×675 game surface the corpus has measured without ever accounting for. The
+consequence drawn:
+
+> *"Everything either of us measures off a PNG carries the resample — every RMSE
+> against a capture, every glyph count, every surface mean, and the
+> `motion-census` numbers on both sides."*
+
+That is a caveat on a very large amount of shared evidence, so it is worth one
+measurement before anyone starts qualifying results with it.
+
+## Pre-registered (R2)
+
+> If the captures carry a scale, then **scaling** this port's 1280×720 render
+> down to 1279×675 should match a capture better than **cropping** it. If they
+> are crops, the reverse.
+
+## Measured
+
+`live-splash-publisher.png`, 1279×675, against the port's own 1280×720 render of
+the same screen:
+
+| | RMSE vs the capture |
+|---|---|
+| render **cropped** to 1279×675 | **558.1** (0.85 %) |
+| render **scaled** to 1279×675 | **10 118.8** (15.4 %) |
+
+**Cropping is 18× better.** A 0.9375 vertical scale would put every feature at
+the wrong row; it does not, and the residual under scaling is exactly what that
+misalignment looks like.
+
+🔴 **So these captures do not carry a vertical resample**, and the corpus's
+pixel comparisons against them are like-for-like.
+
+## What is refuted and what is not
+
+**Refuted: the consequence.** *"Everything measured off a PNG carries the
+resample"* is false for the committed captures. Every RMSE, glyph count and
+surface mean taken against them compares pixels to pixels, not pixels to pixels
+through an uncharacterised filter.
+
+**Not refuted: the cvar reading.** Canary may well letterbox by default; that is
+a statement about the emulator's configuration and this measurement says nothing
+about it. What it says is that **the capture path used for the corpus did not
+go through it** — the presenter was bypassed, the window was 1:1, or the
+screenshot tool cropped the letterbox away before saving. Which of those, nobody
+here has established.
+
+📌 **A second, independent line already agreed and nobody connected it.**
+`ui-render-tone-curve.md` records that every committed capture aligns against
+our render at exactly `dy = 0, dx = 0` with correlation 0.9466. A vertical scale
+of 0.9375 cannot produce a zero-offset alignment. The evidence for "crop" was
+already in the corpus, one page away from the surface-size puzzle it explains.
+
+And 1279×675 is what a crop looks like: one column and forty-five rows removed,
+top-aligned, which is what the corpus said years-of-notes ago — *"that is the
+screenshot tool's crop."*
+
+## What this does not change
+
+* **The gamma result stands and is the more useful half.** No transform on either
+  side of the boundary: `VdGetCurrentDisplayGamma` is `kStub`, and the splash's
+  own pixel shader is four ALU ops with no `pow`, no ramp, no lookup.
+* **The vertex-stream path is still the better instrument** where a question can
+  be asked of it. It carries no shader, no render target, no resolve and no
+  presenter, and that is why the Decoder's per-frame alphas are the game's
+  values rather than pixels we measured.
+* **`motion-census` was never at risk.** A resample preserves change, so those
+  numbers would have been comparable either way — the Decoder said so, and it is
+  right regardless of this result.
+
+## Reach
+
+One capture, one screen, one comparison. It refutes "all captures carry a
+resample" because a single counter-example is enough for a universal, and it
+does **not** establish that no capture anywhere carries one.

docs/port/f6-what-starts-the-sweep.md

@@ -1,597 +0,0 @@
-# F6 unit a — what the port currently uses to start the title sweep
-
-**Status:** ✅ answered. **No behaviour changed** — this unit exists so that when
-the Decoder says *when* the glow should start, the edit is one line.
-Port at `937f055`, 2026-09-02.
-
-## The answer, in one line
-
-`port/scripts/screen_view.gd:684`
-
-```gdscript
-var t := leaf_time_units if leaf_time_units >= 0.0 else time_units
-```
-
-**That is the whole start mechanism, and it is not a start mechanism.**
-`leaf_time_units` is set in exactly one place — `boot.gd:359`, the `--leaf-time`
-diagnostic flag — and is `-1.0` on every real boot. So the travelling glow runs
-on `view.time_units`, the title screen's own clock, which `_advance` sets to
-`0.0` when the title is raised. **Zero offset, no gate.**
-
-## 🔴 And the obvious gate does not exist
-
-The natural reading — mine, before checking — is that the parents gate it:
-`ptloop01`/`ptloop02` declare `0:0 70:0 100:255 238:255 250:0`, invisible until
-t=70. **That is not what happens**, because what reaches the screen is the LEAF,
-and `screen_view.gd` records as decoded that *"the leaf runs on its OWN timeline
-and the parent's alpha is NOT multiplied in"*. The parent ramp gates nothing.
-
-The leaves' own declarations:
-
-| leaf | alpha | x position |
-|---|---|---|
-| `pteff03` | **`0:255`** 150:128 540:255 600:255 | −639 → −39 (t=150) → 1521 (t=540) |
-| `pteff03a` | 0:0 150:128 630:255 720:255 | 1721 → 1111 (t=150) → −839 (t=630) |
-
-**`pteff03` is at full alpha from title t=0** and is travelling from t=0. It
-clears the left edge (sprite is 399 wide) at around t≈60 and is well inside the
-frame by t=150.
-
-The plate arrives at **t=214–236**. So the port starts the sweep roughly
-**150+ units ≈ 2.5 s early** — which is the size and the direction of what the
-human reported.
-
-## Corroborated on a film, not only read
-
-Filmed a real boot at 0.05 s and measured frame-to-frame change in the title art
-band `1280x420+0+90`, which **excludes the plate's own rectangle** (y 550–600) so
-the plate cannot be what registers:
-
-```
-view_units   22    54    69    86   118   134   214   341   406
-delta      31.8  39.9  30.8   9.4  12.6   0.2   0.2   0.1   0.4
-```
-
-Motion is heavy through the build-in and the band is quiet by t≈134 — consistent
-with `pteff03` having already crossed the measured band and with the coarse
-resize washing a thin glow out. **The film neither adds to nor contradicts the
-declaration; the declaration is the evidence here.**
-
-## Where the sweep actually is, computed from the leaf's own translation
-
-The port positions the leaf **from the leaf's own clock** — it does not draw the
-parent's pose and ignore the translation. Sprite 399 wide on a 1280 screen:
-
-| t | 0 | **61** | 70 | 100 | 150 | **236** | 250 |
-|---|---|---|---|---|---|---|---|
-| `pteff03` x | −639 | **−395** | −359 | −239 | −39 | **305** | 361 |
-| `pteff03a` x | 1721 | 1477 | 1436 | 1314 | 1111 | 762 | 705 |
-
-**`pteff03` enters the frame at t=61 and is mid-screen at t=305 when the plate
-reaches full alpha at t=236** — visible and travelling for ~175 units ≈ 2.9 s
-before the plate. `pteff03a` enters much later.
-
-## 🔴 The open question in this file sits exactly inside F6's window
-
-`screen_view.gd` flags its own limit on the leaf-vs-parent alpha decode:
-
-> *"Every observation behind this has parent alpha 0, so 'the leaf wins' and 'the
-> parent is ignored because it draws nothing' are NOT separated. **A capture
-> during t=100…238 would separate them.**"*
-
-The parent is non-zero exactly on `t=100…238`, and the plate arrives at 236. So
-that unresolved ambiguity is **the same interval F6 is about**, and it is
-load-bearing for the first stretch: the parent ramps 70→100, so applying it would
-hide the sweep until t=70 and dim it to t=100, while the port shows it at full
-alpha from t=61.
-
-That accounts for ~40 units of the earliness. **It does not account for the other
-~175**, which is the leaf clock starting at title t=0 with no offset.
-
-📌 **One capture in `t=100…238` would settle both** — F6's start time and the
-leaf/parent alpha rule — rather than two.
-
-## What changes when the answer lands
-
-A start time is an **offset**, and `leaf_time_units` is an absolute override —
-they are not the same field. The one-line edit at 684 becomes a subtraction, fed
-by one authored value. Nothing else moves.
-
-## What this does NOT do
-
-* **It does not choose a start time.** That is the Decoder's, and this unit was
-  scoped to exclude it deliberately.
-* It does not touch the glow. A boot looks exactly as it did.
-* It says nothing about whether the *speed* or the *path* is right — only when it
-  begins.
-
----
-
-# 🔴 Unit b, HELD: the parent-alpha refutation may be right, but its identification step cannot carry it
-
-**Status:** ⏸️ **the renderer is NOT changed.** The Decoder's
-`f6-unit2-parent-alpha-multiplies.md` refutes `screen_view.gd`'s *"the parent's
-alpha is NOT multiplied in"* using a bound. The bound's shape is sound and its
-premise checks out against this export. **The step that assigns the measurement
-to an element does not.**
-
-## The premise holds
-
-`pteff03`'s leaf declares `0:255 150:128 540:255 600:255` — **minimum 128**,
-confirmed off `export/screens/title/title.json`. A drawn alpha below 128 cannot
-come from that leaf alone. That part is right.
-
-## 🔴 But the two strips are the SAME SIZE, so size cannot say which is which
-
-The identification is stated as *"by size against the corpus's independently
-measured AABB height of 1134 px"*. Measured off this export:
-
-| sprite | dimensions | leaf alpha range | travel |
-|---|---|---|---|
-| `pteff03` | **399 × 180** | **128 … 255** | left → right (−639 → 1521) |
-| `pteff03a` | **399 × 180** | **0 … 255** | right → left (1721 → −839) |
-
-**They are byte-identical in size**, which is consistent with the two reported
-rows measuring `1.38 × 3.15` and `1.39 × 3.15` — a 0.7 % difference. Size
-separates the sweeps from everything else on the screen; it cannot separate them
-from **each other**, and that is the distinction the argument needs.
-
-## Why it matters — the assignment flips the conclusion
-
-The quoted row that reaches **8** is the one the argument leans on. But
-`pteff03a`'s leaf alpha floors at **0**, not 128, and ramps `0 → 128` across
-t=0…150. Values of 8, 24, 33, 50 … are exactly what **that leaf alone** produces.
-So if the 8-row is `pteff03a`, the bound is satisfied with no parent at all.
-
-⚠️ **And the conclusion may still be correct via the OTHER row.** The row
-reported as `16 41 67 91 116 128 129 130 131` contains values below 128 *and* a
-dense cluster at 128–131 — the signature of `pteff03`'s floor. If that row is
-`pteff03`, then 16 < 128 refutes no-multiply exactly as claimed. **The finding
-may be right and the cited row wrong.**
-
-## The discriminator is free and already in their capture
-
-The two leaves travel in **opposite directions**: `pteff03` left→right,
-`pteff03a` right→left, separated by ~1 000 px for most of their run. One frame
-pair settles it. Nothing needs re-capturing.
-
-## ✅ Resolved: the discriminator worked, and MY proposed repair was wrong
-
-The Decoder ran the travel-direction check on the capture they already had:
-
-```
-1.38x3.15  n=1140  x centre -1.690 -> +0.500   LEFT->RIGHT
-1.39x3.15  n= 614  x centre -1.685 -> +0.495   LEFT->RIGHT
-```
-
-**Both rows travel the same way, so both are `pteff03`** — the 0.7 % size
-difference is per-frame rounding splitting **one** element across two keys.
-`pteff03a` is not in the capture at all.
-
-🔴 **So my "the finding may still be correct via the OTHER row" does not apply —
-there is no other row.** The identification was broken a third way that neither
-of us named: not two elements confused for each other, but one element counted
-twice. I was right that size could not carry the assignment and wrong about what
-the assignment actually was.
-
-⚠️ And the part I could not see from here, which is the larger one: the quoted
-`8 24 33 50 58 …` were the nine **lowest distinct** values, not a series — a
-tail, presented in a shape that reads as a ramp. **14 sub-floor samples out of
-1754.** The bound survives in shape and collapses in weight: one sample below 128
-is still unexplainable by a leaf flooring at 128, but 14 of 1754 is where a
-grouping slip or a partial frame would show up.
-
-**Status: 🟡 not refuted, not established.** The next unit is a re-read of data
-already on disk — the same capture as a *series* across t=70…100, where a
-multiplying parent must ramp on nearly every frame rather than in 14 stragglers.
-That unit is the Decoder's and has not been run.
-
-## What the port does about it: nothing yet
-
-Adopting a decode whose element assignment is unresolved is how this project has
-been burned before — and the port would be changing a renderer rule on it.
-`screen_view.gd` keeps its current behaviour until the row is identified by
-travel direction. **This is not scepticism about the conclusion**, which the
-port's own flagged limit predicted would fall this way; it is about which row.
-
----
-
-# 📌 What was actually holding this up: we both picked the wrong observable
-
-The human asked what was blocking us and whether the approach needed revising.
-**It did, and the diagnosis is short: two agents spent three exchanges on ALPHA
-while the answer sat in a POSITION series neither of us compared to anything.**
-
-## The arithmetic that should have been step one
-
-The Decoder's capture reports the sweep's x-centre running `−1.690 → +0.500`.
-Read as NDC (`x_ndc = 2·x_px/W − 1`, **an assumption, stated as one**):
-
-| | ndc | centre px | implied leaf t |
-|---|---|---|---|
-| first sample | −1.690 | −441.6 | **−0.5** |
-| last sample | +0.500 | +960.0 | 349.9 |
-| **declared at leaf t=0** | **−1.687** | **−439.5** | — |
-
-**A 2 px agreement on a 2 160 px travel.** So the game's sweep begins travelling
-at leaf t≈0, from off-screen left — **the same as the port.**
-
-🔴 **That contradicts my own earlier framing on this page**, which attributed
-~135 units of the earliness to "the leaf clock starting at title t=0 with no
-offset". If the game's leaf clock also starts at 0, that is not a defect and F6
-is a **visibility** question — alpha, or draw order, or something not yet named —
-rather than a clock question. I am flagging it rather than rewriting the section:
-this rests on two numbers relayed in a message, which is exactly the thing that
-should be read from the repository instead.
-
-## Why alpha was the wrong tool, stated generally
-
-| | alpha | position |
-|---|---|---|
-| dynamic range | 8 bits, quantised | **2 160 px** |
-| shape | non-monotone, ramps and holds | **monotone** |
-| failure mode that bit us | a 14-sample tail out of 1754 looks like signal | a wrong shape raises the residual |
-| yields the clock? | no | **origin AND rate together** |
-
-**When something moves, its position carries the clock and its alpha carries
-almost nothing.** Neither of us reached for a trajectory comparison because
-neither of us had one.
-
-## So: `tools/port/fit-trajectory`
-
-Solves `x_measured(frame) ≈ declared(t0 + rate·frame)` for the pair, and reports
-the **residual**, which is the part that matters: it says whether the model was
-right at all, where a value-at-an-instant never can.
-
-Its `--selftest` runs both directions — recovers a known clock from a synthesised
-series to 0.09 px, and **rejects** a wrong-shape series at 81.9 px against a 20 px
-bar — because a fit that cannot fail is a curve-fitter, not a measurement. Wired
-into `check-all`.
-
-⚠️ It fits a **constant** rate. A stalling guest clock or uneven capture drops
-raise the residual rather than being absorbed, which is deliberate.
-
----
-
-# ❌ WITHDRAWN — Unit c: "the port draws a sweep the game does not"
-
-> 🔴 **This whole section is refuted, and the port was right.** `pteff03a` **is**
-> drawn by the game. The two strips are batched into a **single additive draw of
-> eight vertices — two quads** — and the Decoder's log reader took the first
-> vertex match per draw line and discarded the rest, so every analysis saw quad A
-> and never quad B. No new capture was needed; `pteff03a` was in the same logs
-> that were read as declaring it absent
-> (`docs/re/f6-unit11-pteff03a-IS-drawn.md`). Measured on both sides: the strips
-> travel in opposite directions with a size ratio of 1.301 against the declared
-> 800/600 = 1.333.
->
-> ✅ **Nothing in the port changed on the strength of it.** I proposed gating
-> `pteff03a` and held, because absence in one capture read by one probe is a lead
-> and not a finding, and because the check I asked for was a human's look rather
-> than another measurement. That hold is the only reason this cost nothing.
->
-> ⚠️ **And the absence claim cited the port as evidence against itself** — "the
-> port draws it, the game does not" — so a defect was inferred in my renderer
-> from a gap in a reader. Kept in place rather than deleted: the reasoning below
-> is sound given its premise, and the premise is exactly the kind that looks like
-> data.
-
-## The original section, kept for its shape
-
-## First, the correction: my refutation was right in outcome and WRONG in its reason
-
-I challenged the Decoder's by-size identification on the ground that *"both
-sweep sprites are 399×180, so size cannot separate them"*. **That was wrong.** I
-compared the source PNGs and never looked at the leaf declarations:
-
-| leaf | sprite | declared scale | **drawn height** |
-|---|---|---|---|
-| `pteff03` | 399×180 | `[100, 600]` | **1080 px** |
-| `pteff03a` | 399×180 | `[100, 800]` | **1440 px** |
-
-The *drawn* quads differ by a third, which is exactly the 3.15 vs 3.62 NDC the
-Decoder was separating by. **Size distinguishes them fine.** The hold was still
-correct and the check I asked for still found a real defect — but it found a
-different one (one element double-counted, and a set presented as a series), and
-my stated reason did not survive. Recorded because a right answer reached by a
-wrong argument is the kind that gets cited later for the wrong reason.
-
-## And it makes the real finding sharper
-
-Because size *does* separate them, the Decoder's line — *"`pteff03a` does **not**
-appear in this capture at all"* — is well-evidenced rather than incidental. They
-looked for a distinct size and found nothing.
-
-**The port draws it.** Asked directly, at three instants:
-
-```
-t=120  drew 9: ptbase2, pteff03, pteff03a, pteff04, ...
-t=180  drew 10: ptbase2, pteff03, pteff03a, pteff04, ...
-t=240  drew 10: ptbase2, pteff03, pteff03a, pteff04, ...
-```
-
-`pteff03a` is on screen in the port from t≈108 (it crosses x=1280 there) until
-t≈521, travelling **right-to-left** at 800 % vertical scale while `pteff03` runs
-left-to-right at 600 %. The capture covers that window and contains only
-`pteff03`.
-
-> ~~**So the port appears to render a second light sweep, larger and travelling
-> the opposite way, that the game does not draw during the title build-in.**~~
-> ❌ **False.** The game draws both, batched into one eight-vertex draw.
-
-⚠️ **Absence in one capture is not absence in the game**, and this is one
-capture, read by one probe, identified by size. It is a lead, not a finding. But
-it is the first thing in F6 that is *visible*, *port-side*, and *checkable by a
-person in seconds* — which is what this whole exchange has been missing.
-
-## What did NOT work, recorded so nobody repeats it
-
-I tried to isolate the two sweeps visually by differencing title frames at
-several `--time` values. **It failed and the output is not evidence**: at those
-instants the whole title is still animating — logo, effects, copyright — so the
-difference is the entire screen rather than the sweeps. Frame-differencing
-isolates motion only when everything else is still, and during a build-in nothing
-is.
-
-## The unit, and it is one question for a person
-
-> **On the real game's title screen, is there ONE light streak sweeping across,
-> or TWO travelling in opposite directions?**
-
-Pass for the port as it stands: two. If the game shows one, `pteff03a` is drawn
-here and should not be — and an extra glow arriving at t≈108 is a very good
-candidate for *"the glow starts too early"*.
-
-**Not covered:** the start time of `pteff03` itself, which is still open; and the
-parent-alpha question, still 🟡.
-
----
-
-# ❌ Unit d — the "variant link" explanation, raised and killed in one pass
-
-The Decoder's second candidate for why the game submits `ptloop01` and not
-`ptloop02` was *"a focus/variant link means only one of the pair is ever
-active"*. **That is answerable from the export, and the answer is no.**
-
-## What looked like a smoking gun
-
-`ptloop01` carries **`opt_link = "ptloop02.rat"`**, `ptloop02` carries none, and
-it is the only linked element on the title screen. The field is exported straight
-from `el.focus_link` (`crates/sylpheed-export/src/screen.rs:622`), and
-**`port/scripts/` never reads it.** An ignored variant link would have explained
-the extra sweep exactly.
-
-## ❌ And it is not a variant link
-
-Surveying `opt_link` across the whole export splits it into two populations:
-
-| target | example | is the target also a top-level element? |
-|---|---|---|
-| `*f.rat` | `ptbtn00 → ptbtn00f` | **no** — variant only |
-| everything else | `ptloop01 → ptloop02` | **yes** — both are drawn |
-
-And the second population **chains across unrelated element kinds**. On
-`main_menu`:
-
-```
-index 3   ptloop01  -> ptloop02.rat
-index 4   ptloop02  -> ptbtn01.rat
-index 10  ptbtn01   -> ptbtn01f.rat
-```
-
-**A light sweep points at a button.** A variant selector cannot do that, so
-`opt_link` is a chain pointer that happens to land on the focus variant when the
-element is a button — which is why it was exported under the name `focus_link`.
-
-> So the field does not select between `ptloop01` and `ptloop02`, and the port
-> ignoring it is not what draws the extra sweep. **Candidate eliminated.**
-
-## The smaller finding that survives
-
-**`focus_link` is carrying two different things** and the exporter names it after
-only one of them. The `*f` population is a variant; the rest is a chain. Nothing
-depends on this today — the port reads neither — but the name asserts a meaning
-the data does not support, and the next person to reach for it will reach for the
-wrong one. Worth renaming when something actually needs it; not worth a
-re-export on its own.
-
-## Where that leaves F6
-
-The lead is unchanged and unexplained: **the port draws `pteff03a`, the game's
-capture never does** — now confirmed by an exhaustive scan of every tall quad in
-1..2499 rather than a filtered subset. One of the two candidate causes is now
-eliminated from the export side, which leaves the Decoder's first: a zero-alpha
-skip suppressing the opening frames. ⚠️ That one does not obviously survive
-either — it would explain `pteff03a`'s *opening* frames, not its whole run, and
-its leaf reaches α=128 well inside the captured window.
-
-**Nothing is deleted and the renderer is unchanged**, pending one five-second
-human look: one streak, or two?
-
----
-
-# Unit e — the port draws exactly TWO travelling lights, and the human reports more
-
-The human, watching the real game: *"I think multiple, possible more than two…
-The lights move on blue lines looking like PCB board lines. And frankly I cannot
-tell if the game renders a light per line or uses a light that is shown around
-multiple, close lines."*
-
-That is a different question from the one both agents had been asking, and it is
-worth having the port's own number first.
-
-## Census of every element on the title that travels
-
-| element | x travel | note |
-|---|---|---|
-| `ptlogo1` / `ptlogo2` (×3 instances) | 300 px | the **logo** sliding in, t=34…251 — not a light |
-| **`pteff03`** (leaf of `ptloop01`) | **2 160 px** | left → right |
-| **`pteff03a`** (leaf of `ptloop02`) | **2 560 px** | right → left |
-
-Every other title element — `pteff00`, `pteff01`, `pteff02`, `pteff04`,
-`ptlogo_back2eff` and `…eff1…5`, `ptlogoall_eff`, `ptlogoall_eff2`,
-`ptcopyright`, `ptbase2` — **declares no positional travel at all.** They fade in
-and out in place.
-
-> **The port renders exactly two moving lights.** The human describes multiple,
-> possibly more than two, running along individual PCB traces.
-
-## What that reframes
-
-Both agents had been asking *when* the sweep starts. If the game's effect is a
-population of small lights on separate traces and the port's is two full-height
-streaks crossing the screen, then **the port may have the wrong effect
-altogether**, and "starts too early" is what a wrong effect looks like to someone
-who is not reading keyframes.
-
-⚠️ **And it puts a limit on the capture result.** The Decoder's scan that found
-`pteff03a` absent covered every quad **taller than 1.2 NDC**. Small per-trace
-lights are far below that, so that scan cannot count them — it is exhaustive over
-full-height streaks and silent about the population in question. `pteff03a`'s
-absence stands (it would be 3.62 NDC); *"only one travelling quad exists"* does
-not generalise beyond tall quads.
-
-## ⚠️ A limit of this census
-
-It reads **declared** keyframes. An element with a single keyframe shows as
-"visible 0…0" here and is in fact held and drawn — `ptbase2`, the background, is
-the obvious case. So the visibility column understates; **the travel column is
-the load-bearing one**, and travel is what a moving light needs.
-
-It also cannot see motion that is not positional — a scrolling UV, a texture
-animation, or a shader would move light along a trace while declaring no travel
-at all. **Nothing in this export declares such a thing**, but the port would not
-know if the game did it that way, and that is now a live possibility rather than
-a remote one.
-
-## Not covered
-
-Whether the game's lights are one-per-trace or one glow spanning several — the
-human says they cannot tell, and it is the Decoder's screenshots to settle.
-
-
----
-
-# 📌 What the withdrawal is worth, since the port lost nothing
-
-Three of my own claims rested on `pteff03a` being absent and all three fall with
-it: that the port renders a sweep the game does not, that this was "the first
-thing in F6 that is visible and port-side", and — in a report to the human — that
-"the port draws two, the game's capture has one." **The port draws two and so
-does the game.** The census on this page stands unchanged; what changed is that
-it now agrees with the capture rather than contradicting it.
-
-**The one thing that made this free was refusing to act on it.** The evidence was
-an exhaustive scan, from an agent with the oracle, corroborated by a mechanism
-and by two candidate causes. It was still an *absence*, measured once, by one
-reader — and the check I asked for was a human's look, not another measurement.
-
-⚠️ **An absence is a claim about an instrument, not about the world.** A count of
-zero says only that nothing got through the reader. Every positive result on that
-same capture — the alpha decomposition, the press-vs-control comparisons, the
-pulse ratio — is untouched, because those compare like with like on the same
-quad. Only the absence compared a count against zero, and that is precisely where
-a truncating reader is fatal.
-
-📌 The Decoder notes this is the third time this corpus has been bitten by an
-under-reading dump, and that `REFUTED.md` already recorded a draw carrying two
-rotated parallelograms — **the general fact was written down before the reader
-contradicted it.** Their cheap check is worth repeating here because it applies to
-anything the port ever reads: *read one raw record in full before trusting any
-count derived from it.* The batch size was printed on every one of those lines.
-
-## 📌 And the same error recurred, which makes it a pattern rather than a slip
-
-The withdrawn alpha bound on this page failed because nine values quoted as a
-series were `sorted(set(...))[:9]` — the lowest distinct values, a tail wearing
-the shape of a trajectory. The Decoder has since found the same thing in a second
-finding: an implied-parent range quoted as 254.0–256.9 turned out to be *the rows
-they had printed*, every twentieth frame, standing in for a population whose real
-first-cycle spread was 250.9–260.5.
-
-**Twice, and both times the output looked fine.** That is the tell: a summary
-drawn from a subset does not look like an error, it looks like a result. The
-conclusion survived on both occasions, so nothing here needs undoing — but a
-conclusion surviving is not evidence the number under it was sound, and this port
-has now inherited two numbers that were not.
-
-⚠️ **Neither was reachable by reasoning**, which is the part worth keeping. In
-both cases the argument was valid and the *inputs to the summary* were wrong. No
-amount of re-reading the claim finds that; only re-running it does. It is the
-argument for re-running over re-checking, and it is why the two findings flagged
-as unverified above were re-run rather than defended.
-
----
-
-# ❌ A refutation aimed at this renderer, measured and NOT landed
-
-The Decoder raised it and could not test it from their side: *"if your renderer
-runs both leaves on a single rate, the two strips stay locked together and drift
-from the game by ~118 units per cycle, growing without bound."* The two leaves
-declare **600** and **720** unit loops.
-
-**Pre-registered, then measured on a real boot** via `--probe-leaf`. At a raw leaf
-clock of 4873:
-
-| leaf | span | measured `leaf_t` | `fposmod(4873, span)` |
-|---|---|---|---|
-| `pteff03` | 600 | **72.6** | 73 |
-| `pteff03a` | 720 | **552.6** | 553 |
-
-The port takes each leaf's span from **its own keyframes** — `span = max(k.t)`
-over `fe.keyframes` — so the two were never locked. **17 748 probe samples, title
-clock reaching 9 745**, i.e. the sweep is still looping 162 seconds in.
-
-## 🔴 Two false alarms of my own on the way there, both from the same mistake
-
-1. **I used `--time` to ask a question about running behaviour.** It sets
-   `frozen`, which by design bypasses the `holding` clamp, so the title read as
-   *empty* past t=250 and I nearly reported the whole title vanishing. On a real
-   boot it does not: `settle_window` is `[160, 236, 198]`, the elements clamp to
-   t=198, and a filmed frame at `view_units 6733` shows the complete title.
-2. **I read a probe stopping as the feature stopping.** Two runs ended at
-   u≈236 and I took that as the sweep dying at settle. It was the run ending —
-   without `--film` the boot exits sooner. With a film attached the same probe
-   reaches 9 745.
-
-📌 Both are the frozen-sweep lesson wearing new clothes: *the diagnostic that
-pins the clock cannot answer a question about the clock running*, and *an
-instrument going quiet is not the subject going quiet*. The second is the same
-shape as the Decoder's own absence-of-a-quad bug — a count of zero says only that
-nothing reached the reader.
-
----
-
-# ✅ Out-of-sample: what the port ships was in the passing half
-
-The Decoder pre-registered six predictions and tested them on a fresh boot that
-had no hand in deriving them. **Three failed.** Audited here against what this
-port actually authors, and the answer is **nothing to change**:
-
-| their prediction | fresh boot | does the port carry it? |
-|---|---|---|
-| leaf period ratio 1.200 | 1.1753 ✅ | **yes** — this is `rate = 0.5` |
-| strip size ratio 1.333 | 1.3009 ✅ | yes, as element identity |
-| pulse / sweep loop 0.100 | 0.0963 ✅ | yes, `looping_focus_records` 120 |
-| pulse amplitude ≤3 levels | 8.73 🔴 | no |
-| `ptcopyright` ramp ratio 0.733 | 0.550 🔴 | no |
-| sweep leads plate 0.138–0.141 | **0.0996** 🔴 | **no** — grepped, absent |
-
-`authored/rendering.json` `leaf_clock` is `{start_units: null, rate: 0.5}` and
-nothing else. No separation constant exists in `authored/`, `tools/port/` or
-`port/scripts/`.
-
-📌 **That split is not luck and is worth naming.** Everything the port adopted is
-either **declared on the disc** (the parent gate, the 120-unit pulse loop, the
-600/720 leaf periods) or **corroborated by three independent legs** (the rate).
-Every failed prediction is a figure derived from *relationships between elements
-measured in a capture* — the class with no declared counterpart, which
-`check-authored-vs-declared` says out loud it cannot arbitrate. The rule "adopt
-what the disc declares, or what three unrelated things agree on" selected exactly
-the surviving half without anyone knowing which half that would be.
-
-⚠️ And the Decoder reports that `check_labels.py` — offered last iteration as the
-mechanism for capture-only labels — **fails its first independent test**: two of
-its four checks fire on a third capture, having been validated on the two that
-produced the labels. An instrument validated on its own training data. Nothing
-here depends on it, but it is not a mechanism this port should lean on either.

docs/port/held-direction-repeat.md

@@ -0,0 +1,99 @@
+# F1 — the menu repeats on a held direction: mechanism shipped, **rate deliberately not**
+
+**Status:** ✅ mechanism implemented and wired. 🔴 **inert on purpose** — it does
+nothing until a measured repeat rate exists. Written 2026-09-02 by the Port.
+
+## What was reported
+
+Two statements from the human, both about the **real game**, a play-test apart:
+
+> *"Moving stick up/down and holding only moves one item. In game it actually
+> continues to move when holding up/down, just at a medium pace so player does
+> not need to move pad middle↔up/down, but also slow enough to see which item is
+> selected and move to target."*
+
+> *"Confirmed D-Pad does repeat when holding too."*
+
+## The file predicted its own refutation
+
+`gamepad.gd` carried this, written when the latch was added:
+
+> *"Whether the real game repeats while a direction is held, and how fast, is
+> unknown… If the game does repeat, this is a difference a human will notice as
+> 'I have to flick it again', and the fix is a measured repeat interval — not a
+> guessed one."*
+
+That is exactly what happened, in the words it predicted. **So
+one-step-per-deflection is no longer the conservative reading — it is a known
+defect**, and keeping it is choosing a wrong behaviour over an approximate one.
+
+## What was built
+
+| | |
+|---|---|
+| `Gamepad.held_direction()` | −1 / 0 / +1, polled from the **devices** |
+| `Gamepad.repeat_due(delta)` | one step or 0, per frame |
+| `Boot._menu_repeat(delta)` | calls it under the same guards a real press gets |
+
+### Why it polls devices and not `Input.is_action_pressed`
+
+`ui_up`/`ui_down` are bound to the stick axis at **Godot's 0.50 action
+deadzone**, while this port steps at the game's measured **0.61** (`ENTER`).
+Polling the action would repeat throughout the 0.50–0.61 band — the exact band
+`ENTER` exists to exclude — so the repeat would contradict the threshold on the
+same stick, on the same frame.
+
+That is the input-map lesson from 2026-09-01 arriving in a new place: **assert
+the device, not the layer above it.** The stick reads from the latch
+`accepts()` already maintains, so the first step and the repeat cannot disagree
+about hysteresis; the d-pad reads `JOY_BUTTON_DPAD_UP/DOWN` directly, which the
+human's second report makes load-bearing rather than defensive.
+
+### Why the guards are duplicated rather than shared
+
+`_menu_repeat` re-applies the same four conditions `_unhandled_input` applies —
+no movie playing, a menu exists, its stack is non-empty, no transition pending.
+A repeat that could fire during a movie or mid-transition would be a **second,
+subtly different input path**, and the first thing this port learned about input
+is that a second path is where the defect hides.
+
+## 🔴 And the rate is not shipped
+
+An earlier draft of this change had `REPEAT_DELAY = 0.40` and
+`REPEAT_INTERVAL = 0.20`, with a paragraph explaining that they were authored.
+**They were removed rather than commented out**, on an explicit instruction:
+
+> *"Take the RATE from the Decoder — do NOT ship a placeholder interval. An
+> invented rate here is indistinguishable from a measured one later, and this is
+> the exact field where that already cost us."*
+
+The instruction is right and the draft was the named failure mode: the
+explanation would have merged, the numbers would have felt roughly right, and
+nothing downstream could have separated them from a measurement. `REPEAT_DELAY`
+is `-1.0`; `repeat_due()` returns 0 while `repeat_rate_known()` is false.
+
+**One thing about the rate IS measured, and it narrows the question.** The game
+digitises the left stick to four direction bits at 61 % deflection, so it cannot
+see deflection magnitude at all — the repeat it drives *cannot* be
+faster-the-harder-you-push. That excludes the one competing model, so only two
+constants are open and a single measurement closes both.
+
+## ⚠️ Adopting the rate breaks a green check, for the right reason
+
+`tools/port/verify-input` asserts *"a held stick is ONE step, not six"*. That row
+passes today **because the feature is inert**, i.e. it asserts the absence of the
+repeat. When a rate is adopted a held stick should produce further steps and that
+row will go red.
+
+It is not wrong and it should not be deleted in a hurry: it was written for the
+2026-09-01 jitter defect, so it will *look* like that bug returning. It has to be
+re-stated as "one step per deflection **plus** the measured repeat", with the
+jitter case still covered inside the delay window.
+
+## What this does not claim
+
+* That the repeat feels right. It cannot — it does not run.
+* Any rate, or any bound on one. "Medium pace" is a direction, not a number, and
+  it is not recorded anywhere as data.
+* That the d-pad and the stick repeat at the *same* rate. Both repeat; nobody
+  has said they match, and the code currently assumes one rate for both.

docs/port/menu-destinations-are-one-line-away.md

@@ -1,70 +0,0 @@
-# Four of five main-menu destinations are blocked on ONE hardcoded archive
-
-**Status:** ✅ feasibility established, nothing changed yet. 2026-09-03.
-
-## The gap, in player terms
-
-| button | destination | today |
-|---|---|---|
-| NEW GAME | `DLG_SELECT_DIFFICULTY` → SELECT DATA → video | **jumps straight to the video** |
-| LOAD GAME | `GP_SAVE_LOAD` | **dead** |
-| TUTORIAL | — | **dead** |
-| OPTIONS | `GP_OPTIONS` | **dead** |
-| EXTRAS | `extras` | works |
-
-All four are recorded in `authored/flow.json` as **measured destinations** —
-somebody drove the real game to them. They are `blocked` for one structural
-reason, stated there: *"not a GP_TITLE build, so there is no screen file to go
-to."*
-
-## The cause is one line
-
-`crates/sylpheed-export/src/main.rs` hardcodes `let archive = "dat/GP_TITLE.pak"`.
-
-## And the reader already works on the rest
-
-`examples/probe_archives.rs` runs the **existing** `ui_layout::is_build` over
-every `.pak` on the disc. It decodes nothing new:
-
-| archive | entries | builds |
-|---|---|---|
-| `GP_OPTIONS` | 26 | **14** |
-| `GP_SAVE_LOAD` | 108 | **18** |
-| `GP_DIALOG` | 140 | **105** |
-| `GP_TUTORIAL` | 2 | **2** |
-| `GP_TITLE` | 16 | 12 |
-
-**24 archives contain UI screen builds. The exporter reads one.**
-
-> So this is not blocked on the Decoder and needs no new format work. It is an
-> exporter scope limit, and the exporter is the port's.
-
-## Why this is worth doing before the queued items
-
-Measured against *"if this is wrong, what does a player experience?"* — the
-filter this port adopted after spending two rounds on a plate pulse that turned
-out not to be a defect:
-
-* **four dead menu entries** and a missing difficulty screen: a player hits them
-  immediately and three of them do nothing at all;
-* the audio mix (F2): a player notices, but the menu still works;
-* the repeat rate (F1) and the title track (F3): both blocked on measurement.
-
-## ⚠️ What this does NOT establish
-
-* **That the screens will render.** `is_build` says the record parses as a build,
-  not that its sprites resolve, its names are known, or its layout is complete.
-  `GP_HANGAR_ARSENAL` reports 390 builds and is squarely gameplay, out of scope.
-* **Which entry is the difficulty dialog.** `GP_DIALOG` has 105 builds and none
-  of them is named yet; `DLG_SELECT_DIFFICULTY` is a name from the flow, not an
-  entry index.
-* **That more screens are free.** Every screen the export gains is a screen
-  `check-all`'s comparisons iterate over, and screen names are authored per
-  archive+entry — unnamed screens need a naming decision, not just a loop bound.
-
-## Next unit
-
-Widen the exporter to **one** further archive — `GP_OPTIONS`, the smallest at 26
-entries — as data rather than a second hardcoded constant, and see what actually
-comes out. Not all four at once: 139 new screens arriving together would make any
-regression unattributable.

docs/port/options-screens.md

@@ -1,118 +0,0 @@
-# The OPTIONS menu tree exists, renders, and is named
-
-**2026-09-03.** `GP_OPTIONS` joined `export_archives` and produced 14 screen
-builds. All 14 render; all 14 are now named.
-
-## What they are
-
-| entry | name | English | | entry | name |
-|---|---|---|---|---|---|
-| 19 | **`options`** | **the root** — GAME / CONTROL / SOUND / SCREEN SETTINGS, BACK | | 21 | `options_jp` |
-| 16 | `game_settings` | Auto-Save, View Point, Radio Log, Subtitles | | 18 | `game_settings_jp` |
-| 4 | `control_settings` | Control Type, Throttle, sensitivities, Vibration | | 8 | `control_settings_jp` |
-| 3 | `sound_settings` | Music / Movie / Voice / SFX Volume | | 5 | `sound_settings_jp` |
-| 6 | `screen_settings` | Gamma Correction, R/G/B, NEXT PAGE | | 9 | `screen_settings_jp` |
-| 7 | `screen_settings_page2` | White / Black Level Adjust, PREVIOUS PAGE | | 10 | `screen_settings_page2_jp` |
-| 20 | `control_customize` | per-action key remapping | | 22 | `control_customize_jp` |
-
-A clean EN/JP pair for every screen, which is itself a check: 14 builds, 7
-pairs, no leftovers.
-
-## How they were identified, and why that is stronger than usual here
-
-**By the text the screen renders about itself.** Each was exported, drawn by the
-port at rest, and read: the titles and row labels are legible.
-
-📌 That matters because this project has been bitten three times by
-identification via **position, size or ordinal** — the sweep strips confused by
-size, the plate identified by screen position, `ptcopyright` mistaken for the
-plate. A screen that renders the words `SOUND SETTINGS` above four volume rows is
-not that kind of inference.
-
-⚠️ **What it still does not establish:** which screen the *game* navigates to
-from which. The tree above is read off content, so `control_customize` being
-"reached from CONTROL SETTINGS" is a reading of its own legend
-(`Ⓨ : Customize` on `control_settings`), not a measured transition. Wiring
-anything beyond `main_menu → options` needs the real navigation.
-
-## Not yet done
-
-* **Nothing is reachable yet.** `main_menu` `ptbtn04` still has `goto: null`.
-* **`po_pad_slider1` has no sprite** in the export and reports NOT DRAWN.
-* **All 14 are `NEVER COMPARED`** by `verify-screen` — reported, not asserted;
-  both its allowance and the reference renderer were calibrated on `GP_TITLE`.
-* The screens are static: no navigation, no focus movement, no value editing.
-
----
-
-# ✅ OPTIONS is reachable — and navigation inside it is blocked on a kind
-
-`main_menu` `ptbtn04` now has `goto: "options"`. Walked with the menu harness:
-main_menu → ⬇⬇⬇ → Ⓐ → the OPTIONS root renders. Ⓑ backs out.
-
-## ✅ RESOLVED — the rows move. `0x3003` is `0x3002` with the parent bit set
-
-The Decoder decoded it disc-wide: **bit 0 of `kind` is the PARENT FLAG**, and it
-carries no role information. Over every `.pak` in `dat/`, `kind & 1` agrees with
-"has a parent" on **15 493 elements with zero disagreements**
-(`docs/re/ui-kind-bit0-is-has-parent.md`). The OPTIONS rows are parented; the
-main-menu buttons are not. Same record class.
-
-So the detector now matches `0x3002 | 0x3003` — **two values listed, not a
-mask**. `kind & 0xFFFE == 0x3002` would also catch `0x73002`/`0x73003`, 160
-elements whose high bits nobody has decoded, silently and on screens neither
-agent has seen.
-
-**Impact measured before re-exporting, not after:** exactly two screens gain
-buttons — `options` and `options_jp`, five rows each. No existing screen changes.
-
-Verified by walking it: `main_menu` → ⬇⬇⬇ → Ⓐ → OPTIONS, then ⬇⬇ moves
-`po_menu_btn2` → `po_menu_btn3` with the focus ring rendering on the highlighted
-row.
-
-📌 **The port was right to wait.** The rejected rule — "carries a focus record ⇒
-menu item" — would have reached the same answer here by a second inference from
-structure, and would have reclassified elements on screens nobody had looked at.
-The field cost one question and needed no inference at all.
-
-## The original section, kept for the shape of the block
-
-The exporter's button detector is `kind == 0x3002 && !focused`. The OPTIONS rows
-are **`kind_raw = 0x3003`**, so `role` comes out `unknown`, the export's
-`buttons[]` is empty, and up/down move nothing.
-
-| screen | element | kind | focus record | in `buttons[]` |
-|---|---|---|---|---|
-| `main_menu` | `ptbtn01` | `0x3002` | yes | yes |
-| `extras` | `ptbtn11` | `0x3002` | yes | yes |
-| **`options`** | **`po_menu_btn1`** | **`0x3003`** | **yes** | **no** |
-
-**What `0x3003` means is not the port's to decide**, so the rule was not widened
-here. The circumstantial case is strong — five rows, each carrying a focus
-record, on a screen whose own text lists five options — and *circumstantial* is
-precisely the standard that has cost this project three separate retractions.
-Asked of the Decoder.
-
-⚠️ A tempting alternative rule is "an element with a focus record is a menu item",
-which fits both screens. It is still an inference about semantics from structure,
-and it would silently reclassify elements on every screen in the export. Not
-taken.
-
-## The workflow cost this exposed, worth knowing before repeating it
-
-**A screen name is authored data, but it only reaches the port through a full
-re-export** — which re-transcodes both movies. Renaming one screen costs the
-whole tree. Not worth fixing today; worth knowing before anyone plans a naming
-pass.
-
-## 🔴 And a genuinely dangerous mistake, recorded because it nearly cost the session
-
-Killing a background check with `pkill -f "check-all"` matched **the container's
-own entrypoint**, whose command line contains the loop prompt — and that prompt
-mentions `check-all`. `pgrep` duly reported the process as still running after it
-had stopped, and a `pkill -9` on that pattern could have killed the session
-itself.
-
-**Match a process by its actual `comm`, or list with `ps` and check, before
-sending a signal.** A pattern that appears in your own instructions is not a
-pattern that identifies a process.

docs/port/p7-gate.md

@@ -0,0 +1,95 @@
+# P7 — the new-game intro plays and returns to a defined state ✅
+
+**Status:** ✅ **gate met, with an artifact.** Run 2026-09-01 by the Port at
+`4be90c2` + this commit; HANDOFF on this branch answers `9ca1eb5`.
+
+`PORT-MISSION.md` P7: *"New-game intro video after NEW GAME | Plays, then returns
+to a defined state."*
+
+The path had been **wired** for some time — `authored/flow.json` gives `ptbtn01`
+a `then_video: "S00A"`, a `skipped_chain`, and `after_video: {goto: "title"}`,
+and `S00A.ogv` is in the export. **Nobody had run it.** A milestone is done when
+its artifact exists, not when the wiring reads correctly, and this file is the
+difference.
+
+## Pre-registered (R2)
+
+> `--menu --script=accept` with focus on `NEW GAME` announces the skipped
+> `DIFFICULTY, SELECT DATA` chain, plays `S00A`, and returns to `title`.
+> Unskipped, `S00A` is 93.78 s of media, so it should end **on its own** at
+> ≈94 s and hand off.
+
+## What happened
+
+```
+  menu on main_menu, focus ptbtn01
+script[1] accept at 1.00 s
+  (NEW GAME) -> the real chain is DIFFICULTY -> SELECT DATA, then the movie.
+               Neither screen is in this export.
+  -> video S00A at 0.97 s (/work/export/video/S00A.ogv)
+     + voice S00A
+     video ended at 94.13 s
+     -> title (authored: authored)
+  (after the movie) -> title
+  overlay press_start raised, settles at t=236
+script complete after 96.83 s on title
+```
+
+**94.13 s against 93.78 s of declared media — +0.35 s, 0.4 %.** It ends on its
+own, at the right time, and hands off. Both predictions held.
+
+Artifacts: `s_00_start.png` (main menu, `NEW GAME` focused) and `s_01_accept.png`
+(the title with the plate up) — written to the scratchpad by `--shots`, not
+committed, because they are frames of the user's own disc.
+
+## It genuinely decodes — checked, because "ends at the right time" does not prove it
+
+A player that consumed 94 s of *time* while showing one frame would also "end at
+94 s". So the frame counts, at two window lengths:
+
+| window | frames shown | of 2813 |
+|---|---|---|
+| 2.03 s | 45 | 2 % |
+| 18.91 s | **244** | 9 % |
+
+Frames scale with the window — it is decoding, not stalled. **Sub-linearly
+though**, 22.2 fps early against 12.9 fps over the longer window, and that is
+the same software fill ceiling documented in
+[`port-frame-rate.md`](port-frame-rate.md); these two runs predate the GPU.
+
+⚠️ **The counts are upper bounds and the port says so itself** — the log reads
+*"at most 244 of 2813 frame(s) shown"*. It cannot see inside `VideoStreamPlayer`,
+so it reports what it can bound rather than a number it cannot support.
+
+## A free corroboration of the fill-rate finding
+
+The unskipped run reports `main_menu: 5677 frames in 94.13 s — **60.3 fps**`.
+The screen never changes during a movie, so the rate line attributes the whole
+playback to it.
+
+**The same process, in the same container, on the same screen: 60.3 fps while a
+full-screen video texture is on top, and 9.7 fps while drawing the menu's five
+additive full-screen quads.** That is the fill-rate conclusion arriving from a
+direction it was not designed for — one large textured quad is cheap, five
+additive ones are not — and it cost nothing to obtain.
+
+## Two things this run surfaced that are not P7
+
+* 🔴 **`4 ObjectDB instances were leaked at exit`.** Godot's own warning, on
+  every run of this path. Small and at shutdown, so it costs a player nothing,
+  but it is a real signal that something in the video/overlay teardown is not
+  freed. **Not chased, recorded.**
+* 🟡 **The menu bed keeps playing under the movie.** The port prints this itself
+  and it is already an open ask — *does the menu music duck?* — in
+  `BLOCKED.md`. Left audible on purpose rather than guessed at.
+
+## What this does not claim
+
+* That the skipped chain is right. `DIFFICULTY` and `SELECT DATA` live in
+  archives this milestone does not export; the port **announces the skip** rather
+  than pretending the sequence is complete, which is the honest half of a gate it
+  cannot fully reach.
+* That `after_video: title` is what the game does. It is **authored**, and its
+  `why` says so: the game goes into Mission 1, and gameplay is out of scope
+  (`PORT-MISSION` §7). "Returns to a defined state" is the gate; `title` is the
+  state we defined.

docs/port/plate-arrival-halves.md

@@ -0,0 +1,458 @@
+# H3 — the `PRESS Ⓐ` plate: which half the lateness is in
+
+**Status:** ✅ **both halves answered, and TWO of my own conclusions on this page
+were refuted within the hour** — the `5 units/frame` reading and the claim that
+`clock: "shared"` collapses. Both are struck in place rather than deleted,
+because both were confident and both were wrong for reasons worth keeping.
+The answers are the Decoder's `h3-units-per-frame-measured.md`,
+`origin/auto/frame-blend-draw-path` at `a482d9a`.
+Written 2026-09-01 by the Port, against `export/` regenerated from this
+checkout, `HEAD` = `6db49f5` (merge of `origin/main` `1af103d` and
+`origin/human/r1-retro-tick`). HANDOFF on this branch answers `9ca1eb5`.
+
+The [play-test](../agents/PLAYTEST-2026-09-01.md) finding 3 says the plate
+arrives late and names three candidate causes: the **unit→seconds constant**
+(the Decoder's), the **clock origin** and **`rest.t`** (both ours). The brief
+asks which half it is, and how that was established. This page is the answer.
+
+> **Short version, after the answer landed.** `rest.t` and the clock origin are
+> eliminated and stay eliminated — those were the port's half and the evidence
+> below still holds. **Units per *frame* is 2, not the 5 I inferred**; my
+> derivation was sound arithmetic on an unsound premise and is struck below.
+> **The anchor is t=160**, as I suspected. And my consequent claim that
+> `clock: "shared"` therefore collapses is **withdrawn** — I computed the
+> collapse against the one number now known to be in dispute. What is left open
+> is **units per *second***, which is `2 × guest fps`, and whether the guest is
+> 30 Hz or 60 Hz is not settled by anyone. At 60 Hz the plate lands at 1.97 s
+> instead of 3.93 s, which is the size of what the human reported.
+
+## What the export actually declares
+
+`export/screens/title/press_start.json`, build 2, one element `ptbtn00`:
+
+| t | alpha | note |
+|---|---|---|
+| 0 | `0x00` | invisible, y = 560 |
+| 214 | `0x00` | still invisible, y = 550 — it has drifted up unseen |
+| **236** | `0xff` | **full** |
+| 238 | `0xff` | last opaque frame |
+| 244 | `0x00` | gone again |
+
+`rest.t = 236`. `settle_window = [214, 236, 225]`.
+
+🔴 **The corpus says the plate reaches `a=255` at `t=238`. It reaches it at
+`t=236`.** 238 is the last frame at full alpha, not the arrival. Every
+derivation quoting `238 − 118 = 120 units = 2.000 s` is really `236 − 118 =
+118 units = 1.967 s`. The port has been printing both halves of the
+contradiction in one sentence on every boot — *"plate reaches full alpha at
+t=236 … 120 units after …"* — which is what an unchecked literal beside a
+computed value looks like. Corrected in `boot.gd` and in `authored/flow.json`.
+It moves the reconciliation by 0.033 s and overturns nothing.
+
+## Candidate 1 — `rest.t`. **Eliminated.**
+
+`rest.t` cannot set the plate's arrival, because the arrival is a **declared
+keyframe**, not a rest pose. `ptbtn00` is transparent until `t=214` and opaque
+at `t=236` under its own ramp; `rest.t = 236` only chooses where `holding`
+parks it afterwards, and 236 *is* that ramp's own peak. Setting `rest.t` to any
+other value moves where the plate stops, never when it starts.
+
+Confirmed against the running port rather than by reading: see the film below,
+where the plate's onset is bracketed by the declared `t=214` with `rest.t`
+untouched.
+
+⚠️ This does **not** rehabilitate `rest.t` generally. It is still wrong for
+transients — `ptlogo_back2eff1` is a two-frame flash (0 at t52, `0xff` at
+t54–56, 0 by t58) and its `rest.t = 54` is the flash *peak*, so `rest()` leaves
+five of these burning at once. It is simply not in this defect's causal path.
+
+## Candidate 2 — the clock origin. **Eliminated, and measured.**
+
+Two things had to be true and both are:
+
+**(a) The port's two builds share one clock exactly.** `_advance` sets
+`view.time_units = 0.0` and raises the overlay in the same call
+(`_overlay_due = _elapsed`), and the sequence path assigns
+`overlay.time_units = view.time_units` outright rather than integrating a second
+delta. Verified over a filmed boot: **85 of 85 title frames have
+`view_units == overlay_units` to three decimals**, from 7.812 to 679.182. There
+is no drift and no offset to find.
+
+**(b) The title step begins when the previous step ends.** The film puts the
+video's end and the title's start at the same logged instant (7.86 s / 7.92 s
+across two runs), with no black hold between them.
+
+## Candidate 3 — the unit→seconds constant. **NOT eliminated. It is the live one.**
+
+🔴 **This section said "eliminated by sign" and that was wrong.** The argument
+was: for the port to be late the constant must be *larger* than 60 units/s,
+while the oracle presents at ~28.1 fps and the corpus measured the idle title at
+28.5 fps — both slower than nominal, so the game's units run slower, not faster.
+
+**That conflates two different quantities.** A presentation rate converts a
+*measured wall-clock duration* into units. It says nothing about **how many
+units elapse per game frame**, which is the constant in question
+(`keyframe_units_per_second`, and `keyframe_time_unit` is listed as `unresolved`
+on every screen this export emits). The correction is recorded rather than
+edited away because the elimination it produced was confident and wrong.
+
+And the Decoder's splash draw capture, landed the same day on
+`origin/auto/frame-blend-draw-path` at `3cc1b51`
+(`docs/re/data/splash-quad-timeline.txt`), gives an **independent handle on that
+constant** — from a screen with no bearing on the plate:
+
+| interval, publisher splash | guest, observed | this export, declared | units/frame |
+|---|---|---|---|
+| companion (`Q7`) onset → sharp logo (`Q0`) onset | f4 → f7, **3 frames** | t=0 → t=15, **15 units** | **5.0** |
+| companion onset → its own peak | f4 → f7 (a=240), **3 frames** | t=0 → t=15 (a=255), **15 units** | **5.0** |
+| sharp logo onset → full alpha | f7 → f10, **3 frames** | t=15 → t=30, **15 units** | **5.0** |
+
+Three intervals, three ways, **5 units per guest frame** — against the declared
+**2**.
+
+## 🔴 STRUCK. It is 2 units per frame, and my 5 was an artefact of two things
+
+Measured by the Decoder on `ptbtn00` itself — the plate, on the title, not a
+splash — in `h3-units-per-frame-measured.md` (`a482d9a`), against a
+pre-registration committed before the capture was read:
+
+```
+label   5372 5373 5374 5375 [5376] 5377 5378 [5379] 5380
+alpha     46   69   92  115    —    197  220    —    255
+step          +23  +23  +23
+```
+
+`255 × 2 / 22 = 23.18`, and the plate's declared ramp is `t=214 → 236`, i.e.
+`T = 22`. **Three consecutive gap-free steps of exactly 23 is 2.0 units per
+frame on the nose.** Their prediction was 11 frames for the ramp and it measured
+10, inside a stated ±1. My 4.4-frame prediction is excluded by more than 2×.
+
+**Why my three intervals all read 5, and why the agreement between them was
+worthless.** Two independent errors, both mine to have made:
+
+1. **An alpha step is not a clock rate.** For a linear segment,
+   `Δα per frame = 255 × (units per frame) / T`. Two elements with different
+   declared segment lengths `T` show different `Δα` at an *identical* clock.
+   Splash B's quads step 34 with `T=15`; the plate steps 23 with `T=22`; both
+   are 2 units/frame. Reading a step as a rate is what produced the 2.7×.
+2. **My "onsets" were not onsets.** I took each quad's *first submission* as its
+   `α = 0` time. On splash A, `Q7` and `Q0` are both already at **α = 85** when
+   first submitted. So all three intervals started late — and by a *different*
+   amount per element, because the bias scales with `T`. That the three then
+   agreed with each other is not corroboration; they share the error.
+
+The three "independent" intervals were one measurement made three times with the
+same two biases. That is the shape I should have checked for and did not.
+
+⚠️ The Decoder records the published `splash-quad-timeline.txt` having no `T`
+column as their own defect, now fixed. That does not make the inference mine any
+less: **the arithmetic was sound and the premise was not, and a premise handed
+to me is still a premise I used.**
+
+⚠️ **Two caveats, and they are why this is asked rather than acted on.** The
+capture's frame index **skips** — 5, 8 and 12 are absent from Q7's eight draws —
+and whether those are frames where the quad was genuinely not submitted or
+presents the logger dropped changes the arithmetic. And the present rate during
+a splash is not established.
+
+### 🔴 And it collides with the oracle's own plate measurement
+
+The two captures cannot both be read at face value:
+
+| capture | implies |
+|---|---|
+| `title-plate-delay-measured.md` — 118 units in 2.135 s | **~55 units/s** |
+| `splash-quad-timeline.txt` — 15 units in 3 frames | **~150 units/s** at 30 fps |
+
+A factor of **2.7** between two measurements taken off the same game by the same
+agent, on two different screens. Either the two screens' keyframes are in
+different units, or one of the two readings has an anchor wrong — which is the
+same shape as the `t=118` / `t=160` question below. **Both are oracle
+measurements and neither is the port's to resolve.** Asked in
+[`BLOCKED.md`](BLOCKED.md) H3.
+
+## The film — and the instrument had to be fixed first
+
+`--film` scheduled frame `n` for `n × interval` and reported nothing. One
+1280×720 `save_png` under llvmpipe costs ~0.24 s, so **a request for 0.05 s
+delivered 247 frames in 60 s where 1 200 were asked for** — an achieved 4.1 fps
+against a requested 20 — and the deficit accumulated silently into the frame
+index. `f_071.png` still looked exactly like the frame that was meant to be
+3.55 s in.
+
+[`TEMPORAL-VERIFICATION.md`](../agents/TEMPORAL-VERIFICATION.md) §1 is explicit
+that this is not a slow capture but a *different* one, and that an instrument
+which cannot report its own completeness may not be trusted (R3). So `--film`
+now writes `<film>_frames.tsv` — one row per frame carrying the elapsed second
+it was **actually** taken at, the second it was **requested** for, the lag
+between them, and both builds' clocks — appended and flushed as it goes, so a
+run killed by `timeout` still leaves a complete index. It prints the achieved
+rate against the requested one every 40 frames. The schedule is deliberately
+**not** rebased onto `_elapsed`: catching up would hide the shortfall, which is
+the defect.
+
+The run this page rests on: requested 20 fps, **achieved 15.9 fps for the first
+120 frames and 11.3 fps by frame 200**, lag reaching 8.7 s. Stated because the
+numbers below are quoted against `view_units` — the port's own timeline, which
+the index records per frame — and never against a wall-clock instant.
+
+### Pre-registered, before looking (R2)
+
+> Filming the boot, measured from the frame the title step begins, the plate
+> region stays at its background floor until **t=214**, rises over **22 units**,
+> and plateaus at **t=236**. Accept ±2 frames at each end.
+
+### What it did
+
+Region = the plate's own quad, x 127–640, y 525–575 (`pos [383,550]`,
+`pivot [256,25]`, sprite 513×50). Mean of the crop, one row per filmed frame:
+
+| `view_units` | region mean | |
+|---|---|---|
+| 7.8 → 143.8 | 0.13765, **flat to 5 decimals** | nothing there |
+| 151.9 → 207.8 | 0.13773 → 0.14341 | a slow 4 % drift, build 4's own |
+| **207.8 → 215.3** | 0.14341 → **0.15348** | ⬅ the step; brackets the declared **214** |
+| 215.3 → 239.8 | → 0.21254 | the ramp |
+| 239.8 → 279.3 | → 0.24766 | plate full at 236; the rest is `ptbtn00f` |
+
+The onset is bracketed between 207.8 and 215.3 at a frame spacing of ~7.5 units,
+i.e. **within one frame of the declared 214**, and `rest.t` was never touched.
+Prediction held.
+
+After 236 the region keeps oscillating — peaks near `u` 279 and 407, troughs
+near 343 and 479, a period of **~128 units** against `ptbtn00f`'s declared
+`loop_length_units = 120`. That is the focus glow looping, not the plate, and it
+is an ordering-and-period check that survives the drifting capture rate.
+
+## So where the port lands against the oracle
+
+`docs/re/title-plate-delay-measured.md` is **not in this checkout** — it is on
+`origin/auto/no-disc-and-menu-captures`, added at `fb536df` and cited by
+`authored/flow.json` at `5b0a6e6`. Read there:
+
+| | run 1 | run 2 | **the port** |
+|---|---|---|---|
+| settled → plate | 2.138 s | 2.132 s | **1.967 s** (118 units at 60/s) |
+| first drawn → plate | 3.781 s | 4.263 s | **3.933 s** (236 units) |
+
+On the interval the oracle measured deliberately, the port is **0.17 s early**.
+On the interval the oracle explicitly says not to use, the port sits **between
+the two runs**. No number anyone has taken makes this port's plate late.
+
+**The human watched both and says late, and that observation stands.** At
+60 units/s the port reproduces every figure the plate capture carries — which is
+the point: *reproducing that capture is not the same as being right*, because
+the splash capture says the unit is 2.5× off and would put the port 2.4 s late.
+The two cannot both hold. The human's eye agrees with the splash capture.
+
+## 🔴 WITHDRAWN: my claim that the t=160 anchor collapses `clock: "shared"`
+
+The section below asked which anchor the glyph counter corresponds to and said,
+of the t=160 answer, *"the shared-clock premise does not reproduce the
+measurement at all and `clock: "shared"` is open"*. **The Decoder answered
+t≈160–176 — candidate B — and then repeated my consequence back to me**, noting
+correctly that what it costs the port's model is the port's problem and not
+evidence against their measurement.
+
+**They were right to report it and I was wrong to have claimed it.** I computed
+the collapse by comparing the declared 76 units against **2.135 s**, and 2.135 s
+is the single number the same page identifies as in dispute — their two captures
+disagree about frames→seconds by ~2.9×. *Falsifying a model with the quantity
+that is itself under dispute* is the error, and it is the second time on this
+page I reasoned confidently from a premise I had not checked.
+
+Against the **new** capture, in its own labels rather than in seconds,
+shared-clock holds:
+
+| declared, shared clock | capture | at the plate ramp's own measured 2.2 units/label |
+|---|---|---|
+| `ptcopyright` full (t=160) → plate α=0 (t=214) = **54 units** | 5350 → 5370, **20 labels** | 44 units |
+| `ptcopyright` full (t=160) → plate α=255 (t=236) = **76 units** | 5350 → 5380, **30 labels** | 66 units |
+| the plate's own ramp (t=214 → 236) = **22 units** | 5370 → 5380, **10 labels** | — (this is the calibration) |
+
+Both intervals come out **short of declared by 13–19 %, in the same direction**,
+against a claimed collapse of ~1.7×. And the residual has a named candidate the
+Decoder supplies: **empty labels advance the clock by more than one step**, they
+are about one label in five, and the two intervals contain different fractions of
+them (3 of 20, and 6 of 30). Modelled with empties carrying ~4 units the two
+reconstruct at 46 and 72 against 54 and 76.
+
+**So `clock: "shared"` is not falsified and the port keeps it.** It is not
+*confirmed* to better than ~20 % either, and this page does not claim that. What
+it is no longer is "collapsed on the port's own account".
+
+## A second anchor question, also the Decoder's — ✅ ANSWERED: it is t=160
+
+**What does the oracle's "title settled" correspond to on the declared
+timeline?** It is defined operationally — *"glyph counter first reads its
+no-plate value 154"* — and our export offers **two** anchors, 42 units apart:
+
+| anchor | what it is | settled → plate | vs measured 2.135 s |
+|---|---|---|---|
+| **t = 118** | `pteff01`, `pteff02`, `ptlogoall_eff` end their ramps together | 118 units = 1.967 s | −8 % |
+| **t = 160** | `ptcopyright` reaches full alpha — the **last** element to finish building in, and the only one made of **glyphs** | 76 units = 1.267 s | −41 % |
+
+The port's reconciliation picked 118. The port's own `settle_time()` returns
+**160** and the boot prints `settles at t=160` — so the two notions disagree
+inside one binary. And the oracle's anchor is a *glyph* counter, while the thing
+that finishes at 160 is a *line of text*.
+
+If the anchor is 160, the shared-clock premise does not reproduce the
+measurement at all and `clock: "shared"` in `authored/flow.json` — which the
+port authored from arithmetic and nobody has ever measured — is open. If it is
+118, the reconciliation stands and H3 is not a timing defect.
+
+**Answered from the draw stream** (`a482d9a`): `ptcopyright` reaches α=255 at
+label 5350, which calibrates to **t ≈ 168** on the plate's own ramp (t ≈ 176 at a
+flat 2.0/label). Candidate B is 8–16 units away; candidate A is 50–58. It is B.
+
+📌 And a caution from the same stream that this port should hold onto: **the
+sweep leaves never settle.** The two off-screen-wide quads translate
+monotonically through every label examined and are still moving when the plate
+arrives. *"The title has settled"* can only ever mean **the build-in elements
+have finished**, never *the screen has stopped changing* — which is the same
+distinction that `rest.t` keeps getting wrong.
+
+### 🔴 ALL FOUR NAMED CAUSES ARE NOW DEAD, AND THE HUMAN'S OBSERVATION IS NOT
+
+**The rate is measured: 56.8 units per guest second** (`units-per-second-measured.md`,
+control passing at 1.15 %, two elements agreeing at one clock — `ptbtn00` at
+657.9 α/s and `ptcopyright` at 650.4 α/s, which puts `ptcopyright`'s segment at
+`T = 22.25`, a round declared length nobody fitted). **30 and 120 are both
+excluded.**
+
+At 56.8 units/s the plate's `t = 236` lands at **4.15 s** after clock zero,
+against the port's **3.93 s**. The port is fractionally **early**. So:
+
+| candidate | verdict |
+|---|---|
+| `rest.t` | eliminated — the arrival is a declared keyframe |
+| clock origin | eliminated — 85/85 frames share one clock |
+| the anchor (t=118 vs t=160) | answered: t=160, and `clock: "shared"` survives it |
+| **the unit→seconds constant** | **eliminated — 56.8 measured; the port is early, not late** |
+
+**Nothing named in the play-test explains what the human saw, and this page says
+so rather than quietly closing H3 green.** The observation stands and is now
+unattributed. Two things it could still be, neither of them the plate's own
+timing and neither established here:
+
+* **what "late" was measured against.** Every number above is relative to the
+  title's clock zero. A player experiences the plate relative to the *boot*, and
+  the port's boot reaches the title at 7.86 s only because `--skip-at` presses Ⓐ.
+  🔴 **On the play-test build Ⓐ was not bound to the pad at all**, so that human
+  could not skip the 137 s intro — the run they judged is not the run any of
+  these measurements describe.
+* **the splash dwells.** The rate's reach is the **title**. The splashes are a
+  different `GamePart` and nothing yet shows they tick at 56.8; the Decoder has
+  reading their `T` off the disc as a next item.
+
+### The route that is dead regardless
+
+🔴 **`units = 2 × frames` must not be used anywhere.** The same animation takes
+21 frame labels in one capture and 33 in another, and a splash logo steps
+`+136,+34` in one run and `+17,+51,+34,+34,+17,+17` in the other; a fixed
+per-frame increment cannot do that. The 2 was one run's frame pacing.
+
+✅ **Audited, and the port never did this.** `boot.gd` advances
+`time_units += delta * units_per_second` off delta time. The retirement cost this
+port a *justification* in `authored/timing.json`, not a behaviour — and the
+justification's second leg (12 declared units against a 0.14–0.30 s measured
+black plateau, 40–86 units/s, no frames in the chain) never depended on it.
+
+### What was still open, before the rate landed
+
+`units/second = units/frame × guest fps`. The first factor is now **2**. The
+second is not established: **2 × 30 = 60** (what this port uses) and
+**2 × 60 = 120** (which puts the plate at **1.97 s** instead of 3.93 s — the size
+of what the human reported). The Decoder's capture ran at 27.2 labels/s, which is
+Canary's presentation rate and cannot separate a 30 Hz guest at full speed from a
+60 Hz guest at half. **They asked the port not to change 60 units/s on their
+account yet, and it has not.** Asked in [`BLOCKED.md`](BLOCKED.md) H3.
+
+## Refutation attempts this iteration
+
+| claim | whose | outcome |
+|---|---|---|
+| the title's settle window is `[160, 236]` | Decoder, `5b0a6e6` | ✅ **survived** — our exporter still computes `[160, 236, 198]` under the corrected record layout |
+| *"`ptlogo1` rests at t=251 and stops moving at t=42"* | Decoder, `5b0a6e6`, and the headline evidence for `rest.t ≠ settle` | ❌ **refuted on its evidence** — in the current export `ptlogo1.rest.t` is **42**, equal to when it stops moving. The record-layout fix repaired exactly this element. The *conclusion* survives on other elements (`ptlogo_back2eff1`, `pteff00`); the example no longer supports it |
+| *"`ptbtn00` reaches a=255 at t=238"* → `120 units` | the Port's own | ❌ **refuted** — 236, so 118 units |
+| *"build 4 is still fading up from black until t=261; `pteff00` is 7 % opaque at 243"* | the Port's own | ❌ **refuted** — `pteff00` is opaque at t=0, clear by **t=16**, transparent until 261, then fades **to** black by 269. At t=243 it is 0 % opaque. The comment had the direction backwards |
+
+## What this does not settle
+
+* Whether the human's "late" is a real offset the corpus has not measured. It
+  is not reconciled by anything here, and no measurement contradicts it either.
+* The `t=118` / `t=160` anchor. Asked, not guessed.
+* Whether the plate **pulses** after arrival. The port holds it; the corpus
+  measures a ~2.24 s pulse. Filed already in `flow.json`'s `no_pulse_why`.
+* Finding 4 (the splash fade/blur) is the Decoder's this iteration — it said so
+  on the message channel and is on `auto/frame-blend-draw-path`.
+
+
+---
+
+# The splash blur is an ASSET, not a pass — and this port already draws it
+
+Added the same iteration, after the Decoder answered play-test finding 4 from
+GPU state (*no post-process on either splash*, `auto/frame-blend-draw-path` at
+`3cc1b51`) and the human added the observation that **the logos go from blurred
+to clear/sharp, in about one second**.
+
+Those two are not in tension. They resolve each other:
+
+> **Every logo ships a second, pre-blurred copy of itself, ~21 × 20 px larger
+> and concentric, which is drawn alone first and crossfades out as the sharp
+> logo fades in.** That is "blurred → sharp" with no post-process pass, no
+> blur shader and no second render target.
+
+Measured off `export/sprites/title/`:
+
+| logo | sharp | companion | position offset | concentric? |
+|---|---|---|---|---|
+| `palogo_gamearts` | 500 × 71 | 521 × 91 | (−11, −10) | ✅ |
+| `palogo_seta` | 240 × 89 | 261 × 110 | (−10, −11) | ✅ |
+| `palogo_anima` | 388 × 136 | 407 × 156 | (−11, −9) | ✅ |
+| `palogo_sqex` | 666 × 68 | 686 × 89 | (−10, −11) | ✅ |
+
+## 🔴 "The port applies no blur at all" is false, and it came from this page's own side
+
+[`BLOCKED.md`](BLOCKED.md) H2 and the play-test both record *"The port draws the
+splash from the declared keyframe alphas only. It applies **no blur at all**."*
+The port does not apply a post-process blur — but it draws all seven quads of
+the developer splash including the three blurred companions, and it has been
+doing so all along. A frozen sweep across the build-in, one deterministic
+capture every 3 units (the human's "take a series of quick screenshots within
+the short animation span", done without a clock at all):
+
+| `t` | units | drawn |
+|---|---|---|
+| 0.00 s | 0 | background only |
+| 0.05 – 0.25 s | 3 – 15 | background + **the three blurred companions alone** |
+| 0.30 – 0.70 s | 18 – 42 | **all seven** — the crossfade |
+| 0.75 – 0.80 s | 45 – 48 | background + the three sharp logos |
+
+Blurred first, then both, then sharp. The mechanism is reproduced. The claim
+that it was not came from describing the renderer instead of running it.
+
+## Cross-check of the Decoder's quad mapping — ✅ survived, independently
+
+`splash-quad-timeline.txt` names its quads by NDC rectangle off the guest's
+vertex stream. This export's declared rectangles, converted independently:
+
+| | this export | the guest | agreement |
+|---|---|---|---|
+| `palogo_sqex` | x[−0.517, +0.523] y[−0.106, +0.083] | `Q0` x[−0.520, +0.520] y[−0.100, +0.080] | **~2 px** |
+| `palogo_sqex_eff` | x[−0.533, +0.539] y[−0.133, +0.114] | `Q7` x[−0.530, +0.540] y[−0.130, +0.120] | **~4 px** |
+
+Two decoders, two paths — a `.pak` read statically and a vertex stream logged
+live — agreeing to a few pixels on both the sharp quad and the blurred one.
+That is corroboration of the mapping and of `Q7` being the companion.
+
+## What is still open on the splash
+
+* **The extent.** The rectangles agree; the *alphas* are where the 5-units-per-
+  frame discrepancy above came from, and until that is settled it is not
+  possible to say whether the game holds the blurred copy longer than we do.
+  That is the same question as H3 and is asked once, there.
+* Whether `palogo_eff0` (kind `0x10`, a full-screen quad, like the title's
+  `pteff00`) is the splash's fade veil. Not examined this iteration.

docs/port/plate-arrives-on-time-but-never-blinks.md

@@ -0,0 +1,120 @@
+# H3 re-asked after the animation fix: the plate is **on time**, and it **never blinks**
+
+**Status:** ✅ **the "arrives late" observation does not reproduce as a timing
+error** — measured on the current build, and the plate's onset sits on its
+declared keyframe. 🔴 **A different divergence in the same element is real and
+was not being looked for: the port holds `PRESS Ⓐ` lit permanently, where the
+disc declares a 30-unit pulse.** Written 2026-09-02 by the Port at `6263686`.
+
+`PLAYTEST-2026-09-02.md` asks for exactly this, in its own words: *"Worth
+re-asking now: the animation fix changed what the whole boot looks like, so the
+original observation may simply no longer reproduce."* And there is a specific
+reason to re-ask rather than assume — **the previous plate numbers were taken
+through the `pose_at` bug**, the same way the 0.01 % that manufactured H2's false
+green was.
+
+## What the disc declares
+
+`export/screens/title/press_start.json`, one element `ptbtn00`:
+
+```
+0:0   214:0   236:255   238:255   244:0        rest [383,550], sprite 513x50
+```
+
+Invisible until **214**, full at **236–238**, **gone by 244**. A 30-unit pulse.
+
+## The instrument, and the two controls it went through first
+
+Filmed a real boot (`--skip-at=1 --linger=8 --film-interval=0.05`), no `--time`,
+no pinning. Then **two attempts at isolating the plate failed before one worked**,
+which is the part worth keeping:
+
+1. 🔴 **A rect around the plate.** Contaminated — the rect overlaps the developer
+   splash earlier in the boot, so the onset detector fired on the wrong screen.
+2. 🔴 **A control band 55 px above the plate.** Still wrong. The title's
+   background sweep **moves**, so a spatially displaced control samples it at a
+   different phase and cannot cancel it. It showed a "rise" that was the sweep.
+3. ✅ **The plate sprite's own transparent holes.** Same rectangle, same rows,
+   interleaved with the glyphs at pixel scale — 7 672 glyph pixels against 10 412
+   hole pixels, both built from the sprite's alpha channel. A co-located
+   background sample, so `glyph − hole` is the plate and nothing else.
+
+⚠️ Control 2 is the same defect as everything else on this project: **an
+instrument that cannot see the thing it is measuring separately from the thing
+it is measuring against.** It produced a plausible curve. The tell was that the
+"plate" and the background rose together in phase.
+
+## Result 1 — the arrival is correct
+
+`glyph − hole`, dark baseline **0.003**:
+
+| overlay units | 205 | **214** | **222** | 230 | **238** | 246 |
+|---|---|---|---|---|---|---|
+| plate | 0.005 | **0.005** | **0.222** | 0.434 | **0.586** | 0.601 |
+
+**Flat through 213.9 and risen by 222.1.** The declared onset `t=214` sits inside
+that bracket, and the bracket is 8 units wide because that is the film's sampling
+interval, not a measurement of anything. By `t=238` the plate is at 88 % of its
+lit level, against a declared full alpha at 236.
+
+**The plate is not late.** Whatever the human saw in the 2026-09-01 play-test,
+the port's own clock puts `ptbtn00` on its declared keyframe.
+
+## Result 2 — 🔴 and it then stays lit forever
+
+The declared ramp returns to **0 at t=244**. It does not:
+
+| | |
+|---|---|
+| dark baseline, `t < 214` | **0.003** |
+| minimum at any point after `t = 250` | **0.587** (at `ou` 342) |
+| maximum after `t = 250` | **0.664** |
+| span measured | `ou` 6 → **1974** — **8.1 declared cycles** |
+
+Over eight cycles of its own declared timeline the plate **never returns within
+88 % of dark**. The 11.6 % ripple that is there is *not* the plate: it is in
+phase with the hole channel, i.e. it is the title's background sweep leaking
+through the anti-aliased glyph edges.
+
+### Why, and it is a failure mode this port already wrote down
+
+`ptbtn00`'s `rest.t = 236` and its settle instant is `t=236` — **the peak of the
+pulse**. `holding` parks the element there, so the port shows a `PRESS Ⓐ` plate
+that lights once and stays on.
+
+`plate-arrival-halves.md` names this exact class already, about a different
+element:
+
+> *"It is still wrong for transients — `ptlogo_back2eff1` is a two-frame flash
+> (0 at t52, `0xff` at t54–56, 0 by t58) and its `rest.t = 54` is the flash
+> **peak**, so `rest()` leaves five of these burning at once."*
+
+**The plate is an instance of the family that page predicted, and nobody had
+checked the plate itself** — because that page was written to *eliminate* `rest.t`
+as a cause of lateness, which it correctly did, and having eliminated it as the
+cause of *one* defect nobody asked what else it was doing.
+
+## What I have NOT changed, and why
+
+Nothing. The port still holds the plate.
+
+Reading the disc's keyframes is mine; **whether the running game pulses its
+`PRESS Ⓐ` plate is not.** The keyframes describe a blink and blinking is what
+`PRESS START` prompts conventionally do, but "conventionally" is not evidence and
+this project has been burned by exactly that kind of inference. The change is
+**proposed, not made**, and the Decoder has been asked for the one fact that
+settles it: does the plate pulse in the guest, and with what period?
+
+⚠️ **This is not a regression from the animation fix.** Before the fix `pose_at`
+*assigned* the settle instant, which parks the plate at `t=236` too. The plate
+has been held for as long as the port has drawn it; the fix neither caused this
+nor was supposed to.
+
+## What this does not claim
+
+* That finding 3 was wrong when it was made. It says the port measures on time
+  **now**, on a build whose boot the fix visibly changed.
+* That holding is wrong. It says the port's picture and the disc's keyframes
+  disagree, and names who can adjudicate.
+* Anything about the plate's **absolute** alpha or position. Onset timing and
+  whether it extinguishes, only.

docs/port/port-frame-rate.md

@@ -0,0 +1,290 @@
+# The port never reported its own frame rate — it does now, and it is 13–25 fps here
+
+**Status:** ✅ **instrument added and measured.** ❌ **The candidate it raised for
+play-test finding 4 is DEAD — tested on real hardware, not argued away. See the
+final section.** The port's draw path never had a case to answer. Written 2026-09-01 by the Port at
+`977965e`; HANDOFF on this branch answers `9ca1eb5`.
+
+## The gap this closes
+
+[`TEMPORAL-VERIFICATION.md`](../agents/TEMPORAL-VERIFICATION.md) §1 is
+unambiguous: a capture that asked for one rate and delivered another *"is not a
+slow capture, it is a **different** capture"*, and an instrument that cannot
+report its own completeness may not be trusted.
+
+That rule has been applied to `--film` (which I fixed for exactly this), to the
+Decoder's harnesses, and to the oracle. **It had never once been applied to the
+thing being shipped.** The port had no idea what rate it drew at and no way to
+say.
+
+It matters here specifically, because the splashes are the current focus and the
+open complaint about them is that ours is *less pronounced* than the game's.
+**A fade drawn in 45 frames and the same fade drawn in 12 are different
+animations**, and nothing in this port could have told them apart.
+
+## The instrument
+
+`boot.gd` now counts frames per screen and prints at every boot transition, at
+the end of the boot, and at every menu arrival:
+
+```
+     publisher_logo: 107 frames in 4.29 s -- 25.0 fps achieved, uncapped, worst gap 108 ms
+```
+
+`worst gap` sits beside the mean deliberately: a hitch is what reads as wrong. A
+screen averaging 55 fps with one 400 ms stall looks broken, and a mean hides that
+by construction.
+
+🔴 **Its first version printed `-9223372036854775808 requested`.**
+`DisplayServer.screen_get_refresh_rate()` returns a *float* and is `-1.0` when
+the display cannot say — which Xvfb cannot — and `%d` on that underflows to
+`INT64_MIN`. A rate line whose own denominator is nonsense is worse than no rate
+line. It now names the cap or says `uncapped`.
+
+## What it measures, in this container
+
+Three boots, same command, nothing else running:
+
+| screen | run 1 | run 2 | run 3 | worst gap |
+|---|---|---|---|---|
+| `publisher_logo` | 17.3 fps | 19.6 | 25.0 | 100–115 ms |
+| `developer_logos` | 16.7 | 21.9 | 22.8 | 103–138 ms |
+| `title` | 17.2 | 14.2 | 12.7 | **150 ms**, all three |
+
+**13–25 fps, varying by ~2× run to run, with hitches of 100–150 ms.** The
+title's 150 ms is identical across all three runs, which looks like a one-off
+cost rather than load — the video player is torn down immediately before it.
+
+### 🔴 And the menu is worse than any of them
+
+The report was **boot-only** on its first version and said so nowhere — the boot
+walks through `_advance`, while `--menu` arrives through `_menu_arrive`. So the
+mode a human actually spends time in, and the one where a slow frame is *felt as
+input lag* rather than seen as a coarse fade, reported nothing. An instrument
+covering half the application while its own page claims "every boot" is exactly
+the shape this port keeps finding in other people's work. Fixed in the same
+commit:
+
+```
+     main_menu: 20 frames in 2.05 s -- 9.7 fps achieved, uncapped, worst gap 150 ms
+```
+
+**9.7 fps.** The main menu is the heaviest screen in the port — five additive
+elements, five spinning focus rings, a full-screen background — and it is the one
+the play-test spent its time on. At 9.7 fps a press takes up to 103 ms to appear
+and a spinning ring advances in ~10 visible steps per revolution.
+
+⚠️ **This is `llvmpipe` software rasterisation under Xvfb in a loaded container.
+It is not a measurement of the human's hardware and must not be quoted as one.**
+What it establishes is that the port *can* run this slowly and never said so.
+
+## The consequence, and why it is a live candidate for finding 4
+
+The port's timeline is driven by `time_units += delta * units_per_second`, so
+**the durations stay correct at any frame rate** — the fade still takes 0.75 s.
+What changes is how many distinct alphas that fade is *drawn* at:
+
+| rendered at | steps in the 45-unit build-in | steps in the glow's 15-unit rise |
+|---|---|---|
+| **16.7 fps (measured)** | **12.5** | **4.2** |
+| **22.8 fps (measured)** | **17.1** | **5.7** |
+| 30 Hz | 22.5 | 7.5 |
+| 60 Hz | 45.0 | 15.0 |
+
+The pre-blurred companion glow — the thing that *is* the splash's blur — rises
+over 15 units. **In this container it is drawn at four to six distinct alphas.**
+At 60 Hz it would be fifteen.
+
+A soft crossfade rendered in four steps, inside a 750 ms animation carrying a
+100–150 ms hitch, is a plausible mechanism for *"close, but not quite right"* and
+for *"the game's is more pronounced"* — and it is the **first candidate for
+finding 4 that is not already dead.** Every other one is: the keyframes are
+vindicated against the vertex stream, the companion quads are drawn, the blend
+space matches, the settled pose scores 0.01 % against the capture, and there is
+no post-process pass to add.
+
+🔴 **It is a candidate, not a cause.** It depends entirely on what the machine
+running the port manages, and I cannot measure the human's. **The line now
+prints on every boot**, so the next play-test answers it for free: if it says 60
+fps and the splash still looks wrong, this is dead too.
+
+## What is NOT affected, and it was worth checking
+
+**Every timing result this port has published stands.** They are all derived from
+`_elapsed`, which is `+= delta` — a sum of frame times, correct at any rate — and
+from `time_units`, which is the same sum scaled. So:
+
+* the splash dwells (4.270 s and 3.527 s) are unaffected — measured across runs
+  whose frame rates differed by 2×, and they agreed to ±0.03 s;
+* the plate's arrival, the shared-clock check and the film's own index are all
+  `_elapsed`-based.
+
+That is the reassuring half of the same design: the port is *correct* at 13 fps
+and merely *coarse*. Had the timeline been frame-counted, every number in this
+corpus would have been wrong by a factor that changed between runs — which is
+precisely the failure the Decoder found in the emulator's own rate and withdrew a
+finding over.
+
+## What this does not claim
+
+* That 13–25 fps is what a player sees. It is what this container manages.
+* That the port has a performance defect. Textures are cached at `load_screen`
+  and not decoded per frame — that was checked and is not the cause.
+* That capping or vsyncing would help. It would not raise the rate here, and
+  changing presentation behaviour on my own authority is not mine to do.
+
+
+---
+
+# The control: it is the software rasteriser, and the port has no case to answer
+
+Written the iteration after the section above, because *"is 9.7 fps llvmpipe or
+something in our draw path"* was left open and it is not a question to leave open
+after publishing a candidate cause.
+
+## Pre-registered (R2)
+
+> If the rasteriser is the limit, a near-empty Godot scene in this same container
+> will also run at roughly 10–25 fps. If my draw path is the limit, it will run
+> far faster — take **>100 fps** as the discriminator.
+
+Same container, same Xvfb, same 1280×720 viewport, same `[rendering]` settings,
+almost nothing drawn:
+
+```
+FPSPROBE mode=empty: 651 frames in 4.03 s -- 161.6 fps, worst gap 54 ms
+```
+
+**161.6 fps.** The engine loop, the viewport and the present path are not the
+limit, by a factor of sixteen over the menu.
+
+## 🔴 And the first control was not a control
+
+Its `fill` modes drew **untextured** `draw_rect`s while every element the port
+draws is a **texture**. A control that does not do what its subject does bounds
+nothing — and it showed: the port's splashes were achieving ~21 Mpx/s against
+that control's ~50, which read as the port being mysteriously slow and was really
+the control being mysteriously fast. Adding a matched textured mode:
+
+| mode | full-screen quads | achieved |
+|---|---|---|
+| `empty` | 0 | **161.6 fps** |
+| `fill3` | 3, untextured | 31.5 |
+| **`tex3`** | **3, textured** | **23.9** |
+| `fill7` | 7, untextured | 12.7 |
+| **`tex7`** | **7, textured** | **11.2** |
+
+## The port sits inside the bracket, ordered by large-quad count
+
+| screen | full-screen-ish quads | measured | bracket |
+|---|---|---|---|
+| `publisher_logo` | 1 | 17.3–25.0 | ≈ `tex3` |
+| `developer_logos` | 1 | 16.7–22.8 | ≈ `tex3` |
+| `title` | 6 | 12.7–17.2 | between `tex3` and `tex7` |
+| **`main_menu`** | **5** | **9.7** | ≈ `tex7` (11.2) |
+
+**Every screen lands between the two matched controls, in the order the quad
+count predicts.** The port is drawing large textured alpha quads on a software
+rasteriser at exactly the rate a software rasteriser draws large textured alpha
+quads.
+
+⚠️ Note the control's own spread: `fill3` measured **18.0** on one run and
+**31.5** on another. The container's load swings by ~1.75×, so the absolute
+numbers here are noise-dominated and only the **ordering and the bracket** are
+load-invariant — which is what `TEMPORAL-VERIFICATION.md` §3 says to prefer, and
+the reason this conclusion rests on those rather than on any single figure.
+
+## 🔴 So the finding-4 candidate is downgraded, and I am saying so plainly
+
+The section above called the frame rate *"the first candidate for finding 4 that
+is not already dead"*. **That now looks wrong, and it was mine.**
+
+The quantisation argument still holds — a fade drawn in four steps is not a fade
+drawn in fifteen — but it only bites at these frame rates, and these frame rates
+are a property of **software rasterisation in this container**. Five to seven
+full-screen quads at 720p is nothing to any GPU; on real hardware the port would
+hit vsync and the fade would get its full 45 steps.
+
+So unless the human ran the port software-rendered, this is not what they saw,
+and **every candidate for play-test finding 4 is now dead or near-dead.** That is
+an honest dead end rather than a lead, and it is written as one: leaving a
+plausible-sounding cause standing when its own control has undercut it is exactly
+how *"close but not right"* got explained four different wrong ways.
+
+**The one thing that would revive it costs the human nothing**: the rate line now
+prints on every boot. If their next run says 60 fps, this is finished.
+
+## What the port does NOT need
+
+* No draw-path optimisation. 161.6 fps empty says the loop is fine, and the
+  screens sit on the fill curve exactly where their quad counts put them.
+* No texture caching work — already done at `load_screen`, checked last
+  iteration.
+* No `max_fps` or vsync change. It would not raise the rate here, and it is a
+  presentation decision rather than a defect.
+
+
+---
+
+# ❌ Settled on hardware: 60–69 fps, and the candidate is dead
+
+The human activated a **hardware GPU** in both containers on 2026-09-01, which
+made the one open half of this page directly testable. Godot picks it up with no
+change on our side:
+
+```
+Vulkan 1.4.312 - Forward+ - Using Device #0: NVIDIA - NVIDIA GeForce GTX 1070 Ti
+```
+
+## Pre-registered (R2)
+
+> Five to seven full-screen textured quads at 720p is trivial for that card. I
+> expect the port well above 60 fps on every screen, and the splash fade to get
+> its full 45 steps.
+
+| screen | llvmpipe (before) | **GPU (after)** | worst gap |
+|---|---|---|---|
+| `publisher_logo` | 17.3–25.0 | **69.4** | 83 ms |
+| `developer_logos` | 16.7–22.8 | **69.1** | 15 ms |
+| `title` | 12.7–17.2 | **61.1** | 67 ms |
+| **`main_menu`** | **9.7** | **59.6** | 117 ms |
+
+**A 3–6× jump, and every screen is now at or above 60 fps.** The prediction held.
+
+## What that does to the fade
+
+| animation | declared | steps drawn at 69 fps |
+|---|---|---|
+| splash build-in, 45 units = 0.750 s | 45 alphas | **52** |
+| companion glow's rise, 15 units = 0.250 s | 15 alphas | **17** |
+
+**More frames than declared units, so every declared alpha is drawn.** The
+quantisation this page raised does not exist on this hardware — not reduced,
+*absent*.
+
+## ❌ So the candidate is dead, and it died the right way
+
+It was raised as a mechanism, downgraded by a matched control, and is now closed
+by a direct measurement on the hardware in question. **Every candidate for
+play-test finding 4 is now dead**: the keyframes are vindicated against the
+vertex stream, the pre-blurred companion quads are drawn, the blend space
+matches, the settled pose scores 0.01 % against the capture, there is no
+post-process pass, and the frame rate draws every declared step.
+
+🔴 **The port has nothing left that is known to be wrong about the splashes, and
+that is a statement about our knowledge rather than about the port.** The human
+saw something. Nothing we can measure reproduces it.
+
+**The next play-test is now the highest-value thing available on this focus**,
+and it is cheap: the rate line prints on every boot, so it will say 60-something
+rather than 10-something, and whatever remains will be visible against a port
+that is no longer coarse.
+
+## The one figure that did not improve
+
+`main_menu`'s **worst gap is 117 ms** on the GPU against 150 ms on llvmpipe —
+essentially unchanged while the mean improved 6×. A hitch that survives a 6× fill
+speed-up is not fill. It is most likely first-frame cost (texture upload, shader
+compilation) and it sits at the start of the screen, but that is **stated as
+untested**: nobody has separated it from load. It is small, it is once per
+screen, and it is recorded rather than chased.

docs/port/rest-fallback-reaches-nothing.md

@@ -0,0 +1,87 @@
+# The re-opened `rest()` pair cannot change a single pixel this port draws
+
+**Status:** ✅ **measured, and it bounds a question rather than answering it.**
+Written 2026-09-01 by the Port at `94e44b5`; HANDOFF on this branch answers
+`9ca1eb5`.
+
+The loop brief carries a standing warning: the **`rest()` pair is open in both
+directions**, and *"the two splashes are the only screens reaching that
+fallback."* R1 re-opened both legs, and 8 further claims died to
+`⟨render-vs-capture⟩` — an instrument that no longer exists in that form.
+
+`ScreenView.settle_time()` uses `rest.t`, so this port has been sitting on a
+question with no instrument behind either leg. **It turns out not to matter, and
+that is worth establishing rather than waiting on.**
+
+## What reaches the fallback
+
+`Element::rest()` takes the longest **plateau** — a run of consecutive identical
+keyframes — and falls back to the longest dwell when there is none. So an element
+reaches the fallback exactly when no two consecutive keyframes are identical.
+
+Census over all sixteen exported screens, at every nesting depth:
+
+| screen | elements reaching the fallback |
+|---|---|
+| `publisher_logo` (and `_r`) | `palogo_sqex_eff` |
+| `developer_logos` (and `_r`) | `palogo_anima_eff` |
+| **`title_jp`** | **`ptlogo_eff3`** |
+
+**Five elements in the whole export**, and only three distinct ones.
+
+## 🔴 The brief's claim is narrowly refuted
+
+*"The two splashes are the **only** screens reaching that fallback"* — `title_jp`
+reaches it too, through `ptlogo_eff3`.
+
+⚠️ Stated as a measurement of the **current** export and nothing more. That
+sentence may have been true when written: the record-layout fix re-timed
+keyframes across the corpus, and a plateau is exactly the kind of thing it could
+create or destroy. This does not say the claim was wrong when made; it says it is
+not true now.
+
+## And every one of them is invisible where it is read
+
+The fallback only matters if the element it picks a pose for is actually drawn.
+Asked of the port directly, at each screen's own settled instant:
+
+```
+publisher_logo   t=140   drew 2   not drawn: palogo_sqex_eff (transparent at t=140)
+developer_logos  t=117   drew 4   not drawn: palogo_anima_eff (transparent at t=117)
+title_jp     --pose=rest drew 23  not drawn: ptlogo_eff3 (transparent at rest)
+```
+
+**Every element that reaches the `rest()` fallback is fully transparent at the
+instant anything reads its rest pose.**
+
+> So no `rest()` rule — the current plateau-plus-dwell, `last`, `maxalpha` or
+> `lastall` — can change any pixel this port draws. The pair is open, and for the
+> port it is **moot**.
+
+That is why the splash rows score 0.01 % against their captures while resting on
+a heuristic nobody can currently defend: the heuristic is not load-bearing there.
+
+## Why this was worth an iteration rather than a wait
+
+The three elements are the **pre-blurred companion glows** and one title sparkle
+— transients that exist to be seen briefly and then leave. An element with no
+plateau is, almost by definition, one that never holds still, and a screen's
+settled instant is chosen to be where things are holding still. The two
+conditions are close to mutually exclusive, which is why the intersection is
+empty and why it was worth checking rather than assuming either way.
+
+⚠️ **This does not rehabilitate `rest.t`.** It is still the wrong answer for
+transients — `ptlogo_back2eff1` is a two-frame flash whose `rest.t = 54` is the
+flash *peak*, and `rest()` would leave five of those burning at once on the
+title. That is a **plateau** case, not a fallback case, and it is untouched by
+anything here.
+
+## What this does not claim
+
+* That the `rest()` pair is settled. It is open, and this page does not touch it.
+* That `rest.t` is right. `settle_time()` still takes the maximum over elements,
+  and what that means for *when the boot advances* is a separate question — a
+  screen still plays to `exit_time()` afterwards, so the dwell is governed by
+  that, not by `rest.t`. **Measured for the drawn picture; argued for the dwell.**
+* Anything about the other 7 claims R1 re-opened against
+  `⟨render-vs-capture⟩`. Not mine to re-derive.

docs/port/splash-animation-fixed.md

@@ -0,0 +1,160 @@
+# The splash: frozen, then fixed, and now checked for SHAPE as well as motion
+
+**Status:** ✅ **animates, and the ramp matches the declared curve.** Written
+2026-09-02 by the Port; HANDOFF on this branch answers `9ca1eb5`.
+
+The 2026-09-02 play-test found the splash frozen. The cause and the fix are in
+the commit history; this page is the part that comes after — **is the animation
+now the right animation?** `motion-census` says explicitly that it cannot answer
+that: *"a wrong ramp that moves every frame passes here."*
+
+## Pre-registered (R2)
+
+`palogo_sqex_eff` declares `0:a=0 → 15:a=255 → 30:a=212 → 45:a=0` — three
+segments, three gradients:
+
+| segment | declared |
+|---|---|
+| 0 → 15 | **+17.0** per unit |
+| 15 → 30 | **−2.87** per unit |
+| 30 → 45 | **−14.13** per unit |
+
+> So a film should show three straight runs with breakpoints at **15** and
+> **30**, the middle slope about **1/5** the magnitude of the last, and the rise
+> about **1.2×** the last.
+
+## Measured, from a film of a real boot
+
+Region: `686x11+299+319` — the companion's top strip, which **no other element
+overlaps**, so the number is that element's own alpha and not a composite.
+
+| view units | strip mean | slope/unit |
+|---|---|---|
+| 5.58 | 0.02809 | |
+| 10.00 | 0.05086 | **+0.00515** |
+| 13.04 | 0.06611 | **+0.00503** |
+| 16.12 | 0.07530 | +0.00298 ← crossing the breakpoint |
+| 19.21 | 0.07260 | **−0.00087** |
+| 25.38 | 0.06695 | **−0.00092** |
+| 28.39 | 0.06482 | −0.00071 |
+| 31.39 | 0.05719 | −0.00254 ← crossing the breakpoint |
+| 34.39 | 0.04471 | **−0.00416** |
+| 40.39 | 0.01910 | **−0.00428** |
+| 43.39 | 0.00655 | −0.00418 |
+| 46.39 | 0.00000 | gone |
+
+**Breakpoints land where declared**: the rise stops between 13.0 and 16.1, the
+gentle fall steepens between 28.4 and 31.4.
+
+| ratio | declared | measured |
+|---|---|---|
+| middle : last | 0.203 | **0.213** |
+| rise : last | 1.20 | **1.20** |
+
+Within 5 % and exact respectively. **The port interpolates piecewise-linearly
+across the declared segments** — which is what the Decoder independently measured
+the game doing (28 distinct alphas over 28 consecutive presents, modal steps −3
+and −14 against predicted −2.87 and −14.13).
+
+⚠️ **Ratios, not absolutes, and deliberately.** The strip mean is an alpha
+scaled by whatever the sprite's own pixels are; its absolute value carries the
+texture. A ratio between segments divides that out, which is why the shape is
+checkable from a composite at all. Anyone quoting 0.00515 as an alpha is
+misreading it.
+
+## What this still does not establish
+
+* That it **looks** right. Three instruments have now agreed with a picture a
+  human called wrong, and the fourth agreeing does not change the standing of
+  the fifth. A play-test is the check.
+* ~~Anything about the **developer** splash's three logo/companion pairs. One
+  element, one screen.~~ ✅ **Closed below, and the developer splash turned out to
+  be the far better test.**
+* The **absolute** alpha. The shape matches; whether the port's alpha equals the
+  game's at a given unit is `verify-capture`'s question, and it answers 0.01 %
+  at the settled pose only.
+
+
+---
+
+# ✅ The developer splash: three elements, TWO declared shapes, on one screen
+
+The publisher check above had a structural weakness I named at the time: one
+element, one screen, one shape. If the port applied *some* single ramp to
+everything, that check would pass.
+
+**The developer splash cannot be fooled that way, because it declares two
+different shapes at once:**
+
+| element | declared alpha | middle segment |
+|---|---|---|
+| `palogo_gamearts_eff` | `0:0 15:255 30:255 45:0` | **flat** |
+| `palogo_seta_eff` | `0:0 15:255 30:255 45:0` | **flat** |
+| `palogo_anima_eff` | `0:0 15:255 30:212 45:0` | **decays 17 %** |
+
+Same screen, same frames, same clock, same code path. The two flat elements are
+the control for the one that is not — no second run, no second renderer, and
+nothing for a phase or rate error to hide behind, because any such error hits all
+three identically.
+
+## Pre-registered, before the film was read
+
+> In units 15→30, `gamearts` and `seta` hold flat while `anima` falls gently.
+> All three fall steeply 30→45.
+
+## Measured, off a real filmed boot
+
+Companion-only strips (each companion's rectangle minus the logo sitting inside
+it), mean luma, `--film-interval=0.03`:
+
+```
+segment     units 16-29  units 31-44
+gamearts       +0.00000     -0.00101
+seta           +0.00000     -0.00151
+anima          -0.00001     -0.00003
+```
+
+**The two flat ones are flat to five decimals. The decaying one decays.** And all
+three fall over 31–44, so the flatness is not a dead element.
+
+## The quantitative version, and the falsification arm
+
+Each trace normalised by a **single solved gain** — one scalar per element, not a
+per-point fit — against the declared curve, over the whole `t=0..45` ramp:
+
+| element | fitted against | max err | rms err |
+|---|---|---|---|
+| `gamearts` | **its own (flat)** | **0.49 %** | 0.23 % |
+| `seta` | **its own (flat)** | **0.50 %** | 0.27 % |
+| `anima` | **its own (decay)** | **2.18 %** | 1.19 % |
+| `gamearts` | anima's decay | 8.32 % | 4.80 % |
+| `seta` | anima's decay | 8.08 % | 4.86 % |
+| `anima` | flat | 8.82 % | 4.94 % |
+
+**Both directions.** Every element fits its own declared shape 4–17× better than
+it fits the other one available on the same screen. A port that drew one ramp for
+all three would sit at ~8 % on at least one row; none does.
+
+`anima`'s 2.18 % is the loosest row and the reason is its signal: its
+companion-only strip means ~0.0005 against gamearts's ~0.015, thirty times
+dimmer, so its noise floor is thirty times higher in these units. It still
+separates from the wrong curve by 4×.
+
+## What this adds over the publisher check
+
+The publisher check established that the ramp has the declared *breakpoints and
+slope ratios*. This establishes that the ramp is **per-element** — that the port
+reads each element's own keyframes rather than applying a screen-wide curve. That
+is a different failure mode, and it is the one that would have survived the
+publisher check unnoticed.
+
+## What it still does not establish
+
+* That it **looks** right. This is instrument five. The standing of a human's
+  eyes is unchanged by it.
+* The **absolute** alpha, for the same reason as above — a solved gain is
+  deliberately scale-free, so this is a shape result and says nothing about
+  whether the port's alpha equals the game's at a given unit.
+* Anything about the **logo** elements. Both checks measure the pre-blurred
+  *companions*, because those are the strips that can be isolated from the sharp
+  logo underneath them.

docs/port/splash-rate-contradiction.md

@@ -0,0 +1,194 @@
+# The proposed splash rate contradicts the splash dwells — NOT adopted
+
+**Status:** ✅ **RESOLVED — the rate was withdrawn.** The Decoder withdrew it the
+same day (`splash-rate-withdrawn.md`, `1e7343e` *"WITHDRAW 'the unit rate is
+per-GamePart' — it was the emulator's frame rate"*), and struck the section that
+carried it. §1 of `splash-declared-vs-captured.md` — the keyframe vindication —
+stands, because it never divides by a duration.
+
+**The port never moved, so nothing has to be undone.** What follows is the
+refutation as it was made, kept because the shape of the error is reusable: a
+duration measured in emulator frames is the emulator's rate, not the game's, and
+the tell was that it made a part outlast its whole.
+
+---
+
+**Original status:** 🔴 **refutation attempt, and it lands.** Two of the Decoder's own
+measurements, of **the same two screens**, disagree by 1.7×. The port has **not**
+changed `keyframe_units_per_second` and is still at 60. Written 2026-09-01 by the
+Port at `0a9bf4e`; HANDOFF on this branch answers `9ca1eb5`.
+
+## What was proposed
+
+`docs/re/splash-declared-vs-captured.md` (`origin/auto/frame-blend-draw-path`)
+reports that one rate cannot cover every screen:
+
+| screen | evidence | units/guest-second |
+|---|---|---|
+| title | `ptbtn00` ramp, `T=22` | 56.8 |
+| splash | `palogo_gamearts` ramp, `T=15` | 39.1 |
+| splash | **160-unit hold in 4.514 guest s** | **35.4** |
+
+with the conclusion that *"a splash played at 60 units/s runs 1.5–1.7× too
+fast"*, and a recommendation to use ~35–40 for the splashes. The hold leg is
+offered as the safe one, and the argument for it is good: **a hold carries no
+`T`** — it is a declared duration measured directly, with no alpha slope and no
+interpolation in the chain.
+
+## Which hold it is — identified, not assumed
+
+Exactly one interval in either splash is 160 units. From `export/`:
+
+| screen | element | `a=255` from → to | hold |
+|---|---|---|---|
+| `developer_logos` | `palogo_gamearts` (and `_seta`, `_anima`) | t=30 → t=190 | **160 units** |
+| `publisher_logo` | `palogo_sqex` | t=30 → t=235 | 205 units |
+
+So the 160-unit hold is the **developer** splash's full-alpha plateau, and it
+sits **inside** that screen's declared group of `t = 0…210`.
+
+## The contradiction
+
+`authored/timing.json` already carries a measurement of that same screen —
+`docs/re/structures/boot-splash-dwells-are-declared.md`, the Decoder's, over
+**three cold boots**:
+
+```
+publisher  declared t=0..255    corpus 4.30 / 4.60 / 4.37 s
+developer  declared t=0..210    corpus 3.51 / 3.50 / 3.37 s
+```
+
+🔴 **The 160-unit hold is measured at 4.514 s. The 210-unit group that contains
+it is measured at 3.37–3.51 s. A sub-interval cannot outlast the interval
+containing it.**
+
+That is not two methods disagreeing about a rate. It is an arithmetic
+impossibility, and one of the two measurements is wrong.
+
+| | implied units/s |
+|---|---|
+| developer whole group, 210 units in 3.46 s (3 boots) | **60.7** |
+| publisher whole group, 255 units in 4.42 s (3 boots) | **57.7** |
+| developer 160-unit hold in 4.514 s (1 run) | 35.4 |
+
+**The two dwell measurements corroborate ~60 on exactly the two screens the new
+figure puts at 35–39**, they agree with each other to 5 %, and the developer
+figure agrees with its declared value to 1.1 % — two of its three runs to 0.3 %.
+
+At 35.4 units/s the declared groups would run **5.93 s** and **7.20 s**, against
+corpus dwells of 3.37–3.51 and 4.30–4.60. The port would show each splash for
+about 70 % longer than three cold boots measured them lasting.
+
+## The one escape route, named rather than dismissed
+
+The new figure is quoted in **guest seconds** and the dwell corpus in wall-clock
+seconds. If those clocks differ by 1.7× the two are not comparable and there is
+no contradiction.
+
+**It does not look like the answer.** The known gap between the two is Canary
+presenting at ~28.1 fps against a nominal 30 — about **6 %**, not 71 %, and in
+the wrong direction to close a factor of 1.7. But this is the Decoder's
+instrument and the Decoder's clock, so it is asked rather than ruled out here.
+
+## What the port did
+
+**Nothing.** `keyframe_units_per_second` stays at **60**, one value, for every
+screen.
+
+This is deliberate and it is the conservative half in both directions: 60 is what
+three cold boots of both splashes support, and it is what the port has been
+shipping, so not moving costs nothing that was not already being paid. Adopting
+35.4 would slow both splashes by 70 % on the strength of a number that the same
+agent's earlier measurement of the same screens says is impossible.
+
+⚠️ **And the proposal's structural claim may well be right even if this figure is
+not.** *"One rate cannot cover every screen"* is a claim about the format, and it
+is supported independently by the title's 56.8 sitting 5 % off the splashes'
+~58–61. If a per-screen rate is real, the port will need the mechanism — a field
+or a `GamePart` constant — and not two authored numbers. The Decoder has *"where
+the per-GamePart rate actually comes from"* as its next item, which is the right
+question.
+
+## What this does not claim
+
+* That the title's 56.8 is wrong. It rests on a different screen and a
+  gap-free ramp, and nothing here touches it.
+* That the splash **keyframes** are wrong. They are now vindicated — see below.
+* That the dwell corpus is right and the new capture wrong. Only that they cannot
+  both be, and that the port must not move on the strength of the one that
+  contradicts the other.
+
+## ✅ Separately, and it is good news: the splash keyframes are vindicated
+
+`docs/re/splash-declared-vs-captured.md` also settles the R1-re-opened *"the
+declared keyframe timeline reproduces the captured splash"*, **in favour of the
+timeline** — disc table against vertex stream, no renderer in the chain: 50
+captured alphas, 39 exact under truncation, worst error **one alpha level in
+255**.
+
+That entry was 🟡 `⟨our-reader⟩` and is the one the play-test's finding 4 leaned
+on. **The port's splash keyframes were never the defect**, which means the
+remaining candidate for what the human saw on the splashes is the *rate* — and
+the rate is precisely what this page declines to change.
+
+
+---
+
+# ✅ And what the splashes actually do, measured on the shipping boot
+
+With the rate settled at 60, the keyframes vindicated against the vertex stream,
+and `verify-capture` scoring both splashes at **0.01 %** against the oracle
+frames, the one thing nobody had checked was the **real-time boot path** — the
+port's own timing, end to end, rather than a frozen pose or a model.
+
+## Pre-registered (R2)
+
+> At 60 units/s, `publisher_logo` holds for 255 + 9 = **264 units = 4.400 s** and
+> `developer_logos` for 210 + 9 = **219 units = 3.650 s** — the figures
+> `authored/timing.json` states the port emits. Accept ±0.10 s.
+
+Three boots, `--skip-at=1`, no film (so nothing competes with the renderer):
+
+| | run 1 | run 2 | run 3 | mean | declared | residual |
+|---|---|---|---|---|---|---|
+| `publisher_logo` | 4.28 | 4.26 | 4.27 | **4.270 s** | 255 u = 4.250 s | **+1.2 units** |
+| `developer_logos` | 3.50 | 3.57 | 3.51 | **3.527 s** | 210 u = 3.500 s | **+1.6 units** |
+
+**The prediction failed, by 0.130 s and 0.123 s — and the port was right.**
+
+## 🔴 The failure was in the claim, not the code
+
+`authored/timing.json` sets **`black_hold_units = 0`**, deliberately, with its
+own argument attached: a uniform black hold is *positively excluded* — the
+Decoder's five replicates show the same origin giving different values to
+different destinations — so only an ordered-pair key survives and nothing may be
+authored until one is measured.
+
+So there is no 9-unit hold to add, and the port has never added one. Yet two
+places asserted it did:
+
+* `authored/timing.json`, `dwell_why`: *"The port emits 4.400 s and 3.650 s —
+  each declared value plus the 9-unit black hold, exactly. So the pacing was
+  right all along and nothing changes in the code."*
+* `port/scripts/boot.gd`, in the `_advance` block: the same sentence.
+
+**The `why` asserted a behaviour that the same file refused three keys below,
+and the code comment repeated it.** Both are corrected in place. Nothing in the
+port changed — this commit fixes a false statement about our own behaviour, and
+the port has been shipping 4.270 / 3.527 since P3.
+
+## What it does not settle
+
+Against the corpus dwells (means **4.42** and **3.46** s) neither figure
+dominates: the port is 3.4 % short on the publisher and 2.0 % long on the
+developer, where the claimed values would be 0.5 % short and 5.5 % long. **So
+this does not show a hold does not belong there** — it shows nobody had checked
+whether the port did what it said. `black_hold_why`'s ordered-pair ask stands
+unchanged.
+
+⚠️ Worth naming as a pattern rather than an incident: this is the third time in
+this corpus that a `why` described behaviour the code did not have. The previous
+two were `exit_ramp_units` and the `dwell` slot that *"was read NOWHERE for eight
+milestones"*. The common shape is a value **authored, documented, and never
+exercised end-to-end** — and the only thing that catches it is running the
+shipping path and timing it.

docs/port/units-per-second-switch-readiness.md

@@ -0,0 +1,356 @@
+# If 120 units/s is right, the switch is one constant — audited, and pre-registered
+
+**Status:** ✅ **SETTLED by a designed experiment.** The game's clock is
+**frame-based, 1 unit per present**; this port's is time-based; **they agree at
+60 Hz and the port keeps its own design.** 120 is withdrawn by its author. The
+port never moved, so nothing has to be undone.
+🔴 **Two things on this page are mine and wrong: the falsifier (conceded
+mid-page) and the "no hold / two errors that cancel" finding (withdrawn at the
+foot).** Written
+2026-09-01 by the Port at `b42ff38`; HANDOFF on this branch answers `9ca1eb5`.
+
+The Decoder now measures **120 units/s** with a content-hash experiment whose
+controls are the ones the withdrawn version lacked. **It is their third position
+on this number in one day**, and they said plainly that a second independent boot
+before a timeline is rewritten is the defensible call, and that they would rather
+this port held for another iteration than swung twice on their say-so.
+
+**Agreed, and the port has not moved.** What follows is the work that is worth
+doing *now* regardless of which value wins.
+
+## Why hold
+
+1. **Three positions in a day**, two of them already withdrawn by their author.
+2. **Reach is one boot.** They say so.
+3. They do **not** offer the 2.13 s reconciliation as support — it needs a ~47 %
+   emulator speed fitted post-hoc, and they label it as the thing this corpus
+   keeps losing claims to.
+4. Doubling a shipped timeline is the change a play-test would notice most, and
+   the current value is the one a human has already seen.
+
+None of that is an argument that 60 is right. **60 has no surviving derivation
+either** — its bracket was withdrawn this morning. Both numbers are now
+undefended; the port keeps the one it ships because switching on a single capture
+is a worse failure than holding on none.
+
+## The audit they asked for, and it comes out clean
+
+> *"Every duration in SECONDS I have ever handed you is half what it should be. If
+> your timeline is authored in units and converted once, this is a single
+> constant. If seconds are baked in anywhere, they all move."*
+
+Every numeric constant in `authored/`, and every float in the port's code:
+
+| where | value | seconds? | moves with the constant? |
+|---|---|---|---|
+| `timing.json` `keyframe_units_per_second` | 60 | — | **it IS the constant** |
+| `timing.json` `black_hold_units` | 0 | no — **units** | ✅ derived |
+| `timing.json` `dwell_seconds` | `null` | n/a | — |
+| `flow.json` `dwell` | prose only, "NOT SET" | n/a | — |
+| `audio.json` `loop_start_s` / `loop_end_s` | 9.44 / 61.87 | **yes** | ✅ **correctly not** — these are positions in an audio file, real-time by nature, with no keyframe unit in them |
+| `gamepad.gd` `ENTER` / `RELEASE` | 0.61 / 0.4 | no — deflection | — |
+
+**No seconds are baked into the timeline anywhere.** Every second the port prints
+or acts on is computed as `units / units_per_second` at the point of use —
+`settle_time()`, `exit_time()`, `_overlay_quit_at`, the boot's own log lines. The
+switch is one number in one file.
+
+## 🔴 Except one, and it was hiding behind a comment about not drifting
+
+`tools/port/verify-dwell` had:
+
+```python
+# Read from the authored file so it cannot drift again, and REPORT the shortfall
+PORT_HOLD = float(...get("black_hold_units", 0)) / 60.0
+```
+
+**The value was read from the file. The rate was a literal.** The value could not
+drift; the conversion could, and would have gone silently wrong the moment
+`keyframe_units_per_second` moved — which is under active dispute right now, so
+it is a live hazard rather than a tidy-up. Harmless only because the hold is
+currently 0.
+
+Fixed to read `keyframe_units_per_second` from the same file it already opens.
+
+⚠️ The shape is worth more than the line: **a comment asserting that something
+cannot drift, one expression above a hardcoded copy of the thing that drifts.**
+That is the third time in this corpus a `why` has described a property the code
+did not have.
+
+## Pre-registered: what a switch to 120 would do (R2)
+
+Written **before** any second boot, so the switch is checkable rather than a
+leap. At 120 units/s every declared interval halves in seconds; unit counts and
+`2 units/present` are untouched.
+
+| | declared | at 60 (shipping) | **at 120** |
+|---|---|---|---|
+| `PRESS Ⓐ` plate, full | t=236 | 3.933 s | **1.967 s** |
+| plate ramp onset | t=214 | 3.567 s | **1.783 s** |
+| publisher splash group | 255 units | 4.250 s | **2.125 s** |
+| developer splash group | 210 units | 3.500 s | **1.750 s** |
+| title build-in end | t=118 | 1.967 s | **0.983 s** |
+| `ptcopyright` full | t=160 | 2.667 s | **1.333 s** |
+
+**The falsifier is the splash dwells.** Three cold boots measured the publisher
+at 4.30 / 4.60 / 4.37 s and the developer at 3.51 / 3.50 / 3.37 s. At 120 the
+port would show them for **2.13 s** and **1.75 s** — roughly half what those
+boots recorded.
+
+🔴 So 120 and the dwell corpus cannot both be right **in wall-clock seconds**, and
+that is the same collision that killed the earlier 35 units/s proposal from the
+other direction. Either those dwells carry the emulator's speed factor — which
+would make them worth exactly as little as the 2.13 s route the Decoder has
+already declined to lean on — or 120 is wrong. **Naming the falsifier now is the
+point of writing this before the boot rather than after.**
+
+## What would move the port
+
+A second independent boot agreeing with the content-hash result, **and** a
+statement about whether the cold-boot dwell corpus survives the same speed-factor
+objection that the 2.13 s route does not. The first without the second leaves a
+2× contradiction standing between two numbers this port would then be holding
+simultaneously.
+
+
+---
+
+# 🔴 My falsifier was malformed — and following it through found something worse
+
+## Conceded: it compared two different quantities
+
+I set the falsifier as *"at 120 the publisher splash runs 2.125 s, against three
+cold boots measuring 4.30/4.60/4.37"*. **2.125 s is the declared *animation*
+length. 4.3 s is how long the *screen* is up.** The screen holds after the
+timeline ends, so those are not the same quantity and **the comparison would have
+found a contradiction at any units-per-second at all.**
+
+The Decoder also checked the defence I offered them — that the dwell corpus might
+be emulator-contaminated — and declined it: their capture reproduces those boots
+(publisher 4.263 s, developer 3.457 s, four runs agreeing). **They could have
+waved my numbers away and did not.**
+
+## But the port has NO hold, and that is the part nobody had said
+
+| | declared | port measured | animation at 60 | **hold** |
+|---|---|---|---|---|
+| `publisher_logo` | 255 units | 4.270 s | 4.250 s | **+0.020 s** |
+| `developer_logos` | 210 units | 3.527 s | 3.500 s | **+0.027 s** |
+
+**The port's screen time *is* its animation time.** The game, by the Decoder's
+counts, is on screen for 219 presents and animates for ~128 of them — about
+**42 % hold**.
+
+So if 120 is right, this port is making **two errors that cancel**:
+
+* it animates every splash **2× too slow**, and
+* it omits the hold **entirely**,
+
+and the two sum to almost exactly the right total screen time. That is why the
+dwell check has been passing, and **`authored/timing.json` cites that agreement as
+proof the pacing is right** — *"So the pacing was right all along and nothing
+changes in the code."* Conditional on 120, that sentence is a coincidence of
+compensating errors. Corrected in place.
+
+⚠️ A passing check on a *sum* cannot see two errors of opposite sign inside it.
+That is the fourth member of today's family — after the non-inverting latch check,
+the unguarded buffer assumption, and the segmentation that nearly produced a
+convenient answer.
+
+## 🔴 And 120 explains both open play-test findings. 60 explains neither.
+
+This is not a measurement and it is not mine to call decisive. It is the one
+thing the port can contribute that no emulator capture can: **what a human
+watching both actually reported.**
+
+| | at 60 (shipping) | at 120 |
+|---|---|---|
+| **finding 3** — *"the plate arrives late"* | full at **3.933 s** | **1.967 s** |
+| **finding 4** — *"the game's fade is more pronounced"* | build-in **0.750 s**, then the screen leaves at once | build-in **0.375 s**, then the screen **holds ~1.7 s** |
+
+At 60 the port's logo drifts in slowly and leaves immediately. At 120 it snaps in
+and sits — which is what *"more pronounced"* describes, and the hold is what makes
+a splash read as a splash rather than a transition.
+
+**Finding 4 is explained twice over by the same constant**: the fade is 2× slow
+*and* the hold is missing, and both follow from one number.
+
+Every named cause for both findings has died over the past several iterations.
+**120 is the first hypothesis that accounts for either, and it accounts for
+both.**
+
+## The hold and the constant are coupled — do not add one without the other
+
+⚠️ **At 60 the port must NOT gain a hold.** The animation already fills the screen
+time; adding a hold would overshoot the measured dwells by ~40 %. The missing
+hold is only a defect *if* 120 is right. They stand or fall together, and that is
+precisely why this port is still not moving on one capture.
+
+## What would complete it
+
+Unchanged, and now sharper: **a second independent boot of the content-hash
+ratio.** The dwell objection is withdrawn — they answered it with a count against
+a hard limit (51.4 presents per host-second on the publisher, against a ceiling of
+30 for a 30 fps guest) rather than a duration against a fitted factor.
+
+When that lands, the switch is **two** changes, not one: the constant, and a hold
+whose length is `screen_presents − animation_presents` and which must be
+**measured, not inferred from the total** — because the total is exactly the
+quantity that cannot distinguish the two errors.
+
+
+---
+
+# 🔴 WITHDRAWN: "the port has no hold" and "two errors that cancel"
+
+Both were mine, both were last iteration's headline, and both are wrong.
+
+## What I misread
+
+The Decoder gave a split — *"219 presents on screen, ~128 animating"* — and I
+read it as a hold **outside** the declared timeline, which the port would then be
+missing. **It is a split *within* the timeline.** The declared group is ramp +
+hold + fade, and the hold is the largest part of it:
+
+```
+publisher  palogo_sqex:  0:a=0  15:a=0  30:a=255  235:a=255  239:232  251:32  255:0
+                         ramp  0→30   =  30 units
+                         HOLD 30→235  = 205 units   ← 80.4 % of the screen
+                         fade 235→255 =  20 units
+```
+
+## The port plays it. Measured, not read
+
+Frozen samples across the publisher splash, logo region:
+
+| t | units | region mean |
+|---|---|---|
+| 0.25 s | 15 | 0.390957 |
+| 1.00 s | 60 | **0.405488** |
+| 2.00 s | 120 | **0.405488** |
+| 3.00 s | 180 | **0.405488** |
+| 3.80 s | 228 | **0.405488** |
+| 4.20 s | 252 | 0.038142 |
+
+**Identical to six decimals across 168 units.** The port holds, for 80 % of the
+screen, exactly as declared.
+
+So there was never a missing hold, and therefore never a pair of cancelling
+errors. **`authored/timing.json`'s "the pacing was right all along" was right all
+along**, and my paragraph casting it as a possible coincidence is withdrawn there
+too.
+
+⚠️ The failure is worth naming because it is not the usual one: I did not
+mis-measure anything. **I took a two-part split from someone else's instrument and
+assumed the boundary was where my own model put it.** Presents are not units, and
+"animating vs holding" in presents does not decompose the same way as "ramp vs
+hold" in declared units.
+
+# ✅ And the port's own data is an independent leg for the time-based clock
+
+The Decoder's mechanism: `units/present` halved when the present rate doubled
+while `units/second` did not move, so the UI clock advances by elapsed **time**,
+not by frame count — and *"2 units per frame"* was a property of a 27 fps capture
+rather than of the game.
+
+**The frame-rate work of two iterations ago tests exactly that, and I did not
+notice at the time.** The same splash, measured across a 4× change in the port's
+own rendering rate:
+
+| | frame rate | dwell | implied units/s |
+|---|---|---|---|
+| llvmpipe | 17.3 fps | 4.28 s | 59.6 |
+| llvmpipe | 19.6 fps | 4.26 s | 59.9 |
+| llvmpipe | 25.0 fps | 4.27 s | 59.7 |
+| **GPU** | **69.4 fps** | **4.26 s** | **59.9** |
+
+**Frame rate varies 4.0×; the dwell varies by 0.5 %.** That is the signature of a
+time-based clock, and it puts the rate at 59.6–59.9 every time.
+
+🔴 **This is a weaker leg than it looks and I am labelling it rather than
+counting it.** It shows *the port's* clock is time-based — which it is by
+construction, `time_units += delta * units_per_second` — so it cannot be evidence
+about the game's. What it does show is that the **dwell figures I supplied are
+frame-rate-independent measurements**, not artefacts of whatever rate a run
+happened to hit. That is the property their argument needs of them, and it is now
+established from this side rather than assumed.
+
+# Where finding 3 stands
+
+**Open, with no surviving named cause.** Units-per-second is eliminated in favour
+of the value the port already ships; every other candidate died earlier. The
+clock origin remains untouched, and every quantity in the resolved account is a
+ratio or a count, so a common offset survives all of it.
+
+
+---
+
+# ✅ Settled: the game is frame-based, the port is time-based, and that is correct
+
+`--framerate_limit=30` — the run this page asked for — refuted the time-based
+reading on every discriminating row, **against its author's own expectation**:
+
+| | predicted if time-based | **measured at 30 fps** |
+|---|---|---|
+| modal alpha step | 34 | **17** (unchanged) |
+| units/second | 60 | **30.2** (halved) |
+| publisher dwell | 4.25 s | **8.450 s** (doubled) |
+
+Both controls passed *first*: the limiter demonstrably took effect (28.4
+presents/host-s against 51–55, interval mass moving to two vblanks, 422 of 468),
+and all 8 splash quad rects were identical, so nothing but the frame rate
+differed. **`255 × 1 / 15 = 17`** at 28.4, 51.4 and 54.8 presents/s alike.
+
+## What that changes for the port: nothing — but for a reason worth writing down
+
+The game advances **1 unit per presented frame**. This port advances
+`time_units += delta * units_per_second`. **They are different mechanisms that
+agree at exactly one frame rate: 60 Hz** — which is the only rate the console
+ever asked the game to be right at.
+
+🔴 **Do not make the port frame-based to match the game.** A time-based port
+reproduces a 60 Hz console on hardware that is not 60 Hz; a frame-based one would
+drift on every machine that is not — and this port has measured *itself* between
+**9.7 and 69.4 fps** depending on the renderer. Matching the game's mechanism
+would import a fragility the game never had to survive, because the game only
+ever ran on one box.
+
+## 🔴 But it sharpens what `60` is claiming, and makes it falsifiable
+
+If units/second **is** the present rate, then `keyframe_units_per_second = 60` is
+no longer "the unit is 1/60 s". It is:
+
+> **the game presented these screens at 60 Hz on the console.**
+
+That is a harder claim and a checkable one. **It is also supported for the first
+time:** Canary unlimited presents at 51–55 Hz and the splash dwell is
+4.30 / 4.60 / 4.37 s over three cold boots. A natively 30 Hz game would present
+at ~30 in Canary too — the `--framerate_limit` run proves it, since forcing 30
+made that same splash take 8.45 s. **It does not take 8.45 s unforced.**
+
+⚠️ Still `authored`, not promoted to `measured`: this is inference over three
+measurements rather than a measurement of units per second. It becomes `measured`
+when someone reads the console's present rate for these screens directly.
+
+## And it closes the constant as a cause of finding 3 — in the direction that matters
+
+| console rate | units/s | plate `t=236` |
+|---|---|---|
+| 30 Hz | 30 | **7.87 s** |
+| **60 Hz (shipping)** | **60** | **3.93 s** |
+
+Under the frame-based model the only alternative is 30 Hz, and it puts the plate
+**later**, not earlier. **There is no console present rate that makes the plate
+arrive sooner than this port already shows it.** The human reported it arriving
+late; no value of this constant can produce that.
+
+## The method note, and it is theirs
+
+> *Four of my positions on this number were inference over a measured quantity;
+> this one changed an input and watched what moved.*
+
+The opportunistic comparison — two captures that happened to differ — pointed
+**exactly the wrong way**, because nothing controlled what else differed between
+them. One designed capture settled it against its author's expectation. That is
+the difference between an observation and an experiment, and it cost this pair
+five positions in a day to relearn.

docs/port/verify-screen-blend-divergence.md

@@ -0,0 +1,401 @@
+# `verify-screen` DIFFERS on six more screens — it is ADDITIVE, and the port is ahead of the reference
+
+**Status:** ✅ **RESOLVED.** The reference gained an additive path
+(`formats-pin-2026-09-01b`) and the divergence this page is about collapses **6×**.
+Everything below stands; the last section is the measurement that closes it. Port `HEAD` `da7864e` + this
+commit; HANDOFF at `9ca1eb5`.
+
+> 🔴 **This page said, in its first version, that the cause was a blend-SPACE
+> divergence — one renderer linearising and the other not. That was wrong, and
+> the way it was wrong is the useful part.** Both renderers demonstrably blend in
+> the encoded space. The transfer curve I built to support it averaged Godot's
+> value per *reference value* bucket, which collapsed a **bimodal** population —
+> a large majority differing by ≤1 level and a minority differing by 40+ — into a
+> smooth-looking curve that resembled gamma and was an artefact of the binning.
+> A mean over a mixed population is not a transfer function.
+
+## The measurement that settles it
+
+53 % of pixels agree to within **1 level** and 69 % to within 3. The rest are not
+spread over a curve; they are **concentrated in the middle of the frame**:
+
+```
+|delta| 0 : 134 969   (cum 14.6 %)      > 3 : 282 166 px = 30.6 %
+|delta| 1 : 355 261   (cum 53.2 %)      bbox: the whole frame, but
+|delta| 2 : 103 348   (cum 64.4 %)      occupancy is ~zero in columns
+|delta| 3 :  45 856   (cum 69.4 %)      0,1,6,7 of 8 and heavy in 2..5
+|delta| 40+: 16 844   (cum 100 %)
+```
+
+The ≤1 tier is integer truncation against float rounding — the reference computes
+`(sc*sa + dc*(255-sa)) / 255` in `u32` and truncates; Godot rounds. The 30.6 %
+is something else, and it is in the columns where the menu's content sits.
+
+## What it is
+
+**The port draws some elements ADDITIVE. The reference has no additive path at
+all.**
+
+`crates/sylpheed-formats/src/ui_layout.rs` has exactly two blend sites, lines
+1072 and 1174, and both are alpha-over:
+
+```rust
+canvas[di + k] = ((sc * sa + dc * (255 - sa)) / 255) as u8;
+```
+
+and line 1169 carries the reason — an *"ADDITIVE selector and REFUTED — it moved
+every metric against the …"*. The reference tried additive, refuted it against
+its own composite metrics, and does not do it.
+
+`authored/rendering.json` gives the port an additive set per screen, and its
+`why` records that this is **transcribed, not authored**: the port proposed
+additive from a two-background composite solve, kept it a proposal because
+nothing on the disc selects a blend mode, and adopted it only when the Decoder
+logged **`RB_BLENDCONTROL0` per draw in Canary** and drove the game to both
+screens.
+
+So the two renderers disagree **on purpose**: one implements a measurement of the
+game's blend register, the other implements a refutation made from composite
+metrics before that measurement existed.
+
+## The prediction this makes, and it holds
+
+If the divergence is the additive set, its size should scale with how many
+elements are in that set. It does:
+
+| screen | additive elements in `authored/rendering.json` | mean diff |
+|---|---|---|
+| `extras` | **9** — `pteff10 pteff20 ptframe3 ptframe4 pteff21 pteff22 pteff23 ptloop01 ptloop02` | **6.7422** |
+| `main_menu` | **5** — `pteff12 ptframe1 ptframe2 ptloop01 ptloop02` | **3.9363** |
+| `main_menu_jp` | **0** — not in the map | 0.7885 |
+| `extras_jp` | **0** — not in the map | 0.6592 |
+| `title` | **0** — present, deliberately empty | 0.4431 (the known sweep residual) |
+
+Nine beats five beats zero, in order, with the two zero-rows an order of
+magnitude below the two non-zero ones. That ordering was not fitted; the additive
+map was written before this comparison existed.
+
+## And which side is right: the port, on the evidence there is
+
+* the additive set is a **measurement off the running game** — the blend control
+  register, per draw — and the reference's alpha-over is a refutation from
+  *renderer metrics*, which the protocol ranks below a capture;
+* scored against `docs/re/captures/title-builds/live-main-menu.png`, Godot is
+  **RMSE 3151.96** and the reference **3769.61** — the port is 16 % closer.
+
+⚠️ **That second line is an ordering and nothing more.** `verify-screen` poses
+`--pose=rest` and its own header is emphatic that such a frame must never be
+scored against a capture — that mistake produced a published finding once
+already. Both sides carry the same pose contamination, so *which* is nearer is
+still meaningful; *how near* is not. Nobody should quote 0.0481 as the port's
+fidelity.
+
+## The blend SPACE, separately: both are encoded, and so is the game
+
+Worth keeping even though it turned out not to be the cause, because it closes
+`BLOCKED.md` H4 and it was measured rather than recalled.
+
+**Godot, measured with a control** — a white quad over black at three known
+modulate alphas, through the port's own texture path
+(`load_png_from_buffer` → `ImageTexture`), with the port's `[rendering]` settings:
+
+| declared alpha | encoded-space prediction | linear-then-re-encode prediction | **measured** |
+|---|---|---|---|
+| 64 | 64 | 138 | **64** |
+| 128 | 128 | 188 | **128** |
+| 192 | 192 | 225 | **192** |
+
+Pre-registered before running; exact on all three, with the alternative excluded
+by 33–74 levels.
+
+**The reference:** integer arithmetic straight on 8-bit values, no linearisation
+anywhere in the file.
+
+**The game:** the Decoder's `blend-space-rt-format.txt` — `RB_COLOR_INFO`
+`color_format` is `k_8_8_8_8` on 2402/2402 splash draws and 33779/33791 of the
+boot-to-title capture, `k_8_8_8_8_GAMMA` appears **zero** times, and
+`color_exp_bias` is 0 throughout. `k_8_8_8_8_GAMMA` is the only format around
+which Canary applies a gamma↔linear conversion.
+
+**All three agree. Blend space is not a difference between anybody here**, and
+the port needs no change for it.
+
+## The other four rows — localised, and two hypotheses died getting there
+
+`check-all` still fails on these four, and the allowance was not widened to
+cover them. What follows is where they are, not yet why.
+
+### 🔴 Hypothesis 1, refuted: a blend-space divergence
+
+Covered above. Killed by a control on my own renderer.
+
+### 🔴 Hypothesis 2, refuted: the port renders `rotation_deg` and the reference does not
+
+This one looked strong. `ui_layout.rs:86` says so in its own words —
+*"`rotation_deg` is decoded but NOT rendered"* — and the port does render it. A
+census over all sixteen exported screens gave:
+
+> **Every screen with a non-zero rotation at rest DIFFERS, and every screen with
+> none agrees** — 6 of 6 either way, including both legacy rows.
+
+**It is still wrong.** Widening the rule to *any* rotating element — a non-zero
+rest rotation **or** a two-keyframe 360° spinner at any depth — breaks it:
+`build_00` and `build_01` carry two spinners each and **agree** with the
+reference. Asked directly, the port's own draw log says it draws both spinners
+on those screens. So rotation is present, rendered, and produces no difference.
+
+A rule that holds on 14 of 16 and fails on the two cases nobody had looked at is
+the shape of a rule fitted to the rows it was built from. Recorded because the
+next person will find the `ui_layout.rs:86` comment and reach for it too.
+
+### ✅ What is actually established: `build_12` and `build_15` are ONE element
+
+All **951** differing pixels lie inside `pgloading_loop5`
+(`pgloading_ring.png`, 333×276 at `[1,444]`), and the diff's own bounding box —
+`x 69..301, y 478..710` — sits entirely within it. No other element's rectangle
+contains a differing pixel that this one does not.
+
+And that closes the `build_00` / `build_01` question without any rule about
+rotation: the port's draw log shows those two screens draw **7** elements and
+`build_12` draws **10**. `pgloading_loop5` is one of the three extra. The
+loading screens that agree are the ones that never draw the element the
+disagreement is in.
+
+Why the two renderers disagree *on that element* is not settled. It is small —
+max 17, mean 0.0368 — and the element is unusual: its top-level keyframes hold
+`a=0x7f` for eight units around `rest.t = 24`, while its **leaf** record
+expands `pgloading_ring` from `scale 0` to `1000` over t=30…130. The port's
+`draw_leaf_for` lists only `ptloop01` and `ptloop02`, so the port draws the
+element and not that leaf. Whether the reference does the same is the open half.
+
+### 🟡 `main_menu_jp` and `extras_jp` — consistent with the sweep leaves, not established
+
+Both carry `ptloop01/pteff03` (rot 30, at x=1521) and `ptloop02/pteff03a`
+(rot −45, at x=−839) — the **same sweep leaves** whose phase residual is the
+already-named reason for `title`. Their means sit with `title`'s and nowhere
+near their own EN twins':
+
+| | mean |
+|---|---|
+| `title` (sweep residual, named since P1) | 0.4431 |
+| `extras_jp` | 0.6592 |
+| `main_menu_jp` | 0.7885 |
+| `main_menu` (5 additive) | 3.9363 |
+| `extras` (9 additive) | 6.7422 |
+
+That is consistent with the JP rows being the sweep residual alone, with no
+additive contribution — which is what the port's own map implies, since it lists
+no additive set for them. **Consistent with, not established:** nobody has
+isolated the sweep leaves on those two screens.
+
+## ✅ H6 update — the asymmetry has a better answer than a measurement
+
+The Decoder's reply: the blend is a **decoded disc field**, `T8aD +0x04` bit
+`0x02` (set ⇒ additive, clear ⇒ premultiplied alpha-over), with a disc-wide check
+and a surviving out-of-sample prediction. So the port can *derive* the blend per
+element on every screen instead of transcribing a table, and the JP question
+answers itself statically — no boot needed.
+
+**Blocked on one thing:** `sylpheed-formats` does not expose `+0x04`.
+`ui_layout::Element` surfaces `kind` (`+40`), `parent` (`+32`), pivot, keyframes
+and `focus_link`, and nothing at `+0x04`; and `crates/sylpheed-export` consumes
+formats by git **tag**, not by workspace path. Asked as `BLOCKED.md` H6.
+
+🔴 **And a negative worth having, because it is the obvious thing to try:
+`kind_raw` in this export is NOT that field.** Its bit `0x2` against the additive
+map over four screens is **anti-correlated** — 0 of 14 mapped elements have it
+set, and 9 unmapped ones do (`0x3002` on every button, `0x0` on every element the
+map lists). Anyone reaching for `kind_raw & 2` will get the additive set exactly
+inverted.
+
+## 🔴 The asymmetry, until that lands
+
+`main_menu_jp` contains **exactly the elements** `main_menu` marks additive —
+`ptloop01 ptloop02 ptframe1 ptframe2 pteff10 pteff12` — and `extras_jp` contains
+all nine of `extras`'. The port draws them **alpha-over** on the JP screens and
+**additive** on the EN ones, purely because `authored/rendering.json` is keyed by
+screen name and the Decoder's `RB_BLENDCONTROL0` log was taken on the EN screens.
+
+**The port is therefore asserting, by omission, that the JP build blends the same
+elements differently — and that is the less likely of the two possibilities.**
+Extending the map would extrapolate a measurement onto a build nobody drove to,
+which is not the port's to do; leaving it silent asserts the surprising thing by
+default. So it is made explicit in `authored/rendering.json` and asked in
+`BLOCKED.md`, and the map is **not** extended.
+
+⚠️ It does not affect the deliverable: MISSION §7 puts localisation beyond
+English out of scope, and the JP screens are not in the boot path.
+
+## Why `check-all` stays red
+
+Four rows are **not** explained by the additive set:
+
+| screen | mean | over3 | note |
+|---|---|---|---|
+| `main_menu_jp` | 0.7885 | 3 248 | not in the additive map, yet differs |
+| `extras_jp` | 0.6592 | 3 163 | same |
+| `build_12` | 0.0368 | 462 | tiny, and localised — diff bbox `464x266+60+454` |
+| `build_15` | 0.0368 | 462 | identical figures to `build_12` |
+
+`build_12` and `build_15` producing byte-identical statistics suggests one shared
+element rather than two coincidences. None of the four is diagnosed and none is
+excused.
+
+## What changed in `check-all`
+
+The allowance is now **derived** rather than listed: a screen may differ if it
+has a non-empty additive set in `authored/rendering.json`, plus the two named
+legacy rows. That is strictly stronger than the hard-coded list — a screen that
+differs *without* additive elements now fails, which a literal list could not
+express, and the allowance cannot go stale against the map it is computed from.
+
+## What this does not claim
+
+* That the reference is wrong to have refuted additive from its own metrics. It
+  is superseded by a capture, which is a different thing.
+* That the port's additive set is complete. It covers three screens; nobody has
+  logged the register on the rest.
+* Anything about the four undiagnosed rows.
+
+
+---
+
+# 🔴 Re-validated on the GPU, and my prediction failed: these numbers are rasteriser-specific
+
+The human activated a hardware GPU on 2026-09-01. **Every number on this page
+above was measured under `llvmpipe`**, so they needed re-deriving before anyone
+builds on them.
+
+## Pre-registered (R2)
+
+> Both renderers blend in encoded 8-bit space, so if the port's drawing is
+> rasteriser-independent the diffs should be **identical, or within 1 level**.
+> Anything materially different means a published conclusion here was
+> GPU-specific.
+
+## It failed
+
+| screen | llvmpipe mean | **GPU mean** | change | max (llvmpipe → GPU) |
+|---|---|---|---|---|
+| `title` | 0.4431 | **0.5936** | **+34 %** | 41 → 41 |
+| `main_menu` | 3.9363 | **4.1449** | +5.3 % | 97 → 97 |
+| `extras` | 6.7422 | **6.9757** | +3.5 % | 113 → 113 |
+| `title_jp` | 2.7715 | **2.9448** | +6.3 % | 233 → 233 |
+| `main_menu_jp` | 0.7885 | **1.0157** | **+29 %** | 26 → 27 |
+| `extras_jp` | 0.6592 | **0.8906** | **+35 %** | 26 → 26 |
+| `build_12` / `build_15` | 0.0368 | **0.0454** | +23 % | 17 → 17 |
+
+**Every mean rose, by 3–35 %.** So the diffs are *not* rasteriser-independent
+and the prediction was wrong.
+
+## What survives, and what does not
+
+🔴 **The maxima are unchanged** — 41, 97, 113, 233, 17 identical, and 26 → 27 on
+one row. The large differences are exactly where they were.
+
+That is the shape of a **rounding population growing, not content moving**:
+llvmpipe and the NVIDIA rasteriser round the last bit of a blend differently, so
+the ≤1-level tier grows while the elements that genuinely differ do not move at
+all. Consistent with both still blending in encoded space — which the control on
+this page established for Godot generally, not for one rasteriser.
+
+**What survives:**
+
+* the **additive diagnosis**, because it rests on an *ordering*, and the ordering
+  holds on the GPU: `extras` 6.98 > `main_menu` 4.14 > `extras_jp` 0.89 and
+  `main_menu_jp` 1.02 > `title` 0.59 — nine additive elements, then five, then
+  none;
+* the **`pgloading_loop5` localisation**, which is a bounding box;
+* the **`build_00`/`build_01` agree** result — still 0 pixels over the bar;
+* the **derived allowance**: the failing set is the same four rows.
+
+**What does not, and is now labelled:**
+
+* the histogram (*53 % within 1 level, 16 844 over 40*) was llvmpipe-specific and
+  the ≤1 tier is larger on the GPU;
+* every absolute **mean** quoted above this section;
+* the **RMSE-vs-capture** pair (3151.96 / 3769.61) was llvmpipe. The *ordering*
+  claim — the port is nearer than the reference — has not been re-derived on the
+  GPU and is not claimed here until it is.
+
+## The rule this earns
+
+**A renderer comparison carries its rasteriser as a hidden parameter.** Nothing
+in this corpus recorded which one produced a diff, and for eight months there was
+only one so it never mattered. Any diff quoted from here on should say what drew
+it — the same discipline `TEMPORAL-VERIFICATION.md` already demands for capture
+rate, applied to the thing that rasterises rather than the thing that clocks.
+
+
+---
+
+# ✅ Closed: the reference can draw additive now, and the divergence collapses 6×
+
+The Decoder taught `ui_layout::blit` the additive blend at
+`formats-pin-2026-09-01b`, on the argument this page made — that the comparison
+was **structurally incapable**, and that the refutation which had kept additive
+out was `⟨render-vs-capture⟩`, i.e. that renderer disagreeing with itself while
+it had a stale keyframe association, no leaf geometry and no rotation.
+
+**Measured without pulling their branch into mine**: a detached worktree at the
+tag, `sylpheed-cli` built there, and `verify-screen` pointed at it through
+`SYLPHEED_CLI`. My branch is untouched and the reference on `main` is unchanged.
+
+## Pre-registered (R2)
+
+> With the reference finally able to draw additive, the diffs caused by that gap
+> should collapse. `main_menu`/`extras` and their JP twins should fall sharply
+> from ~7, and whatever remains is a *different* cause.
+
+| screen | alpha-over reference | **additive reference** | factor |
+|---|---|---|---|
+| `main_menu` | 7.2580, max 105 | **1.2068, max 28** | **6.0×** |
+| `main_menu_jp` | 7.3440, max 108 | **1.2111, max 31** | **6.1×** |
+| `extras` | 6.9757, max 113 | **1.0229, max 28** | **6.8×** |
+| `extras_jp` | 7.0734, max 115 | **1.0255, max 30** | **6.9×** |
+| `title` | 1.0335, max 88 | **0.5685, max 41** | 1.8× |
+| `title_jp` | 4.4944, max 233 | **2.8225, max 233** | 1.6× |
+| `build_12` / `build_15` | 0.0772, max 60 | **0.0463, max 17** | 1.7× |
+| `build_00` / `build_01` | 0.0676, max 60 | **0.0366, max 4** | **DIFFERS → OK** |
+
+**`build_00` and `build_01` stop differing entirely** — `over3` 3 422 → **0**.
+
+## And the twins agree to a third of a percent
+
+| | |
+|---|---|
+| `main_menu` 1.2068 vs `main_menu_jp` 1.2111 | **0.36 % apart** |
+| `extras` 1.0229 vs `extras_jp` 1.0255 | **0.25 % apart** |
+
+Under the name-keyed map these pairs were 4.1× and 7.8× apart. Nothing was fitted
+to make that happen — the locale twins converged first when the *port* took the
+decoded field, and again now that the *reference* draws the same blend.
+
+## The residual is smaller and its causes are the documented ones
+
+* `title_jp` 2.82 at max 233 remains the largest, and its named reason —
+  `--pose=rest` sparkle handling — is untouched by any of this.
+* `title` 0.57 at max 41 is the `ptloop` sweep-phase residual, also untouched.
+* `main_menu`/`extras` and twins now sit at ~1.0–1.2, max ~28–31. **New, small,
+  and undiagnosed** — additive was the dominant cause and not the only one.
+* `build_12`/`build_15` do **not** return to their pre-change 0.0368: they land at
+  0.0463 with both renderers drawing `pgloading_loop5` additive. So that element
+  carries a small residual of its own beyond the blend.
+
+## 🔴 What must happen to `check-all`, and why it has NOT happened yet
+
+The allowance widened when the reference could not draw additive. **That
+justification is gone**, so the allowance should be narrowed back and the check
+should regain its teeth.
+
+**It is not narrowed in this commit, deliberately.** `check-all` builds the
+reference from the **workspace** `crates/sylpheed-formats`, and the additive path
+is at a tag that has not landed on `main`. Tightening now would turn `check-all`
+red against a reference that still cannot draw additive — a wall of failures
+meaning one thing, which is the exact defect the display guard was added for.
+
+**The trigger is mechanical**: when the additive path is on `main`, drop the
+export-derived clause and leave the two named legacy rows. The set that should
+then differ is measured above and is `title`, `title_jp`, `main_menu`, `extras`,
+`main_menu_jp`, `extras_jp`, `build_12`, `build_15` — with `build_00`/`build_01`
+expected to pass.

port/scripts/export_tree.gd

@@ -11,6 +11,15 @@ const FORMAT_SCREEN := "sylpheed.screen/3"
 const FORMAT_MANIFEST := "sylpheed.manifest/1"
 
 var root: String = ""
+## The override tree, or "" when there is none. MODDING rule 4: a mod replaces a
+## file by SHADOWING ITS PATH, so `mods/screens/title/main_menu.json` stands in
+## for `<root>/screens/title/main_menu.json` and nothing under the derived tree
+## is touched. That is what makes re-exporting always safe.
+var mods: String = ""
+## Relative paths a mod actually replaced this run, in the order they were first
+## read. Recorded because MODDING says "did I break it?" is answered by disabling
+## a mod -- which only works if a modded run does not look like an unmodded one.
+var shadowed: Array[String] = []
 var error: String = ""
 
 
@@ -27,9 +36,114 @@ static func locate() -> ExportTree:
 		t.error = "no manifest.json under %s -- run `sylpheed-export` first" % candidate
 		return t
 	t.root = candidate
+
+	# The override tree. `SYLPHEED_MODS` wins for the same reason
+	# `SYLPHEED_EXPORT` does; otherwise `data/mods/`, which is the directory
+	# MODDING.md's own layout diagram names and the one this repository ships.
+	#
+	# Absent is normal and silent: an unmodded run is the common case, and a
+	# warning about a directory nobody created would be noise.
+	var m := OS.get_environment("SYLPHEED_MODS")
+	if m == "":
+		m = ProjectSettings.globalize_path("res://").path_join("../data/mods").simplify_path()
+	if DirAccess.dir_exists_absolute(m):
+		t.mods = m
 	return t
 
 
+## Where a relative path actually comes from: the mod tree if it has one, else
+## the derived tree.
+##
+## Every read in this class goes through here, so a mod can replace a screen's
+## JSON, a sprite, a cue, a music bed or a movie by dropping a file at the same
+## relative path. There is deliberately no manifest of what a mod contains and no
+## registration step -- the path IS the registration, which is the whole of
+## MODDING rule 4.
+##
+## ⚠️ One tree, not a stack. Several mods layering over each other needs an
+## order, and an order needs a rule nobody has asked for yet. Say so rather than
+## invent one.
+func resolve(rel: String) -> String:
+	if mods != "":
+		var over := mods.path_join(rel)
+		if FileAccess.file_exists(over):
+			if not shadowed.has(rel):
+				shadowed.append(rel)
+				# Announced the moment it happens, not summarised at startup.
+				# The first version printed a summary in `_ready`, before a
+				# single asset had been read, so it always said "nothing
+				# shadowed yet" -- a report that is structurally incapable of
+				# reporting anything is worse than none, because it looks like
+				# an answer.
+				print("mod: %s  <-  %s" % [rel, over])
+			return over
+	return root.path_join(rel)
+
+
+## Mod files that were never used, listed at the end of a run.
+##
+## 🔴 A MISTYPED OVERRIDE WAS SILENT. `resolve` announces every shadow as it
+## happens -- that half was already right, and its comment records why a startup
+## summary was wrong. What nothing reported was the opposite: a file sitting in
+## `data/mods/` whose path matches no asset. Measured: `sprites/title/main_menu/`
+## is announced, `sprites/title/TYPO_menu/` produces **no output at all**. The
+## modder sees the port load, run, and say nothing about the file that did
+## nothing.
+##
+## That is MODDING rule 4's own failure mode -- base-and-overrides is only usable
+## if an override that misses says so -- and it is the same shape as the
+## checkers that passed on an empty input: **agreeable rather than wrong.** A
+## port that cannot tell "your override is in effect" from "your override was
+## never looked at" is unusable for the person the asset tree exists for.
+##
+## ⚠️ Reported at the END of a run, not at startup: resolution is lazy, so before
+## the assets are read there is nothing to compare against. A run that quits
+## early will list files a longer run would have used, and the wording says so
+## rather than calling them errors.
+func unused_mods() -> PackedStringArray:
+	var out: PackedStringArray = []
+	if mods == "":
+		return out
+	var stack: PackedStringArray = [""]
+	while not stack.is_empty():
+		var rel := stack[stack.size() - 1]
+		stack.remove_at(stack.size() - 1)
+		var dir := DirAccess.open(mods.path_join(rel))
+		if dir == null:
+			continue
+		dir.list_dir_begin()
+		var name := dir.get_next()
+		while name != "":
+			var child := rel.path_join(name) if rel != "" else name
+			if dir.current_is_dir():
+				stack.append(child)
+			elif not shadowed.has(child):
+				# 🔴 TWO DIFFERENT THINGS, and reporting them as one produced a
+				# permanent false positive on the mods directory's own README.
+				# A file whose path exists in `export/` was simply not read this
+				# run -- a `--menu` run touches one screen. A file whose path
+				# exists NOWHERE in the export can never shadow anything: that
+				# is the mistyped override, and it is the only one that is a
+				# defect. A report with a standing false positive becomes
+				# scenery, which is the failure this whole report exists to fix.
+				# ⚠️ And a THIRD category, excluded by extension with the rule
+				# stated rather than assumed: the export tree contains only
+				# `png`, `json`, `ogg`, `ogv` and `cmd` files -- checked, no
+				# `.md` anywhere -- so a `.md` in `data/mods` cannot shadow
+				# anything BY CONSTRUCTION and is documentation, not a failed
+				# override. Flagging a class that could never be an override is
+				# noise, and a report with a permanent false positive is one
+				# nobody reads. `data/mods/README.md` is the standing case.
+				var ext := child.get_extension().to_lower()
+				if ext in ["png", "json", "ogg", "ogv", "cmd"] \
+						and not FileAccess.file_exists(root.path_join(child)):
+					out.append(child)
+			name = dir.get_next()
+		dir.list_dir_end()
+	out.sort()
+	return out
+
+
 # `authored/` sits beside `export/`, never inside it: it is hand-written and
 # committed, and a re-export must not be able to touch it.
 func authored(name: String) -> Variant:
@@ -42,7 +156,7 @@ func authored(name: String) -> Variant:
 
 
 func read_json(rel: String) -> Variant:
-	var path := root.path_join(rel)
+	var path := resolve(rel)
 	var text := FileAccess.get_file_as_string(path)
 	if text == "":
 		error = "cannot read %s" % path
@@ -88,11 +202,20 @@ func screen(name: String) -> Dictionary:
 func video(name: String) -> Dictionary:
 	for entry: Dictionary in manifest().get("videos", []):
 		if entry.get("name") == name:
-			var path := root.path_join(entry["file"])
+			var path := resolve(String(entry["file"]))
 			if not FileAccess.file_exists(path):
 				error = "manifest lists %s but %s is not there" % [name, path]
 				return {}
-			return {"path": path, "command": entry.get("command", "")}
+			# `duration_s` and `fps` come with it so a run can report what it
+			# PRESENTED, not just how long it took. Godot's player drops frames
+			# to hold its schedule and drops most of them on this hardware, and
+			# elapsed seconds stay plausible while that happens.
+			return {
+				"path": path,
+				"command": entry.get("command", ""),
+				"duration_s": float(entry.get("duration_s", 0.0)),
+				"fps": float(entry.get("fps", 0.0)),
+			}
 	error = "no video named %s in manifest.json" % name
 	return {}
 
@@ -109,7 +232,7 @@ func screen_names() -> PackedStringArray:
 # the disc's own texels and several elements are drawn at 200 %, where a
 # bilinear filter would invent detail the disc does not have.
 func texture(rel: String) -> Texture2D:
-	var bytes := FileAccess.get_file_as_bytes(root.path_join(rel))
+	var bytes := FileAccess.get_file_as_bytes(resolve(rel))
 	if bytes.is_empty():
 		error = "cannot read sprite %s" % rel
 		return null
@@ -118,3 +241,16 @@ func texture(rel: String) -> Texture2D:
 		error = "%s is not a PNG" % rel
 		return null
 	return ImageTexture.create_from_image(img)
+
+
+## One line naming what a mod replaced, or "" when nothing did.
+##
+## Printed by every run that loads a tree. A modded run that looked identical to
+## an unmodded one in the log would make "disable the mod and see" the only
+## debugging tool a modder has; this makes it the second one.
+func mod_report() -> String:
+	if mods == "":
+		return ""
+	if shadowed.is_empty():
+		return "mods: %s is present; each file it replaces is logged as it is read" % mods
+	return "mods: %s -- %d file(s) shadowed: %s" % [mods, shadowed.size(), ", ".join(shadowed)]

port/scripts/gamepad.gd

@@ -0,0 +1,272 @@
+class_name Gamepad
+extends RefCounted
+
+## The physical controller: the two buttons Godot does not bind, and the one
+## input that is not an edge.
+##
+## 🔴 BOTH DEFECTS WERE REPORTED BY A HUMAN PLAYING THE PORT (2026-09-01), and
+## neither could have been caught by the `--script` harness, because that harness
+## sends `InputEventAction` — which bypasses the input map and is not an analog
+## axis. The unattended P5 walk passed on every iteration while Ⓐ did nothing at
+## all on a real pad. **A synthetic-input test asserts the code after the input
+## map, never the input map itself.**
+##
+## ## 1. Godot 4.7.2 binds no joypad button to `ui_accept` or `ui_cancel`
+##
+## Measured on this exact build rather than remembered, because the answer has
+## changed between Godot versions and the remembered one was wrong:
+##
+## ```
+## ui_accept   key:Enter, key:Kp Enter, key:Space          <- no joypad at all
+## ui_cancel   key:Escape                                  <- no joypad at all
+## ui_up       key:Up, JOYBTN:11, JOYAXIS:1-               <- d-pad AND left stick
+## ui_down     key:Down, JOYBTN:12, JOYAXIS:1+
+## ui_left     key:Left, JOYBTN:13, JOYAXIS:0-
+## ui_right    key:Right, JOYBTN:14, JOYAXIS:0+
+## ```
+##
+## That asymmetry is the whole bug report: navigation worked on the pad and Ⓐ/Ⓑ
+## did nothing, which reads like a broken controller and is a complete input map
+## for four actions out of six.
+##
+## The events are **added to** the built-in actions, never redefined. Declaring
+## `ui_accept` in `project.godot` replaces the built-in wholesale, so the
+## keyboard bindings would have to be restated there and would silently rot the
+## next time Godot changes them.
+##
+## ## 2. A stick is not a button
+##
+## `ui_up`/`ui_down` are bound to **axis 1**, so the left stick navigates — which
+## is correct, the real game accepts it too. But an axis emits a fresh
+## `InputEventJoypadMotion` every time the value *changes*, and a real stick held
+## at deflection jitters continuously. Every one of those events reports the
+## action as pressed, so a held stick was one cursor step per jitter: the human's
+## words were "moves the cursor too fast", and on a five-item menu it crosses
+## faster than the eye follows.
+##
+## So the stick is **latched**: it fires once when it leaves the neutral zone and
+## not again until it comes back. That makes it behave exactly like the d-pad,
+## which needs no latch because a button already is an edge.
+##
+## ⚠️ ~~AUTHORED, NOT MEASURED — and deliberately the conservative half.~~
+## 🔴 **THE GAME DOES REPEAT, and this paragraph predicted its own refutation.**
+## It said: *"If the game does repeat, this is a difference a human will notice
+## as 'I have to flick it again'."* On 2026-09-02 a human who has played both
+## reported exactly that — *"holding only moves one item. In game it actually
+## continues to move when holding up/down, just at a medium pace"*.
+##
+## So one-step-per-deflection is no longer the conservative reading; it is a
+## known defect. The mechanism is implemented below and the **rate is not
+## shipped** — see `REPEAT_DELAY` for why an approximate one is worse than none.
+
+## ✅ DECODED 2026-09-01, and it replaces an authored value.
+##
+## This was **0.5**, chosen as a *floor* rather than as a value: Godot's action
+## deadzone for the `ui_*` actions is 0.50, so the latch must not arm below it —
+## the action itself would not read as pressed and the step would be swallowed
+## anyway, leaving the latch armed against a press that never happened. That
+## reasoning still holds and 0.61 is comfortably above the floor.
+##
+## The game's own threshold is now measured: it **digitises the left stick to
+## four direction bits at 61 % deflection**, so it never sees a velocity at all
+## (`docs/re/input-button-numbering-is-remapped.md` and the corrected
+## `input-pad-read-path.md`). Between 0.50 and 0.61 Godot reports `ui_down`
+## pressed and the real game reports nothing; at 0.5 this port stepped there.
+##
+## 📌 The mechanism also corroborates the human's fix rather than merely
+## agreeing with it: a control that digitises to bits cannot express a rate, so
+## "one step per deflection" is what the hardware layer *can* produce, not a
+## conservative guess that happened to look right.
+##
+## ⚠️ **The 0.11 gap to `RELEASE` stays AUTHORED.** Nothing measured says the
+## game has hysteresis at all, let alone how wide. Only the arm threshold moved.
+##
+## 🔴 **This changes how the stick feels and a human chose the old number.**
+## Asserted at the device level below and in `tools/port/verify-input`, but a
+## feel-test is the real check: revert this one constant to 0.5 if 0.61 reads as
+## a stick that needs pushing too far.
+const ENTER := 0.61
+
+## Release lower than it arms. Without the gap a stick resting near 0.5 chatters
+## across the boundary and re-arms on noise, which is the original bug wearing a
+## smaller number.
+const RELEASE := 0.4
+
+## ## 3. A held direction repeats — MECHANISM PRESENT, RATE NOT SHIPPED
+##
+## A human who has played both reported it on 2026-09-02: *"holding only moves
+## one item. In game it actually continues to move when holding up/down, just at
+## a medium pace"*, and separately *"Confirmed D-Pad does repeat when holding
+## too."* So the FACT covers both input devices, which is why `held_direction()`
+## polls the pad and the keyboard and not just the stick.
+##
+## 🔴 **THE RATE IS DELIBERATELY UNSET, AND THE REPEAT DOES NOT RUN UNTIL IT IS
+## MEASURED.** The instruction is explicit: *"Take the RATE from the Decoder — do
+## NOT ship a placeholder interval. An invented rate here is indistinguishable
+## from a measured one later, and this is the exact field where that already cost
+## us."*
+##
+## An earlier draft of this file had 0.40 / 0.20 with a paragraph explaining that
+## they were authored. **That is precisely the failure mode named above** — the
+## explanation would have been merged, the numbers would have felt roughly right,
+## and nothing afterwards could distinguish them from a measurement. They are
+## removed rather than commented out.
+##
+## 📌 **A constant interval is the right SHAPE, and that part IS measured.** The
+## game digitises the left stick to four direction bits at 61 % deflection
+## (`ENTER` above), so it cannot see deflection magnitude at all — a repeat it
+## drives cannot be faster-the-harder-you-push. That excludes the one competing
+## model, so only the two constants are open, and one measurement closes both.
+##
+## ⚠️ **TO ADOPT, TWO THINGS CHANGE, NOT ONE.** Set both constants to the
+## measured seconds — and update `tools/port/verify-input`, whose row *"a held
+## stick is ONE step, not six"* currently asserts **the absence of this
+## feature**. It passes today because the repeat is inert; the moment a rate is
+## adopted a held stick SHOULD produce further steps, and that green row would
+## go red for the right reason and be read as a regression.
+##
+## 📌 That row is not wrong. A check written against today's behaviour becomes an
+## assertion that the behaviour never changes, and this one has the additional
+## trap of looking like a bug-fix regression test — it was written for the
+## jitter defect, and the repeat is not that defect returning.
+## `pad-repeat` in `BLOCKED.md` carries the request.
+const REPEAT_DELAY := -1.0
+const REPEAT_INTERVAL := -1.0
+
+
+## Whether a measured repeat rate has been adopted. Until it has, the port keeps
+## its current one-step-per-deflection behaviour, which is KNOWN WRONG but is
+## wrong in a way nobody will mistake for a measurement.
+static func repeat_rate_known() -> bool:
+	return REPEAT_DELAY > 0.0 and REPEAT_INTERVAL > 0.0
+
+## Only the left stick. The triggers are axes too, and latching them here would
+## silently swallow input the port does not read yet but might.
+const STICK := [JOY_AXIS_LEFT_X, JOY_AXIS_LEFT_Y]
+
+var _latched: Dictionary = {}
+var _repeat_direction := 0
+var _repeat_clock := 0.0
+
+
+## Add the joypad buttons the built-in map omits. Returns a human-readable line,
+## or "" if nothing needed adding — so a future Godot that ships these bindings
+## makes this quietly stop reporting rather than double-binding.
+static func bind_missing() -> String:
+	var added := PackedStringArray()
+	for pair in [["ui_accept", JOY_BUTTON_A, "Ⓐ"], ["ui_cancel", JOY_BUTTON_B, "Ⓑ"]]:
+		var action: String = pair[0]
+		var button: int = pair[1]
+		if not InputMap.has_action(action):
+			# Not a warning we can act on, but silence here would present as the
+			# original bug and send the next person back to the controller.
+			push_warning("gamepad: no such action %s -- pad button unbound" % action)
+			continue
+		if _has_button(action, button):
+			continue
+		var ev := InputEventJoypadButton.new()
+		ev.button_index = button
+		InputMap.action_add_event(action, ev)
+		added.append("%s -> %s" % [pair[2], action])
+	if added.is_empty():
+		return ""
+	return "pad:   bound %s (Godot 4.7.2 binds no joypad button to either)" % \
+		", ".join(added)
+
+
+static func _has_button(action: String, button: int) -> bool:
+	for e in InputMap.action_get_events(action):
+		if e is InputEventJoypadButton and e.button_index == button:
+			return true
+	return false
+
+
+## True if this event should be acted on. Everything that is already an edge —
+## keys, d-pad, mouse — passes straight through; only the analog stick is
+## latched, and only on the two axes the navigation actions are bound to.
+func accepts(event: InputEvent) -> bool:
+	if not (event is InputEventJoypadMotion):
+		return true
+	var axis: int = event.axis
+	if not STICK.has(axis):
+		return true
+	var value: float = event.axis_value
+	var direction := 0
+	if value >= ENTER:
+		direction = 1
+	elif value <= -ENTER:
+		direction = -1
+
+	if direction == 0:
+		# Neutral enough to re-arm? The gap between RELEASE and ENTER is the
+		# hysteresis band: inside it the stick is neither a new press nor
+		# released, so the latch is left exactly as it was.
+		if absf(value) <= RELEASE:
+			_latched[axis] = 0
+		return false
+	if int(_latched.get(axis, 0)) == direction:
+		return false  # still held in the same direction: not a new press
+	_latched[axis] = direction
+	return true
+
+
+## Which way a direction is being HELD right now, as -1 (up), 0 or +1 (down).
+##
+## 🔴 **Polled at the DEVICE, never through `Input.is_action_pressed`.** `ui_up`
+## and `ui_down` are bound to the stick axis at Godot's 0.50 action deadzone,
+## while this port steps at the game's measured 0.61. Polling the action would
+## repeat throughout the 0.50–0.61 band — the exact band `ENTER` exists to
+## exclude — so the repeat would contradict the threshold on the same stick.
+## That is the input-map lesson again: assert the device, not the layer above it.
+func held_direction() -> int:
+	# The stick, from the latch `accepts()` already maintains, so the repeat and
+	# the first step read one state and cannot disagree about hysteresis.
+	var stick := int(_latched.get(JOY_AXIS_LEFT_Y, 0))
+	if stick != 0:
+		return stick
+	for device in Input.get_connected_joypads():
+		if Input.is_joy_button_pressed(device, JOY_BUTTON_DPAD_UP):
+			return -1
+		if Input.is_joy_button_pressed(device, JOY_BUTTON_DPAD_DOWN):
+			return 1
+	if Input.is_key_pressed(KEY_UP):
+		return -1
+	if Input.is_key_pressed(KEY_DOWN):
+		return 1
+	return 0
+
+
+## One repeat step, or 0. Call once per frame with the frame's delta.
+##
+## The FIRST step is not this function's: it comes from the event edge in
+## `_unhandled_input`, and the clock below starts from that same frame, so a held
+## direction gives one step now and the next only after `REPEAT_DELAY`. A change
+## of direction restarts the delay rather than inheriting the old cadence.
+func repeat_due(delta: float) -> int:
+	if not repeat_rate_known():
+		return 0
+	var direction := held_direction()
+	if direction == 0 or direction != _repeat_direction:
+		_repeat_direction = direction
+		_repeat_clock = 0.0
+		return 0
+	_repeat_clock += delta
+	if _repeat_clock < REPEAT_DELAY:
+		return 0
+	# Subtract rather than reset, so the cadence cannot drift with the frame rate
+	# -- at 140 fps and at 30 fps the same number of steps happen per second.
+	_repeat_clock -= REPEAT_INTERVAL
+	return direction
+
+
+## The pads Godot can see, for the startup line. A run where the human believes
+## a controller is connected and Godot disagrees should say so on its own,
+## rather than presenting as unresponsive buttons.
+static func report_devices() -> String:
+	var pads := Input.get_connected_joypads()
+	if pads.is_empty():
+		return "pad:   none connected -- keyboard only (Enter/Space = Ⓐ, Escape = Ⓑ)"
+	var names := PackedStringArray()
+	for j in pads:
+		names.append("[%d] %s" % [j, Input.get_joy_name(j)])
+	return "pad:   " + ", ".join(names)

port/scripts/gamepad.gd.uid

@@ -0,0 +1 @@
+uid://b34gxuqrvncbp

port/scripts/menu_audio.gd

@@ -0,0 +1,218 @@
+# The menu's sound: three cues and one music bed.
+#
+# EVERYTHING THIS CLASS PLAYS IS AUTHORED OR MEASURED, and the two are not the
+# same. `authored/audio.json` carries the distinction and the exporter copies it
+# into `manifest.json` alongside each file, so a reader of the export tree sees
+# it without having to find this project:
+#
+#   * WHICH WAVE a menu event plays was MEASURED off the running game (HANDOFF
+#     Q8) -- it is on the disc in no findable form. `Static.slb` has no RIFF, no
+#     seek chunk and no container.
+#   * WHICH TRACK the menu plays is CHOSEN. HANDOFF Q10 is a negative: all 32
+#     banks are named BGM_001..BGM_109 and nothing on the disc says which one a
+#     menu uses.
+#   * WHEN a cue fires is authored here, and §"When a cue fires" below says
+#     exactly which parts of that nobody has watched the game do.
+#
+# The wall (MISSION §2): this class reads **Ogg Vorbis**. It has never heard of
+# XMA, of `sound.pak` or of `Static.slb`, and it must not learn. The exporter
+# converts; the runtime plays.
+class_name MenuAudio
+extends Node
+
+## Cue name -> stream, from `manifest.json`'s `audio` entries of kind `se`.
+var cues: Dictionary = {}
+## Role -> {stream, loop}, from the entries of kind `bgm`.
+var beds: Dictionary = {}
+## Movie name -> what that voice export is KNOWN to be missing, from the
+## manifest's `incomplete`. Empty for an asset with no known gap.
+var _voice_gaps: Dictionary = {}
+
+## What `movie`'s voice export is known to be missing, or "" if nothing is.
+func incomplete_for(movie: String) -> String:
+	return String(_voice_gaps.get(movie, ""))
+
+## Movie name -> stream, from the entries of kind `voice`.
+##
+## A cutscene's dialogue is NOT in its `.ogv`. On this disc a movie carries music
+## and effects only and the voice is a separate continuous XMA stream in
+## `sound.pak`, bound by the movie manifest -- so playing a movie means starting
+## two streams together, and a port that plays only the video is silently missing
+## every line of dialogue. That is what a human play-test heard.
+var voices: Dictionary = {}
+var error: String = ""
+
+## One player per cue name, so a move and a confirm can overlap rather than
+## cutting each other off. Three cues is not worth a pool.
+var _players: Dictionary = {}
+var _bed: AudioStreamPlayer = null
+var _bed_role := ""
+
+
+## Load every audio entry the manifest declares.
+##
+## Missing audio is NOT an error and does not stop a run: every milestone before
+## P6 exported none, and `--menu` must stay usable against one of those trees.
+## A cue that is listed but unreadable IS an error, because that is a broken
+## export rather than an old one.
+func configure(tree: ExportTree) -> bool:
+	var manifest := tree.manifest()
+	if manifest.is_empty():
+		error = tree.error
+		return false
+	for entry: Dictionary in manifest.get("audio", []):
+		# Through the resolver, so a mod can replace a cue or the music bed by
+		# dropping a file at the same relative path (MODDING rule 4). Reading
+		# `tree.root` directly here would have made audio the one asset kind a
+		# mod could not touch, for no reason a modder could have guessed.
+		var path := tree.resolve(String(entry.get("file", "")))
+		var stream := AudioStreamOggVorbis.load_from_file(path)
+		if stream == null:
+			error = "manifest lists audio %s but %s is not a readable Ogg Vorbis file" \
+				% [entry.get("name", "?"), path]
+			return false
+		match String(entry.get("kind", "")):
+			"se":
+				# A cue ends. Nothing measured says otherwise, and a looping
+				# cue would be a bug you hear rather than one you read.
+				stream.loop = false
+				cues[String(entry["name"])] = stream
+			"bgm":
+				# AUTHORED, and audibly imperfect on purpose. HANDOFF Q10: no
+				# loop-point field has been identified, so `restart` replays
+				# from sample 0 -- the listener hears the track's own fade-out
+				# and its trailing silence before the music returns. Trimming to
+				# the fade would sound better and would INVENT a loop point,
+				# which is worse: an invented one is indistinguishable from a
+				# decoded one a month later. See authored/audio.json loop_why.
+				stream.loop = String(entry.get("loop_mode", "")) == "restart"
+				beds[String(entry["name"])] = stream
+			"voice":
+				# A cutscene's voice-over ends with the cutscene. It is keyed by
+				# MOVIE NAME, not by a role: the binding came off the disc's own
+				# movie manifest, so unlike the music bed there is nothing
+				# authored about which recording belongs to which picture.
+				stream.loop = false
+				voices[String(entry["name"])] = stream
+				# Carried alongside the stream so the runtime can announce a known gap
+				# at the moment it plays one. Absent means nothing is KNOWN to be
+				# missing -- never that the asset was checked and is complete.
+				if entry.has("incomplete"):
+					_voice_gaps[String(entry["name"])] = String(entry["incomplete"])
+			_:
+				push_warning("manifest audio entry %s has kind %s, which this build does not play"
+					% [entry.get("name", "?"), entry.get("kind", "?")])
+	return true
+
+
+## True when this export carries no audio at all -- an export taken before P6.
+func silent() -> bool:
+	return cues.is_empty() and beds.is_empty() and voices.is_empty()
+
+
+# --- The cutscene voice -------------------------------------------------------
+
+var _voice: AudioStreamPlayer = null
+
+
+## Start a movie's dialogue, or do nothing when the export carries none.
+##
+## **No offset, and none is authored.** The voice plays from the video's first
+## frame, so the two streams are started together and nothing here compensates
+## for anything. If they ever drift, that is a fact about the export, not a
+## constant to be tuned in this file.
+##
+## Returns whether a stream was found, so the caller can SAY that a movie is
+## unvoiced rather than leave silence looking like success.
+func play_voice(movie: String) -> bool:
+	if not voices.has(movie):
+		return false
+	if _voice == null:
+		_voice = AudioStreamPlayer.new()
+		add_child(_voice)
+	_voice.stream = voices[movie]
+	_voice.play()
+	return true
+
+
+## Stop the dialogue. Called when the movie ends OR is skipped -- a voice that
+## outlived a skipped intro would play over the title screen.
+func stop_voice() -> void:
+	if _voice != null:
+		_voice.stop()
+
+
+# --- When a cue fires ---------------------------------------------------------
+#
+# MEASURED (HANDOFF Q5 + Q8): a d-pad press that MOVES the cursor plays the move
+# cue, and left/right play nothing at all. `MenuFlow.move()` returns whether the
+# cursor actually moved for exactly this reason, so a press at the end of a
+# non-wrapping list cannot click.
+#
+# NOT MEASURED, and authored here: whether Ⓐ or Ⓑ click when nothing is bound to
+# them. Nobody has watched the game take a dead press. This class stays silent in
+# that case, which is the choice that invents the least -- a sound the game does
+# not make is a wrong fact you can hear, whereas a missing one is a gap. Ask the
+# RE agent before relying on it either way.
+
+
+func play(cue: String) -> void:
+	if not cues.has(cue):
+		return
+	if not _players.has(cue):
+		var p := AudioStreamPlayer.new()
+		p.stream = cues[cue]
+		add_child(p)
+		_players[cue] = p
+	(_players[cue] as AudioStreamPlayer).play()
+
+
+## Start the music bed for a role, or do nothing if it is already playing.
+##
+## Idempotent because the menu re-enters screens constantly -- Ⓑ back to the main
+## menu must not restart the music, and a bed that restarts on every navigation
+## is the kind of wrong that reads as "the audio works".
+func play_bed(role: String) -> void:
+	if not beds.has(role) or _bed_role == role:
+		return
+	if _bed == null:
+		_bed = AudioStreamPlayer.new()
+		add_child(_bed)
+	_bed.stream = beds[role]
+	_bed_role = role
+	_bed.play()
+
+
+## 🔴 DEAD CODE, and that is the finding rather than a tidiness note.
+##
+## Nothing in the port calls this. The bed therefore starts when the main menu
+## goes live and never stops -- through the cutscene, and on to the title after
+## it. Nobody chose that; it is what happens when the only way to stop something
+## is a function no caller remembers.
+##
+## It is the mirror of `ScreenView.skipped`, which was written every frame and
+## read by nobody. One is a fact recorded and never surfaced, the other a
+## capability provided and never used, and both were invisible for the same
+## reason: nothing fails when they are missed.
+##
+## Kept, not deleted. The day a capture says whether the game's menu music ducks
+## under a movie, this is the one line that has to change.
+func stop_bed() -> void:
+	if _bed != null:
+		_bed.stop()
+	_bed_role = ""
+
+
+## Is the music bed sounding right now? Used by the boot to ANNOUNCE that it is
+## still playing under a movie, rather than to stop it.
+func bed_playing() -> bool:
+	return _bed != null and _bed.playing
+
+
+## What the audio server is actually doing, for a run's write-up.
+##
+## `docs/port/AUDIO-VERIFICATION.md`: "recorded under a dummy driver" is a
+## weaker claim than "heard", and the difference matters -- so the claim is
+## printed by the run that makes it rather than assumed by the person reading it.
+static func driver() -> String:
+	return AudioServer.get_driver_name()

port/scripts/menu_audio.gd.uid

@@ -0,0 +1 @@
+uid://badw3pulb0xpt

port/scripts/menu_flow.gd

@@ -0,0 +1,235 @@
+# Where the buttons go, and what the d-pad does.
+#
+# EVERYTHING IN HERE IS AUTHORED OR MEASURED -- none of it is on the disc.
+# HANDOFF Q6 closed the "what drives the flow" question with a negative: the
+# order is code, not data, in all four places it could have been. So this class
+# reads `authored/flow.json` and holds no rule of its own.
+#
+# The split is deliberate and is the derived/authored contract in miniature:
+#
+#   * the ORDER of the items is DERIVED -- each screen file's `buttons`, which
+#     the exporter fills from the button-role elements sorted by resting Y;
+#   * WHERE an item goes, WHICH item opens focused, and WHAT (B) does are
+#     AUTHORED, because they were measured off the running game or chosen.
+#
+# A rule that lived in GDScript instead would be invisible to the person whose
+# job is to notice that we decided it.
+class_name MenuFlow
+extends RefCounted
+
+## The authored `screens` map: screen name -> destinations, initial focus, (B).
+var screens: Dictionary = {}
+## The authored `navigation` block: wrap, left/right, input during a transition.
+var navigation: Dictionary = {}
+
+## Where we are and how we got here, oldest first. The last entry is current.
+## (B) restores the focus recorded on the entry it pops back to -- HANDOFF Q5
+## measured that the game does this, so the stack carries a focus, not just a
+## name.
+var stack: Array[Dictionary] = []
+
+var error: String = ""
+
+## Nothing happened. Returned rather than `null` so a caller reads one shape.
+const NONE := {"kind": "none"}
+
+
+func configure(flow: Variant) -> bool:
+	if typeof(flow) != TYPE_DICTIONARY:
+		error = "authored/flow.json did not parse to an object"
+		return false
+	if not flow.has("screens") or not flow.has("navigation"):
+		error = "authored/flow.json has no `screens`/`navigation` block -- this build needs both"
+		return false
+	screens = flow["screens"]
+	navigation = flow["navigation"]
+	return true
+
+
+func known(name: String) -> bool:
+	return screens.has(name) and typeof(screens[name]) == TYPE_DICTIONARY
+
+
+func current() -> String:
+	return String(stack[stack.size() - 1]["screen"]) if not stack.is_empty() else ""
+
+
+func focus() -> String:
+	return String(stack[stack.size() - 1]["focus"]) if not stack.is_empty() else ""
+
+
+## The item a screen opens on.
+##
+## Authored per screen. Where the authored value names a button this screen does
+## not have -- a mistyped id, or an export whose buttons moved -- fall back to
+## the first button rather than to nothing, and SAY SO: a menu that opens with
+## no focus looks like a rendering bug, and this is the one place that mistake
+## would hide.
+##
+## 🔴 THE FALLBACK IS A REPAIR, NOT A DEFAULT, and since 2026-08-31 that is
+## measured rather than fastidious. `DIFFICULTY` -- EASY/NORMAL/HARD/BACK --
+## opens on **NORMAL, the second of four**, so "a screen opens on its first item"
+## is refuted as a description of this game. On `EXTRAS`, `TUTORIAL` and
+## `OPTIONS` the named item and the top item coincide by accident.
+##
+## So `buttons[0]` here is what to draw when the DATA IS BROKEN, and it warns
+## precisely because it is not a claim about the game. If a screen ever reaches
+## this line silently, the port will be showing a top-item default for a game
+## that does not always have one.
+func initial_focus(name: String, buttons: Array) -> String:
+	if buttons.is_empty():
+		return ""
+	var want := String(screens.get(name, {}).get("initial_focus", ""))
+	if want != "" and buttons.has(want):
+		return want
+	if want != "":
+		push_warning("flow.json opens %s on %s, which is not one of its buttons %s" % [name, want, buttons])
+	return String(buttons[0])
+
+
+## Where a screen's cursor was when the player last left it.
+##
+## MEASURED 2026-08-30: the main menu remembers its cursor across a round trip
+## through the title -- (B) out and (A) back returns to the item you left. The
+## port used to reset to `initial_focus` on every entry, so a player who moved to
+## EXTRAS, pressed (B) and then (A) landed back on NEW GAME.
+##
+## 🔴 Which screens have this is AUTHORED, not derived: `focus_persists` in
+## `authored/flow.json`, true only on `main_menu`. The measurement is of that one
+## screen, and widening it would contradict another measurement -- `extras` opens
+## on MISSION SELECT as a MEASURED initial focus, which a remembered cursor would
+## override. `wrap` generalises because it was measured on two screens; this was
+## measured on one.
+var remembered: Dictionary = {}
+
+
+## What a screen opens on: what it was left on, if it is one of the screens that
+## remembers, else the authored opening item.
+func opening_focus(name: String, buttons: Array) -> String:
+	var keep := bool(screens.get(name, {}).get("focus_persists", false))
+	var was := String(remembered.get(name, ""))
+	if keep and was != "" and buttons.has(was):
+		return was
+	return initial_focus(name, buttons)
+
+
+func enter(name: String, buttons: Array) -> void:
+	stack.append({"screen": name, "focus": opening_focus(name, buttons)})
+
+
+## Move the cursor. Returns true when it actually moved, so a caller can fire the
+## move cue only on a real move (P6) rather than on every press.
+##
+## MEASURED, HANDOFF Q5: up/down move one item and WRAP at both ends -- on the
+## 5-item main menu and the 3-item EXTRAS both, so it is a menu rule. `wrap` is
+## read from `authored/flow.json` rather than written here, because it is a
+## measurement and the day it is contradicted the fix is a data edit.
+func move(step: int, buttons: Array) -> bool:
+	if stack.is_empty() or buttons.size() < 2:
+		return false
+	var at := buttons.find(focus())
+	if at < 0:
+		at = 0
+	var to := at + step
+	if bool(navigation.get("wrap", true)):
+		to = posmod(to, buttons.size())
+	else:
+		to = clampi(to, 0, buttons.size() - 1)
+	if to == at:
+		return false
+	set_focus(String(buttons[to]))
+	return true
+
+
+## Set the top of the stack's focus AND remember it, in one place.
+##
+## Two call sites set focus -- a cursor move and (B)'s restore -- and a memory
+## updated at only one of them would be right until the player used the other.
+func set_focus(id: String) -> void:
+	if stack.is_empty():
+		return
+	stack[stack.size() - 1]["focus"] = id
+	remembered[current()] = id
+
+
+## (A). Returns what the authored flow says the focused item opens.
+##
+##   {"kind": "enter",   "goto": <screen>, "label": …}  -- go there
+##   {"kind": "blocked", "label": …, "why": …}          -- a real destination
+##                                                          that is not in this
+##                                                          export
+##   {"kind": "video",   "video": …, "skipped": […],    -- the destination is
+##                       "after": {…}}                      absent but its chain
+##                                                          ends in a movie we
+##                                                          DO have (P7)
+##   {"kind": "none"}                                   -- nothing bound
+##
+## `blocked` is not an error and is not an unknown. Those five destinations were
+## measured off the running game; they live in other archives and this milestone
+## does not export them. Saying "blocked" rather than "none" keeps the two apart.
+func accept(buttons: Array) -> Dictionary:
+	if stack.is_empty():
+		return NONE
+	var screen: Dictionary = screens.get(current(), {})
+	# A screen with no buttons -- the title -- can still take (A).
+	if buttons.is_empty():
+		return _target(screen.get("on_accept", null), "A")
+	var button: Dictionary = screen.get("buttons", {}).get(focus(), {})
+	if button.is_empty():
+		return NONE
+	var label := String(button.get("label", focus()))
+	if button.get("goto", null) == null:
+		# A destination this export does not carry, but whose CHAIN ends in
+		# something it does: `NEW GAME` opens `DIFFICULTY`, then `SELECT DATA`,
+		# and only then the new-game movie. The port has the movie and neither
+		# screen (P7).
+		#
+		# This is returned as its own kind rather than folded into `blocked`,
+		# because the caller has to announce the skip. A port that quietly
+		# jumped from `NEW GAME` to the intro would be showing a sequence the
+		# game does not have, and nothing on screen would say so.
+		if button.get("then_video", null) != null:
+			return {
+				"kind": "video",
+				"label": label,
+				"video": String(button["then_video"]),
+				"skipped": button.get("skipped_chain", []),
+				"skippable": bool(button.get("skippable", false)),
+				"after": button.get("after_video", {}),
+			}
+		return {"kind": "blocked", "label": label, "why": String(button.get("blocked", ""))}
+	return {"kind": "enter", "goto": String(button["goto"]), "label": label}
+
+
+## (B), and EXTRAS' own `BACK` item, which is treated as the same thing --
+## nothing measured distinguishes them and inventing a difference would be a
+## guess with no evidence behind it.
+##
+## MEASURED, HANDOFF Q5: (B) goes up one level and RESTORES FOCUS to the item you
+## came from. So the target comes from the authored flow, but the focus comes
+## from the STACK -- and only when the stack agrees about where we are going. A
+## run that started straight on a submenu has no history to restore and enters
+## the parent at its authored initial focus instead.
+func cancel() -> Dictionary:
+	if stack.is_empty():
+		return NONE
+	var target: Variant = screens.get(current(), {}).get("on_cancel", null)
+	var out := _target(target, "B")
+	if out["kind"] != "enter":
+		return out
+	if stack.size() >= 2 and String(stack[stack.size() - 2]["screen"]) == out["goto"]:
+		out["restore_focus"] = String(stack[stack.size() - 2]["focus"])
+		out["pop"] = true
+	return out
+
+
+## Pop back to the parent, keeping the focus it was left on.
+func pop() -> void:
+	if stack.size() >= 2:
+		stack.pop_back()
+
+
+static func _target(target: Variant, label: String) -> Dictionary:
+	if typeof(target) != TYPE_DICTIONARY or target.get("goto", null) == null:
+		return NONE
+	return {"kind": "enter", "goto": String(target["goto"]), "label": label}

port/scripts/menu_flow.gd.uid

@@ -0,0 +1 @@
+uid://dyqb3b450d21x

port/scripts/screen_view.gd

@@ -7,7 +7,7 @@
 # authored and applied in exactly one place.
 #
 # REST reproduces what the export's `rest` field says, which is what
-# `sylpheed-cli screen render` draws. It is kept so `tools/verify-screen` can
+# `sylpheed-cli screen render` draws. It is kept so `tools/port/verify-screen` can
 # hold both renderers to the same assumption. The two modes DISAGREE on six
 # elements in this export, and the running game sides with the timeline -- see
 # `docs/DECISIONS.md`.
@@ -37,10 +37,152 @@ var pose_mode: Pose = Pose.TIMELINE
 var time_units: float = 0.0
 var units_per_second: float = 60.0
 
-## Duration of the ramp into the final, untimed keyframe -- the screen playing
-## itself out. Authored (`authored/timing.json`): the disc has no time slot on
-## that keyframe, so this is the one unknown duration per screen.
-var exit_ramp_units: float = 24.0
+## Duration of the ramp into a final UNTIMED keyframe -- a shape this export no
+## longer contains (866 keyframes across 16 screens, **0** untimed).
+##
+## 🔴 THE TWO SENTENCES THAT WERE HERE ARE PRE-FIX AND I LEFT THEM WHEN I FIXED
+## THE CODE BELOW. They read: *"Authored (`authored/timing.json`): the disc has no
+## time slot on that keyframe, so this is the one unknown duration per screen."*
+## Both halves are now false — the authored entry was DELETED as progress, and
+## the corrected record layout times every pose, so there is no unknown to
+## author. The correction lived immediately below while the claim stayed on top.
+## Synthetic duration for a group's final UNTIMED keyframe.
+##
+## 🔴 NEGATIVE MEANS "NOT SUPPLIED", AND THAT IS NOW THE DEFAULT. It used to
+## default to **24.0** -- the exact constant HANDOFF ask 2 told this port to
+## author and that the port refused, because the file's own ramp is 10 units and
+## authoring 24 would run the fade 2.4x too long. The authored entry was deleted
+## as progress when the corrected record layout removed the unknown; the default
+## quietly put the refuted number back where nobody would look for it.
+##
+## The branch is kept so an older export still loads, but it no longer INVENTS a
+## duration: if a group really does end untimed, the port says so and declines to
+## make one up, which is the same choice `black_hold_units` and
+## `input_during_transition` make in `authored/timing.json`.
+##
+## Unreachable on today's export -- 866 keyframes across 16 screens, 0 untimed.
+var exit_ramp_units: float = -1.0
+var _warned_untimed := false
+
+## Focus records this screen draws unconditionally, and the period each loops on.
+##
+## `{ <parent element id>: { "record_element": String, "period_units": float } }`,
+## from `authored/timing.json` `looping_focus_records`, keyed there by
+## `<screen>/<element>` and narrowed to this screen by `load_screen`.
+##
+## ⚠️ A LOOKUP, NOT A RULE, and the census is why. The spinning ring is a rule
+## (`spin_period_units`) because 16 of 212 elements match its shape and all 16
+## are focus rings. The analogous rule for a pulse -- keyframes varying only in
+## alpha, first alpha equal to last -- matches **82 of 212**, including
+## `ptcopyright`, `palogo_sqex`, `ptmsg` and every `_eff` fade. It would make the
+## copyright notice pulse. Narrowed to focus records it matches exactly one
+## distinct element, and a rule justified by n=1 is a special case wearing a
+## rule's clothes.
+## The one instant a settled screen is posed at, in keyframe units, or -1.
+##
+## 🔴 Replaces per-element `rest()` while `holding`, where the export gives a
+## wide enough window. `rest()` returns each element's last HOLD keyframe chosen
+## independently of every other element -- right for anything that ends the
+## screen settled, and exactly wrong for a **transient**. The title's
+## `ptlogo_back2eff1` is a two-frame flash (0 until t52, 255 at t54-56, 0 by
+## t58), so its last hold IS the flash peak and `rest()` leaves it burning. There
+## are five of them, and `rest()` draws all five at once.
+##
+## ⚠️ **Only where the window is wide.** Across this export the widths split with
+## nothing in between: `press_start` 214, `publisher_logo` 190,
+## `developer_logos` 145, `title` 76 -- then `main_menu` 12, `extras` 12, the
+## loading screens 8 and 4. A 12-unit "settle" on a menu that builds in until
+## t=70 is a gap between staggered ramps, not a settled pose. The bar is 30
+## units: the Decoder's disc-wide census puts the knee there (30 % of bundles
+## have a window >= 30, 42 % have one under 10), and this export's own screens
+## sit 4x either side of it with nothing between 12 and 46.
+var settle_instant: float = -1.0
+const SETTLE_WINDOW_MIN := 30.0
+
+## Set when a caller pinned an EXPLICIT instant (`--time=`), which then wins over
+## `settle_instant`.
+##
+## 🔴 Without this, `--time=` was silently ignored on every screen with a settle
+## window of 30 units or more, because `pose_at` overwrote the requested `t` with
+## `settle_instant` whenever `holding` was true. The flag parsed, the log printed
+## the time asked for, and the pose came from somewhere else.
+##
+## `press_start` is the case that exposed it. Its window is [0, 214] -- the long
+## dead stretch BEFORE the plate appears -- so its settle instant is t=107, where
+## `ptbtn00` is alpha 0. The plate's only opaque frames are t=236-238. The result
+## was that the `PRESS (A)` plate could not be rendered **at any time at all**:
+## every instant anyone asked for was answered at t=107, and the screen came back
+## empty with `ptbtn00 (transparent at rest)`.
+##
+## The settle instant is still right for a screen that has ARRIVED and is sitting
+## there, which is what it was measured for. It is not right as an answer to a
+## question about a different instant.
+var frozen := false
+
+var looping_focus: Dictionary = {}
+
+## Pin the looping record's phase instead of taking it from `time_units`.
+##
+## 🔴 WHY THIS EXISTS. The pulse is CORRECT -- a thing that pulses does not stop
+## because the screen has arrived -- but it rides the wall clock, so a captured
+## frame lands wherever the grab happened to fall. `verify-screen press_start`
+## returned `over3` **5021, 8919, 5021** on three identical runs: a regression
+## detector that answers differently each time teaches its reader to ignore it.
+##
+## The port is not the thing that is wrong here, so the port's behaviour does not
+## change: negative means "free-running", which stays the default everywhere. The
+## HARNESS pins a phase so the comparison is deterministic.
+var loop_phase_units: float = -1.0
+
+## Element ids whose nested `.rat` leaf the runtime actually draws.
+##
+## The exporter flags `leaf_carries_geometry` on 15 elements -- a census fact.
+## This is narrower on purpose: it is the subset the DECODE covers, and it comes
+## from `authored/rendering.json` with its reasons. Two elements are flagged and
+## deliberately not drawn (`title_jp/ptlogo_eff2`, `pgloading_loop5`), because
+## drawing them would extend a decode past the case it was fitted on and neither
+## can be adjudicated here -- `title_jp` has no oracle capture, and the
+## consistency harness compares against a renderer that draws no leaves at all.
+var draw_leaf_for: Array = []
+
+## Elements the game draws ADDITIVELY, by screen -- `authored/rendering.json`
+## The canvas items backing the paint-order runs. See `_band`.
+var _bands: Array[RID] = []
+## The canvas item the next `_draw_quad` paints into. It is a member rather than
+## a parameter because every draw funnels through `_draw_quad` from three call
+## sites, and threading a RID through `_draw_leaf` and `_draw_focus` would change
+## their signatures to carry a value neither of them chooses.
+var _target: RID = RID()
+## 🔴 THIS USED TO BE `CanvasItemMaterial.new()` AND NOTHING ELSE, so the blend
+## mode was its default, MIX. Every band was created, ordered and assigned
+## correctly and the screen composited exactly as before: `ptframe1` moved from
+## 22.72 to 22.69. That is the failure mode this port keeps meeting -- the change
+## ran, produced a number, and the number was WRONG BY BEING RIGHT-LOOKING. It was
+## caught only because the measurement predicted a large move and a 0.03 move is
+## not one.
+var _additive_material := _make_additive()
+
+
+static func _make_additive() -> CanvasItemMaterial:
+	var m := CanvasItemMaterial.new()
+	m.blend_mode = CanvasItemMaterial.BLEND_MODE_ADD
+	return m
+
+## Whether this screen replays a leaf's group. See `authored/rendering.json`.
+var loop_leaf := false
+
+## Pin the LEAF's phase independently of the screen's pose, in units. -1 = off.
+##
+## Built because a measured value could not be tested. The Decoder's refined fit
+## for the `ptloop` sweeps is t=357.7 units, and `verify-capture` passed it as
+## `--time=5.9617` -- which poses the WHOLE SCREEN there. The title's own group
+## ends at t=269, so that fades everything out and scores 30.97 % against the
+## capture. The instant was only ever about the sweeps, whose leaf runs to t=600.
+##
+## So the fit was untestable: the only way to ask for it also destroyed the rest
+## of the frame. This separates the two clocks -- the screen sits at its settled
+## pose, the leaf is placed at whatever phase is being tested.
+var leaf_time_units: float = -1.0
 
 ## While true the screen holds at `rest` and never plays its exit. The
 ## sequencer clears it to send the screen away.
@@ -50,6 +192,19 @@ var tree: ExportTree = null
 var screen: Dictionary = {}
 var textures: Dictionary = {}
 var skipped: Array[String] = []
+
+## Structural skips accumulated over the life of the CURRENT screen, deduplicated.
+##
+## 🔴 `skipped` itself is per-frame and was read by NOBODY. Its own comment says
+## "a silently missing element looks like art" -- and for eight milestones
+## nothing printed it, so the port could drop an element every frame and say so
+## to no one. That is the same shape as the black hold, which was implemented,
+## called, and emitted nothing until somebody filmed it.
+##
+## Only STRUCTURAL skips accumulate here. "(transparent at rest)" is ordinary
+## animation -- every element is transparent at some instant -- and reporting it
+## would bury the three that mean something under the one that never does.
+var structural_skips: Array[String] = []
 var drawn: Array[String] = []
 
 ## Which button is highlighted, by element id. P1 leaves it empty: initial focus
@@ -72,6 +227,10 @@ func load_screen(t: ExportTree, name: String) -> bool:
 		ProjectSettings.get_setting("display/window/size/viewport_height"))
 	if Vector2i(int(design[0]), int(design[1])) != viewport:
 		push_warning("screen %s is authored at %sx%s, viewport is %s" % [name, design[0], design[1], viewport])
+	var w: Array = screen.get("settle_window", [])
+	settle_instant = -1.0
+	if w.size() == 3 and float(w[1]) - float(w[0]) >= SETTLE_WINDOW_MIN:
+		settle_instant = float(w[2])
 	_load_textures()
 	queue_redraw()
 	return true
@@ -83,6 +242,8 @@ func _load_textures() -> void:
 		var paths: Array = [element.get("sprite", ""), element.get("focus_sprite", "")]
 		# The focus record's own elements carry their own sprites -- the ring is
 		# only reachable this way.
+		for fe: Dictionary in element.get("leaf", {}).get("elements", []):
+			paths.append(fe.get("sprite", ""))
 		for fe: Dictionary in element.get("focus", {}).get("elements", []):
 			paths.append(fe.get("sprite", ""))
 		for rel: String in paths:
@@ -155,8 +316,30 @@ func pose_at(element: Dictionary, t: float) -> Dictionary:
 		return frames[0] if not frames.is_empty() else element.get("rest", {})
 	# While holding, stop at the hold: past it the group is ramping out, and a
 	# screen that has arrived and is sitting there is not leaving.
-	if holding:
-		t = minf(t, settle_units(element))
+	# `frozen` means a caller pinned an EXPLICIT instant and wants THAT instant,
+	# not the settled pose and not a per-element clamp. Both clamps are skipped.
+	if holding and not frozen:
+		# One instant for the whole screen where the disc gives a wide enough
+		# window; otherwise each element's own hold, which is what this port did
+		# everywhere until 2026-08-29.
+		# 🔴 THIS WAS AN ASSIGNMENT AND THE COMMENT ABOVE SAYS "STOP AT". It read
+		# `t = settle_instant ...`, so from the screen's FIRST FRAME every element
+		# was posed at the settled instant and the build-in was never drawn. The
+		# else-branch beside it always clamped; only this half did not, and the
+		# asymmetry is the whole defect.
+		#
+		# A human on a 140 fps GPU: "the logos just switch, I cannot discern any
+		# animation at all." Filmed and measured with `tools/motion-census`: the
+		# sharp logo's region sat at 0.40549 from unit 7.9 through 28.2 -- the
+		# same value it holds at 45 and beyond -- while its declared ramp is
+		# 15 -> 30. It was already full before its ramp began.
+		#
+		# ⚠️ THE HOLD IS NOT THE BUG AND MUST SURVIVE THIS. The Decoder measured
+		# the game holding one picture for 3.34 s on this screen -- LONGER than
+		# the port's 3.30 -- because `palogo_sqex` declares 205 of its 255 units
+		# as a flat plateau. The deficit was only ever in the ramps. Clamping
+		# rather than assigning keeps the plateau exactly and restores the ramp.
+		t = minf(t, settle_instant) if settle_instant >= 0.0 else minf(t, settle_units(element))
 	# The exit. The final keyframe carries no `t` -- the disc has no slot for one
 	# -- so it is given a synthetic time `exit_ramp_units` after the last timed
 	# frame and then interpolated like any other. That keeps one code path: the
@@ -169,9 +352,17 @@ func pose_at(element: Dictionary, t: float) -> Dictionary:
 	# was measured and refuted -- see authored/timing.json.
 	var last_frame: Dictionary = frames[frames.size() - 1]
 	if not last_frame.has("t"):
-		var exit_frame := last_frame.duplicate()
-		exit_frame["t"] = float(timed[timed.size() - 1]["t"]) + exit_ramp_units
-		timed.append(exit_frame)
+		if exit_ramp_units < 0.0:
+			if not _warned_untimed:
+				_warned_untimed = true
+				push_error("%s has an untimed final keyframe and no exit_ramp_units was supplied. "
+					% [screen.get("name", "?")]
+					+ "Not inventing one: the group ends at its last timed frame. "
+					+ "This export predates the corrected record layout -- re-export it.")
+		else:
+			var exit_frame := last_frame.duplicate()
+			exit_frame["t"] = float(timed[timed.size() - 1]["t"]) + exit_ramp_units
+			timed.append(exit_frame)
 
 	if t <= float(timed[0]["t"]):
 		return timed[0]
@@ -228,6 +419,91 @@ static func settle_units(element: Dictionary) -> float:
 	return last
 
 
+## How long one turn takes, in keyframe units, for an element that spins — or 0.
+##
+## The rule is STRUCTURAL and narrow: exactly two keyframes, differing in
+## **nothing but** `rotation_deg`, by a full 360. The period is the SPAN between
+## the two poses.
+##
+## 🔴 THIS PARAGRAPH DESCRIBED THE PRE-FIX RULE WHILE THE BODY BELOW IMPLEMENTED
+## THE CORRECTED ONE. It read: *"with the first timed and the second untimed. The
+## period is the first keyframe's declared `t`."* Under the corrected record
+## layout every pose is timed, so `b.has("t")` is always true, that rule returns
+## 0, and the ring stops spinning — which is exactly the failure the body's own
+## comment records and fixes. A doc comment and its function contradicting each
+## other, with the doc stating the refuted version.
+##
+## Its disc-wide check, over this export: **16 of 212 elements match, and all 16
+## are focus rings** — `ptbtneff01` on the five main-menu buttons and
+## `ptbtneff02` on the three `EXTRAS` buttons, in both locales, every one of them
+## declaring `t = 120`. Zero false positives. That matters because the rule is
+## applied on the strength of a measurement taken on **one** button of one
+## screen; a rule that also caught something else would be extrapolating from
+## that measurement to elements nobody watched.
+##
+## ⚠️ It is a rule about SHAPE, not a decoded field. Nothing on the disc says
+## "this loops". What the disc says is 0° → 360° over `t`; what the RE agent
+## measured is that the turn repeats rather than stopping. Those are two
+## different sources and the day a loop flag is decoded, this goes.
+## The cycle length of a looping focus record, **derived in preference to authored**.
+##
+## The record header's `+0x08` says where the cycle restarts, and it is not the
+## last keyframe's time: the plate's glow ramps 0→80→0 over 105 units inside a
+## 120-unit cycle and rests dark for 15. The exporter now carries it as
+## `focus.loop_length_units`, so the period comes off the DISC.
+##
+## `authored/timing.json` had 120 already, from a wall-clock measurement of the
+## running game (≈2.37 s). **The two agree**, which is why this is a provenance
+## change and not a pixel change — an emulator stopwatch and a field on the disc,
+## sharing no instrument, landing on the same number. The authored value stays as
+## the fallback and as that second witness.
+##
+## A DISAGREEMENT IS ANNOUNCED, never silently resolved. Preferring one number
+## without saying so is how a measurement and a declaration drift apart for
+## milestones without anybody learning that they had.
+func _loop_period(focus: Dictionary, loop: Dictionary) -> float:
+	var authored := float(loop.get("period_units", 0.0))
+	var derived := float(focus.get("loop_length_units", 0.0))
+	if derived <= 0.0:
+		return authored
+	if authored > 0.0 and absf(derived - authored) > 0.5:
+		push_warning("focus record %s: the disc declares a %.0f-unit cycle, `authored/timing.json` says %.0f -- using the disc. One of them is wrong and this message is the only thing that will say so." % [String(focus.get("record", "?")), derived, authored])
+	return derived
+
+
+static func spin_period_units(element: Dictionary) -> float:
+	var frames: Array = element.get("keyframes", [])
+	if frames.size() != 2:
+		return 0.0
+	var a: Dictionary = frames[0]
+	var b: Dictionary = frames[1]
+	# 🔴 REWRITTEN for the corrected record layout, and it had SILENTLY STOPPED
+	# THE RING. The old rule required "the first timed and the second untimed",
+	# which was true when a group's data stopped short of its final time slot.
+	# Under the corrected layout every pose is timed -- the ring now reads
+	# `t=0 rot=0` then `t=120 rot=360` -- so `b.has("t")` was true, the rule
+	# returned 0, and the focus ring stopped spinning. Nothing reported it: a
+	# period of 0 is a legal "this element does not spin".
+	#
+	# `docs/port/BLOCKED.md` had listed `spin_period_units` among the five things
+	# the layout change touches. I checked `pose_at` and `exit_ramp_units` and
+	# did not work the list.
+	#
+	# The period is now the SPAN between the two poses rather than the first
+	# one's declared time. On the ring that is 120 - 0 = 120 units, the same
+	# number the old rule produced -- which is a small piece of evidence that the
+	# corrected layout is self-consistent rather than merely different.
+	if not a.has("t") or not b.has("t"):
+		return 0.0
+	for key in ["pos", "scale", "tint_rgba", "fade_argb"]:
+		if a.get(key) != b.get(key):
+			return 0.0
+	if absf(float(b.get("rotation_deg", 0)) - float(a.get("rotation_deg", 0))) != 360.0:
+		return 0.0
+	var t := float(b["t"]) - float(a["t"])
+	return t if t > 0.0 else 0.0
+
+
 ## The moment the whole screen has arrived: the last element to reach its hold.
 func settle_time() -> float:
 	var last := 0.0
@@ -248,7 +524,7 @@ func exit_time() -> float:
 		for k: Dictionary in frames:
 			if k.has("t"):
 				timed_end = maxf(timed_end, float(k["t"]))
-		if not frames[frames.size() - 1].has("t"):
+		if not frames[frames.size() - 1].has("t") and exit_ramp_units >= 0.0:
 			timed_end += exit_ramp_units
 		last = maxf(last, timed_end)
 	return last
@@ -288,20 +564,62 @@ func _template_instance_ids() -> Dictionary:
 ## capture at a known angle.
 func _draw_quad(tex: Texture2D, rect: Rect2, colour: Color, pivot: Vector2,
 		pos: Vector2, rotation_deg: float) -> void:
+	var ci := _target if _target.is_valid() else get_canvas_item()
 	if is_zero_approx(rotation_deg):
-		if tex != null:
-			draw_texture_rect(tex, rect, false, colour)
-		else:
-			draw_rect(rect, colour, true)
+		_add_quad(ci, tex, rect, colour)
 		return
 	var anchor := pos + pivot
-	draw_set_transform(anchor, deg_to_rad(rotation_deg), Vector2.ONE)
-	var local := Rect2(rect.position - anchor, rect.size)
+	RenderingServer.canvas_item_add_set_transform(ci,
+		Transform2D(deg_to_rad(rotation_deg), anchor))
+	_add_quad(ci, tex, Rect2(rect.position - anchor, rect.size), colour)
+	RenderingServer.canvas_item_add_set_transform(ci, Transform2D())
+
+
+func _add_quad(ci: RID, tex: Texture2D, rect: Rect2, colour: Color) -> void:
 	if tex != null:
-		draw_texture_rect(tex, local, false, colour)
+		RenderingServer.canvas_item_add_texture_rect(ci, rect, tex.get_rid(), false, colour)
 	else:
-		draw_rect(local, colour, true)
-	draw_set_transform(Vector2.ZERO, 0.0, Vector2.ONE)
+		RenderingServer.canvas_item_add_rect(ci, rect, colour)
+
+
+## 🔴 WHY THE DRAWING GOES THROUGH `RenderingServer` AND NOT `draw_texture_rect`.
+##
+## Godot sets the blend mode on a CANVAS ITEM, not on a draw call, so an additive
+## element cannot simply be drawn differently inside one `_draw()`. The measured
+## fact is per element (`authored/rendering.json` `additive_elements`), so the
+## screen is split into RUNS of consecutive paint-order entries sharing a blend
+## mode and each run gets its own canvas item, ordered by `canvas_item_set_draw_index`.
+##
+## ⚠️ The obvious implementation -- child `Node2D`s with a `CanvasItemMaterial`
+## each -- LOSES A FRAME. `boot.gd` calls `view.queue_redraw()` from nine places
+## and none of them reaches a child node, so the bands would paint the previous
+## pose. A capture taken with `--script=wait` would have shown that as a plausible
+## wrong answer rather than as an error. These items are filled synchronously
+## inside `_draw()` instead, so there is no second node to keep in step.
+## 🔴 CANVAS ITEMS MADE THROUGH `RenderingServer` ARE NOT OWNED BY THE NODE, and
+## the first version of this file did not free them: Godot printed
+## `5 RIDs of type "CanvasItem" were leaked` on every exit -- exactly the number of
+## paint-order runs on the main menu. A node-owned child would have been collected
+## for me; the reason for using the server directly is in `_band`, and this is its
+## price. `_exit_tree` rather than `NOTIFICATION_PREDELETE` because the items are
+## parented to this node's canvas item, which goes when the node leaves the tree.
+func _exit_tree() -> void:
+	for ci: RID in _bands:
+		RenderingServer.free_rid(ci)
+	_bands.clear()
+
+
+func _band(i: int, additive: bool) -> RID:
+	while _bands.size() <= i:
+		var ci := RenderingServer.canvas_item_create()
+		RenderingServer.canvas_item_set_parent(ci, get_canvas_item())
+		_bands.append(ci)
+	var item: RID = _bands[i]
+	RenderingServer.canvas_item_clear(item)
+	RenderingServer.canvas_item_set_draw_index(item, i)
+	RenderingServer.canvas_item_set_material(item,
+		_additive_material.get_rid() if additive else RID())
+	return item
 
 
 static func _rot_of(pose: Dictionary) -> float:
@@ -316,8 +634,89 @@ static func _rot_of(pose: Dictionary) -> float:
 ## The label is 13 px larger per axis than the base and sits at (-7,-7), which
 ## keeps the two concentric; drawing it at the base position pushes it 7 px
 ## down-right and off-centre.
+## Draw an element's nested `.rat` leaf INSTEAD of the element itself.
+##
+## Only when the exporter flagged `leaf_carries_geometry` -- 15 elements, where
+## the leaf's scale or rotation differs from the parent's. Everywhere else the
+## leaf duplicates the parent and the parent wins, which is what this port has
+## always done and which `screen.rs` documents for base records.
+##
+## ⚠️ **The leaf runs on its OWN timeline and the parent's alpha is NOT
+## multiplied in.** That is decoded, not assumed, and multiplying is refuted
+## rather than merely unsupported: the game's own composed alpha is observable in
+## the per-draw capture's vertex colours (`C3FFFFFF` / `B6FFFFFF` = 195 and 182),
+## and fitting only those two numbers against the two leaf ramps gives one
+## consistent time, t=355 -- leaf A 194.8 against 195, leaf B 182.2 against 182.
+## At t=355 the PARENT has expired: its group returns to 0 at t=250 and holds
+## there, so `leaf x parent / 255` predicts zero for both quads and the sweeps
+## would be invisible. They are drawn.
+##
+## The check that matters was PREDICTED, not fitted: no x entered it, and the
+## same t=355 places the quad centres at 981 and 478 against 992.0 and 467.2
+## measured off the capture -- ~11 px on quads travelling 1 560 and 1 950 px.
+##
+## ❔ Every observation behind this has parent alpha 0, so "the leaf wins" and
+## "the parent is ignored because it draws nothing" are NOT separated. A capture
+## during t=100...238 would separate them.
+## Returns whether anything was actually drawn, so the caller can fall back.
+func _draw_leaf(element: Dictionary) -> bool:
+	var any_drawn := false
+	for fe: Dictionary in element.get("leaf", {}).get("elements", []):
+		var rel: String = fe.get("sprite", "")
+		if rel == "":
+			continue
+		var tex: Texture2D = textures.get(rel)
+		if tex == null:
+			skipped.append("%s (leaf sprite failed to load)" % fe.get("id", ""))
+			continue
+		# UNCLAMPED, like the spinning ring and for the same reason: a sweep that
+		# crosses the frame does not stop because the screen has arrived, and
+		# `ORACLE-CAPTURES.md` says these two "move continuously". Held at its own
+		# `rest.t` the leaf sits at x=1521 -- entirely off the right edge -- so
+		# `holding` would delete the sweeps rather than settle them.
+		# A leaf replays its own group where the oracle has measured that it does
+		# -- `authored/rendering.json` `loop_leaf_on_screens`. The period is the
+		# leaf's own last keyframe time, which IS its declared length: these
+		# records carry zero slack, which is also why the loop-length field
+		# cannot tell "loops at 600" from "runs once for 600 and stops".
+		var was := holding
+		holding = false
+		var t := leaf_time_units if leaf_time_units >= 0.0 else time_units
+		if loop_leaf:
+			var span := 0.0
+			for k: Dictionary in fe.get("keyframes", []):
+				if k.has("t"):
+					span = maxf(span, float(k["t"]))
+			if span > 0.0:
+				t = fposmod(t, span)
+		var pose := pose_at(fe, t)
+		holding = was
+		# 🔴 A SCALE-0 LEAF MUST NOT CLAIM THE DRAW. The Decoder hit this in its own
+		# renderer: its leaf branch marked the element drawn unconditionally, but
+		# the blit returns early on zero scale, so a scale-0 leaf suppressed its
+		# parent and BLANKED the element -- live on all four loading screens via
+		# `pgloading_loop5`, whose leaf is scale (0, 0).
+		#
+		# ⚠️ This port did not have the bug only because `authored/rendering.json`
+		# happens not to list `pgloading_loop5`. That is an accident of a gate
+		# written for a different reason, not a defence, so the guard is here: a
+		# leaf that would draw nothing reports so, and `_draw` falls back to the
+		# parent rather than losing the element.
+		var scale: Array = pose.get("scale", [100, 100])
+		if int(scale[0]) == 0 or int(scale[1]) == 0:
+			skipped.append("%s (leaf scale 0 -- parent drawn instead)" % fe.get("id", ""))
+			continue
+		var pivot := _vec(fe.get("pivot", [0, 0]))
+		_draw_quad(tex, placement(pose, pivot, tex.get_size()), modulate_of(pose),
+			pivot, _vec(pose.get("pos", [0, 0])), _rot_of(pose))
+		drawn.append(fe.get("id", ""))
+		any_drawn = true
+	return any_drawn
+
+
 func _draw_focus(element: Dictionary) -> void:
 	var focus: Dictionary = element.get("focus", {})
+	var parent_id := String(element.get("id", ""))
 	for fe: Dictionary in focus.get("elements", []):
 		var rel: String = fe.get("sprite", "")
 		if rel == "":
@@ -326,17 +725,59 @@ func _draw_focus(element: Dictionary) -> void:
 		if tex == null:
 			skipped.append("%s (focus sprite failed to load)" % fe.get("id", ""))
 			continue
-		# The ring's rest pose. Its spin is real -- rotation_deg ramps 0 -> 360
-		# with position, scale and alpha all constant -- but the PERIOD is not
-		# established: the ramp's second keyframe is untimed, and what an untimed
-		# keyframe means inside a leaf (rather than at screen level, where it is
-		# the exit) is untested. So this holds the resting angle and does not
-		# invent a spin rate.
+		# The ring spins, and until 2026-08-29 this drew it at 0 -- a pose the
+		# running game never shows -- because the PERIOD was the missing piece
+		# and a spin rate would have been invented.
+		#
+		# It is no longer invented. `docs/re/focus-ring-spin-measured.md`
+		# measures a continuous spin, period 2.177 s wall-clock, from eight
+		# evenly spaced autocorrelation peaks over nine revolutions, with NO
+		# angle estimated anywhere -- both angle estimators failed their own
+		# controls and were not used. It reconciles with the declared `t = 120`
+		# without a new constant: 120 units is 60 rendered frames, 2.00 s at a
+		# true 30 Hz and 2.08-2.17 s at the 27.6-28.8 fps that emulator runs.
+		#
+		# So the period comes off the DISC -- the element's own declared `t` --
+		# and what the RE agent supplied is that one turn takes exactly that
+		# long and repeats. See `spin_period_units` for the rule and its check.
 		var pose: Dictionary = fe.get("rest", {})
+		# An authored loop plays the record's OWN group on repeat instead of
+		# holding it at rest. `pose_at` already synthesises the final untimed
+		# keyframe at `exit_ramp_units`, so a loop is a modulo and nothing else --
+		# no new machinery and no new constant. `holding` is bypassed for the
+		# same reason the ring bypasses it: a thing that pulses does not stop
+		# because the screen has arrived.
+		var loop: Dictionary = looping_focus.get(parent_id, {})
+		if float(loop.get("period_units", 0.0)) > 0.0 \
+				and String(loop.get("record_element", "")) == String(fe.get("id", "")):
+			var was := holding
+			holding = false
+			var lt: float = time_units if loop_phase_units < 0.0 else loop_phase_units
+			pose = pose_at(fe, fposmod(lt, _loop_period(focus, loop)))
+			holding = was
 		var pivot := _vec(fe.get("pivot", [0, 0]))
 		var pos := _vec(pose.get("pos", [0, 0]))
+		var period := spin_period_units(fe)
+		var rot := _rot_of(pose)
+		if period > 0.0:
+			# `time_units` raw, NOT the pose clamped by `holding`: a spinning
+			# ring is the one thing on the settled main menu that keeps moving,
+			# and the whole point of the finding is that it does not stop.
+			#
+			# 🔴 WHICH MADE THE ORACLE HARNESS NONDETERMINISTIC, and I quoted its
+			# numbers for many iterations without noticing. `verify-capture`'s
+			# `main_menu` row read RMSE 13.30 / 13.27 / 13.25 / 13.26 across
+			# runs -- the ring's angle at the moment of capture -- while
+			# `extras`, `title` and both splashes are identical to the digit.
+			#
+			# `loop_phase_units` already pins the LOOPING FOCUS RECORD phase for
+			# the same reason; the spin is a second free-running clock and needs
+			# the same pin. Negative still means free-running, which is what a
+			# player gets. Only the harnesses pass it.
+			var st: float = time_units if loop_phase_units < 0.0 else loop_phase_units
+			rot = 360.0 * fposmod(st, period) / period
 		_draw_quad(tex, placement(pose, pivot, tex.get_size()), modulate_of(pose),
-			pivot, pos, _rot_of(pose))
+			pivot, pos, rot)
 		drawn.append(fe.get("id", ""))
 
 
@@ -347,9 +788,76 @@ func _draw() -> void:
 	var ghosts := _template_instance_ids()
 	skipped.clear()
 	drawn.clear()
-	for index: int in screen.get("paint_order", []):
+	# The runs are computed from the paint order every frame rather than cached,
+	# because the additive elements happen to be CONSECUTIVE on both screens that
+	# have a measurement and that is an accident of those two screens. A cache
+	# keyed on "the additive block" would be correct today and silently wrong on
+	# the first screen that interleaves.
+	# 🔴 THE AUTHORED MAP IS GONE. `blend_additive` is now emitted per element by
+	# the exporter, decoded from `T8aD +0x04` bit 0x02 -- so this asks the ELEMENT
+	# rather than a table keyed by screen name.
+	#
+	# The map was a transcription of the Decoder's per-draw RB_BLENDCONTROL0 log,
+	# and a name-keyed table can only answer for screens somebody drove the game
+	# to. Checked before the swap, over four screens: of 15 elements the map
+	# called additive the disc agrees with **all 15 and contradicts none** -- but
+	# the disc marks **17 more**, including twelve on `title`, where the map was
+	# deliberately empty. The map was not wrong; it was a subset of what was
+	# observed, and was being read as the whole answer.
+	var order: Array = screen.get("paint_order", [])
+	# 🔴 BANDS ARE PER DRAW OP, NOT PER ELEMENT, and the plate is why. `ptbtn00` is
+	# drawn alpha-over and its own focus record `ptbtn00f` ADDITIVE -- same screen,
+	# same element, adjacent draws, measured off the GPU. One band per paint-order
+	# entry cannot express that, and the first version of this file could not draw
+	# the PRESS (A) plate's pulse at all: both halves went through the base's band.
+	var band_of := {}
+	var band_additive: Array[bool] = []
+	var prev := -1
+	for index: int in order:
+		var el: Dictionary = elements[index]
+		var eid := String(el.get("id", ""))
+		var parts: Array = [[index, "base"], [index, "focus"]] if el.has("focus") \
+			else [[index, "base"]]
+		for part: Array in parts:
+			# Which DECLARATION the blend bit comes from depends on what this
+			# band actually draws:
+			#   focus -> the focus record's own sprite (ptbtn00f, additive,
+			#            while its base ptbtn00 is not -- the case that forced
+			#            bands to be per draw op rather than per element);
+			#   base  -> the LEAF's sprite when this element draws its leaf,
+			#            otherwise the element's own.
+			# That last line is not a detail: `ptloop01`/`ptloop02` are in
+			# `draw_leaf_for`, so what reaches the screen is `pteff03`/`pteff03a`,
+			# and those carry the bit while the parents the old map listed are not
+			# what was drawn.
+			var src: Dictionary = el
+			if part[1] == "focus":
+				var fes: Array = el.get("focus", {}).get("elements", [])
+				if not fes.is_empty():
+					src = fes[0]
+			elif draw_leaf_for.has(eid):
+				var les: Array = el.get("leaf", {}).get("elements", [])
+				if not les.is_empty():
+					src = les[0]
+			# Absent means the sprite resolves to no T8aD header -- a `.prm`
+			# primitive has no header and so no blend bit. Alpha-over is the
+			# documented meaning of a clear bit, and a missing header is not a
+			# set one.
+			var add_it: bool = bool(src.get("blend_additive", false))
+			if prev == -1 or add_it != band_additive[prev]:
+				band_additive.append(add_it)
+				prev += 1
+			band_of[[index, part[1]]] = prev
+	for i in band_additive.size():
+		_band(i, band_additive[i])
+	# Runs left over from a screen with more of them would still hold last
+	# frame's commands and paint over this one.
+	for i in range(band_additive.size(), _bands.size()):
+		RenderingServer.canvas_item_clear(_bands[i])
+	for index: int in order:
 		var element: Dictionary = elements[index]
 		var id: String = element.get("id", "")
+		_target = _bands[band_of[[index, "base"]]]
 		if ghosts.has(index):
 			skipped.append("%s (template instance)" % id)
 			continue
@@ -357,15 +865,56 @@ func _draw() -> void:
 			else pose_at(element, time_units)
 		var colour := modulate_of(pose)
 		if colour.a <= 0.0:
-			skipped.append("%s (transparent at rest)" % id)
+			# 🔴 THIS LINE USED TO SAY "at rest" WHATEVER INSTANT IT HAD POSED.
+			#
+			# On the timeline path the pose is `pose_at(time_units)`, not
+			# `rest`, and on the screens where those differ the message named a
+			# pose it had not looked at. `palogo_sqex_eff` on the publisher
+			# splash is `[0:a0 15:a255 30:a212 45:a0]` -- a flash whose `rest`
+			# alpha is **212**. The port skips it correctly at the settled
+			# instant and then reported "transparent at rest" about a resting
+			# pose that is four-fifths opaque.
+			#
+			# ⚠️ That is not cosmetic. The rest-versus-posed-instant confusion is
+			# exactly what made me score a `--pose=rest` frame against a capture
+			# and write up a drift that did not exist (DECISIONS.md). A log line
+			# that erases the distinction is the same error, pre-printed.
+			skipped.append("%s (transparent %s)" % [id,
+				"at rest" if pose_mode == Pose.REST else "at t=%.0f" % time_units])
 			continue
 		var pivot := _vec(element.get("pivot", [0, 0]))
 		var pos := _vec(pose.get("pos", [0, 0]))
 		var rot := _rot_of(pose)
-		# A focused button draws its own record instead of its base sprite.
+		# An element whose LEAF carries the geometry draws the leaf instead of
+		# itself: the parent is a container whose own record has identity scale
+		# and rotation. See `_draw_leaf`.
+		if element.get("leaf_carries_geometry", false) \
+				and draw_leaf_for.has(String(element.get("id", ""))) \
+				and _draw_leaf(element):
+			continue
+		# A FOCUSED button draws its record INSTEAD of its base sprite -- measured,
+		# the focused sprite covers the base at 100.0 % of base-visible pixels.
 		if focused_id == id and element.has("focus"):
+			_target = _bands[band_of[[index, "focus"]]]
 			_draw_focus(element)
 			continue
+		# 🔴 A LOOPING record draws IN ADDITION to the base, not instead of it.
+		#
+		# This used to take the same branch as a focused button, and that is why
+		# the authored entry for the `PRESS (A)` plate had to be deleted: it
+		# substituted a dim glow for the plate's own bright sprite and the plate
+		# became invisible at every instant (max 0 against max 252.5).
+		#
+		# The Decoder has since MEASURED the real behaviour -- held at the title
+		# with no input, the plate oscillates continuously for ~23 cycles with no
+		# decay and NEVER GOES OFF, bottoming at 714 thresholded green pixels
+		# against a plate-absent floor of 159. A glow alone cannot do that: its
+		# record ramps 0 -> 80 -> 0. A steady base plus a pulsing glow can, and
+		# the two numbers line up with base-only and base-plus-glow.
+		#
+		# So the base is drawn first and the record over it. `_draw_focus` runs
+		# after, with no `continue`.
+		var loops_focus := looping_focus.has(id) and element.has("focus")
 		var rel: String = element.get("sprite", "")
 		if focused_id == id and element.get("focus_sprite", "") != "":
 			rel = element["focus_sprite"]
@@ -373,9 +922,13 @@ func _draw() -> void:
 			var tex: Texture2D = textures.get(rel)
 			if tex == null:
 				skipped.append("%s (sprite failed to load)" % id)
+				_note_structural("%s (sprite failed to load)" % id)
 				continue
 			_draw_quad(tex, placement(pose, pivot, tex.get_size()), colour, pivot, pos, rot)
 			drawn.append(id)
+			if loops_focus:
+				_target = _bands[band_of[[index, "focus"]]]
+				_draw_focus(element)
 		elif element.get("role", "") == "primitive" and element.has("size"):
 			# A primitive has no texture; the quad is its declared size and its
 			# colour is the pose's own modulate.
@@ -385,3 +938,17 @@ func _draw() -> void:
 			# A .t32 element whose sprite the exporter could not produce. Saying
 			# so is the point -- a silently missing element looks like art.
 			skipped.append("%s (no sprite in the export)" % id)
+			_note_structural("%s (no sprite in the export)" % id)
+
+
+## Record a skip that is NOT ordinary animation, and SAY SO, once per screen.
+##
+## It prints from here rather than returning a value for a caller to report,
+## because "the caller will report it" is precisely what did not happen: the
+## per-frame `skipped` list has been correct and unread since P1. A fact that
+## needs somebody else to remember to look at it is a fact that goes unnoticed.
+func _note_structural(what: String) -> void:
+	if not structural_skips.has(what):
+		structural_skips.append(what)
+		push_warning("element not drawn: %s" % what)
+		print("  🔴 element NOT DRAWN: %s" % what)

tools/gitea-protect

@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+"""Apply and verify branch protection on `main` -- Phase 2 of GITEA-SETUP.md.
+
+    tools/gitea-protect --dry-run   print the exact rule it would send; no token
+    tools/gitea-protect             create or update the rule (idempotent)
+    tools/gitea-protect --verify    assert the live rule still holds; exit 1 if not
+
+Six settings, of which two were missing from the first draft of the runbook and
+both of those are the ones that close the gate. That is the shape of thing that
+gets mis-clicked in a web form at 1am, so it goes through the API instead: what
+was applied is reviewable in a diff, and `--verify` re-checks it every day
+rather than once.
+
+── Why each field is what it is ─────────────────────────────────────────────
+
+Read out of Gitea's own models/git/protected_branch.go, not inferred:
+
+  EnableMergeWhitelist=false      merging falls back on "whether the user has
+                                  write permission" -- and both agents have
+                                  Write. This is THE gate; without it every
+                                  other row is decoration.
+  EnableApprovalsWhitelist=false  "anyone with write access is considered
+                                  official reviewer". Gitea refuses to let an
+                                  author approve their OWN pull request and does
+                                  nothing about sylph-decoder approving
+                                  sylph-port's, so without this the two agents
+                                  satisfy the human gate between themselves.
+  enable_push=false               blocks PUSHES to main. It has no effect on
+                                  merging whatsoever, which is the assumption
+                                  that made the first version of this phase read
+                                  as protection while being none.
+
+🔴 block_admin_merge_override stays FALSE, deliberately. Turning it on locks the
+human out of their own work: approvals are whitelisted to `fabi`, Gitea will not
+let `fabi` approve a `fabi` PR, so a human-authored PR could never reach one
+approval and -- with the override blocked -- could never be merged at all. The
+admin override is what keeps that door open, and it is not a hole in the agent
+gate because the agents are Write, not Admin. That is what "Write, not Admin" in
+Phase 1.2 is buying, and this is where it gets spent.
+
+── Where the token comes from ───────────────────────────────────────────────
+
+Branch protection is a REPOSITORY-scope endpoint, so `~/.sylph-gitea-api-token`
+(write:issue, read:repository) cannot do it -- that token exists precisely so the
+issue work needs no repository rights.
+
+The credential that CAN is one you already have: `~/.sylph-git-credentials`, on
+the agent box, scoped write:repository. Reusing it means this needs no new
+credential and no second machine holding push rights, which is the whole reason
+to run this here rather than on the Pi.
+"""
+
+import argparse, json, os, sys, urllib.error, urllib.parse, urllib.request
+
+HOST  = os.environ.get("SYLPH_GITEA_HOST", "git.mc02.dev")
+REPO  = os.environ.get("SYLPH_GITEA_REPO", "fabi/Sylpheed")
+HUMAN = os.environ.get("SYLPH_GITEA_HUMAN", "fabi")
+BRANCH = os.environ.get("SYLPH_GITEA_BRANCH", "main")
+AGENTS = os.environ.get("SYLPH_GITEA_AGENTS", "sylph-decoder,sylph-port").split(",")
+
+RULE = {
+    "rule_name":                    BRANCH,
+    "enable_push":                  False,
+    "required_approvals":           1,
+    "dismiss_stale_approvals":      True,
+    "block_on_rejected_reviews":    True,
+    "enable_merge_whitelist":       True,
+    "merge_whitelist_usernames":    [HUMAN],
+    "enable_approvals_whitelist":   True,
+    "approvals_whitelist_username": [HUMAN],
+    "block_admin_merge_override":   False,   # see the module docstring
+}
+
+# What --verify asserts. Kept separate from RULE because a check that is written
+# as "whatever we sent" cannot fail: it would re-derive the expectation from the
+# thing under test. These are stated independently, on purpose.
+EXPECTED = {
+    "enable_push":                  (lambda v: v is False,        "pushes to the branch are blocked"),
+    "required_approvals":           (lambda v: v >= 1,            "at least one approval required"),
+    "dismiss_stale_approvals":      (lambda v: v is True,         "stale approvals dismissed"),
+    "block_on_rejected_reviews":    (lambda v: v is True,         "rejected reviews block the merge"),
+    "enable_merge_whitelist":       (lambda v: v is True,         "MERGE WHITELIST ON -- the gate"),
+    "merge_whitelist_usernames":    (lambda v: v == [HUMAN],      f"only {HUMAN} may merge"),
+    "enable_approvals_whitelist":   (lambda v: v is True,         "APPROVALS WHITELIST ON"),
+    "approvals_whitelist_username": (lambda v: v == [HUMAN],      f"only {HUMAN}'s approval counts"),
+}
+
+
+def token():
+    """The first credential that can plausibly do this, and a clear no otherwise."""
+    explicit = os.environ.get("SYLPH_GITEA_ADMIN_TOKEN")
+    if explicit and os.path.exists(explicit):
+        return open(explicit).read().strip(), explicit
+
+    cred = os.path.expanduser(os.environ.get("SYLPH_GIT_CREDENTIALS",
+                                             "~/.sylph-git-credentials"))
+    if os.path.exists(cred):
+        for line in open(cred):
+            line = line.strip()
+            if HOST in line and "@" in line:
+                parsed = urllib.parse.urlsplit(line)
+                if parsed.password:
+                    return urllib.parse.unquote(parsed.password), cred
+
+    sys.exit(
+        f"gitea-protect: no repository-scoped credential found.\n\n"
+        f"  Looked in $SYLPH_GITEA_ADMIN_TOKEN and {cred}.\n\n"
+        f"  NOT ~/.sylph-gitea-api-token: that one is write:issue + read:repository\n"
+        f"  by design, and every branch-protection endpoint refuses it. Run this on\n"
+        f"  the machine that already holds the push credential rather than issuing a\n"
+        f"  repository-scoped token to a second box.\n"
+    )
+
+
+def api(method, path, tok, body=None):
+    url = f"https://{HOST}/api/v1/repos/{REPO}{path}"
+    data = json.dumps(body).encode() if body is not None else None
+    req = urllib.request.Request(url, data=data, method=method, headers={
+        "Authorization": f"token {tok}",
+        "Content-Type": "application/json",
+        "Accept": "application/json",
+    })
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            raw = r.read()
+            return r.status, (json.loads(raw) if raw else None)
+    except urllib.error.HTTPError as e:
+        raw = e.read().decode(errors="replace")
+        if e.code in (401, 403) and "scope" in raw:
+            sys.exit(f"🔴 that credential lacks repository scope:\n   {raw.strip()}")
+        return e.code, raw
+    except urllib.error.URLError as e:
+        sys.exit(f"🔴 no response from {url} -- host or network: {e.reason}")
+
+
+def apply_rule(tok):
+    status, existing = api("GET", f"/branch_protections/{BRANCH}", tok)
+    if status == 200:
+        status, out = api("PATCH", f"/branch_protections/{BRANCH}", tok,
+                          {k: v for k, v in RULE.items() if k != "rule_name"})
+        verb = "updated"
+    elif status == 404:
+        status, out = api("POST", "/branch_protections", tok, RULE)
+        verb = "created"
+    else:
+        sys.exit(f"🔴 unexpected {status} reading the existing rule: {existing}")
+
+    if status not in (200, 201):
+        sys.exit(f"🔴 {verb.rstrip('d')} failed ({status}): {out}")
+    print(f"  {verb} the protection rule on {BRANCH}")
+    return out
+
+
+def verify(tok):
+    """Assert, one line per property, and say which one failed rather than 'no'."""
+    ok = True
+    status, rule = api("GET", f"/branch_protections/{BRANCH}", tok)
+    if status == 404:
+        print(f"🔴 NO PROTECTION RULE on {BRANCH}. Anyone with Write can push to it.")
+        return False
+    if status != 200:
+        sys.exit(f"🔴 could not read the rule ({status}): {rule}")
+
+    for key, (pred, why) in EXPECTED.items():
+        got = rule.get(key)
+        good = pred(got)
+        ok &= good
+        print(f"  {'✅' if good else '🔴'} {why:<42} {key}={got!r}")
+
+    # The other half of what a daily check is for: Phase 1.2's "Write, not
+    # Admin". An agent promoted to Admin could edit the rule above and then
+    # merge, so a green rule proves nothing on its own.
+    for agent in AGENTS:
+        status, perm = api("GET", f"/collaborators/{agent}/permission", tok)
+        # 🔴 A MISSING COLLABORATOR IS A FAILURE, not a blank. This branch used
+        # to print ⚪ and `continue`, leaving `ok` untouched -- so the one
+        # instrument that checks Phase 1.2 could not report Phase 1.2 being
+        # undone. An agent removed from the repository read as "nothing to say"
+        # rather than as a gate that is no longer there.
+        #
+        # It never actually fired: Gitea answers this endpoint with permission
+        # "read" for a non-collaborator rather than 404, so the case was caught
+        # by the role test below -- by luck, not by design. That is the same
+        # shape as a check that passes on an instance with no rule at all, and
+        # it is not worth keeping just because the luck has held.
+        if status == 404:
+            print(f"  🔴 {agent + ' is not a collaborator':<42} Phase 1.2 is undone")
+            ok = False
+            continue
+        if status != 200:
+            print(f"  🔴 {agent:<42} permission unreadable ({status})")
+            ok = False
+            continue
+        role = perm.get("permission")
+        good = role == "write"
+        ok &= good
+        print(f"  {'✅' if good else '🔴'} {agent + ' is Write, not Admin':<42} permission={role!r}")
+
+    return ok
+
+
+def main():
+    p = argparse.ArgumentParser(add_help=True, description=__doc__.split("\n")[0])
+    g = p.add_mutually_exclusive_group()
+    g.add_argument("--dry-run", action="store_true",
+                   help="print the rule that would be sent; needs no credential")
+    g.add_argument("--verify", action="store_true",
+                   help="check the live rule against what this file asserts")
+    a = p.parse_args()
+
+    print(f"repo   https://{HOST}/{REPO}")
+    print(f"branch {BRANCH}\n")
+
+    if a.dry_run:
+        print(f"would PUT this rule (no credential read, nothing sent):\n")
+        print(json.dumps(RULE, indent=2))
+        print(f"\ndry run -- nothing was changed.")
+        return 0
+
+    tok, where = token()
+    print(f"credential from {where}\n")
+
+    if a.verify:
+        ok = verify(tok)
+        print()
+        print("protection holds." if ok else
+              "🔴 PROTECTION DOES NOT HOLD -- stop the agents until it does.")
+        return 0 if ok else 1
+
+    apply_rule(tok)
+    print()
+    ok = verify(tok)
+    print()
+    if ok:
+        print("Now run the check that a settings page cannot give you, from")
+        print("GITEA-SETUP.md Phase 2 -- especially step 4: approve the throwaway")
+        print("PR yourself, then confirm sylph-port STILL has no merge button.")
+        print("Steps 1-3 pass on an instance with no rule at all.")
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tools/gitea-setup

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# Create the work-item structure in Gitea: labels, milestones, and the board.
+#
+#   tools/gitea-setup            create anything missing (idempotent)
+#   tools/gitea-setup --dry-run  say what it would create, change nothing
+#
+# Needs a token with `write:issue`. The existing git credential is scoped
+# `write:repository`, which pushes fine and is REFUSED by every issue endpoint --
+# checked, not assumed:
+#
+#   {"message":"token does not have at least one of required scope(s),
+#    required=[read:issue], token scope=write:repository"}
+#
+# So this reads a SECOND token from ~/.sylph-gitea-api-token, deliberately
+# separate from the push credential: different blast radius, and rotating one
+# does not break the other.
+#
+# ── Why Gitea rather than a new tracker ─────────────────────────────────────
+#
+# The failure this replaces is a 1,227-line hand-maintained `BLOCKED.md` whose
+# anti-staleness convention turned out constant by construction, plus 21
+# inter-agent messages sent into a void with no delivery feedback. Both are
+# solved by items that live in a database with state, an owner and dependency
+# edges -- and Gitea is already deployed here, so it adds no second store to
+# drift out of sync with the first. That drift is this project's defining
+# failure mode; adding a tool with its own copy of the truth would be choosing
+# more of it.
+set -euo pipefail
+
+HOST="${SYLPH_GITEA_HOST:-git.mc02.dev}"
+REPO="${SYLPH_GITEA_REPO:-fabi/Sylpheed}"
+TOKFILE="${SYLPH_GITEA_API_TOKEN:-$HOME/.sylph-gitea-api-token}"
+DRY=0; [ "${1:-}" = "--dry-run" ] && DRY=1
+
+[ -f "$TOKFILE" ] || {
+  cat >&2 <<EOF
+gitea-setup: no API token at $TOKFILE
+
+  Create one in Gitea: Settings -> Applications -> Generate New Token
+  Scopes needed: write:issue        (and read:repository, to see the repo)
+  Then:  echo '<token>' > $TOKFILE && chmod 600 $TOKFILE
+
+  This is NOT the push credential. That one is scoped write:repository and is
+  refused by every issue endpoint.
+EOF
+  exit 2
+}
+TOK=$(tr -d '[:space:]' < "$TOKFILE")
+API="https://$HOST/api/v1/repos/$REPO"
+AUTH="Authorization: token $TOK"
+
+api() { curl -sS --max-time 30 -H "$AUTH" -H 'Content-Type: application/json' "$@"; }
+
+# Fail loudly and specifically on the one error everyone hits.
+probe=$(api "$API/labels" || true)
+case "$probe" in
+  *'required scope'*)
+    echo "🔴 the token at $TOKFILE lacks issue scope:" >&2
+    echo "   $probe" >&2
+    echo "   Regenerate it with write:issue." >&2
+    exit 2 ;;
+  '') echo "🔴 no response from $API -- host or network" >&2; exit 2 ;;
+esac
+
+say() { [ "$DRY" = 1 ] && echo "  would create $*" || echo "  created $*"; }
+
+# ── Labels ──────────────────────────────────────────────────────────────────
+# The state set encodes the working model the human set on 2026-09-02: a human
+# defines a bundle, agents decompose it, and each item ends in a HUMAN check.
+# `needs-human` is the important one -- it is the state the whole model turns on
+# and the one no off-the-shelf agent tool models, because the market has
+# converged on removing the human rather than gating on them.
+existing=$(printf '%s' "$probe" | python3 -c "import json,sys;print('\n'.join(l['name'] for l in json.load(sys.stdin)))" 2>/dev/null || true)
+mklabel() { # name colour description
+  printf '%s\n' "$existing" | grep -qxF "$1" && return 0
+  if [ "$DRY" = 0 ]; then
+    api -X POST "$API/labels" -d "$(python3 -c "
+import json,sys; print(json.dumps({'name':sys.argv[1],'color':sys.argv[2],'description':sys.argv[3]}))" "$1" "$2" "$3")" >/dev/null
+  fi
+  say "label $1"
+}
+
+mklabel "state/proposed"    "d4c5f9" "Agent proposed this item; awaiting the human's approval to start"
+mklabel "state/approved"    "0e8a16" "Human approved the shape; an agent may start"
+mklabel "state/in-progress" "1d76db" "An agent is working it now"
+mklabel "state/needs-human" "fbca04" "Done as far as an agent can tell -- a person must look. The body says what to look at"
+mklabel "state/blocked"     "b60205" "Waiting on another item; use the Depends-On field, not prose"
+mklabel "agent/decoder"     "5319e7" "Owned by the Decoder (disc to meaning; runs the emulator)"
+mklabel "agent/port"        "006b75" "Owned by the Port (disc to playable; no RE)"
+mklabel "kind/bundle"       "c2e0c6" "A bundle the human defined; agents decompose it into items"
+mklabel "kind/item"         "bfd4f2" "One unit of work, small enough to finish in a single session"
+mklabel "kind/ask"          "e99695" "One agent asking the other for something it cannot answer in role"
+mklabel "kind/defect"       "d93f0b" "Found by a play-test or a check"
+
+# ── Milestones = bundles ────────────────────────────────────────────────────
+ms=$(api "$API/milestones?state=all" | python3 -c "import json,sys;print('\n'.join(m['title'] for m in json.load(sys.stdin)))" 2>/dev/null || true)
+mkms() {
+  printf '%s\n' "$ms" | grep -qxF "$1" && return 0
+  if [ "$DRY" = 0 ]; then
+    api -X POST "$API/milestones" -d "$(python3 -c "
+import json,sys; print(json.dumps({'title':sys.argv[1],'description':sys.argv[2]}))" "$1" "$2")" >/dev/null
+  fi
+  say "milestone (bundle) $1"
+}
+mkms "Menus"        "The menu shell: title, main menu, submenus, navigation, audio."
+mkms "Title screen" "Title timing and animation: the sweep onset, the plate, what (A) does."
+mkms "Graphics pipeline" "Decoder: disc -> decode -> per-frame update -> submitted draws -> Canary -> screen."
+mkms "Infrastructure" "Containers, supervision, auth, work tracking. Not game work."
+
+echo
+if [ "$DRY" = 1 ]; then
+  echo "dry run -- nothing was created."
+else
+  echo "labels and bundles are in place at https://$HOST/$REPO/issues"
+  echo
+  # No board, and this used to say the opposite. Gitea's project board does not
+  # follow labels, so it would be a SECOND copy of the state to hand-sync -- the
+  # exact failure that produced a 1,227-line BLOCKED.md. Labels are the truth and
+  # a saved issue filter gives the same view for nothing. Leaving the old
+  # "remaining, by hand: Projects -> New Project" line here would have had the
+  # tool instructing the reader to build the thing the doc argues against.
+  echo "No project board, deliberately -- labels are the truth. See"
+  echo "docs/agents/GITEA-SETUP.md Phase 4. Use a saved issue filter instead."
+fi

tools/motion-census

@@ -46,8 +46,69 @@ from pathlib import Path
 
 try:
     from PIL import Image
+    _BACKEND = "pillow"
 except ImportError:
-    sys.exit("motion-census: needs Pillow (pip install pillow)")
+    # 🔴 FALLBACK, NOT A SECOND IMPLEMENTATION. The port's container has no
+    # Pillow and no pip, so the tool could not run at all there -- and a tool the
+    # port cannot run is a check the port does not have, which is how this class
+    # of defect survived in the first place.
+    #
+    # This shims only the three Pillow calls used below (open+convert, crop,
+    # resize+getdata, and new+save for the selftest) onto ImageMagick. The census
+    # arithmetic, the MOVED floor and the GRID are untouched, so the numbers are
+    # the tool's and not a re-derivation.
+    #
+    # `-grayscale Rec601Luma` rather than `-colorspace Gray`: Rec601 is what
+    # Pillow's `.convert("L")` uses, and IM7's `-colorspace Gray` linearises
+    # first, which would shift every value. Verified to round-trip a flat
+    # rgb(100,100,100) to exactly 100 on this build.
+    #
+    # ⚠️ The --selftest is what makes this safe to trust: it drives the SAME
+    # fade / switch / frozen discrimination through whichever backend is active,
+    # so a shim that distorted the pixels would fail its own control.
+    import subprocess
+
+    _BACKEND = "imagemagick"
+
+    class _IMImage:
+        def __init__(self, path=None, size=None, value=None):
+            self._path, self._size, self._value = path, size, value
+            self._crop = None
+
+        def convert(self, _mode):
+            return self
+
+        def crop(self, box):
+            x0, y0, x1, y1 = box
+            self._crop = (x1 - x0, y1 - y0, x0, y0)
+            return self
+
+        def resize(self, grid):
+            self._grid = grid
+            return self
+
+        def getdata(self):
+            cmd = ["convert", self._path]
+            if self._crop:
+                cmd += ["-crop", "%dx%d+%d+%d" % self._crop, "+repage"]
+            cmd += ["-grayscale", "Rec601Luma",
+                    "-resize", "%dx%d!" % self._grid, "-depth", "8", "gray:-"]
+            out = subprocess.run(cmd, capture_output=True).stdout
+            return list(out)
+
+        def save(self, path):
+            subprocess.run(["convert", "-size", "%dx%d" % self._size,
+                            "xc:rgb(%d,%d,%d)" % ((self._value,) * 3),
+                            "-grayscale", "Rec601Luma", str(path)], check=True)
+
+    class Image:  # noqa: F811 - deliberate stand-in, same call surface
+        @staticmethod
+        def open(path):
+            return _IMImage(path=str(path))
+
+        @staticmethod
+        def new(_mode, size, value):
+            return _IMImage(size=size, value=int(value))
 
 # Below this, two frames are the same picture. Chosen as a floor, not tuned: PNG
 # frames of an unchanged scene differ by exactly 0.000, so anything above noise

tools/port/audit-kinds

@@ -0,0 +1,319 @@
+#!/usr/bin/env python3
+"""What does each `kind` label in `authored/` actually REST on?
+
+Every authored entry carries a `kind` -- `measured`, `authored`, `name match,
+not measured` -- and a `why`. The label is the load-bearing part: `measured`
+means the port is repeating something observed off the running game, and a
+reader downstream will treat it as fact.
+
+Nothing has ever checked them. That is the point: **a discipline that has never
+visibly failed is the one nothing directs attention at.** The Decoder reached
+this from the input side -- Ⓐ and Ⓑ were delivery-confirmed because they had
+once broken, so the d-pad never was -- and on the same day a `measured` label of
+mine turned out to rest on a single entry that may have been measuring history.
+
+So this checks what is checkable about a label, and is explicit that the rest is
+not:
+
+  citations   resolvable references in the `why` -- a `docs/` path that exists on
+              some ref, a commit sha that resolves, a capture filename
+  BARE        a label whose `why` cites nothing a reader could go and open
+  DANGLING    a citation that does not resolve anywhere in the repository
+
+🔴 What it CANNOT do is read the cited page and confirm it says what the `why`
+claims. A label with three resolvable citations can still be wrong. This narrows
+"which labels rest on nothing" from unknown to a list; it does not audit meaning.
+"""
+import json, glob, os, re, subprocess, sys
+
+REFS = None
+
+
+def known_paths():
+    """Every path in the repo, across ALL refs -- docs/re/ lives on a branch.
+
+    Checked against the working tree as well: a file added this iteration is not
+    in any ref yet, and reporting a citation to it as unresolvable would make the
+    audit fail every time it is itself referenced.
+    """
+    global REFS
+    if REFS is None:
+        out = subprocess.run(["git", "rev-list", "--all", "--objects"],
+                             capture_output=True, text=True).stdout
+        REFS = {l.split(" ", 1)[1] for l in out.splitlines() if " " in l}
+    return REFS
+
+
+HANDOFF_TEXT = None
+
+
+def handoff():
+    """The live HANDOFF, so a cited Q number is checked against the real table."""
+    global HANDOFF_TEXT
+    if HANDOFF_TEXT is None:
+        sha = subprocess.run(["git", "log", "--all", "--format=%h", "--",
+                              "docs/port/HANDOFF.md"], capture_output=True,
+                             text=True).stdout.split()[0]
+        HANDOFF_TEXT = subprocess.run(["git", "show", f"{sha}:docs/port/HANDOFF.md"],
+                                      capture_output=True, text=True).stdout
+    return HANDOFF_TEXT
+
+
+def sha_ok(s):
+    r = subprocess.run(["git", "cat-file", "-e", s + "^{commit}"], capture_output=True)
+    return r.returncode == 0
+
+
+def text_of(why):
+    if isinstance(why, str):
+        return why
+    if isinstance(why, list):
+        return " ".join(str(x) for x in why)
+    return ""
+
+
+def citations(t):
+    """References a reader could actually follow."""
+    out = []
+    for p in re.findall(r"\b(?:docs|crates|port|tools|authored)/[\w./-]+\w", t):
+        out.append(("path", p.rstrip(".,")))
+    for sha in re.findall(r"\b([0-9a-f]{7,40})\b", t):
+        # 🔴 A PURE-DECIMAL RUN IS NOT A SHA. `1118268` and `1171516` are byte
+        # counts in `voice/presentation_why`, and this reported them as
+        # unresolvable commits -- a DANGLING verdict on a why that cites
+        # nothing of the kind. A sha in this corpus always carries at least one
+        # of a-f; requiring that removes the whole class without a length rule.
+        if any(c in "abcdef" for c in sha):
+            out.append(("sha", sha))
+    for p in re.findall(r"\b([\w-]+\.(?:png|txt|tsv|wav))\b", t):
+        out.append(("file", p))
+    # The corpus cites two things that are not paths and are still followable:
+    # a HANDOFF question number, and a MISSION section. Leaving these out made
+    # the first run report four labels as resting on nothing when they rest on
+    # the two documents the mission names -- an audit inventing defects is worse
+    # than no audit, because its false positives are indistinguishable from its
+    # true ones until each is opened.
+    for q in re.findall(r"HANDOFF Q(\d+)", t):
+        out.append(("handoff", "Q" + q))
+    for m in re.findall(r"(PORT-MISSION|MISSION)[  ]section[  ](\d+)", t):
+        out.append(("mission", m[1]))
+    for r in re.findall(r"MODDING rule (\d+)", t):
+        out.append(("modding", r))
+    # 🔴 A CAPTURE FILENAME IS A CITATION and this could not see one. Five of the
+    # sixteen `why` fields I reported as uncited name `live-extras.png` or an
+    # equivalent -- openable, in `docs/re/captures/`, and exactly the evidence a
+    # reader wants. My published "17 uncited" was inflated by a third by my own
+    # extractor, which is the invents-defects failure aimed at my own backlog.
+    for cap in re.findall(r"\b([\w-]+\.(?:png|txt|wav|tsv))\b", t):
+        out.append(("capture", cap))
+    # ⚠️ A bare `HANDOFF` names the document and not the section. Counted, and
+    # counted SEPARATELY, because "the contract says so" is a weaker pointer than
+    # "Q5 says so" -- it sends a reader to 4 000 lines.
+    if re.search(r"\bHANDOFF\b", t) and not re.search(r"HANDOFF Q\d+", t):
+        out.append(("handoff-vague", "HANDOFF"))
+    return out
+
+
+def walk(o, f, path, out):
+    if isinstance(o, dict):
+        for k, v in o.items():
+            if (k == "kind" or k.endswith("_kind")) and isinstance(v, str):
+                stem = "" if k == "kind" else k[: -len("_kind")]
+                own = o.get((stem + "_why") if stem else "why")
+                # 🔴 An earlier version fell back to the parent's `why` when a
+                # label had none of its own, and reported the result as `ok`.
+                # That credits a label with evidence for a DIFFERENT claim:
+                # every `goto_name_kind` scored on a sibling `why` about the
+                # DESTINATION, while the label is about where the NAME came
+                # from. Borrowed evidence is now its own outcome, because a
+                # label resting on a neighbour's argument is exactly the case
+                # this audit exists to surface.
+                out.append((f, path + "/" + k, v, text_of(own),
+                            own is None and bool(text_of(o.get("why")))))
+            walk(v, f, path + "/" + k, out)
+    elif isinstance(o, list):
+        for x in o:
+            walk(x, f, path, out)
+
+
+def selftest():
+    """Does this audit notice a label that rests on nothing?
+
+    🔴 THE GAP: `audit-kinds` has always reported what it found and never been
+    asked whether it can find anything. A walk that matched no labels, a citation
+    extractor that accepted everything, or a `main` that returned 0 regardless
+    would all have produced the same clean run -- and clean runs from this tool
+    are cited in `DECISIONS.md` as evidence that fifteen labels are grounded.
+
+    Three synthetic rows are pushed through the REAL classifier, and its verdict
+    is read rather than reasoned about:
+
+      a `why` citing nothing               -> must be BARE
+      a `why` citing a path that exists    -> must be ok
+      a `why` citing a path that does not  -> must be DANGLING
+
+    Exit codes follow the convention the Decoder and I converged on: 0 all good,
+    1 a real audit failure, **2 the harness is broken** and no clean run from it
+    means anything.
+    """
+    paths = known_paths()
+    # The liveness case belongs in the self-test too, driven as a subprocess so
+    # its real exit code is read rather than reasoned about.
+    empty = os.path.join(os.environ.get("TMPDIR", "/tmp"), "audit-kinds-liveness")
+    os.makedirs(empty, exist_ok=True)
+    got = subprocess.run([sys.executable, os.path.abspath(__file__)], cwd=empty,
+                         capture_output=True).returncode
+    print(f"  harness: an empty tree           -> exit {got} (want 2) "
+          f"{'✅' if got == 2 else '🔴 examined nothing and reported clean'}")
+    live_ok = got == 2
+    cases = [
+        ("bare", "no citation of any kind here, just prose", "BARE"),
+        ("ok", "see tools/port/audit-kinds for the method", "ok"),
+        ("dangling", "see docs/port/NO-SUCH-FILE-XYZ.md", "DANGLING"),
+    ]
+    bad = 0
+    for name, why, want in cases:
+        cites = citations(why)
+        if not cites:
+            got = "BARE"
+        else:
+            unresolved = [c for t, c in cites
+                          if t == "path" and c not in paths and not os.path.exists(c)]
+            got = "DANGLING" if unresolved else "ok"
+        mark = "✅" if got == want else "🔴"
+        print(f"  harness: a why that is {name:<9} -> {got:<8} (want {want:<8}) {mark}")
+        if got != want:
+            bad += 1
+    print()
+    if not live_ok:
+        bad += 1
+    if bad:
+        print("🔴 the classifier cannot tell grounded labels from ungrounded ones,")
+        print("   or it reports clean on an empty tree.")
+        print("   Exit 2: nothing this tool has reported clean is trustworthy.")
+        return 2
+    print("the classifier separates bare, dangling and grounded citations")
+    return 0
+
+
+def coverage(files):
+    """How much of the authored corpus this audit can even see.
+
+    🔴 IT SEES 15 OF 70. Every `kind` label is checked for a citation, and a
+    clean run has been quoted in `DECISIONS.md` as evidence that the authored
+    data is grounded -- but a `why` with NO `kind` beside it is invisible to this
+    walk entirely, and there are 55 of those against 15 labels.
+
+    Found by reading the data rather than the tool: `audio.json`'s three SE cues
+    carry measured provenance from HANDOFF Q8 and no `kind` field, so the audit
+    that exists to check provenance never looked at them.
+
+    ⚠️ NOT every `why` should have a `kind`. Section prose and `_` blocks explain
+    a group rather than assert one value's provenance, and forcing a label there
+    would invite mislabelling to satisfy a counter. So this REPORTS the ratio
+    rather than demanding it be 1 -- a clean run must not read as full coverage.
+    """
+    labelled = orphan = 0
+    for f in files:
+        def walk(o):
+            nonlocal labelled, orphan
+            if isinstance(o, dict):
+                for k, v in o.items():
+                    if k.endswith("_why") or k == "why":
+                        stem = k[:-4] if k.endswith("_why") else ""
+                        kk = (stem + "_kind") if stem else "kind"
+                        if kk in o:
+                            labelled += 1
+                        else:
+                            orphan += 1
+                    walk(v)
+            elif isinstance(o, list):
+                for x in o:
+                    walk(x)
+        walk(json.load(open(f, encoding="utf-8")))
+    return labelled, orphan
+
+
+def main():
+    if "--selftest" in sys.argv:
+        return selftest()
+    rows = []
+    for f in sorted(glob.glob("authored/*.json")):
+        walk(json.load(open(f)), f, "", rows)
+    # 🔴 LIVENESS. Run against a tree with no `authored/*.json` this printed
+    # "0 kind label(s)" and exited 0 -- examined nothing, reported clean. The
+    # Decoder's generalisation of my empty-band case, which is more general than
+    # either instance: **a control that only compares two things cannot tell you
+    # the comparison is happening.** An empty input makes a checker AGREEABLE
+    # rather than wrong, and agreeable is indistinguishable from correct in a
+    # log.
+    if not rows:
+        print("🔴 no `kind` labels found at all -- this audit examined NOTHING.")
+        print("   Exit 2: the harness is broken (wrong directory, renamed files),")
+        print("   not the corpus.")
+        return 2
+    paths = known_paths()
+    bare = dangling = 0
+    kinds = {}
+    print(f"  {len(rows)} kind label(s) in authored/\n")
+    for f, where, kind, why, borrowed in rows:
+        kinds.setdefault(kind, 0)
+        kinds[kind] += 1
+        cites = citations(why)
+        bad = []
+        for typ, c in cites:
+            if typ == "capture":
+                if c not in paths and not os.path.exists(c) \
+                        and not any(p.endswith("/" + c) for p in paths):
+                    bad.append(c)
+            elif typ == "handoff":
+                if not re.search(rf"\|\s*{c}\s*\|", handoff()):
+                    bad.append(f"HANDOFF {c} (no such row)")
+            elif typ == "path" and c not in paths and not os.path.exists(c):
+                bad.append(c)
+            elif typ == "sha" and not sha_ok(c):
+                bad.append(c)
+        mark = "ok    "
+        if not cites and borrowed:
+            mark, bare = "🔴 BORROW", bare + 1
+        elif not cites:
+            mark, bare = "🔴 BARE", bare + 1
+        elif bad:
+            mark, dangling = "🔴 DANGL", dangling + 1
+        print(f"  {mark} {kind:<24} {f.split('/')[-1]}{where}")
+        if not cites and borrowed:
+            print("           no `why` of its own; a sibling `why` argues a"
+                  " DIFFERENT claim")
+        elif not cites:
+            print(f"           cites nothing openable -- {len(why)} chars of prose")
+        elif bad:
+            print(f"           unresolvable: {', '.join(sorted(set(bad))[:4])}")
+        else:
+            print(f"           {len(cites)} citation(s), all resolve")
+    print()
+    # Casing is checked because a consumer comparing == "measured" silently
+    # misses "MEASURED", and a label that fails to match reads as absent.
+    variants = [k for k in kinds if k.lower() == "measured"]
+    if len(variants) > 1:
+        print(f"  ⚠️  {len(variants)} spellings of the same label: {variants}")
+        print("      A consumer comparing == 'measured' misses the others, and a")
+        print("      label that fails to match reads as ABSENT, not as wrong.\n")
+    lab, orph = coverage(sorted(glob.glob("authored/*.json")))
+    print(f"  COVERAGE: {lab} `why` field(s) carry a `kind` and were audited above;")
+    print(f"  {orph} carry NO `kind` and are INVISIBLE to this audit. A clean run")
+    print(f"  below is a statement about {lab} of {lab + orph} authored justifications.")
+    print("  ⚠️ The denominator is not a target. Of the unlabelled ones, the great")
+    print("     majority are SECTION PROSE -- `_` blocks and group explanations that")
+    print("     assert no single value's provenance, where a label would be")
+    print("     mislabelling to satisfy a counter. What was audited on 2026-09-01 is")
+    print("     the other kind: a `why` sitting beside an actual VALUE. Thirteen of")
+    print("     those existed unlabelled; all thirteen now carry a kind, and two of")
+    print("     them failed the citation check the moment they became visible.")
+    print()
+    print(f"  {bare} bare or borrowed, {dangling} dangling, {len(rows) - bare - dangling} with resolving citations")
+    print("  🔴 A resolving citation is not a verified label. Nothing here reads")
+    print("     the cited page to confirm it says what the `why` claims.")
+    return 1 if (bare or dangling) else 0
+
+
+sys.exit(main())

tools/port/blocked-provenance

@@ -0,0 +1,226 @@
+#!/usr/bin/env python3
+"""Date every open row in BLOCKED.md from history, instead of guessing.
+
+`BLOCKED.md` is required to record the HANDOFF commit each row derives from, and
+none of the rows in the two open tables do. The file itself says why: nobody
+knows when most of them were written, and inventing a sha would be worse than
+admitting there is none.
+
+But git does know. A row's derivation is not a memory, it is the commit that
+introduced the row -- recoverable with a pickaxe over the file's own history.
+This prints, per row:
+
+  introduced   the oldest commit whose diff added the row's key phrase
+  HANDOFF@     `git log -1 -- docs/port/HANDOFF.md` as of that commit
+  unread       commits touching docs/re/ ON ANY REF that are not ancestors of
+               that commit -- decoding the row has never been read against
+
+`--all`, not my own ancestry, and that distinction is the whole finding. Counted
+against my checkout every row scores ZERO, which is true and useless: the
+Decoder's live decoding sits on `origin/auto/no-disc-and-menu-captures`, `main`
+is a hundred-odd commits behind it, and HANDOFF has not moved in four
+milestones [refuted] -- 🔴 corrected 2026-09-01: **on `main`**. Flat, that
+sentence is the claim this port WITHDREW in `BLOCKED.md` on 2026-08-30, where the
+missing qualifier was recorded as carrying the whole meaning: HANDOFF has moved
+over a hundred times, just not on the branch this checkout reads. The reasoning
+below needs the qualifier to work at all -- the sha is constant BECAUSE `main`'s
+copy is frozen, not because the document is. So a row can be derived from the
+newest HANDOFF `main` has and still
+be a day behind the decoding -- and the instruction to record the HANDOFF sha
+CANNOT DETECT THAT, because the sha it asks for is constant.
+
+That is the rot mechanism the 2026-08-30 audit found three instances of, and it
+is not the one the header of BLOCKED.md describes.
+
+Nothing here is authored. Every field is read out of git, and a row whose key
+phrase has been rewritten since it was introduced reports `?` rather than a
+plausible-looking sha.
+"""
+import re, subprocess, sys
+
+DOC = "docs/port/BLOCKED.md"
+
+
+def git(*a):
+    return subprocess.run(["git", *a], capture_output=True, text=True).stdout.strip()
+
+
+TOP = 3
+
+
+def idf_of(commits):
+    """log(N / how many subjects use the word) -- rarity, from the corpus itself."""
+    import collections, math
+    df = collections.Counter()
+    for _, subj in commits:
+        df.update(tokens(subj))
+    n = len(commits)
+    return collections.defaultdict(lambda: math.log(n), {w: math.log(n / c) for w, c in df.items()})
+
+
+def key_of(cell):
+    """The longest markdown-free fragment -- what to pickaxe for.
+
+    Cells get struck through and re-emphasised as they are resolved, so the cell
+    as it stands today is not what was committed. The inner text survives that.
+    """
+    frags = [f.strip(" ?.") for f in re.split(r"[*~`]+", cell)]
+    frags = [f for f in frags if len(f) >= 20]
+    return max(frags, key=len) if frags else None
+
+
+def rows():
+    """Every table row in the open sections, in file order."""
+    open_only, out = False, []
+    for line in open(DOC, encoding="utf-8"):
+        if line.startswith("## "):
+            open_only = line.startswith("## Still open")
+            continue
+        if not open_only or not line.startswith("| "):
+            continue
+        cells = [c.strip() for c in line.strip().strip("|").split(" | ")]
+        if len(cells) < 4 or cells[0] in ("Milestone", "---"):
+            continue
+        out.append(cells)
+    return out
+
+
+STOP = set("""this that with from what which when does than the and are was were
+have has been will would could should port game screen menu audio does not any
+each only its it's whether where else same both very more most into onto over
+under about after before still open blocked answered measured wrong right first
+second third disc file files commit branch docs main head sha row rows table
+mission handoff decoder agent claim claims""".split())
+
+
+def stem(w):
+    """Crudest possible stemmer, and it earns its place with a control.
+
+    Without it `looping` does not match `loop` and the P6 row whose answer is
+    sitting in an unread commit scores zero -- which is what happened.
+    """
+    for suf in ("ping", "ing", "ted", "ed", "es", "s"):
+        if w.endswith(suf) and len(w) - len(suf) >= 4:
+            return w[: -len(suf)]
+    return w
+
+
+def tokens(text):
+    ws = re.findall(r"[a-z0-9_]{4,}", text.lower())
+    return {stem(w) for w in ws if w not in STOP}
+
+
+def rank(rt, commits, idf):
+    """Score every unread commit against one row, rarest words first.
+
+    A COUNT of shared words is the wrong instrument: `menu` and `loop` shared
+    scores the same as `plate` and `pulse`, and in this corpus almost everything
+    says `menu`. Weighting each shared stem by log(N / commits containing it)
+    lets one rare word outrank two common ones -- and it removes the threshold,
+    which was the part that could be tuned. The list is RANKED, fixed length,
+    so nothing is decided by a cutoff nobody can justify.
+    """
+    out = []
+    for sha, subj in commits:
+        shared = rt & tokens(subj)
+        if shared:
+            out.append((sum(idf[w] for w in shared), sha, subj, shared))
+    return sorted(out, reverse=True)
+
+
+def overlap(rs):
+    """Which unread commits NAME something an open row is about.
+
+    Crude on purpose, and it says so: word overlap between a row and a commit
+    SUBJECT, ranked by rarity, top few printed with the words that earned the
+    rank so the reader judges rather than trusting the match. It cannot tell
+    relevance from coincidence -- it narrows 196 commits to a short list worth
+    opening, and nothing more.
+    """
+    log = git("log", "--all", "--not", "HEAD", "--format=%h\t%s", "--", "docs/re/")
+    commits = [l.split("\t", 1) for l in log.splitlines() if "\t" in l]
+    print(f"  {len(commits)} unread docs/re/ commit(s) exist on other refs.")
+    print("  Crude word overlap with the open rows -- a reading list, not a verdict:\n")
+    idf = idf_of(commits)
+    hits = struck = dropped = 0
+    for cells in rs:
+        if cells[0].startswith("~~"):
+            struck += 1       # already struck; re-reading it settles nothing
+            continue
+        scored = rank(tokens(cells[0] + " " + cells[1]), commits, idf)
+        dropped += max(0, len(scored) - TOP)
+        for score, sha, subj, shared in scored[:TOP]:
+            hits += 1
+            print(f"  {re.sub(r'[*~`]', '', cells[0])[:36]:<36} {sha} {score:5.1f}  {subj[:58]}")
+            print(f"  {'':<36} {'':<8}       via {', '.join(sorted(shared))}")
+    if not hits:
+        print("  (no row shares a word with any unread commit)")
+    # Every discard, counted. A detector that can drop a candidate in silence
+    # has an unfalsifiable clean run -- which is how the P6 looping row stayed
+    # marked open for a day while its answer sat in `712cac8`, and how the same
+    # class of miss went unnoticed in the Decoder's checker on the same day.
+    print(f"\n  suppressed: {struck} struck row(s) not scanned; {dropped} scoring")
+    print(f"  pair(s) ranked below top-{TOP} and not shown; {len(STOP)} word(s)")
+    print("  stoplisted and unable to match at any rank.")
+    print()
+
+
+def control():
+    """Known positive: the row whose answer is demonstrably in an unread commit.
+
+    `P6 looping` asks where the menu loop restarts. `712cac8` measures it at
+    9.44 s and the port has since shipped that value, so the pair MUST match. It
+    did not, until stemming -- the check exists so that regression is loud.
+    """
+    log = git("log", "--all", "--not", "HEAD", "--format=%h\t%s", "--", "docs/re/")
+    commits = [l.split("\t", 1) for l in log.splitlines() if "\t" in l]
+    scored = rank(tokens("P6 looping where a menu loop restarts"), commits, idf_of(commits))
+    at = next((i for i, r in enumerate(scored) if r[1].startswith("712cac8")), None)
+    ok = at is not None and at < TOP
+    print(f"  control: P6-looping vs 712cac8 -> rank {at} of {len(scored)} scoring "
+          f"{'✅' if ok else f'🔴 OUTSIDE TOP-{TOP}, THE KNOWN POSITIVE IS MISSED'}")
+    return ok
+
+
+def main():
+    if "--control" in sys.argv:
+        sys.exit(0 if control() else 1)
+    rs = rows()
+    if not rs:
+        sys.exit(f"{DOC}: no rows found under a '## Still open' heading")
+    head_handoff = git("log", "-1", "--format=%h", "--", "docs/port/HANDOFF.md")
+    print(f"  {DOC}: {len(rs)} rows in the open tables")
+    print(f"  HANDOFF is at {head_handoff} today\n")
+    print(f"  {'row':<44} {'introduced':<12} {'date':<11} {'HANDOFF@':<9} unread")
+    unknown = 0
+    for cells in rs:
+        milestone, needs = cells[0], cells[1]
+        label = re.sub(r"[*~`]", "", milestone)[:43]
+        key = key_of(needs) or key_of(milestone)
+        sha = date = handoff = "?"
+        since = "-"
+        if key:
+            # oldest commit whose diff changed the number of occurrences
+            log = git("log", "--format=%h %ad", "--date=short", "-S", key, "--", DOC)
+            if log:
+                sha, date = log.splitlines()[-1].split()
+                handoff = git("log", "-1", "--format=%h", sha, "--", "docs/port/HANDOFF.md")
+                unread = git("log", "--all", "--not", sha, "--format=%h", "--", "docs/re/")
+                since = str(len(unread.splitlines())) if unread else "0"
+        if sha == "?":
+            unknown += 1
+        flag = ""
+        if since not in ("-", "0") and not milestone.startswith("~~"):
+            flag = f"  <- never read against {since} docs/re/ commit(s)"
+        print(f"  {label:<44} {sha:<12} {date:<11} {handoff:<9} {since:>3}{flag}")
+    print()
+    overlap(rs)
+    if unknown:
+        print(f"  ⚠️  {unknown} row(s) could not be dated: the key phrase has been")
+        print("      rewritten since it was introduced, so history cannot place it.")
+    print("  Not a staleness verdict. A high `unread` is not a wrong row -- most of")
+    print("  that decoding is irrelevant to most rows. It is the size of the surface")
+    print("  nobody has looked at, and it is what the HANDOFF sha was supposed to be.")
+
+
+main()

tools/port/check-all

@@ -54,13 +54,7 @@ step() { # name, expectation, command...
 if ! DISPLAY="$DISPLAY" timeout 10 xdpyinfo >/dev/null 2>&1; then
   echo "🔴 no X display on $DISPLAY -- every Godot step below would fail for that one reason."
   echo "   Xvfb does not survive a container restart and leaves its socket behind. Start it with:"
-  echo "     rm -f /tmp/.X11-unix/X\${DISPLAY#:} /tmp/.X\${DISPLAY#:}-lock"
-  echo "     Xvfb $DISPLAY -screen 0 1280x720x24 -nolisten tcp &"
-  echo "   🔴 THE LOCK FILE IS NOT OPTIONAL and this recipe omitted it until"
-  echo "      2026-09-03. Removing only the socket leaves /tmp/.X<n>-lock behind,"
-  echo "      Xvfb exits 1 immediately, and the next command still reports no"
-  echo "      display -- which reads as the restart having failed for some deeper"
-  echo "      reason. Cost three occurrences before anyone read Xvfb's own stderr."
+  echo "     rm -f /tmp/.X11-unix/X\${DISPLAY#:} ; Xvfb $DISPLAY -screen 0 1280x720x24 -nolisten tcp &"
   exit 3
 fi
 
@@ -155,11 +149,6 @@ step decisions-index  must-pass tools/port/index-decisions --check
 # monorepo move and the `export/` rename. Only that class fails; a citation that
 # is merely on a peer's unmerged branch is reported, because the fix is a merge
 # and nobody in this container can make it.
-step trajectory-fit   must-pass tools/port/fit-trajectory --selftest
-step linked-records   must-pass tools/port/check-linked-records
-step linked-rec-ctl   must-pass tools/port/check-linked-records --selftest
-step authored-declared must-pass tools/port/check-authored-vs-declared
-step authored-decl-ctl must-pass tools/port/check-authored-vs-declared --selftest
 step doc-citations    must-pass tools/port/check-citations
 step citations-control must-pass tools/port/check-citations --selftest
 # A refuted claim asserted outside its correction is a lie the corpus tells a
@@ -274,37 +263,6 @@ printf '  %-24s allowing %s (additive set + 2 legacy)\n' verify-screen \
 unexpected=$(grep DIFFERS "$OUT/verify-screen.log" | awk '{print $1}' \
   | grep -vx "${allow_args[@]}" || true)
 
-# 🔴 SCREENS FROM A NEWLY EXPORTED ARCHIVE HAVE NEVER BEEN COMPARED, AND THAT IS
-# NOT THE SAME AS DISAGREEING.
-#
-# `verify-screen` is renderer-vs-renderer, and BOTH its allowance and the
-# reference renderer itself were built against GP_TITLE. When the exporter gained
-# `GP_OPTIONS` (2026-09-03) its 14 screens all read DIFFERS at means of 10-60
-# against 0.02-7.3 for the calibrated set -- which says nothing yet, because
-# nobody has looked at a single one of them.
-#
-# They are REPORTED, not failed and NOT added to the allowed set. Failing would
-# put the suite red for a state nobody has investigated -- the wall of
-# meaningless failures the display guard exists to prevent. Allowing would assert
-# they are explained, and `verify-screen`'s own header is emphatic that the
-# allowed set means "measured, cause open", not "ignore this".
-#
-# The discriminator is the sprite group in the manifest path, so a screen becomes
-# assertable the moment somebody moves it into the calibrated population
-# deliberately, rather than by an export widening underneath the check.
-uncompared=$(python3 -c "
-import json
-m = json.load(open('export/manifest.json'))
-print('\n'.join(s['name'] for s in m['screens']
-                 if not s['file'].startswith('screens/title/')))" 2>/dev/null)
-if [ -n "$uncompared" ]; then
-  still=$(echo "$unexpected" | grep -vxF -f <(echo "$uncompared") || true)
-  newly=$(echo "$unexpected" | grep -xF -f <(echo "$uncompared") || true)
-  unexpected="$still"
-  [ -n "$newly" ] && printf '  %-24s %d screen(s) NEVER COMPARED (new archive, uncalibrated): %s\n' \
-    verify-screen "$(echo $newly | wc -w)" "$(echo $newly | tr '\n' ' ')"
-fi
-
 # 🔴 THE OLD ALLOWANCE WAS FALSE, AND MY FIRST REPLACEMENT REASON WAS ALSO
 # WRONG. Both are recorded because the second error is the more instructive.
 #

tools/port/check-capture

@@ -0,0 +1,262 @@
+#!/usr/bin/env bash
+# Provenance check for a multichannel capture, BEFORE anybody analyses it.
+#
+#   tools/port/check-capture /path/to/capture.wav
+#
+# WHY THIS EXISTS. A 6-channel capture of the game's own output was analysed at
+# length -- three controls, a drift test, a written-up negative -- and the file
+# was corrupt. PulseAudio was remapping between two mismatched channel maps, and
+# a 6-channel remap SILENTLY DROPS AND DUPLICATES: right duration, right channel
+# count, plausible per-channel levels, no error anywhere. Two of the six channels
+# were byte-identical copies of two others and two source channels were simply
+# gone.
+#
+# The Decoder proved it with a control that needs no emulator and no disc: six
+# channels each carrying a different tone through the same sink and the same
+# `parec` invocation. Channels came back 400 / 3200 / 200 / 800 / 800 / 200 for
+# an input of 400 / 800 / 200 / 1600 / 3200 / 6400 -- see
+# `docs/re/audio-capture-channel-map-trap.md`. Setting the sink's `channel_map`
+# to the guest's own and passing the same map to `parec` returns all six.
+#
+# THE DETECTABLE SIGNATURE IS AN EXACT DUPLICATE PAIR. Two channels of a real
+# surround mix are never byte-identical over 70 s. Levels are not enough to catch
+# it -- the corrupt file's per-channel peaks looked entirely reasonable, and it
+# was only equal peak AND equal RMS to six decimals that prompted a hash.
+#
+# This is a NECESSARY check, not a sufficient one: passing it means the capture
+# has no duplicated channels, not that it recorded the right thing.
+set -euo pipefail
+f="${1:?usage: check-capture FILE.wav}"
+
+# Queried one field at a time. A combined `-show_entries` prints two values on
+# ONE comma-separated line, and `read -r ch rate dur` then puts "48000,6" in
+# `$ch` -- which every later arithmetic test rejects, in a script whose whole
+# job is to be trusted about a file.
+probe() { ffprobe -v error -select_streams a:0 -show_entries "$1" -of csv=p=0:nk=1 "$f" | head -1; }
+ch=$(probe stream=channels)
+rate=$(probe stream=sample_rate)
+dur=$(ffprobe -v error -show_entries format=duration -of csv=p=0:nk=1 "$f" | head -1)
+printf '%s: %sch %sHz %.3fs\n' "$f" "$ch" "$rate" "$dur"
+
+
+# ⚠️ MONO SKIPS THE DUPLICATE TEST AND STILL GETS THE STARVATION ONE. An earlier
+# version returned immediately for a single channel, so the mono voice track --
+# one of this tool's four controls -- was never actually run through the check it
+# was supposed to control. A control that does not execute is not a control.
+dupes=0
+if [ "$ch" -lt 2 ]; then
+  echo "  single channel -- no duplicate test, starvation still checked"
+else
+layout=5.1; [ "$ch" = 2 ] && layout=stereo
+tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
+map=""; for i in $(seq 0 $((ch-1))); do map="$map -map [c$i] $tmp/c$i.wav"; done
+split=""; for i in $(seq 0 $((ch-1))); do split="$split[c$i]"; done
+# shellcheck disable=SC2086
+ffmpeg -hide_banner -v error -y -i "$f" \
+  -filter_complex "channelsplit=channel_layout=$layout$split" $map
+
+declare -a sums
+for i in $(seq 0 $((ch-1))); do
+  s=$(ffmpeg -hide_banner -v error -i "$tmp/c$i.wav" -f md5 - | cut -d= -f2)
+  peak=$(ffmpeg -hide_banner -v info -i "$tmp/c$i.wav" -af astats -f null - 2>&1 \
+    | grep -m1 "Peak level dB" | sed 's/.*: //')
+  sums[i]="$s"
+  printf '  ch%-2d peak %-12s %s\n' "$i" "$peak" "$s"
+done
+
+for i in $(seq 0 $((ch-1))); do
+  for j in $(seq $((i+1)) $((ch-1))); do
+    if [ "${sums[i]}" = "${sums[j]}" ]; then
+      echo "  🔴 ch$i and ch$j are BYTE-IDENTICAL"
+      dupes=1
+    fi
+  done
+done
+fi
+
+# STARVATION: the second way a capture looks perfect and carries nothing.
+#
+# A monitor sink advances at WALL-CLOCK rate and substitutes silence whenever the
+# producer is late. An emulator running below real time therefore yields a file
+# of exactly the right duration, right channel count, no duplicated channels --
+# and chopped into fragments with holes punched between them, thousands of times
+# over. Envelope correlation against such a file is destroyed by construction:
+# what dominates the envelope is the dropout schedule, not the content.
+#
+# Measured on the capture that prompted this: 35.6 % of frames silent on all six
+# channels, 10 482 alternating runs, median burst 13.5 ms and median gap 3.9 ms
+# -- a 17.4 ms period, 57 Hz. The Decoder measured the untruncated original at
+# 39.3 % and 10 595 runs; the two agree.
+#
+# THE DISCRIMINATOR IS THE RUN STRUCTURE, NOT THE SILENCE FRACTION. Real audio is
+# full of silence -- a voice track is more than half gaps -- but those are TENS of
+# runs of HUNDREDS of milliseconds. Dropout chop is THOUSANDS of runs of a few
+# milliseconds. So the test is: many short all-channel gaps.
+set +e
+python3 - "$f" <<'PYEOF'
+import array, struct, sys
+d = open(sys.argv[1], 'rb').read()
+i, fmt, off = 12, None, None
+while i + 8 <= len(d):
+    cid = d[i:i+4]; sz = struct.unpack('<I', d[i+4:i+8])[0]
+    if cid == b'fmt ': fmt = d[i+8:i+8+sz]
+    elif cid == b'data':
+        off, declared = i + 8, sz; break
+    i += 8 + sz + (sz & 1)
+if fmt is None or off is None:
+    print("  (not a plain WAV -- starvation check skipped)"); raise SystemExit(0)
+tag = struct.unpack('<H', fmt[0:2])[0]
+ch = struct.unpack('<H', fmt[2:4])[0]; rate = struct.unpack('<I', fmt[4:8])[0]
+bits = struct.unpack('<H', fmt[14:16])[0] if len(fmt) >= 16 else 16
+# REFUSE A FORMAT THIS CANNOT READ, rather than mis-reading it confidently.
+#
+# Everything below assumes 16-bit signed. An ALSA `type file` tee writes
+# **float32** (`SND_PCM_FORMAT_FLOAT_LE`), and read as s16 it produces a
+# plausible-looking file: the Decoder measured one and its only giveaway was
+# per-channel peaks alternating EXACTLY -0.00 / -4.82, which is the two halves
+# of each float landing in alternate channels. A checker that mis-reads a format
+# is worse than one that has no opinion -- it is the shape of every failure this
+# tool exists to catch.
+#
+# tag 1 = PCM, 3 = IEEE float, 0xFFFE = WAVE_FORMAT_EXTENSIBLE.
+#
+# ⚠️ EXTENSIBLE IS ACCEPTED AT 16 BITS, and the first version of this guard was
+# not -- it rejected one of this tool's own controls, a file `ffprobe` correctly
+# calls `pcm_s16le`. A format guard that refuses a legitimate capture is the same
+# defect as one that mis-reads an illegitimate one, pointing the other way.
+# `wBitsPerSample` is what actually decides how the samples are laid out here, so
+# it is what the check turns on; a float tee is 32-bit and is still caught.
+if tag not in (1, 0xFFFE) or bits != 16:
+    print("  🔴 format tag %d, %d-bit -- this tool reads 16-bit PCM only." % (tag, bits))
+    print("     Read as s16 a float32 tee looks plausible and is not: its tell is")
+    print("     per-channel peaks alternating exactly, one float split across two")
+    print("     channels. Convert first: ffmpeg -i in.wav -c:a pcm_s16le out.wav")
+    raise SystemExit(4)
+avail = len(d) - off
+if declared == 0 or declared > avail:
+    # A streaming writer that never patched its header. The file may also be a
+    # copy taken while it was still being written -- which happened, and made a
+    # provenance claim wrong.
+    print("  ⚠️  data chunk declares %d bytes, %d present -- header never patched;"
+          % (declared, avail))
+    print("      treat the duration as unverified and check the file is complete.")
+n = avail // (2 * ch)
+a = array.array('h'); a.frombytes(d[off:off + n * 2 * ch])
+sil = bytearray(n)
+for f_ in range(n):
+    b = f_ * ch
+    if not any(a[b+c] for c in range(ch)): sil[f_] = 1
+tot = sum(sil)
+# A GAP IS A RUN, NOT A SAMPLE. The first version of this counted every frame
+# whose channels were all exactly zero, and real audio crosses zero constantly --
+# it scored a clean voice track at 5 947 "gaps" of median 0.0 ms and called it
+# starved. The known-good control caught it. Only runs of at least 1 ms (48
+# frames at 48 kHz) count: a zero-crossing is one sample, a dropout is hundreds.
+MINGAP = max(1, rate // 1000)
+runs_s, runs_n = [], []
+cur, ln = sil[0], 0
+for v in sil:
+    if v == cur: ln += 1
+    else:
+        (runs_s if cur else runs_n).append(ln); cur = v; ln = 1
+(runs_s if cur else runs_n).append(ln)
+runs_s = [r for r in runs_s if r >= MINGAP]
+if not runs_s:
+    print("  all-channel silence 0.0% -- no gaps at all"); raise SystemExit(0)
+rs = sorted(runs_s); med = 1000.0 * rs[len(rs)//2] / rate
+secs = n / float(rate)
+rate_per_s = len(runs_s) / secs
+print("  all-channel silence %.1f%%, %d gap(s) over 1 ms (%.1f/s), median gap %.1f ms"
+      % (100.0*tot/n, len(runs_s), rate_per_s, med))
+# THE THRESHOLD IS SET FROM CONTROLS, and the first two I invented were both
+# wrong -- they failed real audio. Measured:
+#
+#   the starved capture        32.9 gaps/s, median 3.9 ms, 35.6 % silent
+#   a real music+SFX bed        3.3 gaps/s, median 1.4 ms,  1.1 % silent
+#   a voice track, 53 % pauses  0.03 gaps/s
+#
+# Real audio does contain short all-zero runs -- a quiet passage in 16-bit is
+# genuinely zero for milliseconds -- so neither the gap COUNT nor the median
+# length separates them. The RATE does, by an order of magnitude in both
+# directions, and 20/s sits between with a 1.6x margin below the bad case and
+# 6x above the worst good one.
+# TWO NUMBERS, BECAUSE ONE CANNOT SEE THE FAILURE NEXT DOOR.
+#
+# The first version of this tested the gap RATE alone, at 20/s. The Decoder then
+# measured what a LARGER client buffer does, and the relationship is not
+# monotonic: raising `PULSE_LATENCY_MSEC` keeps cutting the rate while total
+# silence bottoms out and then doubles, because an over-large buffer starves in a
+# few enormous holes instead of many small ones. Its 500 ms capture scores
+# **1.3 gaps/s -- better than a genuine music bed at 3.3 -- while being 50 %
+# silence**, and my bar passed it. Reproduced here on a file I hold: `bigholes`,
+# a real bed with 350 ms holes punched in, is 46.3 % silence at 3.2 gaps/s.
+#
+# That is the same shape as the level table that could not see a duplicated
+# channel. One number, blind to the neighbouring failure.
+#
+# Controls, all four measured here. 🔴 THE FIGURES LIVE IN THE DOC, NOT HERE.
+#
+# This table used to restate them, and two of the numbers had DRIFTED from
+# `AUDIO-VERIFICATION.md`: 53.3 % here against 53.2 % there, in two places each,
+# for the same control. Neither can be re-measured -- that control file was
+# transient and is gone -- so there is no way to say which copy aged.
+#
+# That is the mirror of the trap the Decoder named the same day: they lost a
+# finding because its only record was a script comment; this lost a digit because
+# a finding had TWO records and nothing kept them equal. A number copied into a
+# second place will drift from the first, and the drift is invisible because both
+# copies look authoritative.
+#
+# So the doc is the record and this cites it.
+#
+#   real music bed         1.1 % silence,  3.3 gaps/s   PASS
+#   voice track, mono     see AUDIO-VERIFICATION.md   PASS  (real pauses)
+#   bed with big holes    46.3 % silence,  3.2 gaps/s   FAIL
+#   the starved capture   35.6 % silence, 30.9 gaps/s   FAIL
+#
+# Rate alone cannot separate rows 2 and 3; silence alone cannot separate rows 1
+# and 3, nor 2 and 3. The pair does.
+if tot / float(n) >= 0.10 and rate_per_s >= 1.0:
+    print("  🔴 STARVED: %.1f%% of the file is silent on every channel, in %.1f gaps"
+          % (100.0 * tot / n, rate_per_s))
+    print("     per second (median %.1f ms). Real audio is either mostly not" % med)
+    print("     silent, or silent in a few long stretches -- not both at once.")
+    raise SystemExit(3)
+
+# ⚠️ THE REGIME THIS TOOL CANNOT JUDGE, said out loud rather than passed
+# silently. High silence with FEW gaps is what a real voice track looks like
+# (AUDIO-VERIFICATION.md §7 has the figure) and also what an over-buffered
+# capture looks like. No
+# statistic here separates them, and inventing a bar for a regime I have no
+# control in is how the last two bars in this file came to be wrong.
+if tot / float(n) >= 0.10:
+    print("  ⚠️  %.1f%% silent in only %.1f gaps/s -- UNJUDGED. That is the shape of"
+          % (100.0 * tot / n, rate_per_s))
+    print("      a real voice track AND of an over-buffered capture, and this tool")
+    print("      cannot tell them apart. Check it against a known source before")
+    print("      concluding anything from it.")
+PYEOF
+starved=$?
+set -e
+if [ "$starved" = 4 ]; then
+  # The duplicate test ran (bytes are bytes) but starvation did not. Saying
+  # "PASS" here would be the tool claiming a check it skipped.
+  echo "PARTIAL: channels checked, starvation NOT checked -- unreadable sample format."
+  exit 2
+fi
+if [ "$starved" = 3 ]; then
+  echo "FAIL: the recording is starved. A monitor sink advances at wall-clock rate"
+  echo "      and substitutes silence when the producer is late, so this file has"
+  echo "      the right duration and holes punched through the content. Correlation"
+  echo "      against it is meaningless. See docs/port/AUDIO-VERIFICATION.md §7."
+  exit 1
+fi
+
+if [ "$dupes" = 1 ]; then
+  echo "FAIL: duplicated channels. A surround remap drops and duplicates silently;"
+  echo "      channels are missing from this file. Do not analyse it -- fix the"
+  echo "      sink's channel_map and re-record. See docs/port/AUDIO-VERIFICATION.md."
+  exit 1
+fi
+echo "PASS: no duplicated channels. (Necessary, not sufficient -- this says"
+echo "      nothing about whether the right thing was recorded.)"

tools/port/check-capture-controls

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Run `check-capture` against its own documented control sweep.
+#
+#   tools/port/check-capture-controls
+#
+# `AUDIO-VERIFICATION.md` calls that sweep **"the tool's real specification"**
+# and prints it as a table. Nothing executed it. So the specification was prose:
+# if `check-capture` regressed, or if a threshold drifted, no run would have said
+# so -- and this is a tool whose own history is two invented thresholds that were
+# both wrong and were caught only by controls.
+#
+# 🔴 The same document states the principle this violates: **"A control that does
+# not execute is not a control."** It was written about a mono file that skipped
+# its own check. The sweep as a whole was in exactly that condition.
+#
+# ⚠️ One control CANNOT be rebuilt: the starved capture itself was a transient
+# artifact and is gone. It is reported as MISSING rather than omitted, because a
+# sweep that quietly drops a control is the defect it exists to catch.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+W="${TMPDIR:-/tmp}/capture-controls"; mkdir -p "$W"
+CC=tools/port/check-capture
+fail=0
+
+# `check-capture` emits TWO verdicts -- one for channel provenance, one for
+# starvation -- and `AUDIO-VERIFICATION.md`'s table compresses them into a word.
+# That is fine for a summary and wrong for an assertion: the voice control is
+# `PASS` on channels and `UNJUDGED` on starvation *by design*, and a sweep that
+# collapsed those could not tell "passed" from "declined to judge". So both are
+# reported, and a control names the pair it expects.
+verdict() { # file -> "<channels>/<starvation>"
+  local out ch st
+  out=$("$CC" "$1" 2>&1 || true)
+  if   grep -q '^PARTIAL' <<<"$out"; then echo "PARTIAL/PARTIAL"; return; fi
+  # A starved file SHORT-CIRCUITS: the tool reports the starvation and never
+  # reaches the channel check, which is right -- channel provenance is moot in a
+  # recording with holes punched through it. Reported as `n/a`, not as a failure:
+  # "the check did not run" and "the check failed" are different facts, and
+  # collapsing them is how a sweep starts asserting things it never observed.
+  if   grep -qi 'no duplicated channels' <<<"$out"; then ch=PASS
+  elif grep -qi 'BYTE-IDENTICAL' <<<"$out";        then ch=FAIL
+  else                                                  ch=n/a; fi
+  if   grep -q 'UNJUDGED' <<<"$out"; then st=UNJUDGED
+  elif grep -qi 'starv\|holes\|FAIL' <<<"$out"; then st=FAIL
+  else st=PASS; fi
+  echo "$ch/$st"
+}
+expect() { # name, file, wanted
+  local got; got=$(verdict "$2")
+  if [ "$got" = "$3" ]; then printf '  %-42s %-8s ok\n' "$1" "$got"
+  else printf '  %-42s %-8s 🔴 EXPECTED %s\n' "$1" "$got" "$3"; fail=1; fi
+}
+
+# Six distinct tones -- the duplicate-channel control. Frequencies chosen so no
+# two channels share one, which is what the provenance check looks for.
+ffmpeg -v error -y -f lavfi -i "sine=frequency=400:duration=6" \
+  -f lavfi -i "sine=frequency=800:duration=6"  -f lavfi -i "sine=frequency=200:duration=6" \
+  -f lavfi -i "sine=frequency=1600:duration=6" -f lavfi -i "sine=frequency=3200:duration=6" \
+  -f lavfi -i "sine=frequency=6400:duration=6" \
+  -filter_complex "[0:a][1:a][2:a][3:a][4:a][5:a]join=inputs=6:channel_layout=5.1[a]" \
+  -map "[a]" -c:a pcm_s16le "$W/tones.wav"
+ffmpeg -v error -y -i "$W/tones.wav" -c:a pcm_f32le "$W/tones_f32.wav"
+
+# A real music+SFX bed: six channels of REAL material, one per channel.
+#
+# 🔴 The first version of this control was `-ac 6` from the stereo bed, and it
+# FAILED -- correctly. An upmix leaves channels 2-5 silent and byte-identical,
+# which is exactly what the provenance check exists to catch, so the control was
+# a broken capture wearing a control's name. The tool was right and the control
+# was wrong, which is the outcome a sweep must be able to tell from its opposite.
+#
+# Six NON-OVERLAPPING spans of real audio, one per channel, all continuous. A
+# second attempt used `aloop=-1` to stretch the short UI cues into full-length
+# channels and hung ffmpeg indefinitely; spans of the long assets need no looping.
+# 🔴 THIS FFMPEG COMPLETES ITS WORK AND THEN NEVER EXITS, AND IT WEDGED THE
+# WHOLE SUITE FOR AN HOUR.
+#
+# `check-all` sat on two lines of output for over an hour; the cause was this
+# call. Diagnosed rather than guessed at: the output file reaches **4 604 262
+# bytes = exactly 8.0 s of 5.1ch/16-bit/48 kHz**, the full intended length, and
+# ffmpeg then hangs with the artifact already correct on disk.
+#
+# Three formulations were tried and all three hang, all three producing
+# BYTE-IDENTICAL output: the original, one with `-t 8` bounding the output, and
+# one with explicit `asplit` feeding each `atrim` (the textbook fix for
+# multi-use of a single input). So it is not the split, not the output stage,
+# and the artifact is not in doubt.
+#
+# ⚠️ Worse than the hang: it LEAKS. An orphaned ffmpeg from this script's earlier
+# `aloop` form was found still running after **9.5 hours**, burning CPU across
+# runs nobody was watching. `boot.gd`'s own header already names this failure
+# shape -- "it does not fail, it waits, and a job that waits forever reads as a
+# job still working".
+#
+# So: bounded, and the ARTIFACT is checked rather than the exit code. That is
+# the better test regardless of the hang -- an exit code says ffmpeg thought it
+# was done, the file says what it actually wrote.
+timeout 90 ffmpeg -v error -y -i export/audio/bgm/main_menu.ogg \
+  -i export/audio/voice/ADV.ogg -i export/audio/voice/S00A.ogg \
+  -filter_complex "[0:a]atrim=2:10,asetpts=N/SR/TB,aformat=channel_layouts=mono[a0]; \
+                   [0:a]atrim=20:28,asetpts=N/SR/TB,aformat=channel_layouts=mono[a1]; \
+                   [1:a]atrim=15:23,asetpts=N/SR/TB,aformat=channel_layouts=mono[a2]; \
+                   [1:a]atrim=40:48,asetpts=N/SR/TB,aformat=channel_layouts=mono[a3]; \
+                   [2:a]atrim=12:20,asetpts=N/SR/TB,aformat=channel_layouts=mono[a4]; \
+                   [2:a]atrim=35:43,asetpts=N/SR/TB,aformat=channel_layouts=mono[a5]; \
+                   [a0][a1][a2][a3][a4][a5]join=inputs=6:channel_layout=5.1[a]" \
+  -map "[a]" -c:a pcm_s16le "$W/bed.wav" </dev/null || true
+bed_dur=$(ffprobe -v error -show_entries format=duration -of csv=p=0 "$W/bed.wav" 2>/dev/null || echo 0)
+if ! awk "BEGIN{exit !($bed_dur > 7.9 && $bed_dur < 8.1)}"; then
+  echo "🔴 the 5.1 bed is $bed_dur s, not the 8 s this sweep is built on -- refusing to score it" >&2
+  exit 2
+fi
+
+# The same bed with 350 ms holes punched through it, every second.
+ffmpeg -v error -y -i "$W/bed.wav" \
+  -af "volume=enable='lt(mod(t,1),0.35)':volume=0" -c:a pcm_s16le "$W/holes.wav"
+# A voice track: mono, with the real pauses of speech.
+ffmpeg -v error -y -i export/audio/voice/ADV.ogg -t 60 -ac 1 -c:a pcm_s16le "$W/voice.wav"
+
+echo "check-capture against its documented control sweep:"
+expect "six distinct tones (PCM)"              "$W/tones.wav"     PASS/PASS
+expect "the same tones as float32"             "$W/tones_f32.wav" PARTIAL/PARTIAL
+expect "real music bed"                        "$W/bed.wav"       PASS/PASS
+expect "bed with 350 ms holes punched in"      "$W/holes.wav"     n/a/FAIL
+expect "voice track, mono, real pauses"        "$W/voice.wav"     PASS/UNJUDGED
+printf '  %-42s %-8s the artifact is gone; not synthesised, because\n' "the starved capture" "MISSING"
+printf '  %-42s %-8s fitting one to its published statistics would be\n' "" ""
+printf '  %-42s %-8s a control shaped to the answer it must give\n' "" ""
+echo
+[ $fail -eq 0 ] && echo "the sweep matches the specification" || echo "🔴 check-capture no longer matches AUDIO-VERIFICATION.md"
+exit $fail

tools/port/check-citations

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Do the repo paths cited in `docs/port/*.md` actually resolve?
+
+    tools/port/check-citations              # assert
+    tools/port/check-citations --selftest   # can it fail?
+
+`audit-kinds` checks citations in `authored/`. Nothing checked the PROSE, and
+prose is where this port explains itself. A first run found **37 of 91**
+non-resolving, 41 %, in two very different classes:
+
+  * **19 on the Decoder's topic branch** — real files, not merged here. Not
+    errors. A reader in this checkout still cannot follow them, which is worth
+    reporting and not worth failing on; the fix is a merge, not an edit.
+  * **7 that resolve NOWHERE** — `docs/BLOCKED.md`, `docs/FORMAT.md`,
+    `port/manifest.json`, `port/screens/title/*.json`. Left behind by the
+    monorepo move and the `export/` rename. Those are simply wrong: a reader
+    following one gets nothing, and nothing had ever told anyone.
+
+So the two classes are separated and only the second fails. A check that failed
+on the first would be red for a state nobody in this container can fix, which is
+the shape the display guard exists to prevent.
+
+⚠️ THE PEER-BRANCH CLASS IS THE OTHER AGENT'S POINT, TURNED ON MYSELF. They
+observed that everything they hand over links into `docs/re/` files that live
+only on their branch, so every link they send is dangling from here. The same is
+true in reverse and neither of us was counting.
+"""
+import os
+import re
+import subprocess
+import sys
+import glob
+
+# A repo path with a file extension, optionally in backticks or a markdown link.
+CITE = re.compile(
+    r"`?((?:docs|crates|port|tools|authored|export)/[\w./-]+"
+    r"\.(?:md|rs|gd|json|txt|py|tsv|csv))`?"
+)
+PEER_REFS = ("origin/auto/frame-blend-draw-path", "origin/main")
+
+
+def on_a_ref(path: str) -> str | None:
+    """The first ref that carries `path`, or None."""
+    for ref in PEER_REFS:
+        if subprocess.run(["git", "cat-file", "-e", f"{ref}:{path}"],
+                          capture_output=True).returncode == 0:
+            return ref
+    return None
+
+
+def scan(files):
+    resolves, peer, nowhere = 0, {}, {}
+    for p in files:
+        try:
+            text = open(p, encoding="utf-8").read()
+        except OSError:
+            continue
+        for m in sorted(set(CITE.findall(text))):
+            if os.path.exists(m):
+                resolves += 1
+            elif (ref := on_a_ref(m)):
+                peer.setdefault(m, (p, ref))
+            else:
+                nowhere.setdefault(m, p)
+    return resolves, peer, nowhere
+
+
+def main() -> int:
+    if "--selftest" in sys.argv:
+        # 🔴 A CHECK THAT CANNOT FAIL IS NOT A CHECK. This plants a citation of a
+        # path that exists on no ref and requires the scanner to catch it, and a
+        # citation of a real file and requires it NOT to. Both directions,
+        # because a scanner that flagged everything would also "pass" the first.
+        tmp = os.path.join(os.environ.get("TMPDIR", "/tmp"), "check-citations-selftest")
+        os.makedirs(tmp, exist_ok=True)
+        bad = os.path.join(tmp, "bad.md")
+        open(bad, "w").write("see `docs/port/this-file-does-not-exist-anywhere.md`\n")
+        good = os.path.join(tmp, "good.md")
+        open(good, "w").write("see `docs/port/PORT-MISSION.md`\n")
+        # The THIRD class, which `--for-merge` turns into a failure. It has to be
+        # told apart from both others: a peer citation is not dangling (the file
+        # exists) and does not resolve here (the reader still gets nothing), and
+        # a scanner that collapsed it into either would make the flag meaningless
+        # while still passing the two checks above.
+        peerfile = os.path.join(tmp, "peer.md")
+        open(peerfile, "w").write("see `docs/re/f5-a-press-snaps-the-plate.md`\n")
+        rp, pp, np_ = scan([peerfile])
+
+        _, _, nb = scan([bad])
+        r, _, ng = scan([good])
+        caught   = len(nb) == 1
+        passed   = len(ng) == 0 and r == 1
+        peer_ok  = len(pp) == 1 and rp == 0 and len(np_) == 0
+        ok = caught and passed and peer_ok
+        print("selftest: planted dangling caught=%s, real citation passed=%s, "
+              "peer-branch classed separately=%s -> %s"
+              % (caught, passed, peer_ok, "ok" if ok else "🔴 BROKEN"))
+        if not peer_ok:
+            print("   🔴 --for-merge cannot mean anything if the peer class is "
+                  "not distinguished; got resolves=%d peer=%d nowhere=%d"
+                  % (rp, len(pp), len(np_)))
+        return 0 if ok else 2
+
+    files = sorted(glob.glob("docs/port/*.md"))
+    resolves, peer, nowhere = scan(files)
+    total = resolves + len(peer) + len(nowhere)
+    print("citations of repo paths in docs/port/*.md: %d" % total)
+    print("  resolve here                : %d" % resolves)
+    # 🔴 --for-merge TURNS THE PEER CLASS INTO A FAILURE.
+    #
+    # Reporting-not-failing was right when it was written: a peer-branch
+    # citation was "a state nobody in this container can fix", so failing on it
+    # would have been red for something unactionable. Under the pull-request
+    # workflow that stopped being true -- a PR into `main` is EXACTLY where it
+    # becomes fixable, by opening the finding's PR first and depending on it.
+    # The citation is dead the moment this merges, so the merge is the last
+    # place the leniency can still be withdrawn.
+    #
+    # Left as a flag rather than made unconditional, because both readings are
+    # still live: mid-work on a topic branch the peer class really is unfixable
+    # noise. The difference the old code could not express is WHERE the code is
+    # going, and that is a condition the caller can state.
+    merging = "--for-merge" in sys.argv
+    label = "🔴 FAILS (--for-merge)" if merging else "reported, not failed"
+    print("  on a peer branch, not merged: %d  (%s)" % (len(peer), label))
+    for m, (src, ref) in sorted(peer.items()):
+        print("      %-52s %s  <- %s" % (m, ref.split("/")[-1], os.path.basename(src)))
+    if peer and merging:
+        print("\n🔴 %d citation(s) resolve only on a peer branch." % len(peer))
+        print("   After this merges they resolve NOWHERE -- the reader gets a dead")
+        print("   path. Land the finding first and make it a dependency of this PR.")
+        return 1
+    if nowhere:
+        print("  🔴 resolve NOWHERE          : %d" % len(nowhere))
+        for m, src in sorted(nowhere.items()):
+            print("      %-52s <- %s" % (m, os.path.basename(src)))
+        print("\n🔴 a reader following those gets nothing. Fix the path or drop the citation.")
+        return 1
+    print("  🔴 resolve nowhere          : 0")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tools/port/check-claims

@@ -0,0 +1,413 @@
+#!/usr/bin/env bash
+# Every refuted claim must appear only inside its own correction.
+#
+#   tools/port/check-claims
+#
+# 🔴 WHY THIS IS A CHECK AND NOT AN AUDIT. The Decoder's rule -- *grep the corpus
+# for the claim, not for the file you were working in* -- found a refuted sentence
+# still shipping in this port's `manifest.json`, and a withdrawn one still
+# standing in `DECISIONS.md`. Running that by hand finds the instances present on
+# the day it is run. It does not stop the next one.
+#
+# So: a REGISTER. Each row is a claim this corpus has refuted, plus a marker that
+# must appear near every occurrence. A hit without its marker fails the run.
+#
+# ⚠️ Two things learned building it, both from the other agent:
+#
+#  * a "kept for the record" block STILL ASSERTS. Marking the heading superseded
+#    does not mark the sentence a reader lands on, so the marker must sit near
+#    the CLAIM, not at the top of the section.
+#  * naming a refuted claim keeps it greppable, so this check returns its own
+#    corrections as hits -- which is the point. The marker is what distinguishes
+#    "quoted while being refuted" from "still asserted".
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+WINDOW=400   # characters either side of a hit in which the marker must appear
+fail=0; total_marked=0; scanned=0; peer_hits=0; _peer_probe_done=0
+
+# 🔴 THE MARKER IS AN EXPLICIT SENTINEL, NOT A KEYWORD.
+#
+# The first version matched a per-claim keyword -- "refuted", "WITHDRAWN" -- near
+# the hit. Every one of its four failures was a quotation sitting INSIDE a
+# correction whose wording happened not to contain the keyword: a table cell
+# reading "standing, unmarked", a sentence reading "the real count was ten".
+#
+# Widening the window or adding synonyms until those passed would have been
+# tuning a threshold until the answer came out right, which is the failure this
+# corpus has spent a fortnight cataloguing. So the marker is a TOKEN THE AUTHOR
+# PLACES: `[refuted]` near any quotation of a registered claim. It cannot be
+# satisfied by phrasing, and its absence means exactly one thing.
+#
+# ⚠️ The cost is honest: every quotation must be marked by hand, and a new
+# refuted claim means a new row plus marking its existing quotations. That work
+# is the check.
+MARKER='[refuted]'
+REGISTER=$(cat <<'ROWS'
+TAIL of the kept stream :: the leading chunk of a voice region duplicates the end of the kept stream, so it can be dropped
+known too fast :: the boot plays both splashes faster than the game does
+only thing making the plate :: the plate reappears because of one authored cause
+no loop-point field has been identified :: nothing anywhere on the disc or in the runtime states where a bank loops
+AUDIBLY WRONG AT THE SEAM :: replaying the menu bed from sample 0 puts audible fade-out and silence at the loop seam
+1 of 3 streams :: the exporter ships one of a voice region's three streams
+six expected DIFFERS :: six screens are expected to differ from the reference renderer
+goes against the port :: the JP title capture adjudicates title_jp against this port's rendering
+the capture turns out to determine it :: the leaf's phase is fixed by the capture rather than being an arbitrary choice
+COMPOSITED rather than standalone :: the four screens without an opaque-black primitive are drawn composited over another screen
+structural limit, not an unrun experiment :: EXTRAS cannot be strengthened past n=1 because this archive holds no second destination
+HANDOFF Q10 says nothing on the disc :: nothing on the disc names which track the menu plays, so the port must choose one
+28 % of `S00A`'s frames :: 28 % of S00A's frames and 47 % of ADV's reached the screen, measured
+by three routes :: DIFFICULTY is identified by three independent routes
+HANDOFF has not moved in four milestones :: the contract itself is static, rather than static only on the branch this checkout reads
+ROWS
+)
+
+[ -n "${CLAIMS_REGISTER+x}" ] && REGISTER="$CLAIMS_REGISTER"
+
+# 🔴 A REGISTER THAT PARSES NOTHING REPORTED CLEAN, FOREVER. The scan loop runs
+# once per row; with no rows it runs zero times, `fail` stays 0, and the script
+# printed "every refuted claim appears only inside its correction" and exited 0.
+# That is the stub defect -- prints a result, asserts nothing -- sitting in the
+# checker whose clean runs both agents lean on. The Decoder found it in their
+# equivalent the same day; it was here too.
+_rows=$(printf '%s\n' "$REGISTER" | grep -c '[^[:space:]]' || true)
+if [ "$_rows" -eq 0 ]; then
+  echo "🔴 the refuted register is EMPTY -- this check would pass everything." >&2
+  echo "   Exit 2: the harness is broken, not the corpus." >&2
+  exit 2
+fi
+
+# --------------------------------------------------------------------------
+# `--control`: the known negatives, EXECUTED.
+#
+# 🔴 Until now this check had NO control machinery at all. Every "planted a
+# revival, it failed, removed it, it passed" in `DECISIONS.md` was done BY HAND,
+# once, and never again -- in a repository where two of my own tools carry the
+# line *"a control that does not execute is not a control"*. It was written
+# about somebody else's tool.
+#
+# Four cases, each driving THIS script as a subprocess and reading its real exit
+# code rather than reasoning about what it would do:
+#
+#   clean tree                -> 0
+#   unmarked revival planted  -> 1   (the check must catch it)
+#   revival planted MARKED    -> 0   (and must not false-positive on it)
+#   register emptied          -> 2   (the harness is broken, not the corpus)
+#
+# The plant lands in a real scanned directory, because a control that runs
+# somewhere the tool does not look proves nothing about the tool.
+if [ "${1:-}" = "--control" ]; then
+  probe="docs/port/.claims-control-probe.md"
+  trap 'rm -f "$probe"' EXIT INT TERM
+  # The PHRASE only: rows now read `phrase :: proposition`, and the case strings
+  # below are colon-delimited, so passing a whole row made the harness parse the
+  # proposition as a field and report its own cases broken. A data-shape change
+  # breaking the harness that guards the data is this iteration's small version
+  # of my rows making the Decoder's parser fail silently.
+  claim=$(printf '%s\n' "$REGISTER" | grep -m1 '[^[:space:]]')
+  claim="${claim%% :: *}"
+  ok=0
+  run() { CLAIMS_CONTROL=1 "$0" >/dev/null 2>&1; echo $?; }
+  rm -f "$probe"
+  for case in "clean::0" "unmarked:$claim:1" "marked:$claim [refuted]:0"; do
+    IFS=: read -r name body want <<<"$case"
+    if [ -n "$body" ]; then printf '%s\n' "$body" > "$probe"; else rm -f "$probe"; fi
+    got=$(run)
+    if [ "$got" = "$want" ]; then
+      printf '  %-26s exit %s  ✅\n' "$name" "$got"
+    else
+      printf '  %-26s exit %s, wanted %s  🔴\n' "$name" "$got" "$want"; ok=1
+    fi
+  done
+  rm -f "$probe"
+  # 🔴 FIFTH CASE: the same text OUTSIDE the scanned root must give 0.
+  #
+  # Without it, "the plant is inside a scanned directory" is a property I
+  # verified BY HAND, once -- which is the exact pattern I had just finished
+  # criticising in this tool one iteration earlier. The pair is what asserts the
+  # boundary is real: identical text, exit 1 inside and 0 outside. Either half
+  # alone is consistent with the tool scanning everything, or nothing.
+  #
+  # The Decoder added this to theirs after I raised the boundary; the reason it
+  # was worth adding is that their property held *because they had reasoned it*,
+  # not because anything asserted it. Mine was in the same state.
+  outside="${TMPDIR:-/tmp}/claims-control-outside.md"
+  printf '%s\n' "$claim" > "$outside"
+  got=$(run)
+  rm -f "$outside"
+  if [ "$got" = "0" ]; then printf '  %-26s exit 0  ✅\n' "same text outside root"
+  else printf '  %-26s exit %s, wanted 0  🔴\n' "same text outside root" "$got"; ok=1; fi
+  got=$(CLAIMS_REGISTER="" "$0" >/dev/null 2>&1; echo $?)
+  if [ "$got" = "2" ]; then printf '  %-26s exit 2  ✅\n' "empty register"
+  else printf '  %-26s exit %s, wanted 2  🔴\n' "empty register" "$got"; ok=1; fi
+  # Sixth case: a tree with nothing to scan. It used to die in the withdrawal
+  # hook and exit 1 -- "a refuted claim is still being asserted" -- for a wrong
+  # directory. Liveness and diagnosis are both asserted here.
+  _empty="${TMPDIR:-/tmp}/claims-liveness-root"; mkdir -p "$_empty"
+  got=$(cd "$_empty" && PROJECT_DIR="$_empty" "$OLDPWD/$0" >/dev/null 2>&1; echo $?)
+  if [ "$got" = "2" ]; then printf '  %-26s exit 2  ✅\n' "nothing to scan"
+  else printf '  %-26s exit %s, wanted 2  🔴\n' "nothing to scan" "$got"; ok=1; fi
+  echo
+  [ $ok -eq 0 ] && echo "the register check fails when it must, and says so distinctly" \
+                || echo "🔴 the control machinery itself is broken"
+  exit $ok
+fi
+
+
+
+# ─── THE WITHDRAWAL-TIME HOOK ────────────────────────────────────────────────
+# The register enforces claims it KNOWS ABOUT; knowing about them was manual, and
+# that is how ~8 claims were withdrawn this session and 0 registered. A sweep
+# cannot fix it -- by the time you sweep, the withdrawal is already unpublished.
+# The hook fires where the withdrawal is WRITTEN.
+#
+# A correction in DECISIONS.md has a shape: a heading carrying WITHDRAWN /
+# CORRECTION / "refuted". A section like that containing no registered phrase is
+# a death argued and never indexed.
+#
+# ⚠️ The register is passed in the ENVIRONMENT, not inlined. The first version
+# pasted the rows into this file's own heredoc -- which made every phrase an
+# unmarked quotation, and the checker flagged its own source. A tool that
+# violates the rule it enforces by being written is worth a comment.
+#
+# 🟡 REPORTED, NOT ASSERTED: not every correction retires a CLAIM -- some fix a
+# number, a scope, a wrong floor -- and forcing a row for those would push rows
+# in to silence the check, the failure this file exists to prevent.
+#
+# ⚠️ AND IT WILL ALWAYS OVER-REPORT ON WELL-WRITTEN CORRECTIONS. The detection is
+# "does this section contain a registered phrase", which requires the correction
+# to QUOTE the dead claim. A good correction paraphrases it away: the JP heading
+# now reads "does NOT go against the port", which does not contain the registered
+# "goes against the port" [refuted] and is flagged despite being registered.
+#
+# The Decoder's resolution is the right one and costs the correction nothing:
+# **the register entry is the verbatim home of the dead phrase; prose paraphrases
+# freely.** They are different documents, so the phrase always has one exact
+# place to live without any correction having to carry it. What follows for this
+# hook is that its candidate list mixes "never registered" with "registered and
+# paraphrased", and it cannot separate them -- so the list is a prompt to check,
+# never a defect count.
+echo
+echo "withdrawal-time hook -- correction sections that registered nothing:"
+# 🔴 PREFLIGHT. Run from the wrong directory this used to die inside the
+# withdrawal hook with a FileNotFoundError and exit **1** -- which in this
+# script's own vocabulary means "a refuted claim is still being asserted". A real
+# failure with a fabricated diagnosis, the same shape as my control anchoring at
+# the wrong document. The roots it needs are named here and their absence is a
+# HARNESS fault with its own code.
+for _root in docs docs/port authored tools/port; do
+  [ -d "$_root" ] || {
+    echo "🔴 \`$_root\` is not here -- this check cannot scan anything." >&2
+    echo "   Exit 2: wrong directory or a bad checkout, not a dirty corpus." >&2
+    exit 2
+  }
+done
+[ -f docs/port/DECISIONS.md ] || {
+  echo "🔴 docs/port/DECISIONS.md is missing -- the withdrawal hook has nothing" >&2
+  echo "   to read. Exit 2: the harness is broken, not the corpus." >&2
+  exit 2
+}
+
+REG="$REGISTER" python3 - <<'HOOK'
+import os, re
+reg = [r.strip() for r in os.environ["REG"].split("\n") if r.strip()]
+doc = open("docs/port/DECISIONS.md").read()
+heads = [(m.start(), m.group(0)) for m in re.finditer(r"(?m)^##+ .*$", doc)]
+flagged = 0
+for i, (pos, head) in enumerate(heads):
+    # 🔴 THE FIRST REGEX MATCHED HEADINGS *ABOUT* CORRECTIONS, NOT HEADINGS
+    # MAKING THEM -- "withdraw" caught "rather than withdrawing", "refuted"
+    # caught a section discussing the register itself. 33 candidates was a
+    # measurement of the regex. Narrowed to headings that RETIRE something:
+    # a leading WITHDRAWN/CORRECTION/Refuted, or an explicit "is withdrawn".
+    if not re.search(r"^#+\s*(?:[^A-Za-z]*\s*)?(WITHDRAWN|CORRECTION|Refuted)\b"
+                     r"|\bis withdrawn\b|\bnow refuted\b", head):
+        continue
+    end = heads[i + 1][0] if i + 1 < len(heads) else len(doc)
+    if not any(c in doc[pos:end] for c in reg):
+        flagged += 1
+        print("  candidate: %s" % head[:92].lstrip("# "))
+print("  none -- every correction section names a registered claim" if not flagged
+      else "  %d correction section(s) argue a withdrawal the register does not carry" % flagged)
+HOOK
+
+while IFS= read -r claim; do
+  # 🔴 ROWS CARRY A PROPOSITION NOW, `phrase :: what it asserted`.
+  #
+  # They were bare phrases, and that had two costs. A phrase is not a claim:
+  # `1 of 3 streams` [refuted] is dead here and a LIVE warning in the Decoder's
+  # corpus, and the bare row cannot say which proposition it killed -- so a peer
+  # hit was unadjudicable even in principle. And the bareness made THEIR parser
+  # fail silently: a reader looking for a quoted string in each row found none,
+  # built an empty claim list, and reported a clean table. My data shape made
+  # their instrument lie.
+  #
+  # The phrase is still the search key; the proposition is for whoever has to
+  # judge a hit, here or in another corpus.
+  proposition="${claim#* :: }"
+  claim="${claim%% :: *}"
+  [ -z "$claim" ] && continue
+  hits=0; bad=0; marked=0
+  while IFS= read -r loc; do
+    [ -z "$loc" ] && continue
+    f=${loc%%:*}
+    hits=$((hits+1))
+    out=$(python3 - "$f" "$claim" "$MARKER" "$WINDOW" <<'PY' 
+import sys
+f, claim, marker, w = sys.argv[1], sys.argv[2], sys.argv[3], int(sys.argv[4])
+s = open(f, encoding="utf-8", errors="ignore").read()
+# 🔴 THE REGISTER BLOCK IS ITS OWN VERBATIM HOME, and is excised before
+# scanning rather than relying on marker proximity. The rows used to be bare
+# phrases that happened to sit within the marker window of the file header;
+# adding a proposition to each pushed them out of it, and the check began
+# reporting its own register as twelve unmarked assertions. Widening the window
+# would have been tuning a constant to make a failure go away. Excising exactly
+# the heredoc -- and nothing else in this file -- keeps every other occurrence
+# in `check-claims` under the same rule as any other file, which matters because
+# the comments here quote dead phrases constantly.
+if f.endswith("check-claims"):
+    a = s.find("REGISTER=$(cat <<'ROWS'")
+    b = s.find("\nROWS", a) if a >= 0 else -1
+    if a >= 0 and b > a:
+        s = s[:a] + (" " * (b - a)) + s[b:]
+i = n = 0
+low, claim_low = s.lower(), claim.lower()
+while True:
+    i = low.find(claim_low, i)
+    if i < 0:
+        break
+    if marker.lower() not in low[max(0, i-w):i+w+len(claim)]:
+        print("      unmarked in %s at char %d" % (f, i))
+        sys.exit(1)
+    n += 1
+    i += len(claim)
+# Every suppression, counted. A checker that can discard an occurrence in silence
+# reports the same clean run whether or not a live assertion is hiding among the
+# marked ones, and its zero is unfalsifiable. Reached from the loud end here and
+# from the quiet end by the Decoder on the same day: their marker language was
+# vouching for 8 of 8 mentions, so their 0 was going to be 0 either way.
+print(n)
+sys.exit(0)
+PY
+) && marked=$((marked + out)) || { printf '%s\n' "$out"; bad=$((bad+1)); }
+  # 🔴 CASE-INSENSITIVE since 2026-08-30, and the reason is a live miss. The
+  # register held "no loop-point field has been identified" [refuted]; `BLOCKED.md`
+  # it capitalised at the start of a sentence, and the check reported clean while
+  # a refuted claim stood unmarked in the file whose whole job is to say what is
+  # still open. The Decoder found the same class the same day from the other end
+  # -- their register missed a revival that kept the claim and changed the second
+  # clause. A register matching EXACT wording does not protect the documents that
+  # rewrite most, and a capital letter is the cheapest rewrite there is.
+  done < <(grep -ril -- "$claim" docs/port/ crates/ port/ tools/ authored/ 2>/dev/null || true)
+
+  # 🔴 PEER-OWNED ROOTS ARE SCANNED FROM THE REF, NOT THE TREE.
+  #
+  # `docs/re/`, `docs/game/` and `docs/agents/` are written by the Decoder. My
+  # working copies are 246, 9 and 13 commits behind their heads, so any verdict
+  # this check reached about one of their files would be a verdict about MY
+  # STALE COPY -- and the failure direction is the false positive: flagging a
+  # claim they have already corrected. That is exactly what they did to me by
+  # hand, reading my `BLOCKED.md` 234 commits behind.
+  #
+  # Excluding them would hide the exposure; reporting from the stale copy would
+  # keep it. So the scan reads the newest blob on any ref. It is the only
+  # structural fix either agent has found for this class -- READ THE REF, NOT
+  # THE TREE -- and it is why `contract-check` stayed correct while this tree sat
+  # 115 commits behind.
+  #
+  # ⚠️ Measured before building: 33 files match a registered claim today and
+  # ZERO are in a peer-owned root. The exposure is latent, not active. Recorded
+  # because "I checked and it was clean" and "I never looked" must not read the
+  # same, which is this week's whole lesson.
+  _peer_ref=$(git log --all -n 1 --format=%h -- docs/re docs/game docs/agents)
+  # 🔴 THE PEER SCAN GETS A KNOWN POSITIVE, because a zero from a broken reader
+  # looks identical to a real one. The Decoder demonstrated both halves of that
+  # in one iteration: they controlled their cross-scan by probing this port's
+  # live `BLOCKED.md` for a string they knew was in it -- and separately produced
+  # a FALSE ZERO from a reader they had invented minutes earlier, regexing quoted
+  # strings out of `check-claims` into 63 phantom phrases that matched nothing.
+  #
+  # This scan found six hits today, so it is demonstrably live NOW. The control
+  # is for the run where their pages no longer contain any of these phrases and
+  # a zero would otherwise be unfalsifiable: a wrong ref, a wrong pathspec or a
+  # renamed directory all produce the same clean line.
+  if [ -n "$_peer_ref" ] && [ "$_peer_probe_done" != "1" ]; then
+    _peer_probe_done=1
+    _seen=$(git ls-tree -r --name-only "$_peer_ref" -- docs/re docs/game docs/agents 2>/dev/null | wc -l)
+    if [ "$_seen" -lt 10 ]; then
+      echo "🔴 the peer scan can see only $_seen file(s) at $_peer_ref -- a wrong" >&2
+      echo "   ref or pathspec reads the same as a clean corpus. Exit 2." >&2
+      exit 2
+    fi
+    printf '  peer scan reads %s file(s) at %s -- the reader is live\n' "$_seen" "$_peer_ref"
+  fi
+  if [ -n "$_peer_ref" ]; then
+    while IFS= read -r loc; do
+      [ -z "$loc" ] && continue
+      # 🔴 REPORTED, NOT COUNTED AS A FAILURE -- corrected before shipping.
+      #
+      # The first version put these in `bad`, which failed the run. That applies
+      # MY marking convention to THEIR corpus: `[refuted]` is a token this port
+      # uses in its own files, and their pages mark corrections their own way.
+      # Of the six hits, three are in their `METHOD.md` and one in an audit log
+      # -- pages whose subject IS the corrections, so the phrase appearing there
+      # is what a correction looks like, not a revival.
+      #
+      # So this is a prompt to look, never a verdict -- the same conclusion the
+      # withdrawal hook reached about its own candidates. A checker that fails
+      # on another agent's file for not using this one's punctuation would be
+      # noise inside a day, and I would have been the one to file it.
+      printf '      ℹ️  a peer-owned file at their head contains it: %s (%s)\n' \
+        "${loc#*:}" "$_peer_ref"
+      peer_hits=$((peer_hits+1))
+    done < <(git grep -ril -- "$claim" "$_peer_ref" -- docs/re docs/game docs/agents 2>/dev/null || true)
+  fi
+  scanned=$((scanned + hits))
+  if [ "$bad" -eq 0 ]; then
+    printf '  %-42s %d file(s), %d occurrence(s) suppressed\n' "$claim" "$hits" "$marked"
+    [ -n "$proposition" ] && [ "$proposition" != "$claim" ] \
+      && printf '      it asserted: %s\n' "$proposition"
+    total_marked=$((total_marked + marked))
+  else
+    printf '  %-42s 🔴 %d file(s) assert it unmarked\n' "$claim" "$bad"; fail=1
+  fi
+done <<< "$REGISTER"
+
+# 🔴 LIVENESS. A register full of claims and a tree with nothing in it reports
+# clean: the grep matches no files, every row scores 0, and the run passes having
+# READ NOTHING. Wrong directory, renamed docs, a bad checkout -- all produce a
+# green line. The Decoder's rule for the family: a control that only compares two
+# things cannot tell you the comparison is happening.
+if [ "$scanned" -eq 0 ]; then
+  echo "🔴 no file anywhere contains any registered claim -- this check READ" >&2
+  echo "   NOTHING. Exit 2: the harness is broken, not the corpus." >&2
+  exit 2
+fi
+
+echo
+if [ "$peer_hits" -gt 0 ]; then
+  printf '  %d occurrence(s) sit in PEER-OWNED files, read at their branch head\n' "$peer_hits"
+  echo "  rather than from this stale tree. NOT counted as failures: their pages"
+  echo "  mark corrections their own way, and the pages whose subject IS the"
+  echo "  corrections are where a dead phrase is supposed to appear."
+  echo
+  echo "  🔴 AND A PEER HIT IS UNADJUDICABLE FROM THE PHRASE ALONE. This register"
+  echo "     indexes PHRASES, not PROPOSITIONS. Demonstrated: \`1 of 3 streams\`"
+  echo "     [refuted] is"
+  echo "     dead here -- the exporter shipped one stream and now ships all"
+  echo "     qualifying ones -- and LIVE in the Decoder's corpus, where it is a"
+  echo "     standing warning. Same words, different propositions, and the bare"
+  echo "     row cannot tell them apart. It is not even unambiguous HERE: this"
+  echo "     port's own DECISIONS says the warning stays, in the same file where"
+  echo "     the export claim is dead. The marker separates them locally because"
+  echo "     the context is mine. Nothing separates them across corpora."
+  echo
+fi
+printf '  %d occurrence(s) were SUPPRESSED by a neighbouring `%s`.\n' "$total_marked" "$MARKER"
+echo "  That number is the size of what this check chose not to look at. A"
+echo "  detector that can discard a candidate without saying how many has an"
+echo "  unfalsifiable clean run -- its zero reads the same whether or not a live"
+echo "  assertion is hiding among the marked ones."
+echo
+[ $fail -eq 0 ] && echo "every refuted claim appears only inside its correction" \
+                || echo "🔴 a refuted claim is still being asserted"
+exit $fail

tools/port/check-modding

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Check the export against MODDING.md's five rules.
+#
+#   tools/port/check-modding
+#
+# `MODDING.md` opens by saying modding is a requirement and **a constraint on the
+# exporter today, not a later feature**. Nothing checked it. That is the shape
+# this port keeps finding: a rule stated, believed, and unexercised -- the black
+# hold implemented and never called, `ScreenView.skipped` written and never read,
+# `stop_bed` provided and never used, `--focus` parsed and overwritten.
+#
+# So this is a guard, not a fix: every rule passes as of 2026-08-30. Its value is
+# that the next thing to break one of them says so.
+#
+# ⚠️ What it CANNOT check: rule 3's "modern, editable" is enforced by extension,
+# which cannot tell a valid PNG from a renamed one, and rule 1's "one logical
+# asset" is checked as one-file-per-reference -- an exporter that split a sprite
+# and referenced both halves would pass. These are the rules' checkable shadows.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+EXPORT="${EXPORT:-export}"
+fail=0
+note() { printf '  %-6s %s\n' "$1" "$2"; [ "$1" = FAIL ] && fail=1 || true; }
+
+echo "MODDING rule 1 -- one logical asset, one file"
+python3 - "$EXPORT" <<'PY'
+import json, glob, os, sys
+E = sys.argv[1]
+ref = set()
+for p in glob.glob(f"{E}/screens/*/*.json"):
+    d = json.load(open(p))
+    for e in d["elements"]:
+        for k in ("sprite", "focus_sprite"):
+            if e.get(k): ref.add(e[k])
+        for sub in ("focus", "leaf"):
+            for fe in (e.get(sub) or {}).get("elements", []):
+                if fe.get("sprite"): ref.add(fe["sprite"])
+files = {os.path.relpath(p, E) for p in glob.glob(f"{E}/sprites/**/*.png", recursive=True)}
+missing, orphan = sorted(ref - files), sorted(files - ref)
+split = [f for f in files if any(t in os.path.basename(f) for t in ("part", "seg", "chunk"))]
+print("  %-6s %d sprites referenced, %d present" % ("OK" if not (missing or orphan) else "FAIL", len(ref), len(files)))
+if missing: print("  FAIL   referenced but absent:", missing[:5])
+if orphan:  print("  FAIL   present but unreferenced:", orphan[:5])
+if split:   print("  FAIL   split-looking names:", split[:5])
+sys.exit(1 if (missing or orphan or split) else 0)
+PY
+[ $? -eq 0 ] || fail=1
+
+echo "MODDING rule 2 -- names a person recognises"
+hex=$(find "$EXPORT" -type f | grep -Ec '0x[0-9a-f]{6,}|/[0-9a-f]{8}\.' || true)
+[ "$hex" -eq 0 ] && note OK "no hex or hash-shaped filenames" || note FAIL "$hex hash-shaped names"
+
+echo "MODDING rule 3 -- modern, editable formats only"
+bad=$(find "$EXPORT" -type f | sed 's/.*\.//' | sort -u | grep -vE '^(json|png|ogg|ogv|cmd)$' || true)
+[ -z "$bad" ] && note OK "only json/png/ogg/ogv (+ .cmd sidecars)" || note FAIL "unexpected: $(echo $bad)"
+# A `.cmd` is not an asset. It is allowed only because it SAYS SO in its own
+# first line -- see video.rs. An unlabelled one reads as something to edit.
+for c in $(find "$EXPORT" -name '*.cmd'); do
+  head -1 "$c" | grep -q '^# Generated by sylpheed-export' \
+    && note OK "$(basename "$c") is self-describing" \
+    || note FAIL "$(basename "$c") has no header saying what it is"
+done
+
+echo "MODDING rule 4 -- base and overrides, never one merged pile"
+grep -q 'data/mods' .gitignore && note OK "data/mods contents are gitignored" \
+  || note FAIL "data/mods is not gitignored -- a mod is usually a game asset"
+grep -rq 'data/mods' crates/sylpheed-export/src/ && note OK "the exporter resolves overrides" \
+  || note FAIL "nothing reads data/mods"
+
+echo "MODDING rule 5 -- provenance in every generated file"
+python3 - "$EXPORT" <<'PY'
+import json, glob, os, sys
+E = sys.argv[1]; miss = []
+for p in sorted(glob.glob(f"{E}/**/*.json", recursive=True)):
+    d = json.load(open(p))
+    if os.path.basename(p) == "manifest.json":
+        # The manifest is the provenance -- it carries disc, exporter and the
+        # formats revision for the whole tree, so it has no `source` of its own.
+        if not all(k in d for k in ("disc", "exporter", "formats_rev")): miss.append(p)
+        continue
+    src = d.get("source") or {}
+    if not (isinstance(src, dict) and src): miss.append(p)
+print("  %-6s %d json files carry provenance" % ("OK" if not miss else "FAIL",
+      len(glob.glob(f"{E}/**/*.json", recursive=True)) - len(miss)))
+for m in miss[:5]: print("  FAIL  ", m)
+sys.exit(1 if miss else 0)
+PY
+[ $? -eq 0 ] || fail=1
+
+echo
+[ $fail -eq 0 ] && echo "all five rules pass" || echo "🔴 a MODDING rule is broken"
+exit $fail

tools/port/contract-check

@@ -0,0 +1,538 @@
+#!/usr/bin/env python3
+"""Reconcile the numbers the CONTRACT states against the numbers the PORT ships.
+
+`docs/port/HANDOFF.md` is the contract, and this port reads it from `main` --
+where it is frozen at 926 lines while the live document, on the Decoder's branch,
+is 4 111. Two days of deliveries addressed to the port landed on a page the port
+does not open. Reading 70 unread sections by hand is how that gets missed again.
+
+So the values are checked instead of read. Each check names a quantity, pulls it
+OUT OF THE LIVE HANDOFF TEXT by pattern -- never restating it here, or this file
+would be a third copy to go stale -- and compares it against the port's own
+`export/` tree or `authored/` mapping.
+
+Three outcomes, and the third is the point:
+
+  ok        the contract and the port agree
+  MISMATCH  they disagree; one of us is wrong and this says which values
+  ANCHOR    the pattern no longer matches the contract -- the check has STOPPED
+            CHECKING. Reported as loudly as a mismatch, because a check whose
+            anchor has drifted passes forever while measuring nothing.
+
+Reads the newest HANDOFF on ANY ref, not the working tree's, and says which.
+
+🔴 WHEN A CHECK GOES `ANCHOR LOST`, ADD A SECOND NARROW ANCHOR -- DO NOT LOOSEN
+THIS ONE. The temptation is to make the pattern general enough to survive any
+rewording, and a general matcher fails in a way you have not met yet instead of
+one you can see. The Decoder reached this the expensive way: a narrow calibrated
+reader failed, they replaced it wholesale with a whole-frame comparison, and the
+swap felt like rigour until a crash dialog overlaid the frame and killed the
+general instrument while the narrow one kept working.
+"""
+import json, re, subprocess, sys, os
+
+FAIL = 0
+
+
+def git(*a):
+    return subprocess.run(["git", *a], capture_output=True, text=True).stdout
+
+
+def contract():
+    """The newest HANDOFF anywhere, and how far the working tree's copy is behind."""
+    sha = git("log", "--all", "--format=%h", "--", "docs/port/HANDOFF.md").split()[0]
+    mine = git("log", "-1", "--format=%h", "--", "docs/port/HANDOFF.md").strip()
+    text = git("show", f"{sha}:docs/port/HANDOFF.md")
+    behind = len(git("log", "--all", "--not", "HEAD", "--format=%h",
+                     "--", "docs/port/HANDOFF.md").split())
+    print(f"  contract: {sha} ({len(text.splitlines())} lines)")
+    print(f"  my copy : {mine} ({len(git('show', f'{mine}:docs/port/HANDOFF.md').splitlines())} lines)"
+          f"{'' if behind == 0 else f'  <- {behind} HANDOFF commit(s) unread'}")
+    return text
+
+
+def report(name, want, got, ok):
+    global FAIL
+    if want is None:
+        FAIL += 1
+        print(f"  {name:<30} 🔴 ANCHOR LOST -- the contract no longer states this")
+    elif ok:
+        print(f"  {name:<30} ok        contract {want}  port {got}")
+    else:
+        FAIL += 1
+        print(f"  {name:<30} 🔴 MISMATCH contract {want}  port {got}")
+
+
+def jload(p):
+    return json.load(open(p)) if os.path.exists(p) else None
+
+
+def el(screen, prefix):
+    d = jload(f"export/screens/title/{screen}.json")
+    if not d:
+        return None
+    return next((e for e in d["elements"] if e["id"].startswith(prefix)), None)
+
+
+# --- the checks ------------------------------------------------------------
+
+def check_fade_quads(h):
+    """The fade-in that a broken helper reported 5x too slow for years.
+
+    The contract prints the three builds' `pteff00` poses in one fence. The port
+    animates that quad from its OWN export, so agreement here is two readers of
+    the same bytes -- theirs rebuilt after the record-layout fix, mine the pinned
+    crate -- and a disagreement would mean one reader never got the fix.
+    """
+    for screen, build in (("title", 4), ("main_menu", 5), ("extras", 6)):
+        m = re.search(rf"build {build} \([^)]*\)\s+pteff00\.prm\s+(.+)", h)
+        want = None
+        if m:
+            want = [(int(t), int(a)) for t, a in re.findall(r"t=\s*(\d+)\s*α=(\d+)", m.group(1))]
+        e = el(screen, "pteff00")
+        got = [(k["t"], int(k["fade_argb"][2:4], 16)) for k in e["keyframes"]] if e else None
+        report(f"fade quad, {screen}", want, got, want is not None and want == got)
+
+
+def check_plate_period(h):
+    """`+0x08` is the loop length: 120, and the port must not run the glow at 105."""
+    m = re.search(r"the plate's pulse period is (\d+), not (\d+)", h)
+    want = int(m.group(1)) if m else None
+    e = el("press_start", "ptbtn00")
+    got = (e.get("focus") or {}).get("loop_length_units") if e else None
+    report("plate glow cycle", want, got, want is not None and want == got)
+    a = jload("authored/timing.json") or {}
+    auth = a.get("looping_focus_records", {}).get("press_start/ptbtn00", {}).get("period_units")
+    report("  ... authored 2nd witness", want, auth, want is not None and want == auth)
+
+
+def check_bgm_window(h):
+    """The menu loop, as an ffmpeg window the contract states literally."""
+    m = re.search(r"the window is \*\*`-ss ([\d.]+) -t ([\d.]+)`\*\*", h)
+    want = (float(m.group(1)), float(m.group(2))) if m else None
+    a = ((jload("authored/audio.json") or {}).get("bgm") or {}).get("main_menu", {})
+    got = (a.get("loop_start_s"), a.get("loop_end_s"))
+    report("menu BGM loop window", want, got, want is not None and want == got)
+
+
+def check_black_hold(h):
+    """The gap between screens is not a load: the contract says keep it at 0."""
+    m = re.search(r"Keep `black_hold_units` at (\d+)", h)
+    want = int(m.group(1)) if m else None
+    got = (jload("authored/timing.json") or {}).get("black_hold_units")
+    report("black hold between screens", want, got, want is not None and want == got)
+
+
+def check_menu_bank(h):
+    """Which bank the menu plays -- the row the port once got wrong by authoring."""
+    m = re.search(r"`(BGM_\d+)` confirmed from the RUNTIME", h)
+    want = m.group(1) if m else None
+    got = (((jload("authored/audio.json") or {}).get("bgm") or {})
+           .get("main_menu", {}).get("bank", ""))
+    report("menu BGM bank", want, got, want is not None and got.startswith(want))
+
+
+def check_fade_out(h):
+    """The fade-OUT lengths, derived from the same poses the fade-in check reads.
+
+    Stated as prose rather than in the fence, so this parses the sentence. Split
+    from the fade-in deliberately: they came from the same broken helper, and a
+    single check covering both would let one wrong half hide behind a right one.
+    """
+    m = re.search(r"Fade-out = (\d+) units, (\d+) units, and \*\*(\d+)\*\* on the title", h)
+    want = [int(m.group(i)) for i in (1, 2, 3)] if m else None
+    got = []
+    for screen in ("main_menu", "extras", "title"):
+        e = el(screen, "pteff00")
+        ks = [k["t"] for k in e["keyframes"]] if e else []
+        got.append(ks[-1] - ks[-2] if len(ks) >= 2 else None)
+    report("fade-out ramps", want, got, want is not None and want == got)
+
+
+def check_splash_dwell(h):
+    """The two boot splashes' dwell -- the retraction the port's recomputation caused.
+
+    The contract gives 190 and 145 as the widest gap in each entry's own times.
+    The port plays the declared timeline, so the same gap must come out of the
+    export. This is the retracted claim re-derived from a third reading.
+    """
+    m = re.search(r"the splashes are (\d+) and (\d+)", h)
+    want = [int(m.group(1)), int(m.group(2))] if m else None
+    got = []
+    for screen in ("publisher_logo", "developer_logos"):
+        d = jload(f"export/screens/title/{screen}.json")
+        ts = sorted({k["t"] for e in d["elements"] for k in e["keyframes"]}) if d else []
+        got.append(max((b - a for a, b in zip(ts, ts[1:])), default=None))
+    report("boot splash dwells", want, got, want is not None and want == got)
+
+
+def check_splash_times(h):
+    """The splash's ABSOLUTE keyframe times, not just the gap between two of them.
+
+    🔴 Added 2026-08-30 because the dwell check above is a DIFFERENCE, and a
+    difference is blind to the origin: a reader whose times were all shifted by a
+    constant would produce the same 190 and pass. That is not hypothetical -- the
+    Decoder's own control asserted "two DOWNs move two items", which a constant
+    offset preserves exactly, and it passed for a whole session on a reader that
+    was two items wrong. Ground truth caught it; the control could not.
+
+    The contract prints entry 10's times in full, so the origin is checkable.
+    """
+    m = re.search(r"entry 10's times are\s*`\[([0-9, ]+)\]`", h)
+    want = [int(x) for x in m.group(1).split(",")] if m else None
+    d = jload("export/screens/title/publisher_logo.json")
+    got = sorted({k["t"] for e in d["elements"] for k in e["keyframes"]}) if d else None
+    report("splash absolute times", want, got, want is not None and want == got)
+
+
+def check_initial_focus(h):
+    """What the menu opens on FROM A FRESH BOOT -- measured, and it was authored.
+
+    Anchored on the measurement rather than on the value, so that if the reading
+    is corrected again this fails instead of silently agreeing.
+    """
+    want = "NEW GAME" if re.search(
+        r"\*\*Initial focus on a fresh boot is `NEW GAME`\*\*", h) else None
+    scr = ((jload("authored/flow.json") or {}).get("screens") or {}).get("main_menu", {})
+    bid = scr.get("initial_focus")
+    got = (scr.get("buttons") or {}).get(bid, {}).get("label")
+    kind = scr.get("initial_focus_kind")
+    report("menu opens on (fresh boot)", want, f"{got} [{kind}]",
+           want is not None and got == want and kind == "measured")
+
+
+
+
+
+def fn_nav_perturbed(fn, old, new):
+    """Run a walk-anchored check against a perturbed copy of the walk.
+
+    `nav()` reads from git, so the perturbation is injected by swapping the
+    function out rather than by editing a file -- nothing on disk is touched.
+    """
+    global nav
+    real = nav
+    nav = lambda: (real()[0].replace(old, new), real()[1])
+    try:
+        fn(None)
+    finally:
+        nav = real
+
+
+def selftest(h):
+    """Does the CONTROL MACHINERY notice a check that cannot fail?
+
+    🔴 THE GAP THIS CLOSES, named by me and prioritised by the Decoder: every
+    `--control` run asserts that each check FAILS on a perturbed contract. None
+    of them asserted that a **broken control reports broken**. That is the same
+    shape as printing a verdict without asserting it, one level up — and a
+    control harness that silently approves a dead check is exactly as useless as
+    a check that silently approves a dead value.
+
+    So a stub check that can never fail is fed to the machinery, and the
+    machinery must flag it. If the stub comes back "✅ fails as it must", the
+    harness is broken and says so with its own exit code.
+
+    Exit codes follow the Decoder's convention, which distinguishes the two
+    failures that matter: **0** all good, **1** a real check failed, **2** the
+    HARNESS is broken and nothing it reported can be trusted.
+    """
+    import io, contextlib
+
+    def always_ok(_h):
+        # Prints a verdict and asserts nothing -- the exact defect shipped in
+        # `verify-transcode-fidelity`'s unconditional `return 0`.
+        print("  stub: everything is fine")
+
+    # 🔴 RUN THE REAL MACHINERY OVER THE STUB. A first version of this checked
+    # that the stub left FAIL at zero and then ARGUED that `control` would
+    # therefore flag it. That is reasoning where a measurement was available --
+    # the error this whole thread has been about -- so the stub goes through the
+    # same `control()` loop the real checks do, and its verdict is read.
+    with contextlib.redirect_stdout(io.StringIO()) as buf:
+        verdict = control(h, extra=[(always_ok, "120", "121")])
+    out = buf.getvalue()
+    stub_line = [l for l in out.splitlines() if "always_ok" in l]
+    if verdict is not False or not stub_line:
+        print("  🔴 HARNESS BROKEN: the control machinery did not flag a check that")
+        print("     cannot fail. Nothing any `--control` run has reported is trustworthy.")
+        print(f"     stub verdict: {verdict!r}; line: {stub_line}")
+        return 2
+    if "PASSES A WRONG CONTRACT" not in stub_line[0]:
+        print(f"  🔴 HARNESS BROKEN: stub flagged, but not as a dead check: {stub_line[0].strip()}")
+        return 2
+    print("  harness self-test: a check that cannot fail is flagged by the machinery ✅")
+    print(f"    {stub_line[0].strip()}")
+    print("  Exit codes: 0 all good, 1 a real check failed, 2 the HARNESS is broken.")
+    return 0
+
+
+def control(h, extra=None):
+    global FAIL
+    import io, contextlib
+    ok = True
+    print("  known negatives -- every check must notice a perturbed contract:\n")
+    for fn, old, new in CONTROLS + [(f, o, n) for f, o, n in NAV_CONTROLS] + (extra or []):
+        # Membership tested against NAV_CONTROLS, not CONTROLS: anything else --
+        # including a self-test stub passed in via `extra` -- is anchored on
+        # HANDOFF. Written the other way round, the stub was routed at the walk
+        # and flagged "the control's own anchor is gone", a real failure for a
+        # fabricated reason.
+        src = nav()[0] if (fn, old, new) in NAV_CONTROLS else h
+        if old not in src:
+            print(f"  {fn.__name__:<22} 🔴 the control's own anchor is gone")
+            ok = False
+            continue
+        before, FAIL = FAIL, 0
+        with contextlib.redirect_stdout(io.StringIO()):
+            if src is h:
+                # 🔴 EVERY occurrence, not the first. A one-shot replace left the
+                # check reading an untouched duplicate and passing a perturbed
+                # contract -- reported 2026-08-30 the day a delivery's heading
+                # came to appear twice. The control caught its own harness: a
+                # perturbation that does not reach every copy of the anchor makes
+                # the check untestable, silently, because it keeps passing.
+                fn(h.replace(old, new))
+            else:
+                fn_nav_perturbed(fn, old, new)
+        noticed, FAIL = FAIL > 0, before
+        print(f"  {fn.__name__:<22} {'✅ fails as it must' if noticed else '🔴 PASSES A WRONG CONTRACT -- it checks nothing'}")
+        ok = ok and noticed
+    return ok
+
+
+def nav():
+    """The player's-eye walk, from the newest ref that carries it.
+
+    A second unreachable document: `docs/game/navigation.md` was filled in from
+    the committed oracle frames and, like HANDOFF, is not on `main`. The port's
+    `authored/flow.json` is the executable form of that walk, so the two must not
+    drift -- and the drift would be invisible, because nothing in the port fails
+    when a label is wrong.
+    """
+    sha = git("log", "--all", "--format=%h", "--", "docs/game/navigation.md").split()[0]
+    return git("show", f"{sha}:docs/game/navigation.md"), sha
+
+
+def flow_buttons(screen):
+    d = jload("authored/flow.json") or {}
+    b = ((d.get("screens") or {}).get(screen) or {}).get("buttons") or {}
+    return [v.get("label") for _, v in sorted(b.items())]
+
+
+def check_focus_persists(h):
+    """The menu remembers its cursor -- MEASURED, on the main menu, one screen.
+
+    🔴 This checked a PAIR until 2026-08-30: on for `main_menu`, off everywhere
+    else. The second half asserted that `extras` does NOT persist, and **nothing
+    measured that**. What the corpus has is EXTRAS' initial focus from a single
+    entry and Ⓑ restoring the PARENT's focus 4/4 — neither says what a submenu's
+    own cursor does on re-entry. So one measured behaviour and one absence of a
+    measurement were being reported identically, and if the game does persist
+    EXTRAS the check would have held the port to the wrong behaviour AND PASSED.
+
+    The mirror of the trap it was written to avoid: refusing to let a derived
+    rule overwrite a measured value, then letting "not measured here" become a
+    positive assertion of the negative. Now only the measured half is asserted
+    against the contract; the scope is a guard, below.
+    """
+    heading = bool(re.search(r"the main menu remembers its cursor; re-entry is not a reset", h))
+    # 🔴 SECOND NARROW ANCHOR, added 2026-08-30 on the Decoder's advice, and it
+    # repairs a weakness I had already identified and not acted on. The heading
+    # anchor is on the CONCLUSION; when they corrected the run's item names --
+    # `TUTORIAL → EXTRAS → EXTRAS` was actually `NEW GAME → TUTORIAL → TUTORIAL`
+    # -- this check sailed past it, because the conclusion was above the part
+    # that was wrong. It survived by luck, not by design.
+    #
+    # So the check now also rests on the EVIDENCE: the ring at y 384.0 before the
+    # round trip and 385.5 after. That pair is the geometry-free equality the
+    # conclusion actually stands on, and it is what a future correction to the
+    # measurement would have to touch.
+    #
+    # Two narrow anchors, NOT one loosened one. Their words: after a specific
+    # instrument fails the general one feels safer, and its failure mode is only
+    # one you have not met yet.
+    evidence = bool(re.search(r"ring sits at y 384\.0 before the round trip and 385\.5 after", h))
+    want = heading and evidence
+    got = (((jload("authored/flow.json") or {}).get("screens") or {})
+           .get("main_menu", {}).get("focus_persists"))
+    if heading != evidence:
+        print(f"  {'menu remembers its cursor':<30} 🔴 ANCHOR SPLIT -- heading"
+              f" {heading}, evidence {evidence}: one moved without the other")
+        globals()["FAIL"] = FAIL + 1
+        return
+    report("menu remembers its cursor", want or None, got, want and got is True)
+
+
+def check_extras_resets(h):
+    """EXTRAS resets -- MEASURED 2026-08-30, and it used to be asserted unmeasured.
+
+    For one iteration the port asserted this with nothing behind it, which the
+    Decoder flagged; it then measured it and the assertion was right. That does
+    not make the assertion evidence, so the check is rewritten to rest on the
+    measurement rather than being left to look vindicated.
+    """
+    want = False if re.search(r"EXTRAS resets, the main menu persists", h) else None
+    ex = ((jload("authored/flow.json") or {}).get("screens") or {}).get("extras", {})
+    got = ex.get("focus_persists")
+    report("extras resets its cursor", want, f"{got} [{ex.get('focus_persists_kind')}]",
+           want is not None and got is False and ex.get("focus_persists_kind") == "measured")
+
+
+def check_reset_target(h):
+    """A submenu resets to its OWN OPENING ITEM, not to the top one.
+
+    Measured 2026-08-31. The port satisfies it by construction -- `opening_focus`
+    falls through to `initial_focus` -- so this asserts that construction has not
+    been quietly replaced by a `buttons[0]` default, which is now known wrong for
+    a real screen (`DIFFICULTY` opens on the second of four).
+    """
+    want = bool(re.search(r"resets to its own opening item", h))
+    scr = ((jload("authored/flow.json") or {}).get("screens") or {}).get("extras", {})
+    btns = sorted((scr.get("buttons") or {}).keys())
+    target = scr.get("initial_focus")
+    # The check has teeth only because EXTRAS' named item happens to be first
+    # here: what it guards is that the AUTHORED value is the target, not the
+    # index. Stated so a reader does not mistake agreement for evidence.
+    report("submenu reset target", "the authored opening item" if want else None,
+           f"{target} (authored){' == buttons[0]' if btns and target == btns[0] else ''}",
+           want and target is not None and target == scr.get("initial_focus"))
+
+
+def guard_focus_scope(_h):
+    """NOT a contract check. A guard over the screens NOBODY HAS LOOKED AT.
+
+    Two screens are now measured and disagree -- `main_menu` persists, `extras`
+    resets -- so there is no menu-wide rule to state. What this guards is the
+    rest: `OPTIONS`, `LOAD GAME` and `TUTORIAL` are untouched, and their absent
+    `focus_persists` is the port defaulting, not a finding.
+
+    📌 The absent key and a measured `false` behave identically and mean opposite
+    things. That is why `extras` now spends a key on saying `false` out loud.
+    """
+    global FAIL
+    scr = ((jload("authored/flow.json") or {}).get("screens") or {})
+    stated = {n: v.get("focus_persists") for n, v in scr.items()
+              if isinstance(v, dict) and "focus_persists" in v}
+    silent = sorted(n for n, v in scr.items()
+                    if isinstance(v, dict) and "focus_persists" not in v)
+    ok = stated == {"main_menu": True, "extras": False}
+    if ok:
+        # ✅ 2026-08-31: all FOUR submenus are now measured to reset -- EXTRAS,
+        # LOAD GAME, TUTORIAL and OPTIONS -- and the main menu remains the only
+        # screen that remembers. Three of those four are not in this export, so
+        # no authored value changes.
+        #
+        # 🔴 NOT PROMOTED TO A RULE, deliberately. "Submenus reset" at 4/4 is
+        # better evidence than the 2/2 that made `wrap` a rule -- and adopting it
+        # would change nothing today, because the only submenu this port ships is
+        # already measured. What it WOULD do is pre-decide the next screen from a
+        # generalisation instead of a measurement, which is the trap that nearly
+        # let a derived rule overwrite EXTRAS' measured opening item.
+        print(f"  {'focus_persists scope':<30} guard     {stated} measured;"
+              f" {len(silent)} screen(s) silent = UNMEASURED, not 'resets'"
+              f"  [4/4 submenus reset disc-wide; not promoted to a rule]")
+    else:
+        FAIL += 1
+        print(f"  {'focus_persists scope':<30} 🔴 GUARD  {stated} -- a screen states"
+              f" this without a measurement behind it")
+
+
+def check_menu_labels(_h):
+    """The five main-menu labels, in order, off the walk's own table."""
+    n, sha = nav()
+    rows = re.findall(r"^\| [1-5] \| \*\*([A-Z ]+)\*\* \|", n, re.M)
+    want = rows or None
+    report(f"main menu labels ({sha})", want, flow_buttons("main_menu"),
+           want is not None and want == flow_buttons("main_menu"))
+
+
+def check_extras_labels(_h):
+    """EXTRAS' three items, written as prose rather than a table."""
+    n, _ = nav()
+    m = re.search(r"Three items: `([A-Z ]+)` · `([A-Z ]+)` · `([A-Z ]+)`", n)
+    want = [m.group(i) for i in (1, 2, 3)] if m else None
+    report("extras labels", want, flow_buttons("extras"),
+           want is not None and want == flow_buttons("extras"))
+
+
+def check_wrap(_h):
+    """The cursor wraps, and it is a MENU rule -- the walk says so in two places."""
+    n, _ = nav()
+    want = True if re.search(r"one item, and it \*\*wraps\*\* at both ends", n) else None
+    got = ((jload("authored/flow.json") or {}).get("navigation") or {}).get("wrap")
+    report("cursor wraps", want, got, want is not None and want == got)
+
+
+# Each check paired with a one-token edit to the CONTRACT that must break it.
+# A check that has never been observed to fail is not evidence -- it may be
+# reading nothing, comparing a value to itself, or anchored on a pattern that
+# matches anything. `--control` perturbs the contract and requires every check to
+# notice. This is the same discipline the checks themselves enforce: an
+# instrument goes through a known negative before its clean run is believed.
+CONTROLS = [
+    (check_fade_quads,  "pteff00.prm   t=  0 α=255   t= 12", "pteff00.prm   t=  0 α=255   t= 13"),
+    (check_fade_out,    "Fade-out = 10 units, 10 units",     "Fade-out = 11 units, 10 units"),
+    (check_plate_period, "pulse period is 120, not 105",     "pulse period is 121, not 105"),
+    (check_bgm_window,  "`-ss 9.44 -t 61.87`",               "`-ss 9.45 -t 61.87`"),
+    (check_black_hold,  "Keep `black_hold_units` at 0",      "Keep `black_hold_units` at 3"),
+    (check_menu_bank,   "`BGM_103` confirmed from the RUNTIME", "`BGM_999` confirmed from the RUNTIME"),
+    (check_splash_dwell, "the splashes are 190 and 145",     "the splashes are 191 and 145"),
+    (check_focus_persists, "the main menu remembers its cursor; re-entry is not a reset",
+                           "the main menu forgets its cursor; re-entry is a reset"),
+    # The SECOND anchor gets its own known negative. Perturbing only the evidence
+    # must trip ANCHOR SPLIT -- otherwise the second anchor is decorative and the
+    # check is still resting on the conclusion alone.
+    (check_focus_persists, "ring sits at y 384.0 before the round trip and 385.5 after",
+                           "ring sits at y 384.0 before the round trip and 999.9 after"),
+    # The list sits on the line AFTER "times are", so the perturbation has to
+    # carry the newline the check's `\s*` spans. A control whose own anchor is
+    # written from memory of the prose rather than from the prose is the same
+    # class of error the checks exist to catch.
+    (check_splash_times, "times are\n`[0,15,30,45,235,239,251,255]`",
+                         "times are\n`[1,16,31,46,236,240,252,256]`"),
+    (check_reset_target, "resets to its own opening item",
+                         "resets to whichever item is on top"),
+    (check_extras_resets, "EXTRAS resets, the main menu persists",
+                          "EXTRAS persists, the main menu persists"),
+    (check_initial_focus, "**Initial focus on a fresh boot is `NEW GAME`**",
+                          "**Initial focus on a fresh boot is `TUTORIAL`**"),
+]
+
+# The walk's controls perturb `navigation.md` instead of HANDOFF, so they are
+# applied to a different document and kept separate rather than folded in.
+NAV_CONTROLS = [
+    (check_menu_labels,   "| 1 | **NEW GAME**",  "| 1 | **NEW GAMES**"),
+    (check_extras_labels, "`MISSION SELECT` · `MOVIE THEATER`", "`MISSION SELECTS` · `MOVIE THEATER`"),
+    (check_wrap,          "one item, and it **wraps** at both ends", "one item, and it stops at both ends"),
+]
+
+
+def main():
+    if not os.path.exists("export/manifest.json"):
+        sys.exit("no export/ -- run the exporter first; this check reads what is shipped")
+    h = contract()
+    print()
+    if "--selftest" in sys.argv:
+        return selftest(h)
+    if "--control" in sys.argv:
+        return 0 if control(h) else 1
+    for fn in (check_fade_quads, check_fade_out, check_plate_period,
+               check_bgm_window, check_black_hold, check_menu_bank,
+               check_splash_dwell, check_menu_labels, check_extras_labels,
+               check_wrap, check_focus_persists, guard_focus_scope,
+               check_splash_times, check_initial_focus, check_extras_resets,
+               check_reset_target):
+        fn(h)
+    print()
+    print("  A passing run means the port agrees with the contract ON THESE VALUES.")
+    print("  It is not a statement about the 70 sections nobody has reduced to a")
+    print("  check -- those are still read by hand, or not read at all.")
+    if FAIL:
+        print(f"\n🔴 {FAIL} disagreement(s) or lost anchor(s) with the contract")
+    else:
+        print("\nthe port agrees with the contract on every value checked")
+    return 1 if FAIL else 0
+
+
+sys.exit(main())

tools/port/edge-residual-kind

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""What KIND of error is left at the edges after tone is accounted for?
+
+    tools/port/edge-residual-kind [screen]        # default main_menu
+
+`verify-capture`'s `diff` column thresholds at 25 % and so only sees GROSS
+displacement. Fitting a per-level LUT removes everything a tone effect can
+explain. What is left on the main menu is concentrated 3.2x on edge pixels
+(DECISIONS.md, 2026-08-31) -- and three things produce that: a misregistration,
+an antialiasing difference, or a genuinely misplaced element.
+
+THE DISCRIMINATOR IS THE SIGN, and it is the Decoder's, from their reply on
+2026-08-31: a shift gives a residual with a CONSISTENT DIRECTION along the edge,
+an antialiasing difference does not. Made concrete:
+
+  * shifted by (dx,dy):  residual ~ dx*d/dx + dy*d/dy   -- and the fitted SLOPE
+                                                           IS THE SHIFT IN PIXELS
+  * blurred/sharpened :  residual ~ -k * laplacian      -- symmetric, no direction
+
+EXIT CODES. 0 the report is trustworthy, 2 A CONTROL FAILED so the numbers below
+it mean nothing. There is no 1: this tool classifies, it does not judge. A
+correlation this tool reports is worthless without the two controls above it,
+which is why they are not optional and not a flag.
+"""
+import math, os, subprocess, sys, tempfile
+
+CAPS = "docs/re/captures/title-builds"
+SCREEN = sys.argv[1] if len(sys.argv) > 1 else "main_menu"
+# The captures are a 1279x675 top-left crop of the 1280x720 guest surface, so the
+# render is cropped to match and NOTHING IS SCALED -- resampling would manufacture
+# exactly the edge signal this tool measures. See verify-capture, same reason.
+W, H = 1279, 675
+EDGE = 12          # |grad| above which a pixel is an edge
+PASS_SHIFT, PASS_BLUR = 0.70, -0.70
+
+
+def gray(png, out):
+    subprocess.run(["convert", png, "-colorspace", "Gray", "-depth", "8",
+                    "gray:" + out], check=True)
+    return open(out, "rb").read()
+
+
+def lutfit(a, b):
+    tot = [0] * 256; cnt = [0] * 256
+    for i in range(len(a)):
+        tot[a[i]] += b[i]; cnt[a[i]] += 1
+    return [(tot[v] // cnt[v]) if cnt[v] else v for v in range(256)]
+
+
+def analyse(a, b):
+    lut = lutfit(a, b)
+    gx = []; gy = []; lp = []; rs = []
+    for y in range(1, H - 1):
+        o = y * W
+        for x in range(1, W - 1):
+            i = o + x
+            ax = (a[i + 1] - a[i - 1]) * 0.5
+            ay = (a[i + W] - a[i - W]) * 0.5
+            if abs(ax) + abs(ay) < EDGE:
+                continue
+            gx.append(ax); gy.append(ay)
+            lp.append(float(a[i + 1] + a[i - 1] + a[i + W] + a[i - W] - 4 * a[i]))
+            rs.append(float(lut[a[i]] - b[i]))
+    n = len(rs)
+    if n < 1000:
+        print(f"  🔴 only {n} edge pixels -- nothing to classify"); sys.exit(2)
+    mr = sum(rs) / n
+
+    def fit(u):
+        mu = sum(u) / n
+        suu = sum((v - mu) ** 2 for v in u)
+        srr = sum((v - mr) ** 2 for v in rs)
+        sur = sum((u[k] - mu) * (rs[k] - mr) for k in range(n))
+        return (0.0, 0.0) if suu <= 0 or srr <= 0 else (sur / suu, sur / math.sqrt(suu * srr))
+    return n, fit(gx), fit(gy), fit(lp)
+
+
+def row(label, res):
+    n, (sx, rx), (sy, ry), (sl, rl) = res
+    print(f"  {label}  (n={n})")
+    print(f"    horizontal shift : r={rx:+.3f}  slope={sx:+.3f} px")
+    print(f"    vertical   shift : r={ry:+.3f}  slope={sy:+.3f} px")
+    print(f"    blur / sharpness : r={rl:+.3f}  coef ={sl:+.3f}")
+    return rx, ry, rl
+
+
+def shifted(a, dx):
+    out = bytearray(a)
+    for y in range(H):
+        for x in range(W):
+            out[y * W + x] = a[y * W + min(W - 1, max(0, x - dx))]
+    return bytes(out)
+
+
+def blurred(a):
+    out = bytearray(a)
+    for y in range(1, H - 1):
+        o = y * W
+        for x in range(1, W - 1):
+            i = o + x
+            out[i] = (a[i] * 4 + a[i + 1] + a[i - 1] + a[i + W] + a[i - W]) // 8
+    return bytes(out)
+
+
+tmp = tempfile.mkdtemp()
+cap_png = f"{CAPS}/live-{SCREEN.replace('_', '-')}.png"
+if not os.path.exists(cap_png):
+    print(f"  🔴 no capture: {cap_png}"); sys.exit(2)
+render = os.environ.get("RENDER") or f"{tmp}/render.png"
+if not os.path.exists(render):
+    print(f"  🔴 no render at {render} -- set RENDER=<png>"); sys.exit(2)
+subprocess.run(["convert", render, "-crop", f"{W}x{H}+0+0", "+repage",
+                f"{tmp}/crop.png"], check=True)
+r = gray(f"{tmp}/crop.png", f"{tmp}/r.gray")
+c = gray(cap_png, f"{tmp}/c.gray")
+
+print("CONTROLS -- the render against a deliberately damaged copy of itself.")
+print("A correlation below is meaningless unless these two recover what was done.\n")
+ra = analyse(r, shifted(r, 1))
+rxa, _, rla = row("known +1 px HORIZONTAL shift", ra)
+rb = analyse(r, blurred(r))
+_, _, rlb = row("known BLUR, no shift", rb)
+bad = []
+if rxa < PASS_SHIFT: bad.append(f"shift control r={rxa:+.3f} < {PASS_SHIFT}")
+if rlb > PASS_BLUR:  bad.append(f"blur control r={rlb:+.3f} > {PASS_BLUR}")
+if bad:
+    print("\n  🔴 CONTROL FAILED: " + "; ".join(bad))
+    print("  The discriminator cannot see what it is for. Report suppressed.")
+    sys.exit(2)
+print(f"\n  ✅ controls pass -- a 1 px shift reads as {ra[1][0]:+.3f} px\n")
+print(f"THE REAL PAIR -- {SCREEN}\n")
+rx, ry, rl = row(f"{SCREEN} render vs oracle capture", analyse(r, c))
+print()
+if max(abs(rx), abs(ry)) < 0.15 and abs(rl) < 0.3:
+    print("  => NEITHER a global shift NOR a uniform blur.")
+    print("  ⚠️ REACH: this is a WHOLE-FRAME fit. One misplaced element is a small")
+    print("     share of the edge pixels and would not move these numbers. This")
+    print("     excludes a global translation; it does not exclude a local one.")

tools/port/edge-residual-map

@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""WHERE does the edge residual sit, and is that region locally shifted?
+
+    RENDER=<png> tools/port/edge-residual-map [screen]
+
+`edge-residual-kind` fits the whole frame and excludes a GLOBAL translation. Its
+own reach statement says the thing it cannot do: one misplaced element is a small
+share of 38 752 edge pixels and would not move a whole-frame number. This tiles
+the frame and runs the same discriminator INSIDE each tile, so a single displaced
+element shows up as one hot tile with a local slope -- which is invisible to the
+global fit by construction, not by accident.
+
+Division of labour, agreed with the Decoder 2026-08-31: the residual map is the
+port's (it needs the render beside the capture), the element inventory is theirs
+(it needs the disc). This tool produces the map and NAMES NOTHING.
+
+THE CONTROL IS A KNOWN LOCAL SHIFT. A map that cannot localise a displacement it
+was told about cannot be trusted to have found one it was not. Exit 0 the report
+is trustworthy, 2 the control failed and the report is suppressed. No 1.
+"""
+import math, os, subprocess, sys, tempfile
+
+CAPS = "docs/re/captures/title-builds"
+SCREEN = sys.argv[1] if len(sys.argv) > 1 else "main_menu"
+W, H = 1279, 675                 # top-left crop of the guest surface; never scaled
+TILE = 64
+EDGE = 12
+MIN_EDGE_PX = 150                # below this a tile's slope is noise
+# The controls displace this region and the map must find it there.
+CTRL_BOX = (448, 320, 640, 448)  # x0, y0, x1, y1
+# TWO controls, because ONE OF THEM FAILED AND TAUGHT ME THE LIMIT. The slope is
+# a linearisation, residual ~ dx * gradient, which holds only while dx is small
+# against the width of an edge. A +2 px displacement localises perfectly but reads
+# back +0.8..+1.25, so the estimator SATURATES. Control A checks magnitude in the
+# regime where magnitude means something; control B checks that a displacement too
+# large to measure is still FOUND. Reporting a saturating slope as a distance
+# would understate a real displacement by more than half.
+CTRL_A_DX = 1   # linear regime: localisation AND magnitude
+CTRL_B_DX = 2   # saturating:    localisation and SIGN only
+
+
+def gray(png, out):
+    subprocess.run(["convert", png, "-colorspace", "Gray", "-depth", "8",
+                    "gray:" + out], check=True)
+    return open(out, "rb").read()
+
+
+def lutfit(a, b):
+    tot = [0] * 256; cnt = [0] * 256
+    for i in range(len(a)):
+        tot[a[i]] += b[i]; cnt[a[i]] += 1
+    return [(tot[v] // cnt[v]) if cnt[v] else v for v in range(256)]
+
+
+def tiles(a, b):
+    """Per-tile mean |residual| on edge pixels, and the local shift slope."""
+    lut = lutfit(a, b)          # ONE global LUT: tone is global, displacement is not
+    out = {}
+    for ty in range(0, H - 1, TILE):
+        for tx in range(0, W - 1, TILE):
+            gx = []; gy = []; rs = []; flat = []
+            for y in range(max(1, ty), min(H - 1, ty + TILE)):
+                o = y * W
+                for x in range(max(1, tx), min(W - 1, tx + TILE)):
+                    i = o + x
+                    ax = (a[i + 1] - a[i - 1]) * 0.5
+                    ay = (a[i + W] - a[i - W]) * 0.5
+                    d = float(lut[a[i]] - b[i])
+                    if abs(ax) + abs(ay) < EDGE:
+                        flat.append(abs(d)); continue
+                    gx.append(ax); gy.append(ay); rs.append(d)
+            n = len(rs)
+            if n < MIN_EDGE_PX:
+                continue
+            mabs = sum(abs(v) for v in rs) / n
+            mflat = (sum(flat) / len(flat)) if flat else 0.0
+            mr = sum(rs) / n
+
+            def slope(u):
+                mu = sum(u) / n
+                suu = sum((v - mu) ** 2 for v in u)
+                if suu <= 0:
+                    return 0.0
+                return sum((u[k] - mu) * (rs[k] - mr) for k in range(n)) / suu
+            out[(tx, ty)] = (mabs, slope(gx), slope(gy), n, mflat)
+    return out
+
+
+def top(t, k=8):
+    return sorted(t.items(), key=lambda kv: -kv[1][0])[:k]
+
+
+def show(t, label, k=8):
+    print(f"  {label}")
+    print(f"    {'tile':>12}  {'edge':>7} {'flat':>7} {'e/f':>6} "
+          f"{'dx':>7} {'dy':>7} {'edge px':>8}")
+    for (tx, ty), (m, sx, sy, n, mf) in top(t, k):
+        ef = (m / mf) if mf > 0.01 else float('inf')
+        print(f"    {tx:4d},{ty:4d}   {m:7.2f} {mf:7.2f} {ef:6.2f} "
+              f"{sx:+7.3f} {sy:+7.3f} {n:8d}")
+
+
+def shift_box(a, box, dx):
+    x0, y0, x1, y1 = box
+    out = bytearray(a)
+    for y in range(y0, y1):
+        for x in range(x0, x1):
+            out[y * W + x] = a[y * W + min(W - 1, max(0, x - dx))]
+    return bytes(out)
+
+
+tmp = tempfile.mkdtemp()
+cap = f"{CAPS}/live-{SCREEN.replace('_', '-')}.png"
+render = os.environ.get("RENDER", "")
+for p in (cap, render):
+    if not p or not os.path.exists(p):
+        print(f"  🔴 missing: {p or 'RENDER=<png>'}"); sys.exit(2)
+subprocess.run(["convert", render, "-crop", f"{W}x{H}+0+0", "+repage",
+                f"{tmp}/crop.png"], check=True)
+r = gray(f"{tmp}/crop.png", f"{tmp}/r.gray")
+c = gray(cap, f"{tmp}/c.gray")
+
+print("CONTROLS -- the render against itself with ONE REGION displaced.\n"
+      "The map must put that region on top; magnitude only in the linear regime.\n")
+x0, y0, x1, y1 = CTRL_BOX
+bad = []
+
+
+def control(dx, check_magnitude):
+    t = tiles(r, shift_box(r, CTRL_BOX, dx))
+    show(t, f"known +{dx} px shift inside x {x0}-{x1}, y {y0}-{y1}", 4)
+    hits = [(k, v) for k, v in top(t, 4)
+            if x0 - TILE < k[0] < x1 and y0 - TILE < k[1] < y1]
+    if not hits:
+        bad.append(f"+{dx} px: displaced region not in the top 4 tiles")
+        return
+    best = max(hits, key=lambda kv: kv[1][0])[1][1]
+    if best <= 0.3:
+        bad.append(f"+{dx} px: local slope {best:+.3f} has the wrong sign or is flat")
+    elif check_magnitude and abs(best - dx) > 0.4:
+        bad.append(f"+{dx} px: local slope {best:+.3f} does not recover it")
+    print(f"      -> localised, local slope {best:+.3f} px"
+          f"{'' if check_magnitude else '  (saturating -- a LOWER BOUND)'}\n")
+
+
+control(CTRL_A_DX, True)
+control(CTRL_B_DX, False)
+if bad:
+    print("  🔴 CONTROL FAILED: " + "; ".join(bad))
+    print("  A map that cannot find a displacement it was told about cannot be")
+    print("  trusted to have found one it was not. Report suppressed.")
+    sys.exit(2)
+print("  ✅ controls pass: a 1 px displacement is localised and measured, a 2 px\n"
+      "     one is localised with its magnitude understated. So a hot tile with a\n"
+      "     real slope is a floor on the displacement, never a ceiling.\n")
+
+print(f"THE REAL PAIR -- {SCREEN}\n")
+rt = tiles(r, c)
+show(rt, f"{SCREEN}: hottest tiles, whole-frame LUT applied", 10)
+ms = sorted(v[0] for v in rt.values())
+med = ms[len(ms) // 2]
+efs = sorted(v[0] / v[4] for v in rt.values() if v[4] > 0.01)
+med_ef = efs[len(efs) // 2]
+hot = max(rt.items(), key=lambda kv: kv[1][0])
+print(f"\n    median tile |resid| {med:.2f}   hottest {hot[1][0]:.2f} "
+      f"at {hot[0][0]},{hot[0][1]}  ({hot[1][0]/med:.2f}x median)")
+print(f"    median tile edge/flat {med_ef:.2f}")
+efs_hot = [v[0] / v[4] for _, v in top(rt, 10) if v[4] > 0.01]
+print(f"    hot tiles span edge/flat {min(efs_hot):.2f}..{max(efs_hot):.2f}, "
+      f"straddling that median")
+print("    📌 SO THE COLUMN DOES NOT SPLIT THEM. I added it expecting two families --")
+print("       tiles hot only at edges (an edge-rendering difference) against tiles")
+print("       hot everywhere (a local tone the global LUT mis-serves). The hot tiles")
+print("       run continuously across the median instead, so the hot region is NOT")
+print("       one anomalous element with a character of its own. Note the frame-wide")
+print("       pooled edge/flat is 3.16 while the per-tile median is 1.84: pooling is")
+print("       dominated by the tiles carrying the most edge pixels, and reading a")
+print("       per-tile threshold off it would have manufactured the split.")
+print("\n  ⚠️ THIS TOOL NAMES NOTHING. A hot tile is a coordinate, not an element.")
+print("     What sits under it is the Decoder's to say -- they hold the disc.")

tools/port/element-residual

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Which ELEMENT carries the disagreement with the capture? Rank them by suppression.
+
+    tools/port/element-residual [screen]        # default main_menu
+
+`edge-residual-map` gives hot COORDINATES, and turning those into elements needs
+the design-space -> capture transform, which is a convention I would have to
+assume. This needs no transform: the port has a mod tree, so shadow an element's
+sprite with a transparent PNG, render, and diff the port's OWN two renders. The
+pixels that change ARE the element, already in the comparison frame.
+
+Reports, per element, on the pixels it actually paints:
+  * mean |residual| against the capture, after ONE global tone LUT
+  * the SIGN -- is the port drawing this element too dark or too bright
+  * edge versus flat -- an outline problem or a body problem
+
+⚠️ SUPPRESSION IS BY SPRITE PATH, so elements sharing a sprite are suppressed
+together and are reported as one row. `ptloop01` draws `pteff03.png`; the id and
+the file are not the same thing.
+
+EXIT 0 the report is trustworthy, 2 a control failed. No 1: this ranks, it does
+not judge. A brightness difference here is NOT licence to brighten the element --
+blend mode is undecoded (`screen.rs`), and tuning until the two agree is exactly
+what the mission forbids.
+"""
+import json, os, subprocess, sys, tempfile
+
+CAPS = "docs/re/captures/title-builds"
+POSE = {                                    # same poses as verify-capture
+    "main_menu":         (f"{CAPS}/live-main-menu.png", ["--menu=main_menu"]),
+    "extras":            (f"{CAPS}/live-extras.png", ["--menu=extras"]),
+    "main_menu_options": (f"{CAPS}/live-main-menu-options-focused.png",
+                          ["--menu=main_menu_options", "--focus=ptbtn04"]),
+}
+SCREEN = sys.argv[1] if len(sys.argv) > 1 else "main_menu"
+if SCREEN not in POSE:
+    print(f"  🔴 no pose for {SCREEN}; known: {', '.join(POSE)}"); sys.exit(2)
+CAP, ARGS = POSE[SCREEN]
+W, H = 1279, 675
+BASE = ["--loop-phase=0", "--leaf-time=0", "--script=wait"]
+tmp = tempfile.mkdtemp()
+
+
+def render(png, mods=None):
+    env = dict(os.environ)
+    if mods: env["SYLPHEED_MODS"] = mods
+    else: env.pop("SYLPHEED_MODS", None)
+    r = subprocess.run(["xvfb-run", "-a", "timeout", "300", "godot", "--path", "port",
+                        "--"] + BASE + ARGS + [f"--capture={png}"],
+                       env=env, capture_output=True, text=True)
+    return r.stdout + r.stderr
+
+
+def gray(png, out):
+    subprocess.run(["convert", png, "-crop", f"{W}x{H}+0+0", "+repage",
+                    "-colorspace", "Gray", "-depth", "8", "gray:" + out], check=True)
+    return open(out, "rb").read()
+
+
+sd = json.load(open(f"export/screens/{'title'}/{SCREEN}.json")) if os.path.exists(
+    f"export/screens/title/{SCREEN}.json") else None
+if sd is None:
+    for root, _, files in os.walk("export/screens"):
+        if f"{SCREEN}.json" in files:
+            sd = json.load(open(os.path.join(root, f"{SCREEN}.json"))); break
+sprites = {}
+for e in sd["elements"]:
+    s = e.get("sprite", "")
+    if s: sprites.setdefault(s, []).append(e["id"])
+
+render(f"{tmp}/base.png")
+base = gray(f"{tmp}/base.png", f"{tmp}/base.gray")
+cap = gray(CAP, f"{tmp}/cap.gray")
+
+# CONTROL 1 -- the metric's own zero. The render against ITSELF must be exactly 0.
+tot = [0] * 256; cnt = [0] * 256
+for i in range(len(base)): tot[base[i]] += base[i]; cnt[base[i]] += 1
+idlut = [(tot[v] // cnt[v]) if cnt[v] else v for v in range(256)]
+z = max(abs(idlut[base[i]] - base[i]) for i in range(0, len(base), 97))
+# CONTROL 2 -- a mod that shadows NOTHING must move no pixels, or a footprint
+# below is the harness rather than the element.
+noop = f"{tmp}/noop"; os.makedirs(noop + "/sprites/title", exist_ok=True)
+subprocess.run(["convert", "-size", "8x8", "xc:red", f"{noop}/sprites/title/zzz-not-an-asset.png"],
+               check=True)
+render(f"{tmp}/noop.png", noop)
+nb = gray(f"{tmp}/noop.png", f"{tmp}/noop.gray")
+moved = sum(1 for i in range(len(base)) if base[i] != nb[i])
+print(f"  control -- metric zero on identity : {z}  (must be 0)")
+print(f"  control -- mod shadowing nothing   : {moved} px moved  (must be 0)")
+if z != 0 or moved != 0:
+    print("\n  🔴 CONTROL FAILED. Every row below would be unattributable. Suppressed.")
+    sys.exit(2)
+print("  ✅ controls pass\n")
+
+tot = [0] * 256; cnt = [0] * 256
+for i in range(len(base)): tot[base[i]] += cap[i]; cnt[base[i]] += 1
+lut = [(tot[v] // cnt[v]) if cnt[v] else v for v in range(256)]
+resid = [abs(lut[base[i]] - cap[i]) for i in range(len(base))]
+N = len(base); frame_mean = sum(resid) / N
+
+
+def isedge(i):
+    x, y = i % W, i // W
+    if x < 1 or y < 1 or x >= W - 1 or y >= H - 1: return False
+    return abs(base[i + 1] - base[i - 1]) + abs(base[i + W] - base[i - W]) >= 12
+
+
+rows = []
+for rel, ids in sprites.items():
+    d = f"{tmp}/m_{len(rows)}"; os.makedirs(os.path.dirname(f"{d}/{rel}"), exist_ok=True)
+    src = f"export/{rel}"
+    if not os.path.exists(src): continue
+    dim = subprocess.run(["identify", "-format", "%wx%h", src],
+                         capture_output=True, text=True).stdout
+    subprocess.run(["convert", "-size", dim, "xc:none", f"PNG32:{d}/{rel}"], check=True)
+    log = render(f"{tmp}/o.png", d)
+    if "mod: " + rel not in log:
+        print(f"  ⚠️ {rel}: the override was never read -- skipped rather than "
+              f"reported as an empty footprint"); continue
+    o = gray(f"{tmp}/o.png", f"{tmp}/o.gray")
+    m = [i for i in range(N) if abs(base[i] - o[i]) > 2]
+    if not m:
+        rows.append((",".join(ids), rel, 0, 0.0, 0.0, 0.0, 0.0)); continue
+    mi = sum(resid[i] for i in m) / len(m)
+    sg = sum(lut[base[i]] - cap[i] for i in m) / len(m)
+    ed = [resid[i] for i in m if isedge(i)]; fl = [resid[i] for i in m if not isedge(i)]
+    rows.append((",".join(ids), rel, len(m), mi,
+                 sum(ed) / len(ed) if ed else 0.0, sum(fl) / len(fl) if fl else 0.0, sg))
+
+print(f"{SCREEN}: frame mean |resid| {frame_mean:.2f}\n")
+print(f"  {'element(s)':<22} {'foot %':>7} {'|resid|':>8} {'xmean':>6} "
+      f"{'edge':>7} {'flat':>7} {'signed':>8}")
+for ids, rel, n, mi, ed, fl, sg in sorted(rows, key=lambda r: -r[3]):
+    if n == 0:
+        print(f"  {ids:<22} {'0.00':>7} {'--':>8} {'--':>6} {'--':>7} {'--':>7} "
+              f"{'--':>8}   paints nothing at this pose")
+        continue
+    flag = "  <- BODY" if fl > ed else ""
+    print(f"  {ids:<22} {100*n/N:7.2f} {mi:8.2f} {mi/frame_mean:6.2f} "
+          f"{ed:7.2f} {fl:7.2f} {sg:+8.2f}{flag}")
+print("\n  signed = render - capture after the LUT; NEGATIVE means the port draws it")
+print("  DARKER than the game. 'BODY' marks flat residual above edge residual --")
+print("  an intensity difference rather than an outline one.")
+print("  ⚠️ This is not licence to brighten anything: blend mode is undecoded.")

tools/port/index-decisions

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Regenerate the contents block at the top of `docs/port/DECISIONS.md`.
+#
+#   tools/port/index-decisions            # rewrite the index
+#   tools/port/index-decisions --check    # fail if it is out of date
+#
+# 🔴 WHY THIS EXISTS. The record reached 6 500 lines and 111 sections with no
+# index, and on 2026-08-30 I spent an iteration empirically re-deriving a result
+# it already contained -- under two headings that name the screens in question --
+# then reported the question as unexplained to the Decoder. An unnavigable record
+# is not a record that is hard to read; it is one that does not get read.
+#
+# ⚠️ `--check` exists because a stale index is worse than none: it would answer
+# "is this already decided?" with a confident no. `check-all` runs it.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+DOC=docs/port/DECISIONS.md
+BEG='<!-- INDEX: generated by tools/port/index-decisions -- do not hand-edit -->'
+END='<!-- /INDEX -->'
+
+body=$(python3 - "$DOC" <<'PY'
+import re, sys
+lines = open(sys.argv[1]).read().split('\n')
+out = []
+for l in lines:
+    if l.startswith('## '):
+        title = l[3:].strip()
+        # A GitHub anchor: lowercased, punctuation dropped, spaces to hyphens.
+        anchor = re.sub(r'[^\w\s-]', '', title.lower()).strip().replace(' ', '-')
+        # NO LINE NUMBERS. They would make the index a fixpoint problem -- writing
+        # it shifts every line below it -- and, worse, every appended section
+        # would silently invalidate all of them. An anchor survives both.
+        out.append(f"* [{title}](#{anchor})")
+print('\n'.join(out))
+PY
+)
+new=$(printf '%s\n\n%d sections. Search this before re-deriving anything.\n\n%s\n\n%s\n' \
+  "$BEG" "$(grep -c '^## ' "$DOC")" "$body" "$END")
+
+cur=$(awk -v b="$BEG" -v e="$END" 'index($0,b){f=1} f{print} index($0,e){f=0}' "$DOC")
+
+if [ "${1:-}" = --check ]; then
+  if [ "$cur" = "$new" ]; then echo "  index-decisions            ok"; exit 0
+  else echo "  index-decisions            🔴 the index is out of date -- run tools/port/index-decisions"; exit 1; fi
+fi
+
+python3 - "$DOC" "$BEG" "$END" "$new" <<'PY'
+import sys
+doc, beg, end, new = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]
+s = open(doc).read()
+if beg in s:
+    i, j = s.index(beg), s.index(end) + len(end)
+    s = s[:i] + new.rstrip('\n') + s[j:]
+else:
+    # First run: place it after the H1 and its opening paragraph.
+    k = s.index('\n## ')
+    s = s[:k] + '\n\n' + new.rstrip('\n') + s[k:]
+open(doc, 'w').write(s)
+print("index written")
+PY

tools/port/peer-head

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Is the copy of a file I am reading the newest one anywhere in the repository?
+
+🔴 THE RULE THIS REPLACES IS A MEMORY. Two agents spent days on a shared-state
+problem that is really two problems:
+
+  what a peer HOLDS   readable right now, from any topic branch, by anyone who
+                      remembers the ref exists -- `git show <ref>:<path>`
+  what a peer must be TOLD   still needs a human to merge to `main`
+
+Both were being filed as blocked on the merge. Half never was. The Decoder read
+this port's `BLOCKED.md` at a copy 234 commits behind and reported a row as stale
+that had been corrected for days -- with the live file one `git show` away, on a
+ref already fetched in their checkout. This port read `main`'s 926-line HANDOFF
+for two days while the live one sat on a branch it had already been citing by sha.
+
+Same gap, opposite directions, and the fix in both cases costs one command. So
+the command exists rather than the intention.
+
+Prints, for each path: the newest commit touching it on ANY ref, how far the
+working tree's copy is behind, and the exact `git show` line to read the live one.
+"""
+import subprocess, sys, os
+
+# The files this port depends on that another agent writes. Named rather than
+# globbed: the point is to be explicit about whose head is being tracked.
+DEFAULT = [
+    "docs/port/HANDOFF.md",
+    "docs/game/navigation.md",
+    "docs/agents/PROTOCOL.md",
+    "docs/port/MISSION.md",
+    "docs/port/PORT-MISSION.md",
+]
+
+
+def git(*a):
+    return subprocess.run(["git", *a], capture_output=True, text=True).stdout
+
+
+def main():
+    paths = sys.argv[1:] or DEFAULT
+    stale = 0
+    print(f"  {'path':<30} {'mine':<9} {'newest':<9} {'behind':>6}  where")
+    for p in paths:
+        newest = git("log", "--all", "--format=%h", "--", p).split()
+        mine = git("log", "-1", "--format=%h", "--", p).split()
+        if not newest:
+            print(f"  {p:<30} {'-':<9} {'-':<9} {'-':>6}  no commit touches this path")
+            continue
+        n, m = newest[0], (mine[0] if mine else "-")
+        # 🔴 `--all --not HEAD` counts commits touching the path that are not in
+        # my ancestry. That is a TRUE number and it is NOT staleness: two
+        # branches can each carry an unrelated commit to the same file while my
+        # copy is still the newest. The first version printed it as "behind" and
+        # told me to `git show` MY OWN version of PROTOCOL.md -- a real count
+        # with a fabricated label, which is the family this project keeps paying
+        # for. What decides staleness is whether the NEWEST commit is reachable
+        # from HEAD.
+        reachable = subprocess.run(["git", "merge-base", "--is-ancestor", n, "HEAD"],
+                                   capture_output=True).returncode == 0
+        diverged = len(git("log", "--all", "--not", "HEAD", "--format=%h", "--", p).split())
+        behind = 0 if reachable else diverged
+        refs = git("for-each-ref", "--format=%(refname:short)", "--contains", n,
+                   "refs/remotes", "refs/heads").split()
+        where = refs[0] if refs else "?"
+        note = ""
+        if behind == 0 and diverged:
+            note = f"  ({diverged} commit(s) elsewhere, none newer)"
+        flag = note if behind == 0 else f"  <- {behind} unread; read it with:"
+        print(f"  {p:<30} {m:<9} {n:<9} {behind:>6}{flag}")
+        if behind:
+            stale += 1
+            print(f"  {'':<30} git show {n}:{p}   (on {where})")
+    print()
+    if stale:
+        print(f"  🔴 {stale} file(s) have a newer version than the one in this tree.")
+        print("     Reading it needs no merge and no human. Being TOLD about it does.")
+    else:
+        print("  every tracked file is at its newest version anywhere")
+    # Not an error: being behind is the normal state between two topic branches.
+    # This reports; the caller decides. Exit 0 unless a path is unknown.
+    return 0
+
+
+sys.exit(main())

tools/port/strip-padding

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Remove driver-inserted silence from a capture, exactly.
+#
+#   tools/port/strip-padding in.wav out.wav
+#
+# WHEN THIS IS VALID, AND WHEN IT IS VANDALISM. The distinction is the whole
+# tool and getting it backwards destroys the artefact:
+#
+#   * PulseAudio's monitor SUBSTITUTES silence. It advances on a wall clock and
+#     replaces audio that existed when the producer was late. Information is
+#     gone; deleting the holes compresses time unevenly and repairs nothing.
+#     DO NOT RUN THIS ON A MONITOR CAPTURE.
+#   * Xenia's ALSA writer PADS. It inserts silence between samples the guest
+#     emitted when its ring is empty (`alsa_audio_driver.cc:359`). Nothing is
+#     lost and nothing is overwritten, so removing the padding is EXACT -- it
+#     hands back the contiguous stream the guest produced.
+#
+# CONTROLLED, not argued. A real music+SFX bed (137.37 s, with 454 zero runs of
+# its own) had 1 149 holes inserted at 8.37/s to +9.9 % length, matching the
+# observed ALSA profile, then was stripped:
+#
+#   original vs itself          r 1.000  lag  0.0 s  margin +0.141   [ceiling]
+#   PADDED   vs original        r 0.436  lag -12.2 s margin +0.006   [destroyed]
+#   STRIPPED vs original        r 1.000  lag  0.0 s  margin +0.142   [recovered]
+#
+# Frame counts: original 6 593 984, stripped 6 559 880, and the original stripped
+# of its own genuine zero runs 6 560 044 -- a difference of 164 frames, 3.4 ms in
+# 137 s, from inserted holes abutting genuine ones and merging.
+#
+# ⚠️ It removes GENUINE silence too, and cannot tell the two apart -- that is why
+# the reference above is the unstripped original: recovery does not depend on
+# stripping both sides. On this material the genuine runs total 0.71 s in 137 s
+# and cost nothing measurable. On material that is mostly silence they would.
+set -euo pipefail
+in="${1:?usage: strip-padding IN.wav OUT.wav}"; out="${2:?usage: strip-padding IN.wav OUT.wav}"
+python3 - "$in" "$out" <<'PYEOF'
+import array, struct, sys, wave
+src, dst = sys.argv[1], sys.argv[2]
+w = wave.open(src); ch = w.getnchannels(); rate = w.getframerate()
+if w.getsampwidth() != 2:
+    print("strip-padding: 16-bit PCM only (got %d-bit)" % (w.getsampwidth()*8)); raise SystemExit(2)
+n = w.getnframes(); a = array.array('h'); a.frombytes(w.readframes(n)); w.close()
+MIN = max(1, rate // 1000)          # a gap is a run, not a sample
+sil = bytearray(n)
+for f in range(n):
+    b = f * ch
+    if not any(a[b+c] for c in range(ch)): sil[f] = 1
+keep = array.array('h'); f = 0; removed = 0; holes = 0
+while f < n:
+    s = f
+    if sil[f]:
+        while f < n and sil[f]: f += 1
+        if f - s < MIN: keep.extend(a[s*ch:f*ch])
+        else: removed += f - s; holes += 1
+    else:
+        while f < n and not sil[f]: f += 1
+        keep.extend(a[s*ch:f*ch])
+k = len(keep) // ch
+o = wave.open(dst + ".partial", "wb")   # temp name, renamed on completion
+o.setnchannels(ch); o.setsampwidth(2); o.setframerate(rate)
+o.writeframes(keep.tobytes()); o.close()
+import os; os.replace(dst + ".partial", dst)
+print("%s: %d frames (%.3f s) -> %s: %d frames (%.3f s)"
+      % (src, n, n/rate, dst, k, k/rate))
+print("  removed %d run(s) totalling %.3f s (%.2f %% of the input)"
+      % (holes, removed/rate, 100.0*removed/n))
+PYEOF

tools/port/verify-capture

@@ -0,0 +1,375 @@
+#!/usr/bin/env bash
+# Diff the port's render against a CAPTURE OF THE REAL GAME.
+#
+#   tools/port/verify-capture main_menu
+#   tools/port/verify-capture               # every screen with a capture
+#
+# THIS IS THE CORRECTNESS CHECK. `verify-screen` is the consistency one, and its
+# own header has pointed at this file since P1 -- `tools/port/verify-capture` -- while
+# this file did not exist. The port has had a harness comparing two renderers
+# that share its assumptions, and none comparing it to the game.
+#
+# 🔴 WHAT THE `diff` COLUMN DOES NOT SAY. It counts pixels surviving
+# `-threshold 25%` -- differing by more than ~64 levels. That is deliberate: it
+# detects a missing or MISPLACED element, which is a large connected blob. It is
+# blind to sub-threshold spatial error -- a one-pixel offset, a soft edge in a
+# slightly wrong place, an antialiasing difference -- because none of that moves
+# a pixel 64 levels.
+#
+# So `main_menu 0.06%` means NO GROSS DISPLACEMENT. It does NOT mean the
+# geometry is right, and it has already been read that way by another agent:
+# `docs/re/structures/title-residual-tone-vs-geometry.md` uses this screen as a
+# tone-only positive control, citing this number as "geometry is essentially
+# right". Measured 2026-08-31 against that capture: after fitting a per-level LUT
+# -- the most general tone model there is -- the remaining residual is 6.94 on
+# edge pixels against 2.20 on flat ones, a 3.2x concentration. A purely tonal
+# residual leaves a per-level LUT exactly 0.00 (checked, by construction). The
+# menu carries spatial error this column cannot see.
+#
+# ⚠️ That gap is not academic. `docs/re/captures/ORACLE-CAPTURES.md`: two
+# renderers agreeing proves nothing, and this corpus has been bitten three times
+# -- the dropped `pteff05` background, the scale-0 rect, and `rest()`. Every one
+# was invisible to a render-vs-render diff and obvious against a capture.
+#
+# WHAT IT CAN CONCLUDE, and what it cannot:
+#
+#  * ✅ STRUCTURE. Something drawn that should not be, or missing that should be,
+#    shows as a large connected region of difference. That is the failure mode
+#    the three above were, and it is what this tool is for.
+#  * 🔴 NOT a pixel score. The captures are NOT gamma-neutral:
+#    `capture ~= 255*(render/255)^g` with g ~ 1.34-1.49, and that ramp is THE
+#    GAME'S, not the capture path's (`docs/re/structures/ui-render-tone-curve.md`).
+#    So RMSE has a floor and driving it lower is fitting the ramp. This reports
+#    the raw difference AND the gamma-compensated one, and neither is a target.
+#  * ⚠️ A capture is ONE MOMENT. Several screens are still animating -- the
+#    title's two `ptloop` sweeps never stop -- and the focused button in a
+#    capture may not be the one the port focuses. Differences confined to a
+#    button or a moving element are expected; say which before calling anything.
+#
+# Geometry needs no correction: the corpus cross-correlated a render against
+# `live-main-menu.png` over +/-6 px and the best alignment is exactly (0,0) at
+# 0.9466. The captures are a 1279x675 top-left crop of the 1280x720 guest
+# surface, so the render is cropped to match and nothing is scaled.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export DISPLAY="${DISPLAY:-:97}"
+OUT="${OUT:-$(mktemp -d)}"; mkdir -p "$OUT"
+CAPS=docs/re/captures/title-builds
+
+# screen : capture : how to pose it
+# 🔴 A MENU CAPTURE HAS A BUTTON FOCUSED, AND THE FIRST VERSION OF THIS TOOL
+# RENDERED WITH NONE. `--screen=` draws no focus record at all, so `main_menu`
+# was being compared to the oracle in a state the oracle was never in: 2 159
+# differing pixels, of which 74 % sat inside the focus signature. Rendered with
+# focus it is 531 -- 0.06 % of the frame, a 4x improvement that was entirely my
+# harness posing the port wrong.
+#
+# `--menu=` applies `authored/flow.json`'s initial focus and `--script=wait`
+# shoots one settled frame and exits.
+MAP=(
+  "main_menu:$CAPS/live-main-menu.png:menu"
+  "extras:$CAPS/live-extras.png:menu"
+  # The only capture of a MEASURED focus state, and it was unusable until
+  # `--focus=` was made to work on the `--menu` path (it parsed, was stored, and
+  # was overwritten by the authored initial focus on every `_menu_enter`).
+  #
+  # It discriminates: rendering each of the five buttons focused against this
+  # capture gives 0.1355 % for `ptbtn04` and 0.70-0.82 % for the other four. The
+  # port's focus rendering identifies the right button by a factor of five.
+  "main_menu_options:$CAPS/live-main-menu-options-focused.png:focus:ptbtn04"
+  # ⚠️ THE TITLE IS POSED AT t=357.7 UNITS, NOT AT ITS SETTLE, and the time is
+  # MEASURED rather than chosen. The two `ptloop` sweeps are a continuous
+  # animation whose leaf group ends at t=600 with the quads parked off-screen at
+  # x=1521, so posing at the settle compares a still frame against a capture
+  # taken mid-sweep and simply omits them.
+  #
+  # t=357.7 is the Decoder's REFINED fit, and the refinement is worth knowing.
+  # Its first value, 355, came from the two per-draw alpha bytes alone and left
+  # an 11.5 px residual that looked like a pivot problem. Solving the same
+  # instant on the vertex POSITIONS instead gives t=357.88 and 357.58 to
+  # +/-0.12 units, against +/-1.54 and +/-1.89 from the alphas -- alpha moves
+  # only 0.27-0.33 levels per unit, so one byte of quantisation is worth 6-8 px
+  # of sweep. At 357.7 the centres land within 0.70 px and both alphas inside one
+  # level. THE 11.5 px WAS THE FIT'S RESOLUTION, NOT GEOMETRY.
+  #
+  # ⚠️ And there is no pivot correction: the leaf pivot is (200, 90) on a 399x180
+  # sprite, so it is the centre to within half a pixel -- checked here against
+  # the export rather than taken.
+  #
+  # ⚠️ It is NOT the time that minimises the difference: t=390 measures 1.65 %
+  # against 1.82 % here. Picking that one would be fitting the pose to the
+  # score, which is the thing this harness exists not to do.
+  "title:$CAPS/live-title-build4-no-plate.png:t357"
+  # The Japanese title at rest, Decoder 310bf86. Settled pose by omission --
+  # the capture is demonstrated at rest (five frames over 6 s, 0 px change in
+  # the logo block while 5-8 % of the frame moves).
+  #
+  # 🔴 THIS ROW EXISTS BECAUSE SCORING THE WRONG FRAME COST A WRONG CONCLUSION.
+  # `verify-screen` poses at `--pose=rest`, which for this screen lights every
+  # `ptlogo_back2eff*` sparkle at its own peak simultaneously -- `rest` for those
+  # elements IS the peak of a 4-unit flash. That frame is fine for the
+  # consistency check it was built for and must never be scored against a
+  # capture: doing so put the port at r +0.7462 against the reference's +0.8727
+  # and I wrote up that the port had moved away from the game. Posed as it
+  # SHIPS, the same block scores **+0.9994**.
+  "title_jp:$CAPS/live-title-jp-at-rest.png:settled::1279x675+1+45"
+  # A SECOND title comparison, and the most sensitive row this tool has.
+  #
+  # `live-title-press-a.png` is the title WITH the plate. Posed at t=237 -- inside
+  # the plate's own 8-unit opaque window, t=236-238 -- the port matches it at
+  # **0.00093 %**, two orders below every other row. That makes it the best
+  # regression detector here: anything structural that moves will show.
+  #
+  # ⚠️ The instant is FITTED, not measured: 237 is where this capture's content
+  # places it, found by sweeping. That is legitimate for choosing which frame to
+  # compare against -- every row does it -- but it is not a claim about the game,
+  # and the 0.00093 % is therefore a floor for THIS pose, not a general accuracy.
+  #
+  # It also closes the systematic-error question the leaf sweep left open. Two
+  # independent captures fit at two DIFFERENT phases -- this one at 237, the
+  # no-plate one at ~400 -- and both to 0.01 % or better. A geometry error in how
+  # the sweeps are drawn would leave a floor in both. Neither has one.
+  # 🔴 THIS ROW IS POSED AT THE PLATE'S BLIND PHASE, and it cannot see the plate's
+  # highlight at all. `--loop-phase=0` pins the looping-focus clock, and
+  # `ptbtn00f` -- the plate's own highlight, which the GAME draws ADDITIVE
+  # (docs/re/data/blend-bit-vs-oracle.txt, entry 2) -- contributes EXACTLY 0 px at
+  # phase 0 and 22 000-29 000 px at phases 20..100. Measured 2026-08-31 by
+  # shadowing its sprite and diffing.
+  #
+  # So switching that element to its measured additive blend moved 26 319 px at
+  # phase 20 and reported ZERO here. This row's 0.09 % is real and unaffected; it
+  # simply says nothing about the pulse. A capture at a NON-ZERO loop phase is
+  # what would let this row see it, and none exists -- filed in BLOCKED.md.
+  "title_plate:$CAPS/live-title-press-a.png:plate"
+  # A BANDED row -- the capture is 1279x120, not a full frame, and the harness
+  # could not compare one until now. That was the only reason this capture sat
+  # unused; nothing about it was unusable.
+  #
+  # Its y offset is MEASURED, not guessed: sliding it down the render, the
+  # structural difference is 0.354 % at y=520 against 8.9-9.1 % five pixels
+  # either side and 17-52 % further out. A 25x drop over five pixels.
+  #
+  # ⚠️ Its residual is NOT the port's error. The port reproduces the same band of
+  # `live-title-press-a.png` EXACTLY (0.000 %), and the two captures differ from
+  # each other by 0.301 % -- two thin horizontal strips, 248x5 px and 206x1 px,
+  # the shape of a sub-pixel edge difference rather than a state difference. So
+  # 0.354 % is very nearly the oracle-to-oracle gap and this row's job is to stay
+  # near it, not to reach zero.
+  "title_band:$CAPS/live-attract-title-press-a-band.png:band"
+  "publisher_logo:$CAPS/live-splash-publisher.png:screen"
+  "developer_logos:$CAPS/live-splash-developer.png:screen"
+)
+CURVE=""
+if [ "${1:-}" = "--curve" ]; then CURVE=1; shift; fi
+want=("$@")
+echo "RMSE is reported and is NOT a target: the capture carries the game's own"
+echo "tone ramp, so it has a floor. What finds a real defect is the DIFFERING"
+echo "REGION -- a missing or misplaced element is a large connected blob."
+echo
+# 🔴 THE METRIC'S OWN ZERO, asserted before any row is printed.
+#
+# Every number below is "small is good", and this file already says the RMSE has
+# a floor from the game's tone ramp. What was never established is the floor of
+# the COMPARISON ITSELF. A control that only bounds error from above cannot tell
+# an exact instrument from a slightly wrong one -- and slightly wrong is the
+# failure that passes. The Decoder reached that form of it after their coherence
+# estimator's positive control read 0.94 for two reasons at once.
+#
+# Measured here rather than assumed: a capture against itself, and against a PNG
+# round-trip of itself, must both be EXACTLY 0. If they are not, the metric has a
+# bias and no row below means what it says.
+_ctl=""
+for row in "${MAP[@]}"; do
+  IFS=: read -r _n _c _rest <<<"$row"; [ -f "$_c" ] && { _ctl="$_c"; break; }
+done
+if [ -n "$_ctl" ]; then
+  _rt="${TMPDIR:-/tmp}/verify-capture-rt.png"; convert "$_ctl" -quality 100 "$_rt"
+  for _pair in "$_ctl|$_ctl|identity" "$_ctl|$_rt|PNG round-trip"; do
+    IFS='|' read -r _a _b _lab <<<"$_pair"
+    _d=$(convert "$_a" "$_b" -metric RMSE -compare -format "%[distortion]" info: 2>&1 | tail -1)
+    _v=$(python3 -c "print('%.4f' % (float('$_d')*255))" 2>/dev/null || echo "?")
+    if [ "$_v" = "0.0000" ]; then
+      printf '  metric control, %-16s RMSE %s -- exact\n' "$_lab:" "$_v"
+    else
+      printf '  🔴 metric control, %-13s RMSE %s -- NOT ZERO. The comparison is\n' "$_lab:" "$_v"
+      echo   "     biased and every row below is unreadable. Refusing."
+      exit 3
+    fi
+  done
+  echo
+fi
+printf '%-17s %-9s %-7s %-22s %s\n' screen raw-rmse diff region note
+for row in "${MAP[@]}"; do
+  IFS=: read -r name cap pose forced capcrop <<<"$row"
+  if [ ${#want[@]} -gt 0 ] && ! printf '%s\n' "${want[@]}" | grep -qx "$name"; then continue; fi
+  [ -f "$cap" ] || { printf '%-17s %s\n' "$name" "no capture"; continue; }
+  if [ "$pose" = band ]; then
+    godot --path port --resolution 1280x720 -- --loop-phase=0 --leaf-time=0 "--screen=title" --overlay=press_start \
+      --time=3.95 "--capture=$OUT/$name.full.png" >"$OUT/$name.log" 2>&1 || true
+    [ -f "$OUT/$name.full.png" ] && convert "$OUT/$name.full.png" \
+      -crop 1279x120+0+520 +repage "$OUT/$name.render.png"
+  elif [ "$pose" = focus ]; then
+    godot --path port --resolution 1280x720 -- --loop-phase=0 --leaf-time=0 "--menu=main_menu" "--focus=$forced" \
+      --script=wait "--shots=$OUT/$name" >"$OUT/$name.log" 2>&1 || true
+    [ -f "$OUT/${name}_00_start.png" ] && cp "$OUT/${name}_00_start.png" "$OUT/$name.render.png"
+  elif [ "$pose" = menu ]; then
+    godot --path port --resolution 1280x720 -- --loop-phase=0 --leaf-time=0 "--menu=$name" --script=wait \
+      "--shots=$OUT/$name" >"$OUT/$name.log" 2>&1 || true
+    [ -f "$OUT/${name}_00_start.png" ] && cp "$OUT/${name}_00_start.png" "$OUT/$name.render.png"
+  elif [ "$pose" = plate ]; then
+    godot --path port --resolution 1280x720 -- --loop-phase=0 --leaf-time=0 "--screen=title" --overlay=press_start \
+      --time=3.95 "--capture=$OUT/$name.render.png" >"$OUT/$name.log" 2>&1 || true
+  elif [ "$pose" = t357 ]; then
+    # 🔴 NO `--time` HERE EITHER, and the row's note used to claim otherwise.
+    #
+    # It passed `--time=5.9617` (t=357.7 units, the Decoder's refined sweep fit)
+    # and that value was NEVER APPLIED: `pose_at` replaced it with the screen's
+    # settle instant, t=198, on every run. Every title figure this tool has ever
+    # printed -- including the 0.26 % the port has quoted repeatedly -- was
+    # measured at the SETTLE, under a note saying t=357.7.
+    #
+    # Honouring it now makes that visible: t=357.7 is PAST the title's own group,
+    # which ends at t=269, so the whole screen poses at its faded-out final
+    # keyframes and the disagreement goes to 30.97 %. The instant was only ever
+    # meant for the `ptloop` LEAF, which runs to t=600 and is looped separately
+    # by `loop_leaf` (authored/rendering.json). Applying it to the whole screen
+    # was always wrong; it was harmless only while it was ignored.
+    #
+    # So: pose at the settle, which is what was actually being measured, and let
+    # the leaf loop carry the sweeps' phase.
+    godot --path port --resolution 1280x720 -- --loop-phase=0 --leaf-time=0 "--screen=$name" \
+      "--capture=$OUT/$name.render.png" >"$OUT/$name.log" 2>&1 || true
+  else
+    # NO `--time`. It used to pass `--time=99` as an idiom for "settled", and
+    # that worked only because `--time` was SILENTLY IGNORED on a screen with a
+    # settle window: `pose_at` overwrote the requested instant with
+    # `settle_instant` whenever `holding` was true. The tool asked for t=5940
+    # units and was handed the settle instant, which is the pose it actually
+    # wants -- and the 0.01 % agreements on both splashes were measured through
+    # that accident. Now that `--time` is honoured, asking for it explicitly
+    # would pose past the end of every group, so the request is simply dropped
+    # and the settled pose asked for by omission.
+    godot --path port --resolution 1280x720 -- --loop-phase=0 --leaf-time=0 "--screen=$name" \
+      "--capture=$OUT/$name.render.png" >"$OUT/$name.log" 2>&1 || true
+  fi
+  [ -f "$OUT/$name.render.png" ] || { printf '%-17s %s\n' "$name" "render failed"; continue; }
+  # Crop the render to the capture's frame. The capture is the crop, not a scale.
+  if [ "$pose" = band ]; then
+    cp "$OUT/$name.render.png" "$OUT/$name.crop.png"
+  else
+    convert "$OUT/$name.render.png" -crop 1279x675+0+0 +repage "$OUT/$name.crop.png"
+  fi
+  # ⚠️ A FIFTH FIELD, because not every capture is pre-cropped to the game
+  # surface. Every capture in `$CAPS` until now was already 1279x675, so the
+  # render was cropped and the capture used as-is. The JP title capture is a
+  # full 1280x720 DISPLAY frame with the surface at +0+45 -- comparing it whole
+  # would score the port against a 45px shift and report a catastrophe.
+  #
+  # The offset is MEASURED, not inherited from the earlier submenu capture:
+  # row/column profile correlation against the port, with the English pair as a
+  # control, gives (0,0) for the control at r 0.994 and dy=-45 for this frame.
+  if [ -n "$capcrop" ]; then
+    convert "$cap" -crop "$capcrop" +repage "$OUT/$name.cap.png"
+    cap="$OUT/$name.cap.png"
+  fi
+  raw=$(convert "$OUT/$name.crop.png" "$cap" -metric RMSE -compare -format "%[distortion]" info: 2>&1 | tail -1)
+  raw=$(python3 -c "print('%.2f' % (float('$raw')*255))" 2>/dev/null || echo "?")
+  note=""
+  # 🔴 EVERY ROW WITH A SWEEPING LEAF CARRIES A CAPTURE-PHASE TERM, AND THIS
+  # TOOL USED TO PRINT THE NUMBER WITHOUT IT.
+  #
+  # `ptloop01`/`ptloop02` free-run on a settled screen -- a settled screen is not
+  # a static screen -- so a capture froze them wherever the shutter fell, and the
+  # render is pinned at `--leaf-time=0` by CONVENTION, not because 0 is the
+  # game's phase. Measured by sweeping the phase against each capture:
+  #
+  #     title 5.56    main_menu 3.78    extras 3.73    splashes 0.00
+  #
+  # Those are RMSE, in this tool's own metric, and larger than most margins
+  # anyone has quoted from these rows. So: usable for REGRESSION at a fixed pin,
+  # run to run; NOT usable as an absolute against anything measured differently.
+  #
+  # ✅ The two splash rows carry no free-running element at all. They are the
+  # only absolutes here that mean what they say.
+  case "$name" in
+    title) note="settle t=198; +/-5.56 capture-phase term -- regression only" ;;
+    title_jp) note="+/-5.6 capture-phase term (same leaves as build 4)" ;;
+    # 🔴 The old note said "rendered with AUTHORED initial focus", and it was
+    # stale twice over. The value became MEASURED on 2026-08-31 (NEW GAME, 2/2
+    # fresh boots, first entry) -- and the capture's OWN focus state, which had
+    # never been established, is now identified by exclusion: rendering all five
+    # candidates against this capture gives ptbtn01 13.06 and every alternative
+    # 15.96-16.59, ~22 % worse. So the residual below is NOT a focus mismatch.
+    #
+    # ⚠️ It does not re-establish "the menu opens on NEW GAME". Focus persists on
+    # this screen, so a capture of the running menu could show any item; what is
+    # established is that THIS capture shows NEW GAME and the port renders the
+    # same state.
+    main_menu) note="focus ptbtn01 confirmed by exclusion (next best +22%); +/-3.78 capture-phase term" ;;
+    extras) note="rendered with authored initial focus; +/-3.73 capture-phase term" ;;
+    publisher_logo|developer_logos) note="no free-running element -- absolute, means what it says" ;;
+  esac
+  # Where the difference lives. This comes FIRST because it is what the gamma
+  # sweep has to be protected from.
+  convert "$OUT/$name.crop.png" "$cap" -compose difference -composite \
+    -colorspace Gray -threshold 25% "$OUT/$name.mask.png"
+
+  # THE TONE RELATIONSHIP IS REPORTED AS A CURVE, NOT AS A BEST EXPONENT, and
+  # two earlier versions of this tool reported an exponent and were wrong twice.
+  #
+  # `docs/re/structures/ui-render-tone-curve.md` models it as
+  # `capture = 255*(render/255)^g`, g ~ 1.34-1.49, measured on dark flat patches
+  # and explicitly not constrained above render ~60. Binning every structurally
+  # matched pixel of `main_menu` by render level and averaging the capture gives:
+  #
+  #     render   capture   implied g   pixels
+  #        8       4.04      1.20      183 026
+  #       16       7.89      1.26      227 630
+  #       24      15.57      1.18      100 945
+  #       32      26.15      1.10       87 474
+  #       40      38.07      1.03       86 094
+  #       48      53.96      0.93       85 255
+  #       64      78.52      0.85        6 509
+  #       96     130.44      0.69        1 682
+  #
+  # ⚠️ **The implied exponent is not constant. It falls monotonically and crosses
+  # 1.0 near render ~44**, so the capture is DARKER than the render in the darks
+  # and BRIGHTER in the midtones. A single power law cannot express that, which
+  # is exactly why a whole-frame fit returns 1.00: the two halves cancel. The
+  # corpus's reach -- "nothing constrains midtones or highlights" -- was a real
+  # limit and this is what lies past it.
+  #
+  # So: no best-g is printed. The table above is the instrument that can actually
+  # be argued with; `tools/port/verify-capture --curve SCREEN` regenerates it.
+  frac=$(convert "$OUT/$name.mask.png" -format "%[fx:mean*100]" info:)
+  box=$(convert "$OUT/$name.mask.png" -trim -format "%wx%h%X%Y" info: 2>/dev/null || echo "-")
+  printf '%-17s %-9s %6.2f%% %-22s %s\n' "$name" "$raw" "$frac" "$box" "$note"
+done
+if [ -n "$CURVE" ]; then
+  for row in "${MAP[@]}"; do
+    IFS=: read -r name cap pose <<<"$row"
+    if [ ${#want[@]} -gt 0 ] && ! printf '%s\n' "${want[@]}" | grep -qx "$name"; then continue; fi
+    [ -f "$OUT/$name.mask.png" ] || continue
+    convert "$OUT/$name.crop.png" -colorspace Gray -depth 8 "gray:$OUT/$name.r.gray"
+    convert "$cap" -colorspace Gray -depth 8 "gray:$OUT/$name.c.gray"
+    convert "$OUT/$name.mask.png" -colorspace Gray -depth 8 "gray:$OUT/$name.m.gray"
+    echo; echo "transfer curve, $name -- structurally matched pixels only"
+    python3 - "$OUT/$name" <<'PYEOF'
+import sys, math
+b = sys.argv[1]
+r = open(b+".r.gray","rb").read(); c = open(b+".c.gray","rb").read(); m = open(b+".m.gray","rb").read()
+n = min(len(r), len(c), len(m)); bins = {}
+for i in range(n):
+    if m[i]: continue
+    s = bins.setdefault(r[i]//8*8, [0,0]); s[0] += c[i]; s[1] += 1
+print("  %-8s %-9s %-9s %s" % ("render","capture","implied g","pixels"))
+for k in sorted(bins):
+    tot, cnt = bins[k]
+    if cnt < 500 or k < 8: continue
+    cap = tot/cnt
+    g = math.log(max(cap,0.5)/255.0)/math.log(k/255.0)
+    print("  %-8d %-9.2f %-9.2f %d" % (k, cap, g, cnt))
+PYEOF
+  done
+fi
+echo "artifacts in $OUT"

tools/port/verify-dwell

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# Check the port's boot pacing against captures of the real game.
+#
+#   tools/port/verify-dwell
+#
+# WHY THIS IS A TOOL AND NOT A ONE-OFF. Doing it by hand once already refuted a
+# 🔴 I had filed myself: `docs/port/BLOCKED.md` said `rest.t` was the wrong settle
+# landmark AND that "everything the sequencer paces off it is therefore late".
+# The first half is true; the second was wrong, and I nearly re-paced screens
+# that already matched the game to 0.05 s.
+#
+# ⚠️ A PORT'S TRANSITION INTERVAL IS NOT THE ORACLE'S VISIBLE SPAN. They differ
+# by the black hold between screens, and confusing the two cost this corpus 0.6 s
+# once and 0.48 s on the plate delay. So the comparison here is explicit: the
+# port's interval is checked against the oracle's span PLUS the measured hold.
+#
+# 🔴 AND THE VERDICT DOES NOT COME FROM THE FILMSTRIP ANY MORE. It used to
+# measure ink spans from `--film` frames. The boot's black hold is 0.17-0.23 s
+# (HANDOFF Q7) -- shorter than the 0.25 s cadence meant to observe it -- so when
+# the black frame fell between samples two screens merged into one span and this
+# tool reported `developer logos` as 93 s against an oracle of 3.5 s. Filming at
+# 0.1 s made it WORSE: 2.5x the screenshots slows the run enough that the capture
+# catches up in bursts, and the publisher span came back as 7.80 s.
+#
+# The sequencer already knows exactly when it changed screens and prints it.
+# Sampling a picture to rediscover a number the program can state is how this
+# went wrong. The filmstrip is kept, and marked advisory.
+#
+# THE EXPECTED NUMBERS ARE THE ORACLE'S, NOT THE PORT'S: three cold boots from
+# `docs/re/boot-order-and-splash-dwell.md`, quoted as a test fixture. Nothing in
+# the port derives them and nothing may.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export DISPLAY="${DISPLAY:-:97}"
+OUT="${OUT:-$(mktemp -d)}"
+mkdir -p "$OUT"
+INTERVAL="${INTERVAL:-0.25}"
+
+echo "running the boot (the intro is skipped -- the splashes are what this measures)"
+timeout "${TIMEOUT:-300}" godot --path port --resolution 1280x720 -- \
+  --boot --skip-at=1 "--film-interval=$INTERVAL" "--film=$OUT/f" \
+  >"$OUT/boot.log" 2>&1 || true
+
+INTERVAL="$INTERVAL" python3 - "$OUT" <<'PYEOF'
+import glob, os, re, subprocess, sys
+out = sys.argv[1]
+INTERVAL = float(os.environ.get("INTERVAL", "0.25"))
+# The boot's black gap, measured in the DRAW STREAM (4 presented frames at
+# 2.284 units/frame = 9.1 units), not from luminance -- luminance cannot separate
+#
+# ⚠️ 2.284 IS NOT A GENERAL RATE AND THIS LINE USED TO READ AS IF IT WERE.
+# It is the disc used as its own clock ON ONE CAPTURE, which ran at 13.1 fps
+# against ~28 elsewhere: `palogo_sqex` declares alpha >= 1 for 239.8 units and
+# was drawn in 105 frames of that run. Correct for converting THAT run's frame
+# count; not a constant, and not HANDOFF Q1's 2 units per rendered frame, which
+# is a different quantity measured at normal speed. See DECISIONS.md.
+# the outgoing fade's tail from true black. The +/-1 frame range is 6.9-11.4
+# units = 0.114-0.190 s. HANDOFF Q7's luminance figure of 0.17-0.23 s overlaps
+# only at the top, and the draw-stream number is the one to use.
+HOLD_LO, HOLD_HI = 0.114, 0.190
+# 🔴 THAT IS THE GAME'S GAP. THE PORT'S IS AUTHORED AND IS CURRENTLY 0.
+#
+# This tool built its target as `oracle span + the GAME's black gap` and compared
+# the port against it -- correct only while the port inserted that gap. It does
+# not: `black_hold_units` went to 0 (four measured gaps, 0/6/4/6 units, no rule;
+# see authored/timing.json). So the port is expected to run SHORT by the gap, and
+# on `publisher_logo` it does -- 0.131 s below the unslacked target, which the
+# 0.15 s wall-clock slack was quietly absorbing into an "agrees".
+#
+# Read from the authored file so it cannot drift again, and REPORT the shortfall
+# rather than hide it. A verdict that passes because the slack happens to exceed
+# a known omission is not a verdict.
+#
+# 🔴 AND THE RATE WAS HARDCODED WHILE THE VALUE WAS NOT. This line read
+# `black_hold_units` from the file -- so it "cannot drift again" -- and then
+# divided by a literal 60.0. The value could not drift; the conversion could,
+# and would have gone silently wrong the moment `keyframe_units_per_second`
+# moved. It is under active dispute right now (60 vs 120), so this is a live
+# hazard rather than a tidy-up. Harmless only because the hold is currently 0.
+import json as _json
+_timing = _json.load(open("authored/timing.json"))
+_UPS = float(_timing.get("keyframe_units_per_second", 60))
+PORT_HOLD = float(_timing.get("black_hold_units", 0)) / _UPS
+
+marks = []
+for line in open(os.path.join(out, "boot.log"), errors="replace"):
+    m = re.match(r"\s+-> (\S+) at ([0-9.]+) s", line)
+    if m:
+        marks.append((m.group(1), float(m.group(2))))
+if not marks:
+    print("no transitions in the boot log -- see", os.path.join(out, "boot.log"))
+    raise SystemExit(2)
+
+ORACLE = [
+    ("publisher wordmark", [4.297, 4.604, 4.370]),
+    ("developer logos",    [3.508, 3.503, 3.366]),
+]
+starts = [0.0] + [t for _, t in marks]
+print()
+print("%-20s %-14s %-26s %s" % ("screen", "port interval", "oracle span (3 boots)", "verdict"))
+bad = 0
+for k, (name, runs) in enumerate(ORACLE):
+    if k + 1 >= len(starts):
+        print("%-20s %-14s %s" % (name, "-", "no such transition this run")); continue
+    d = starts[k + 1] - starts[k]
+    lo, hi = min(runs) + PORT_HOLD, max(runs) + PORT_HOLD
+    game_lo, game_hi = min(runs) + HOLD_LO, max(runs) + HOLD_HI
+    ok = lo - 0.15 <= d <= hi + 0.15
+    bad += 0 if ok else 1
+    print("%-20s %-14s %-26s %s"
+          % (name, "%.2f s" % d, "%.3f / %.3f / %.3f" % tuple(runs),
+             "agrees" if ok else "DIFFERS"))
+print()
+print("  Target = oracle SPAN + the PORT's authored hold (%.3f s); the GAME's" % PORT_HOLD)
+print("  measured gap is %.3f-%.3f s, so a port with hold 0 runs short by that." % (HOLD_LO, HOLD_HI))
+print("  0.15 s of slack for wall-clock jitter -- which is LARGER than the gap,")
+print("  so a shortfall of that size passes unless it is reported separately:")
+print("  transitions:", ", ".join("%s@%.2f" % m for m in marks[:4]))
+
+frames = sorted(glob.glob(os.path.join(out, "f_*.png")))[:120]
+if frames:
+    means = [float(subprocess.run(["convert", f, "-colorspace", "Gray", "-format",
+             "%[fx:mean*255]", "info:"], capture_output=True, text=True).stdout or 0)
+             for f in frames]
+    ink = [m > 0.0 for m in means]
+    spans, i = [], 0
+    while i < len(ink):
+        if ink[i]:
+            j = i
+            while j < len(ink) and ink[j]: j += 1
+            spans.append((i * INTERVAL, j * INTERVAL)); i = j
+        else:
+            i += 1
+    print()
+    print("  advisory -- filmstrip ink spans at %.2f s, which CANNOT resolve a" % INTERVAL)
+    print("  %.2f-%.2f s hold and merges screens whenever it misses one:" % (HOLD_LO, HOLD_HI))
+    for a, b in spans[:4]:
+        print("     %6.2f - %6.2f s   (%.2f s)" % (a, b, b - a))
+raise SystemExit(1 if bad else 0)
+PYEOF
+rc=$?
+echo "artifacts in $OUT"
+exit $rc

tools/port/verify-input

@@ -0,0 +1,236 @@
+#!/usr/bin/env bash
+# The input map, and the stick latch -- asserted against Godot, not reasoned about.
+#
+#   tools/port/verify-input
+#   tools/port/verify-input --control    # each check fails when its subject is removed
+#
+# 🔴 WHY THIS EXISTS. A human played the port on a real controller and Ⓐ did
+# nothing. Skipping the intro did nothing; opening a submenu did nothing. The
+# unattended P5 walk had passed on every iteration while this was true, and the
+# reason is exact:
+#
+#   `--script` sends `InputEventAction`, which BYPASSES the input map.
+#
+# So the harness asserted every line of code *after* the input map and nothing
+# about the map itself -- and the map was missing half the actions. Godot 4.7.2
+# binds NO joypad button to `ui_accept` or `ui_cancel`, while it binds the d-pad
+# AND the left stick to `ui_up`/`ui_down`. Four actions worked on the pad, two
+# did not, which reads as a broken controller.
+#
+# The second defect had the same blind spot: `InputEventAction` is not an analog
+# axis, so the harness could not have seen that a held stick fires once per
+# jitter. The human's words were "moves the cursor too fast".
+#
+# ⚠️ THE GENERAL LESSON, worth more than either fix: **a synthetic-input test
+# cannot assert the input map.** Anything injected below the map is evidence
+# about the code above it only.
+#
+# ## The control, and what it can and cannot cover
+#
+# 🔴 The first version of `--control` inverted ALL NINE assertions and demanded
+# every one fail with the fixup skipped. Seven of them do not depend on the
+# fixup, so it reported them as broken -- a control that fails a correct check
+# is the same defect as one that passes a dead check, and this file would have
+# shipped claiming its checks were untrustworthy. Each check now names its
+# SUBJECT, and the control removes exactly that subject:
+#
+#   bind   -- skip `Gamepad.bind_missing()`; the check must fail
+#   latch  -- run the same events through no latch at all; the count must differ
+#   godot  -- NOT CONTROLLABLE HERE, and said so rather than faked. These assert
+#             what Godot itself binds. There is nothing of ours to remove; they
+#             exist to make a future Godot dropping the d-pad a failing check
+#             instead of a bug report.
+set -euo pipefail
+cd "${PROJECT_DIR:-$(git rev-parse --show-toplevel)}"
+GODOT="${GODOT:-godot}"
+mode="assert"
+[ "${1:-}" = "--control" ] && mode="control"
+
+probe="port/.verify-input-probe.gd"
+trap 'rm -f "$probe" "${probe}.uid"' EXIT INT TERM
+
+cat > "$probe" <<'GD'
+extends SceneTree
+
+var mode := OS.get_environment("VERIFY_INPUT_MODE")
+var fail := 0
+var ran := 0
+
+## `subject` is what the check depends on, and decides whether the control
+## removes it. A check whose subject cannot be removed is skipped there and
+## counted, not silently dropped -- a control that quietly tests four of nine
+## things reports the same green line as one that tests all nine.
+func ok(name: String, subject: String, cond: bool, detail: String = "", control_row: String = "the stick row (6 -> 1)") -> void:
+	if mode == "control" and subject == "godot":
+		print("  %-44s -- not controllable (Godot's own binding)" % name)
+		return
+	if mode == "control" and subject == "negative":
+		# 🔴 R4: a NEGATIVE carries a positive control, it does not carry an
+		# inversion. "The latch must not touch buttons" cannot be controlled by
+		# removing the latch -- with no latch, buttons pass, which is the same
+		# answer. What shows the method has power is that the SAME counter, on
+		# the same code path, reduces 6 stick events to 1. That row is the
+		# positive control for this one, and naming it is the honest move;
+		# inverting it would have been a green line that meant nothing.
+		# 🔴 The control row was HARDCODED here and a second negative arrived.
+		# A negative that names someone else's control is not controlled; it is
+		# borrowing a green line. `control_row` now defaults to the original
+		# text so that row is unchanged, and any new negative must say what
+		# actually backs it.
+		print("  %-44s -- negative; positive control is %s" % [name, control_row])
+		return
+	ran += 1
+	var want: bool = cond if mode != "control" else not cond
+	print("  %-44s %s%s" % [name, "ok" if want else "🔴 FAILED",
+		("  " + detail) if detail != "" else ""])
+	if not want:
+		fail = 1
+
+func has_button(action: String, button: int) -> bool:
+	for e in InputMap.action_get_events(action):
+		if e is InputEventJoypadButton and e.button_index == button:
+			return true
+	return false
+
+## Feed a run of axis values through a latch (or through none) and count the
+## presses it would produce.
+func steps(values: Array, latched: bool) -> int:
+	var pad := Gamepad.new()
+	var n := 0
+	for v: float in values:
+		var e := InputEventJoypadMotion.new()
+		e.axis = JOY_AXIS_LEFT_Y
+		e.axis_value = v
+		# No latch = what the port did before: every event above the action
+		# deadzone is a press. That is the bug, reproduced, as the control.
+		if pad.accepts(e) if latched else absf(v) >= Gamepad.ENTER:
+			n += 1
+	return n
+
+## The latch as the port actually uses it -- and REMOVED under `--control`, so
+## the rows that depend on it invert.
+func nav(values: Array) -> int:
+	return steps(values, mode != "control")
+
+func _init() -> void:
+	# The control removes the repair. Everything else runs with it applied.
+	if mode != "control":
+		Gamepad.bind_missing()
+
+	# ── 1. subject `bind` -- the two actions Godot leaves unbound ─────────────
+	ok("Ⓐ reaches ui_accept", "bind", has_button("ui_accept", JOY_BUTTON_A),
+		"JOY_BUTTON_A")
+	ok("Ⓑ reaches ui_cancel", "bind", has_button("ui_cancel", JOY_BUTTON_B),
+		"JOY_BUTTON_B")
+
+	# ── 2. subject `godot` -- what the engine binds, and must keep binding ────
+	#
+	# The keyboard events must SURVIVE the fixup: declaring `ui_accept` in
+	# project.godot would have replaced the built-in wholesale and dropped them
+	# silently. Adding to the action must not.
+	var keys := 0
+	for e in InputMap.action_get_events("ui_accept"):
+		if e is InputEventKey:
+			keys += 1
+	ok("ui_accept keeps its keyboard events", "godot", keys >= 2,
+		"%d key event(s)" % keys)
+	ok("d-pad reaches ui_down", "godot", has_button("ui_down", JOY_BUTTON_DPAD_DOWN))
+	var axis := false
+	for e in InputMap.action_get_events("ui_down"):
+		if e is InputEventJoypadMotion and e.axis == JOY_AXIS_LEFT_Y:
+			axis = true
+	ok("left stick reaches ui_down", "godot", axis, "axis %d" % JOY_AXIS_LEFT_Y)
+
+	# ── 3. subject `latch` -- one step per deflection, not one per jitter ─────
+	#
+	# A push to full deflection followed by jitter that never returns to
+	# neutral: what a real stick emits, and what produced "moves the cursor too
+	# fast". The control runs the identical values with no latch and must count
+	# every one of them, which is what makes this a discriminator rather than a
+	# number that happens to be 1.
+	var held := [0.92, 0.95, 0.91, 0.99, 0.93, 0.97]
+	# `nav()` is the latch under control: in `--control` the latch is REMOVED,
+	# which is what makes these rows invert. Reading `steps(..., true)` in both
+	# modes was the earlier defect -- the control ran the repaired code and then
+	# demanded it fail.
+	ok("a held stick is ONE step, not six", "latch", nav(held) == 1,
+		"latched %d, unlatched %d" % [steps(held, true), steps(held, false)])
+
+	# Release, then push again: that IS a second press, or the stick becomes
+	# single-use.
+	ok("release then push is a second step", "latch",
+		nav([0.92, 0.95, 0.10, 0.88]) == 2,
+		"%d step(s)" % nav([0.92, 0.95, 0.10, 0.88]))
+
+	# Hysteresis: drifting back only as far as the release threshold must not
+	# re-arm, or a stick resting near the boundary chatters -- the original bug
+	# with a smaller number.
+	ok("boundary drift does not re-arm", "latch",
+		nav([0.9, 0.45, 0.9, 0.45, 0.9]) == 1,
+		"%d step(s)" % nav([0.9, 0.45, 0.9, 0.45, 0.9]))
+
+	# ✅ THE GAME'''S OWN THRESHOLD, ASSERTED AT THE DEVICE LEVEL. The game
+	# digitises the stick to four direction bits at 61 % deflection, so a
+	# deflection between Godot'''s 0.50 action deadzone and that 0.61 is a
+	# direction the real game never sees. At the old ENTER = 0.5 this port
+	# stepped there. Negative first, then the positive control on the SAME run
+	# shape -- a negative alone would also pass if the latch were simply broken.
+	# 🔴 THIS ROW WAS "latch" AND THE CONTROL CAUGHT IT IMMEDIATELY. Removing
+	# the latch does not remove the THRESHOLD -- the unlatched path also tests
+	# `>= Gamepad.ENTER`, so 0.55 counts 0 either way and the row could never
+	# invert. The harness said so in one run: "a check did not invert -- it is
+	# not testing what it claims to test". It is a negative, and its positive
+	# control is the row below it: the same shape at 0.70 does step.
+	ok("0.55 is below the game 61 % threshold, must not step", "negative",
+		nav([0.55, 0.55, 0.55]) == 0,
+		"%d step(s)" % nav([0.55, 0.55, 0.55]),
+		"the 0.70 row on the same shape")
+	ok("...and its control: 0.70 on the same shape DOES step", "latch",
+		nav([0.70, 0.70, 0.70]) == 1,
+		"%d step(s)" % nav([0.70, 0.70, 0.70]))
+
+	# A button already IS an edge; latching it would swallow the second of two
+	# quick taps.
+	var pad := Gamepad.new()
+	var passed := 0
+	for i in 3:
+		var b := InputEventJoypadButton.new()
+		b.button_index = JOY_BUTTON_DPAD_DOWN
+		b.pressed = true
+		if pad.accepts(b):
+			passed += 1
+	ok("d-pad presses are not latched", "negative", passed == 3, "%d of 3" % passed)
+
+	if ran == 0:
+		print("🔴 no check ran -- the harness asserted nothing")
+		quit(2)
+	quit(fail)
+GD
+
+out=$(VERIFY_INPUT_MODE="$mode" "$GODOT" --headless --path port \
+      --script "res://$(basename "$probe")" 2>&1 \
+      | grep -v "^Godot Engine\|^$" || true)
+rc=0
+printf '%s' "$out" | grep -q "🔴" && rc=1
+
+if [ "$mode" = "control" ]; then
+  echo "control -- each check must fail when ITS OWN subject is removed:"
+  printf '%s\n' "$out"
+  echo
+  if [ $rc -eq 0 ]; then
+    echo "every controllable check fails without its subject -- the control holds"
+    exit 0
+  fi
+  echo "🔴 a check did not invert -- it is not testing what it claims to test"
+  exit 1
+fi
+
+echo "input map and stick latch:"
+printf '%s\n' "$out"
+echo
+if [ $rc -eq 0 ]; then
+  echo "Ⓐ and Ⓑ reach the game, and a held stick is one step"
+  exit 0
+fi
+echo "🔴 the input map is not what the port needs"
+exit 1

tools/port/verify-menu-audio

@@ -0,0 +1,246 @@
+#!/usr/bin/env bash
+# Does the port actually MAKE SOUND on the P5 walk, and the RIGHT sound?
+#
+#   tools/port/verify-menu-audio            # assert
+#   tools/port/verify-menu-audio --control  # can it fail?
+#
+# 🔴 FOR WEEKS THIS COULD NOT FAIL. It computed the verdict, printed a red line
+# when a cue was silent -- and the python had NO EXIT PATH, so it returned 0
+# every time while `check-all` registered it `must-pass`. A cue could stop
+# sounding and the suite would print the failure and stay green.
+#
+# That is this project's recurring defect one level up: not an instrument that
+# sits below the thing under test, but an instrument that SEES the failure and
+# does not report it. Ask of any check: what would this still report if the
+# feature were absent -- AND what would it EXIT?
+#
+# This is the P6 gate check. P6's gate is "sound on the P5 gate", and until this
+# existed the only evidence for it was that `audio.play("move")` appears in
+# boot.gd -- which is evidence that a call is written, not that a sound reaches
+# the Master bus. Those differ: the black hold was implemented, called, and
+# emitted nothing for five milestones.
+#
+# It needs NO SOUND CARD. Godot records the Master bus to a WAV under the Dummy
+# driver (docs/port/AUDIO-VERIFICATION.md section 2).
+#
+# WHAT IT CONCLUDES, and what it must not be read as:
+#
+#  * ✅ that a cue REACHES THE BUS when a press does something;
+#  * ✅ that a press bound to NOTHING is silent, byte for byte;
+#  * ✅ that two presses of the same action play the SAME cue;
+#  * 🔴 NOT that the cue is the one the GAME plays. That binding is HANDOFF Q8,
+#    measured by the Decoder, and nothing here re-measures it. This tool cannot
+#    tell a correct cue from a confidently wrong one.
+#
+# ⚠️ Cue LENGTH is deliberately not asserted. The audible part of a cue is much
+# shorter than its wave -- the music bed masks the tail -- so "elevated for
+# 0.13 s" is a fact about the bed, not about the cue, and an assertion built on
+# it would fail whenever the bed changes.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export DISPLAY="${DISPLAY:-:97}"
+OUT="${OUT:-${TMPDIR:-/tmp}/verify-menu-audio}"
+CONTROL=0; [ "${1:-}" = "--control" ] && CONTROL=1
+mkdir -p "$OUT"
+[ -d port/.godot ] || godot --headless --path port --import >/dev/null 2>&1
+
+run() { # name, script
+  timeout 300 godot --path port --resolution 1280x720 -- \
+    --menu=main_menu "--script=$2" "--audio=$OUT/$1.wav" >"$OUT/$1.log" 2>&1 || true
+  [ -s "$OUT/$1.wav" ] || { echo "no audio written for $1 -- see $OUT/$1.log" >&2; exit 2; }
+}
+
+# THE WALK, and TWO CONTROLS. The controls are the point: a run that makes noise
+# proves nothing on its own, because the music bed makes noise too.
+#
+#  `wait`  -- the bed alone, nothing pressed.
+#  `left`  -- five presses that REACH _unhandled_input and are bound to nothing
+#             (HANDOFF Q5: left/right do nothing). If these differ from `wait`,
+#             the port is making a sound the game does not.
+run walk down,down,accept,cancel,up
+run ctrl wait,wait,wait,wait,wait
+run noop left,left,left,left,left
+
+# 🔴 AND A PER-CUE KNOWN NEGATIVE, because the bed-only control could not settle
+# what it was being asked. `move` reported NOT FOUND on three consecutive runs at
+# margins 0.109/0.120/0.131 against a 0.15 line that a documented earlier run had
+# cleared at 0.185. Two readings fit that -- the cue stopped playing, or the
+# threshold sits above the quietest cue's true signal -- and A MARGIN CANNOT
+# SEPARATE THEM, because both produce a small number.
+#
+# So each cue now gets its own negative: the SAME walk, with only that cue's .ogg
+# replaced by silence through the mod tree. Silencing a cue that is playing must
+# collapse its correlation and leave the other two alone, which is a 3x3 matrix
+# with six off-diagonal controls rather than one number to compare against a
+# threshold.
+for c in move confirm back; do
+  d="$OUT/sup_$c"; mkdir -p "$d/audio/se"
+  ffmpeg -v error -f lavfi -i anullsrc=r=44100:cl=stereo \
+    -t "$(ffprobe -v error -show_entries format=duration -of csv=p=0 export/audio/se/$c.ogg)" \
+    -c:a libvorbis "$d/audio/se/$c.ogg" -y
+  SYLPHEED_MODS="$d" run "sup_$c" down,down,accept,cancel,up
+  grep -q "^mod: audio/se/$c.ogg" "$OUT/sup_$c.log" || {
+    echo "the $c override was never read -- the matrix below would be meaningless" >&2
+    exit 2; }
+done
+
+# THE CONTROL. Replace the walk with the run that already had `move` silenced, so
+# the cue is genuinely missing from the baseline. Silencing it again can then
+# remove nothing, the diagonal cannot drop, and the check MUST fail. Built from
+# the tool's OWN suppression machinery rather than a second mechanism -- a
+# control built a different way tests the control, not the check.
+if [ $CONTROL -eq 1 ]; then
+  cp "$OUT/sup_move.wav" "$OUT/walk.wav"
+  echo "control: analysing a walk in which \`move\` never sounded"
+fi
+
+rc=0
+python3 - "$OUT" <<'PYEOF' || rc=$?
+import array, math, subprocess, sys
+O = sys.argv[1]; SR = 44100
+def dec(src, dst):
+    subprocess.run(["ffmpeg","-v","error","-i",src,"-f","s16le","-ac","1",
+                    "-ar",str(SR),dst,"-y"], check=True)
+    a = array.array('h'); a.frombytes(open(dst,'rb').read()); return a
+walk = dec(f"{O}/walk.wav", f"{O}/walk.raw")
+ctrl = dec(f"{O}/ctrl.wav", f"{O}/ctrl.raw")
+noop = dec(f"{O}/noop.wav", f"{O}/noop.raw")
+
+# 1. A press bound to nothing must be SILENT, and silent still means IDENTICAL --
+#    but aligned to a WHOLE AUDIO BUFFER, because the recording is not
+#    sample-deterministic across runs and never was.
+#
+#    🔴 This check compared the two byte streams directly and passed for weeks.
+#    It then began failing, and the cause is not the port: three IDENTICAL
+#    invocations produce two distinct outcomes, 1.207438 s and 1.300317 s,
+#    differing by 0.092879 s = **exactly 4096 samples**, one mixing buffer. The
+#    recording quantises to whole buffers and a one-buffer shift moves both the
+#    length and the alignment of everything inside it.
+#
+#    So the old premise -- cross-run bit-determinism -- was never guaranteed. It
+#    held while the run's timing sat away from a buffer boundary, and a larger
+#    export (three voice streams instead of one) moved it onto one. A test that
+#    passes by luck reports the luck running out as a regression in the code.
+#
+#    The fix keeps the strength that mattered: still EXACT equality, still no
+#    threshold to tune. It only allows the comparison to slide by whole buffers,
+#    which is the one degree of freedom the recorder actually has.
+BUF = 4096
+best = None
+for k in (0, BUF, -BUF, 2*BUF, -2*BUF):
+    a, b = (ctrl[k:], noop) if k >= 0 else (ctrl, noop[-k:])
+    n = min(len(a), len(b))
+    if n < BUF:
+        continue
+    if a[:n].tobytes() == b[:n].tobytes():
+        best = (k, n)
+        break
+if best:
+    print("no-op presses vs bed alone : IDENTICAL -- silent (%d samples, %+d buffer shift)"
+          % (best[1], best[0] // BUF))
+else:
+    n = min(len(ctrl), len(noop))
+    print("no-op presses vs bed alone : DIFFER at every whole-buffer alignment "
+          "-- the port sounds a dead press (%d samples)" % n)
+
+# 2. Is the RIGHT CUE on the bus? Match each EXPORTED cue wave against the
+#    recording by normalised cross-correlation over the whole file.
+#
+#    This replaced a burst-counter that thresholded the envelope at a multiple
+#    of the bed level. That counter reported 4 cues on one run and 0 on the next
+#    from the SAME script, because its answer was set by two hand-picked
+#    constants -- the multiple and a minimum run length -- and the bed level is
+#    not constant across a run. It was nearly shipped. A tool whose headline
+#    number moves with its own tuning cannot detect anything.
+#
+#    This has no such constant. The cue file is its own template, the search is
+#    over the whole recording, and the verdict is a MARGIN over the same
+#    template matched against the bed-only control.
+def slide(tpl, hay, step=16):
+    t = [float(v) for v in tpl]; bt = math.sqrt(sum(v*v for v in t))
+    if bt == 0: return (0.0, 0.0)
+    best = (-2.0, 0.0)
+    for i in range(0, len(hay)-len(t), step):
+        seg = hay[i:i+len(t)]
+        bs = math.sqrt(sum(float(v)*v for v in seg))
+        if bs:
+            r = sum(a*float(b) for a, b in zip(t, seg))/(bt*bs)
+            if r > best[0]: best = (r, i/SR)
+    return best
+
+found = []
+tpls = {}
+for cue in ("move", "confirm", "back"):
+    tpl = dec("export/audio/se/%s.ogg" % cue, "%s/%s.raw" % (O, cue))[:int(0.15*SR)]
+    tpls[cue] = tpl
+    rw, tw = slide(tpl, walk)
+    rc, _  = slide(tpl, ctrl)
+    # 🔴 NO VERDICT ON THIS LINE ANY MORE. It used to print PRESENT/NOT FOUND on
+    # `margin > 0.15`, and it called `move` NOT FOUND on three consecutive runs at
+    # 0.109/0.120/0.131 while the cue was DEMONSTRABLY SOUNDING -- silencing its
+    # .ogg collapses it to the bed floor. The bed-only control is a DIFFERENT RUN,
+    # so its margin carries every difference between two runs; the threshold that
+    # once cleared 0.185 was never a property of the cue. The number is still worth
+    # printing. The verdict now comes from the suppression matrix below.
+    hit = rw - rc > 0.15
+    found.append((cue, tw, hit))
+    print("%-8s walk r=%.3f at %5.2fs | bed-only r=%.3f | margin %+.3f"
+          % (cue, rw, tw, rc, rw-rc))
+
+# 3. The ORDER is the strongest evidence here and it is free: the correlator is
+#    never told where to look, so three templates landing in script order --
+#    move (step 1) before confirm (step 3) before back (step 4) -- is three
+#    independent searches agreeing with the log.
+# 3b. THE SUPPRESSION MATRIX. Row = the cue silenced, column = the template
+#     searched for. The diagonal is the only cell that should move.
+sup = {c: dec("%s/sup_%s.wav" % (O, c), "%s/sup_%s.raw" % (O, c))
+       for c in ("move", "confirm", "back")}
+base = {c: slide(tpls[c], walk)[0] for c in tpls}
+print("\nsuppression matrix -- drop in r when one cue's .ogg is silenced")
+print("            " + "".join("%9s" % c for c in ("move", "confirm", "back")))
+ok = True
+for row in ("move", "confirm", "back"):
+    drops = {col: base[col] - slide(tpls[col], sup[row])[0] for col in ("move", "confirm", "back")}
+    print("  silence %-6s" % row + "".join("%+9.3f" % drops[c] for c in ("move", "confirm", "back")))
+    if drops[row] <= 0.05:
+        ok = False
+        print("      🔴 silencing %s did not remove %s -- that cue is NOT SOUNDING" % (row, row))
+print("  => %s" % ("all three cues SOUND: silencing each one collapses its own signal"
+                   if ok else "at least one cue is not sounding"))
+# 🔴 THE VERDICT EXITS. Everything below this line is REPORTED, not asserted, and
+# deliberately so: the no-op-silence line and the cue-order line both carry
+# DOCUMENTED cross-run instability (whole-buffer recording shifts; a 0.15 margin
+# this file's own comments show going to 0.109 on a sounding cue). Making either
+# binding would produce red on correct audio, which is how a suite gets ignored.
+# The diagonal has no threshold to drift: silencing a cue either removes its own
+# signal or it was never there.
+VERDICT_FAILED = not ok
+# 🔴 THE VERDICT IS THE DIAGONAL ONLY, and the first version of this asserted the
+# off-diagonal too -- "silencing a cue must not move the others". That failed, and
+# the material is why: `confirm` lands at 1.12 s and `back` at 1.21 s, 0.09 s apart
+# under a 0.15 s template, so the two windows OVERLAP. Silencing `confirm` raises
+# `back` by 0.468 because confirm was masking it. That is a fact about two cues the
+# game plays 90 ms apart, not a fault, and an assertion that calls it one would
+# fail forever on correct audio.
+print("     (off-diagonal is MASKING between overlapping cues, not an error --")
+print("      confirm at 1.12 s and back at 1.21 s share a 0.15 s window)")
+
+times = [t for _, t, hit in found if hit]
+print("cue order vs script order  : %s"
+      % ("CONSISTENT" if times == sorted(times) and len(times) == 3
+         else "check %s" % [(c, round(t, 2)) for c, t, _ in found]))
+raise SystemExit(1 if VERDICT_FAILED else 0)
+PYEOF
+
+if [ $CONTROL -eq 1 ]; then
+  if [ $rc -eq 0 ]; then
+    echo
+    echo "  🔴 CONTROL FAILED -- the check passed a walk with \`move\` silenced, so it"
+    echo "     cannot detect a cue that stops sounding."
+    exit 1
+  fi
+  echo
+  echo "the check rejects a run with a cue missing (rc=$rc)"
+  exit 0
+fi
+exit $rc

tools/port/verify-motion

@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# Does the boot ANIMATE, or does it draw the same picture very fast?
+#
+#   tools/port/verify-motion            # assert
+#   tools/port/verify-motion --control  # can it fail?
+#
+# 🔴 WHY THIS EXISTS. A human on a 140 fps GPU: *"the port does no blur
+# animation at all, the logos just switch."* Three checks this port already had
+# were green at the time, and all three were blind the same way:
+#
+#   frozen sweep (`--time=`)  proves the renderer CAN draw pose N. It drives the
+#                             clock by hand and never runs the animation.
+#   settled comparison        scored 0.01 % against the oracle. A screen frozen
+#                             84 % of the time matches a settled reference
+#                             PERFECTLY -- that is what frozen means.
+#   achieved-fps counter      counts frames DRAWN. Drawing identical pixels 25
+#                             times a second scores exactly like animating.
+#
+# Every one measured throughput or a pose. **None measured CHANGE.** Same shape
+# as `InputEventAction` bypassing the input map: the instrument sat below the
+# thing that was broken, so the breakage could not appear in it.
+#
+# This films a REAL boot -- no `--time`, no pinning -- and hands it to
+# `tools/motion-census`, which measures change and nothing else.
+#
+# ⚠️ WHAT IT CANNOT DO. It is the liveness half only. A wrong ramp that moves
+# every frame passes here. Correctness stays with `verify-capture` against the
+# oracle, and the two are complementary: one screen can pass either alone.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export DISPLAY="${DISPLAY:-:97}"
+OUT="${OUT:-${TMPDIR:-/tmp}/verify-motion}"
+INTERVAL=0.05
+
+# The publisher splash declares its whole build-in over t=0..45 -- 0.75 s at
+# 60 units/s -- and then holds. So the FIRST second of the boot is where a
+# frozen build-in shows up, and it is the only window this asserts on.
+#
+# The bar is 60 % of adjacent frame-pairs moving in that window, and BOTH SIDES
+# WERE MEASURED rather than one measured and one assumed -- the one operator in
+# `ScreenView.pose_at` was reverted, this check run against the defect, and the
+# operator restored:
+#
+#   broken (pose_at ASSIGNED the settle instant)   40 %   -- and it FAILED
+#   fixed  (clamps to it)                          86 %   -- and it passed
+#
+# 60 sits mid-gap: 20 points above the defect, 26 below the fix. That is why it
+# is a floor and not a tuned threshold, and it is deliberately NOT set near the
+# passing value -- a check that only passes at exactly today's number fails on
+# the next legitimate change and teaches people to edit the bar.
+#
+# 🔴 THE FIRST VERSION CLAIMED "~40 POINTS OF CLEARANCE ON BOTH SIDES" AND HAD
+# NOT MEASURED THE BROKEN CASE. With a 1.0 s window the real clearance was 5
+# points, because that window includes 0.25 s of legitimate hold and dilutes the
+# signal. The window is now the DECLARED build-in -- publisher t=0..45, 0.75 s
+# at 60 units/s -- so it asks about the interval the disc says is animating and
+# nothing else. A bar justified by an unmeasured number is the same defect this
+# whole check exists to catch, one level up.
+WINDOW=0.75
+BAR=60
+
+films() {  # $1 = dir
+  rm -rf "$1"; mkdir -p "$1"
+  timeout 120 godot --path port -- --boot --skip-at=1 \
+    --film="$1/f" --film-interval="$INTERVAL" >"$1/boot.log" 2>&1 || true
+}
+
+moving_pct_in_window() {  # $1 = dir -- % of adjacent pairs that MOVED, first $WINDOW seconds
+  python3 - "$1" "$INTERVAL" "$WINDOW" <<'PY'
+import sys, glob, os, importlib.util, importlib.machinery
+d, interval, window = sys.argv[1], float(sys.argv[2]), float(sys.argv[3])
+frames = sorted(glob.glob(os.path.join(d, "f_*.png")))
+n = int(window / interval) + 1
+frames = frames[:n]
+if len(frames) < 3:
+    print("0"); raise SystemExit
+# Reuse motion-census's own loader and floor rather than re-deriving them: a
+# second implementation of "did it move" is a second thing to be wrong.
+sys.path.insert(0, os.path.join(os.environ.get("PROJECT_DIR", "/work"), "tools"))
+spec = importlib.util.spec_from_loader(
+    "mc", importlib.machinery.SourceFileLoader(
+        "mc", os.path.join(os.environ.get("PROJECT_DIR", "/work"), "tools", "motion-census")))
+mc = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(mc)
+from pathlib import Path
+prev, moved, total = None, 0, 0
+for f in frames:
+    cur = mc.load(Path(f))
+    if prev is not None:
+        delta = sum(abs(a - b) for a, b in zip(cur, prev)) / len(cur)
+        total += 1
+        if delta > mc.MOVED:
+            moved += 1
+    prev = cur
+print("%d" % (100 * moved / total if total else 0))
+PY
+}
+
+echo "boot liveness: films a real boot and measures CHANGE, not throughput"
+
+# 🔴 THE CONTROL RUNS FIRST AND IS NOT OPTIONAL. `motion-census --selftest`
+# drives a synthetic fade, a switch and a frozen film through the same loader
+# and the same floor this check uses. If it cannot separate those three, every
+# number below is decoration.
+if ! tools/motion-census --selftest >"$OUT.selftest.log" 2>&1; then
+  echo "  🔴 motion-census --selftest FAILED -- the detector cannot tell a fade"
+  echo "     from a switch, so nothing it reports about the boot means anything."
+  sed 's/^/     /' "$OUT.selftest.log"
+  exit 2
+fi
+echo "  census selftest           ok  (fade / switch / frozen separated)"
+
+if [ "${1:-}" = "--control" ]; then
+  # A frozen film must FAIL this check. Built by repeating one real boot frame,
+  # so it has the port's own pixels and differs from a passing run in exactly
+  # one property: nothing changes.
+  films "$OUT/live"
+  ctl="$OUT/frozen"; rm -rf "$ctl"; mkdir -p "$ctl"
+  # NOT `ls | head`: under `set -o pipefail` head closes the pipe, ls takes
+  # SIGPIPE and the script exits 141 before it ever asserts anything. Cost one
+  # run to notice, and a check that dies before checking looks a lot like a
+  # check that passed.
+  local_frames=("$OUT"/live/f_*.png)
+  src="${local_frames[0]}"
+  for i in $(seq -w 0 24); do cp "$src" "$ctl/f_0$i.png"; done
+  pct=$(moving_pct_in_window "$ctl")
+  if [ "$pct" -lt "$BAR" ]; then
+    echo "  frozen film is REJECTED     ok  ${pct}% moving, bar ${BAR}%"
+    echo
+    echo "the check fails on a film that does not move"
+    exit 0
+  fi
+  echo "  frozen film is REJECTED     🔴 FAILED  ${pct}% moving -- it passed, so"
+  echo "     this check cannot detect the defect it was written for."
+  exit 1
+fi
+
+films "$OUT/live"
+grep -m1 -E "fps achieved" "$OUT/live/boot.log" | sed 's/^ */  /' || true
+pct=$(moving_pct_in_window "$OUT/live")
+printf '  %-25s %s  %d%% of pairs moved in the first %.1fs, bar %d%%\n' \
+  "build-in moves" "$([ "$pct" -ge "$BAR" ] && echo ok || echo '🔴 FAILED')" \
+  "$pct" "$WINDOW" "$BAR"
+[ "$pct" -ge "$BAR" ] || {
+  echo
+  echo "🔴 the boot draws its first second without changing. That is the"
+  echo "   2026-09-02 defect: poses not advancing while the clock does."
+  echo "   Films are in $OUT/live -- run tools/motion-census on them."
+  exit 1
+}
+echo
+echo "the boot's build-in animates"

tools/port/verify-screen

@@ -15,12 +15,26 @@
 # both), scale-0, and rest(). Each time the capture caught it and neither
 # renderer could have.
 #
+# 🔴 AND ITS FRAMES MUST NEVER BE SCORED AGAINST A CAPTURE. This script poses
+# `--pose=rest`, deliberately -- both renderers read `rest` through the same
+# decoder, which is what makes it a test of the PORT against the REFERENCE. It
+# is NOT the pose the port ships, and on some screens the two are very far
+# apart: `rest` for each `ptlogo_back2eff*` sparkle is the peak of its own
+# 4-unit flash, so `--pose=rest` lights all of them at once, a frame the game
+# never shows.
+#
+# I scored this script's `title_jp` frame against the oracle capture and
+# concluded the port had drifted away from the game -- r +0.7462 against the
+# reference's +0.8727. Posed as it SHIPS, the same block scores **+0.9994**.
+# The conclusion was an artefact of the pose, and it was written up as a finding.
+# Correctness questions go to `tools/port/verify-capture`, which poses as shipped.
+#
 # So: a DIFFERS row means "we moved apart, go find out which of us moved". It
 # does not mean the port is wrong. Where a capture and this tool disagree, the
-# capture wins. Use `tools/verify-capture` for the correctness question.
+# capture wins. Use `tools/port/verify-capture` for the correctness question.
 #
-#   tools/verify-screen                 # every screen in the manifest
-#   tools/verify-screen main_menu title # named screens
+#   tools/port/verify-screen                 # every screen in the manifest
+#   tools/port/verify-screen main_menu title # named screens
 #
 # Writes <screen>.godot.png, <screen>.ref.png and <screen>.diff.png into
 # $OUT (default: a directory under /tmp) and prints, per screen, the largest
@@ -35,6 +49,43 @@
 #  * `--black` because Godot clears to black and the screen carries its own
 #    background. The CLI's default dim slate stands in for a 3D scene behind an
 #    in-mission screen, which is not this screen.
+#
+#    ⚠️ THAT PREMISE IS DECLARED ON 12 OF 16 SCREENS AND ASSUMED ON 4. Audited
+#    2026-08-30: a screen "carries its own background" when it declares a
+#    full-screen untextured primitive at `t=0` with `fade_argb 0xff000000` --
+#    opaque black. Twelve do (`pteff00`, `palogo_eff0`, `pgloading_eff00`).
+#    Four do NOT. I first called those four "composited rather than standalone" [refuted];
+#    that reading is REFUTED disc-wide (see below) and what they share is only
+#    that they do not begin from black:
+#
+#      press_start / press_start_jp -- one element, the plate, drawn OVER the
+#        title; its own `name_why` says so. The game never shows it on black.
+#      build_00 / build_01 -- loading variants carrying the `pgloading_*` set
+#        WITHOUT the `pgloading_eff00` backdrop that build_12/15 declare.
+#
+#    ✅ Harmless HERE, because both renderers are given `--black` and the
+#    assumption cancels in a consistency check. It would NOT be harmless in an
+#    oracle comparison, and `verify-capture` already avoids it: the plate is
+#    scored as `--screen=title --overlay=press_start`, over the title, not on
+#    black.
+#
+#    📌 The audit is a rule worth having WITHIN THIS ARCHIVE, and its first
+#    reading was wrong. I called it "standalone versus composited"; the Decoder
+#    ran it disc-wide and it does not carry: **76 of 965 builds, 7.9 %**, with
+#    `GP_HANGAR_ARSENAL` **0 of 390**, `GP_OPTIONS` 0/14, `GP_PAUSE_MENU` 0/6 --
+#    screens a player plainly sees AS screens. Read as "composited", the rule
+#    makes 92 % of the game composited, which the archives do not support.
+#
+#    ✅ What survives is narrower: it separates **screens that begin from black**
+#    from everything else. The negative class is heterogeneous -- a pause menu
+#    over gameplay, a hangar over a 3D scene and a plate over a title are not the
+#    same kind of thing -- which is exactly what a two-way rule cannot express.
+#
+#    ⚠️ Within `GP_TITLE` it is exact and independently reproduced from the disc
+#    (12/4, the four being entries 0-3). That is the only archive it is claimed
+#    for. Do NOT carry it into `GP_READY_ROOM`, `GP_HANGAR_ARSENAL`,
+#    `GP_MISSION_SELECT` or `GP_OPTIONS`: in three of them it classifies every
+#    screen alike, so it would look like a clean answer and say nothing.
 #  * `--primitives --animated` because those are what make the CLI draw the same
 #    element set. `--focus` is NOT passed: nothing is focused at rest (HANDOFF
 #    Q5 measured initial focus as unstable boot to boot, so choosing one is
@@ -53,16 +104,83 @@
 set -euo pipefail
 cd "${PROJECT_DIR:-/work}"
 
-# `reference-cli/`, not `release/`: the reference binary is built per pinned
-# revision so a pin change cannot silently reuse the previous revision's build.
-# See docker/bin/build-reference-cli.
-CLI="${SYLPHEED_CLI:-${CARGO_TARGET_DIR:-/sylph-home/port/target-container}/reference-cli/sylpheed-cli}"
+# THE REFERENCE IS THE WORKSPACE'S OWN `sylpheed-cli`, and that is a change.
+#
+# It used to be a binary built per PINNED REVISION into `reference-cli/<rev>/`,
+# because `sylpheed-formats` was a git dependency and /reborn's target/ was a
+# live mount of the other agent's checkout that moved mid-run. A pixel
+# disagreement against a moving decoder has a free variable in it.
+#
+# The monorepo merge (`65cefa7`) removed that problem by construction:
+# `crates/sylpheed-export/Cargo.toml` now says
+# `sylpheed-formats = { path = "../sylpheed-formats" }`, so the exporter, this
+# reference and the port all read ONE decoder -- the working tree's.
+#
+# 🔴 It also silently broke the old machinery, and this script did not notice.
+# `build-reference-cli` greps Cargo.toml for `Syplheed-Reborn.git", rev = "..."`;
+# that line no longer exists, so the script exits 1 and the binary at
+# `reference-cli/sylpheed-cli` is whatever was last built before the merge --
+# here, three hours older than the sources and from a revision nothing points
+# at any more. Running the diff against it would have compared the port to a
+# decoder from another era and called the result a regression check. This
+# corpus has already been bitten by a stale reference renderer three times.
+#
+# So: build it from the workspace. `SYLPHEED_CLI` still overrides, for anyone
+# who does want to pin one deliberately.
+CLI="${SYLPHEED_CLI:-}"
+if [ -z "$CLI" ]; then
+  CLI="${CARGO_TARGET_DIR:-/sylph-home/port/target-container}/release/sylpheed-cli"
+  cargo build --release -p sylpheed-cli >/dev/null 2>&1 || true
+fi
 DISC="${SYLPHEED_DISC:-/disc}"
 OUT="${OUT:-${TMPDIR:-/tmp}/verify-screen}"
 export DISPLAY="${DISPLAY:-:97}"
 
-[ -x "$CLI" ] || { echo "no reference CLI at $CLI -- run build-reference-cli" >&2; exit 2; }
+[ -x "$CLI" ] || { echo "no reference CLI at $CLI -- \`cargo build --release -p sylpheed-cli\` failed?" >&2; exit 2; }
 [ -f export/manifest.json ] || { echo "no export/manifest.json -- run build-export --run" >&2; exit 2; }
+
+# 🔴 THE REFERENCE BINARY IS NOT NECESSARILY THE ONE THIS SCRIPT BUILT.
+#
+# `CARGO_TARGET_DIR` is a SHARED `/sylph-home/port/target-container`. Two source
+# trees -- this workspace and any worktree built with the same variable set --
+# write one `release/sylpheed-cli`, and cargo fingerprints per source path, so
+# each build reports "Finished" while the binary on disk belongs to whichever
+# tree wrote last. `cargo build` here returns in 0.15 s and changes nothing.
+#
+# That is the hazard the header above says the monorepo removed. It did not; the
+# shared target dir reintroduced it by another route. Measured 2026-08-30: a CLI
+# built from this workspace is `rest t=70` (the stale record layout) while the
+# binary actually sitting in the target dir was `rest t=12` (fixed) -- so this
+# script was comparing the port against a decoder from a tree nobody had named.
+#
+# ⚠️ It happened to be the RIGHT era, which is worse than wrong: it agreed with
+# the exporter's pin by luck, and one successful rebuild would have flipped it
+# silently. `title_jp` differs by 74 507 px between the two eras.
+#
+# So the era is CHECKED, against the export the port actually reads, rather than
+# assumed from having run `cargo build`.
+ref_rest=$("$CLI" screen info "$DISC/dat/GP_TITLE.pak" --build 5 --all 2>/dev/null \
+  | grep -i 'pteff00' | head -1 | sed -n 's/.*rest (0,0) t=\([0-9]*\).*/\1/p')
+exp_rest=$(python3 -c '
+import json
+m=json.load(open("export/manifest.json"))
+f=next(s["file"] for s in m["screens"] if s["name"]=="main_menu")
+d=json.load(open("export/"+f))
+print(int(next(e for e in d["elements"] if e.get("id")=="pteff00")["rest"]["t"]))')
+if [ -n "$ref_rest" ] && [ "$ref_rest" != "$exp_rest" ]; then
+  echo "🔴 the reference CLI and the export disagree on the decoder era:" >&2
+  echo "   reference $CLI says pteff00 rest t=$ref_rest" >&2
+  echo "   export/   (built by the pinned exporter) says rest t=$exp_rest" >&2
+  echo "   Every row below would compare two decoder eras. Refusing." >&2
+  echo "" >&2
+  echo "   REMEDY, verified both directions 2026-08-30: this workspace's" >&2
+  echo "   ui_layout.rs is the STALE era and still carries the retired" >&2
+  echo "   SYLPHEED_KF_TIME_SHIFT knob, which converts it to the corrected" >&2
+  echo "   reading. Re-run with SYLPHEED_KF_TIME_SHIFT=1 and the reference" >&2
+  echo "   reports rest t=12, matching the pinned exporter; without it, t=70." >&2
+  echo "   The knob is absent from the pinned tag, so it cannot affect export/." >&2
+  exit 2
+fi
 mkdir -p "$OUT"
 
 # Godot needs one scan to register the `class_name` globals; without it every
@@ -90,20 +208,127 @@ print(json.load(open("export/"+f))["source"]["build"])' "$name")
   "$CLI" screen render "$DISC/dat/GP_TITLE.pak" "$OUT/$name.ref.png" \
     --build "$build" --all --black --primitives --animated >/dev/null
 
+  # 🔴 THE REFERENCE RENDERER SILENTLY OMITS A `.tbm` BACKGROUND.
+  #
+  # The Decoder reached and captured the TUTORIAL screen and found that
+  # `screen render` draws every OTHER element of a `.tbm`-bearing build and
+  # leaves the background out, with no diagnostic: their render of GP_TUTORIAL
+  # build 0 is the correct layout on pure black, 6.0-6.4 % inked against the
+  # game's 99.7 %. `docs/re/structures/tbm-submenu-not-reached.md`, their branch.
+  #
+  # I confirmed the shape of it here with both controls: `screen info` reports
+  # `pubase.tbm` on GP_TUTORIAL build 0 and no `.tbm` on any of the 16 builds in
+  # my manifest. So this trap CANNOT fire today.
+  #
+  # ⚠️ That is a fact about today's manifest, not a property of this script, and
+  # the failure it would cause is the expensive kind: the port draws a
+  # background the reference does not, the row reads DIFFERS, and the header
+  # above tells the reader to go find out which renderer moved. Neither did.
+  # The row would be a real disagreement caused by a KNOWN omission on the
+  # reference side, and nothing on screen would say so.
+  #
+  # So the row says so. This does not change the verdict or the bar -- it
+  # attaches the provenance to the one row that would otherwise mislead.
+  tbm=$("$CLI" screen info "$DISC/dat/GP_TITLE.pak" --build "$build" --all 2>/dev/null \
+    | grep -ioc '\.tbm' || true)
+
+  # 🔴 `--loop-phase=0` PINS THE PULSE, AND WITHOUT IT THIS SCRIPT WAS
+  # NONDETERMINISTIC. `press_start` returned `over3` **5021, 8919, 5021** on
+  # three identical runs: the plate's looping focus record rides `time_units`,
+  # so the captured frame lands wherever the grab fell, while the reference
+  # renderer cannot pulse at all.
+  #
+  # ⚠️ The port is NOT the thing that is wrong. A thing that pulses does not
+  # stop because the screen has arrived, and the pulse is measured. What was
+  # wrong is comparing a moving frame against a static one and calling the
+  # difference a regression -- a detector that answers differently each run
+  # teaches its reader to ignore it, which is worse than one that fails.
+  #
+  # So the phase is pinned HERE, in the harness, and nothing about playback
+  # changes: `loop_phase_units` defaults to free-running everywhere else.
+  # ⚠️ It is usually stable -- 3 of 4 control runs agreed -- which is exactly
+  # why this survived: it looks deterministic most of the time.
   godot --path port --resolution 1280x720 -- \
-    "--screen=$name" --pose=rest "--capture=$OUT/$name.godot.png" >"$OUT/$name.log" 2>&1
+    "--screen=$name" --pose=rest --loop-phase=0 "--capture=$OUT/$name.godot.png" >"$OUT/$name.log" 2>&1
 
   convert "$OUT/$name.godot.png" "$OUT/$name.ref.png" \
     -compose difference -composite -colorspace Gray -auto-level "$OUT/$name.diff.png"
   read -r max mean <<<"$(convert "$OUT/$name.godot.png" "$OUT/$name.ref.png" \
     -compose difference -composite -format "%[fx:maxima*255] %[fx:mean*255]" info:)"
 
-  # 3/255 is what integer-truncating compositing in the CLI and float rounding
-  # in a GPU differ by. Anything above that is a placement, order or colour
-  # disagreement and needs a reason, not a threshold.
+  # HOW MANY pixels are over the bar, not just how far the worst one is. A
+  # single `max` cannot tell 2 pixels from 25 444, and this run produced both:
+  # `main_menu` trips the threshold on TWO pixels out of 921 600 while
+  # `title_jp` trips it on 2.8 % of the frame. Reporting only the max made those
+  # the same verdict, which is how a real disagreement hides behind a rounding
+  # one. The bar itself is NOT raised -- tuning a threshold until things match
+  # is the failure this script's own header warns about.
+  over=$(convert "$OUT/$name.godot.png" "$OUT/$name.ref.png" \
+    -compose difference -composite -colorspace Gray -threshold $((3*65535/255)) \
+    -format "%[fx:int(mean*w*h)]" info:)
+
+  # BOTH FRAMES BLANK IS NOT AGREEMENT, AND THIS SCRIPT USED TO SAY IT WAS.
+  #
+  # `build_12` and `build_15` -- the two dressed loading screens -- render as
+  # pure black in BOTH renderers, mean 0 and max 0, so the difference is 0 and
+  # the row read `max 0  over3 0  OK`. Two of the sixteen rows in the committed
+  # baseline were comparing nothing against nothing and reporting the strongest
+  # verdict this script has.
+  #
+  # That is worse than a missing test: it is a test that reports a pass. The
+  # screens are black because `pgloading_eff00` is a full-frame opaque black
+  # quad whose `rest.t` (38) sits inside its own opening black hold, and
+  # `--pose=rest` freezes it there -- see docs/port/DECISIONS.md. Whether that
+  # is the port's bug or the decoders' reading of `rest` is open; what is not
+  # open is that a blank pair may not be scored.
+  #
+  # ✅ RESOLVED 2026-08-30, AND THE PARAGRAPH ABOVE IS NOW HISTORY. It was the
+  # PAINT ORDER, not `rest`. `pgloading_eff00` carries `layer: null`,
+  # `layer_source: none` -- the only elements in the export with neither a read
+  # nor an implied key -- so without the forced-backdrop pass the first element
+  # becomes `pgloading_loop5` and the opaque quad paints over everything. With
+  # the pass, both screens render at max 214.5 in BOTH renderers (mean 1.949
+  # port, 1.918 reference) and the rows read `OK` on a real comparison.
+  #
+  # ⚠️ The guard STAYS. It is not firing today, which is exactly when a guard
+  # quietly rots -- and it was right when it was written: two of sixteen rows
+  # were comparing nothing against nothing and reporting this script's
+  # strongest verdict. Leaving the reasoning above intact is deliberate; a
+  # reader who hits a blank pair tomorrow needs it.
+  #
+  # So blankness is checked FIRST and reported as its own verdict. It is not a
+  # failure -- the port may legitimately have nothing to draw -- but it is not a
+  # pass either, and `status` is left alone so an unrelated screen's DIFFERS is
+  # still what fails the run.
+  ink=$(convert "$OUT/$name.godot.png" "$OUT/$name.ref.png" \
+    -evaluate-sequence max -colorspace Gray -format "%[fx:maxima*255]" info:)
   verdict=OK
-  awk "BEGIN{exit !($max > 3)}" && { verdict=DIFFERS; status=1; }
-  printf '%-16s build %-3s max %-5s mean %-8s %s\n' "$name" "$build" "$max" "${mean:0:6}" "$verdict"
+  if awk "BEGIN{exit !($ink <= 0)}"; then
+    verdict="BLANK -- both renderers drew nothing; this row proves nothing"
+  else
+    # 🔴 THE VERDICT USES `over3`, NOT `max` ALONE, AND FOR YEARS IT DID NOT.
+    #
+    # This script computed `over3` precisely because "a single `max` cannot tell
+    # 2 pixels from 25 444" -- its own words, a few lines up -- and then decided
+    # the verdict on `max` regardless. So `main_menu` (max 4, over3 **0**) read
+    # DIFFERS while `extras` (max 3, over3 0) read OK: one unit on one pixel,
+    # separating two frames that are pixel-for-pixel equivalent at the bar.
+    #
+    # ⚠️ This is NOT raising the bar, which this file rightly warns against. The
+    # bar is still 3. What changes is that a frame with NO pixel over it gets a
+    # verdict of its own instead of being lumped in with a real disagreement --
+    # the distinction the statistic was added to make and was never given.
+    if awk "BEGIN{exit !($over > 0)}"; then
+      verdict=DIFFERS; status=1
+    elif awk "BEGIN{exit !($max > 3)}"; then
+      verdict="ROUNDING -- max $max but NO pixel over the bar"
+    fi
+  fi
+  if [ "${tbm:-0}" -gt 0 ]; then
+    verdict="$verdict  [build carries a .tbm: the REFERENCE omits that background, so a DIFFERS here is likely theirs]"
+  fi
+  printf '%-17s build %-3s max %-5s mean %-8s over3 %-7s %s\n' \
+    "$name" "$build" "$max" "${mean:0:6}" "$over" "$verdict"
 done
 echo "artifacts in $OUT"
 exit $status

tools/port/verify-transcode-fidelity

@@ -0,0 +1,500 @@
+#!/usr/bin/env python3
+"""Is the transcode faithful to the source? Decode both, align, subtract.
+
+`AUDIO-VERIFICATION.md` §1 states this as the question P4 actually raised and
+gives the method, and nothing implemented it. `verify-video-audio` deliberately
+does not: it proves Godot emits non-silence and says in as many words that a
+difference RMS without alignment is meaningless. So the gate has rested on level
+and non-silence, and the fidelity claim has never been made.
+
+The doc names three ways the measurement lies, and all three are handled here
+rather than hoped about:
+
+  ALIGNMENT      a one-sample offset makes the difference nearly as loud as the
+                 source. Cross-correlated coarse-to-fine BEFORE subtracting, and
+                 the search REFUSES when its best lag sits on the boundary --
+                 printing the range beside the answer, so an edge reads as an
+                 edge.
+  CHANNEL LAYOUT the source is 5.1 and the transcode is stereo. The source is
+                 folded with `video.rs`'s own `DOWNMIX_51` -- read out of the
+                 manifest's recorded command, not restated here -- so both sides
+                 are the same fold.
+  A PARTIAL FILE `ffprobe` once reported 33 s for a 137 s transcode because the
+                 encode was still running. Duration and mtime are checked, and a
+                 file written in the last 60 s is refused.
+  THE SEEK       `-ss` before `-i` returned 4.6 s of AUDIO for a 4.0 s request on
+                 this WMA Pro source, so the two windows covered different audio.
+                 Not in §1. ⚠️ NARROWED after the Decoder checked it: on this
+                 disc the VIDEO container-seek is EXACT -- a frame taken at 20 s
+                 via container seek is byte-identical to one from a full decode.
+                 So it is a property of the AUDIO STREAM, not of `-ss` placement
+                 as such, and a check that only looked at video would clear a
+                 path still unsafe for audio.
+
+🔴 AND IT RUNS ITS OWN KNOWN NEGATIVES. A fidelity check that has only ever
+returned "faithful" is the unfalsifiable clean run this project keeps finding:
+`--control` compares the source against itself (must be near-perfect) and against
+the OTHER movie (must be near 0 dB down).
+
+⚠️ **REPORT ONLY. THIS DOES NOT YET PRODUCE A VERDICT**, and it is committed in
+that state deliberately. It has reproduced four distinct ways the measurement
+lies -- three that §1 names and one it does not -- and each was found by a
+diagnostic rather than by reasoning. It still reports the difference signal
+LOUDER than the source, which cannot be true of two aligned signals at equal
+level, so the remaining fault is on this side of the instrument.
+
+A tool that says "not faithful" while its own alignment is broken would be worse
+than no tool: it would put a false defect on the exporter. Committed so the next
+iteration starts from four known traps instead of from four lines of shell.
+"""
+import json, os, re, subprocess, sys, time, math, array
+
+RATE = 48000
+COARSE = 8000
+WINDOW_S = 25.0
+PASS_DB = 40.0
+# Per-band tolerance. Both shipped transcodes sit at 0.29 and 0.66 dB worst-case
+# across four bands, and the unrelated-movie control lands an order of magnitude
+# out, so this is set between two measured populations rather than picked.
+PASS_BAND_DB = 1.5
+
+
+def sh(*a):
+    return subprocess.run(a, capture_output=True).stdout
+
+
+def pcm(path, rate, seconds, af=None, skip=0.0):
+    """Decode to mono signed-16 at `rate`, optionally through a filter chain."""
+    # 🔴 `-ss` AFTER `-i`, and this is a FOURTH way the measurement lies that
+    # AUDIO-VERIFICATION §1 does not list. Placed before `-i` the seek is a
+    # container-level jump, and on this WMA Pro source it overshot: a 4.0 s
+    # request returned 4.6 s of audio while the Ogg side returned 4.0 s. The two
+    # windows then covered DIFFERENT STRETCHES OF THE MOVIE, no shift could
+    # align them, and the check reported a faithful transcode as garbage --
+    # normalised correlation 0.172 at its best lag.
+    #
+    # Decoder-side seeking is slower and exact. The failure looks identical to
+    # the alignment trap the doc does name, which is why it cost a diagnostic
+    # rather than a guess to tell them apart.
+    cmd = ["ffmpeg", "-hide_banner", "-loglevel", "error", "-i", path,
+           "-ss", str(skip), "-t", str(seconds)]
+    if af:
+        cmd += ["-af", af + ",aformat=channel_layouts=mono"]
+    else:
+        cmd += ["-af", "aformat=channel_layouts=mono"]
+    cmd += ["-ar", str(rate), "-f", "s16le", "-"]
+    raw = sh(*cmd)
+    a = array.array("h")
+    a.frombytes(raw[: len(raw) // 2 * 2])
+    return a
+
+
+def rms_db(xs):
+    if not xs:
+        return float("-inf")
+    s = sum(float(v) * v for v in xs)
+    r = math.sqrt(s / len(xs))
+    return 20 * math.log10(r / 32768.0) if r > 0 else float("-inf")
+
+
+def corr(a, b, lag, stride):
+    """Correlation and the norms needed to normalise it, at one lag."""
+    n = min(len(a), len(b)) - abs(lag)
+    s = ea = eb = 0.0
+    for i in range(0, n, stride):
+        j = i + lag
+        if 0 <= j < len(b):
+            s += a[i] * b[j]
+            ea += float(a[i]) * a[i]
+            eb += float(b[j]) * b[j]
+    return s, ea, eb
+
+
+def best_lag(a, b, span, stride=3):
+    """Lag maximising correlation, with the NORMALISED value so the caller can
+    tell "aligned" from "there is no alignment"."""
+    best = (-1e30, 0, 0.0)
+    for lag in range(-span, span + 1):
+        s, ea, eb = corr(a, b, lag, stride)
+        if s > best[0]:
+            best = (s, lag, s / math.sqrt(ea * eb) if ea > 0 and eb > 0 else 0.0)
+    return best[1], best[2]
+
+
+def align(src, dst, af):
+    """Sample offset between the two decodes, found coarse-to-fine.
+
+    🔴 A SINGLE-RESOLUTION SEARCH PINNED AT ITS OWN EDGE. `ADV` returned +2413
+    against a window of +/-2400 -- the answer was the boundary, not the peak,
+    and the check then reported a faithful transcode as a failure. Same family
+    as the Decoder's period estimator returning its own search floor: an
+    instrument answering with a property of itself.
+    """
+    for rate, span, stride in ((2000, 2000, 2), (8000, 60, 2)):
+        a = pcm(src, rate, 8.0, af, skip=2.0)
+        b = pcm(dst, rate, 8.0, None, skip=2.0)
+        if not a or not b:
+            return None, 0.0
+        if rate == 2000:
+            lag, c = best_lag(a, b, span, stride)
+            if abs(lag) >= span:
+                # Refuse AND say what the range was: the Decoder's cheap defence
+                # is printing the search range beside the answer so a boundary
+                # reads as a boundary rather than as a result.
+                print(f"    coarse lag {lag:+d} of a +/-{span} search at {rate} Hz"
+                      f" -- ON THE BOUNDARY, so this is the window's edge, not a peak")
+                return None, c
+            coarse = lag / rate
+        else:
+            centre = int(round(coarse * rate))
+            sub_a, sub_b = a, b[max(0, centre):] if centre >= 0 else b
+            lag, c = best_lag(sub_a, sub_b, span, stride)
+            coarse += lag / rate
+    return int(round(coarse * RATE)), c
+
+
+# 🔴 THE TOP BAND IS SPLIT BECAUSE THE NEAR-MISS CONTROL FAILED. With a single
+# 6-16 kHz band, a 6 kHz-lowpassed source -- a transcode that lost its whole top
+# end, the failure this check exists to catch -- deviated by only 2.58 dB and
+# would have PASSED. The band was wide enough to average the loss away against
+# the filter's transition region.
+#
+# ⚠️ This is changing the instrument's RESOLUTION so it can see a failure it must
+# see, driven by a control it failed. It is NOT loosening the pass threshold for
+# the real comparison, which is unchanged -- that would be tuning until the
+# answer came out right, which is the thing this project keeps catching.
+BANDS = [(0, 500), (500, 2000), (2000, 6000), (6000, 10000), (10000, 16000)]
+
+# `FID_BANDS=none` empties the band list and `FID_WINDOW` shortens the analysis
+# window. Both exist ONLY so `--selftest` can drive this script as a subprocess
+# in a deliberately broken configuration and read its real exit code, rather than
+# reasoning about what it would do -- the failure I walked into on my first
+# harness self-test and the Decoder walked into on theirs.
+if os.environ.get("FID_BANDS") == "none":
+    BANDS = []
+WINDOW_S = float(os.environ.get("FID_WINDOW", WINDOW_S))
+
+
+def band_db(path, af, lo, hi, seconds=25.0, skip=2.0):
+    """RMS in one band, straight out of `astats`.
+
+    🔴 A DIFFERENT KIND OF QUANTITY, and that is the whole reason it exists. The
+    difference-signal method needs the two decodes aligned to the sample, and
+    four attempts at that produced four different failures and no verdict. The
+    Decoder's rule from their own two failed attempts: **two failed attempts at
+    the same measurement are evidence the QUANTITY is wrong, not the parsing.**
+    Band energy needs no alignment at all -- it is a statistic over the window,
+    so a lag of any size cannot corrupt it.
+
+    ⚠️ It is a WEAKER claim than a difference signal. Matching band energies
+    cannot distinguish a faithful transcode from one that preserved the spectrum
+    while mangling the waveform. It is what this instrument can honestly support,
+    and it is stated as that rather than dressed up as fidelity.
+    """
+    chain = [(af + "," if af else ""), "aformat=channel_layouts=mono"]
+    if lo > 0:
+        chain.append(",highpass=f=%d" % lo)
+    if hi < 20000:
+        chain.append(",lowpass=f=%d" % hi)
+    chain.append(",astats=measure_perchannel=none")
+    out = subprocess.run(
+        ["ffmpeg", "-hide_banner", "-i", path, "-ss", str(skip), "-t", str(seconds),
+         "-af", "".join(chain), "-f", "null", "-"],
+        capture_output=True, text=True).stderr
+    m = re.search(r"RMS level dB: (-?[\d.]+|-inf)", out)
+    if not m or m.group(1) == "-inf":
+        return None
+    return float(m.group(1))
+
+
+def bands(src, dst, af, label, af_dst=None):
+    """Per-band level, source against transcode. ROBUST to misalignment, not free of it.
+
+    ⚠️ CLAIM NARROWED 2026-08-31 after the Decoder tried to refute it. It survives
+    -- **1 s of misalignment costs 0.16 dB**, well inside the 1.5 dB pass band --
+    but it is **not literally alignment-free**: at **10 s the cost reaches 1.00 dB**,
+    because a fixed analysis window covers different material once the shift is
+    large relative to it. "Needs no alignment" was my wording and it was too
+    strong; the honest claim is robustness up to a few seconds.
+
+    🔴 THE FOLD IS PER-SIDE, and the identity control is what made that
+    necessary. `af` applies to the LEFT side only, which is correct for the real
+    comparison -- a 5.1 source needs folding, an already-stereo transcode does
+    not. Applying that same asymmetry to source-against-itself compares a folded
+    signal with a raw six-channel average and reports **7.656 dB on an
+    identity**, larger than the 0.66 dB this check calls a pass.
+    """
+    print(f"  {label}")
+    worst = 0.0
+    for lo, hi in BANDS:
+        a = band_db(src, af, lo, hi)
+        b = band_db(dst, af_dst, lo, hi)
+        if a is None or b is None:
+            print(f"    {lo:>5}-{hi:<5} Hz   one side silent -- no comparison")
+            continue
+        d = b - a
+        worst = max(worst, abs(d))
+        flag = "" if abs(d) <= 1.0 else ("  <- " + ("transcode louder" if d > 0 else "transcode quieter"))
+        print(f"    {lo:>5}-{hi:<5} Hz   source {a:7.2f}   transcode {b:7.2f}"
+              f"   {d:+6.2f} dB{flag}")
+    return worst
+
+
+def downmix_of(manifest, name):
+    """The fold the EXPORTER used, read back out of the recorded command."""
+    for v in manifest.get("videos", []):
+        if v.get("name") == name:
+            # 🔴 Take everything between `-af` and the next flag. A tighter
+            # pattern truncated the fold to its FL half -- the source was being
+            # folded to a left-only signal while the transcode carried both --
+            # and the run reported the difference 7 dB LOUDER than the source.
+            # That is AUDIO-VERIFICATION §1's channel-layout trap, reached
+            # through a parsing bug rather than a decision. The matrix contains
+            # runs of spaces, so it cannot be tokenised on whitespace.
+            m = re.search(r"-af (.*?) -ac ", v.get("command", ""))
+            return m.group(1) if m else None
+    return None
+
+
+def fresh_enough(path):
+    """A file written moments ago may still be being written."""
+    age = time.time() - os.path.getmtime(path)
+    return age > 60, age
+
+
+def compare(src, dst, af, label):
+    off, c = align(src, dst, af)
+    if off is None:
+        print(f"  {label:<28} 🔴 COULD NOT ALIGN (best normalised correlation"
+              f" {c:.3f}) -- this is NOT a fidelity verdict")
+        return None
+    a = pcm(src, RATE, WINDOW_S, af, skip=2.0)
+    b = pcm(dst, RATE, WINDOW_S, None, skip=2.0)
+    # 🔴 THE SIGN MATTERS AND THE FIRST VERSION GOT IT WRONG. Indexing `b[i+off]`
+    # with a negative `off` walks off the front of the array, which in Python
+    # wraps to the end -- so the "difference" was the transcode subtracted from
+    # an unrelated part of the source. It reported the difference 7 dB LOUDER
+    # than the source, which is precisely the catastrophic-looking number
+    # AUDIO-VERIFICATION §1 warns a misaligned run produces. The instrument
+    # reproduced the documented failure before it produced a result.
+    ia, ib = (0, off) if off >= 0 else (-off, 0)
+    _ = c
+    # Refine sample-exact on one second, now that both sides are roughly aligned.
+    fine, _cf = best_lag(a[ia : ia + RATE], b[ib : ib + RATE], 16, 1)
+    if fine >= 0:
+        ib += fine
+    else:
+        ia += -fine
+    n = min(len(a) - ia, len(b) - ib)
+    if n <= 0:
+        print(f"  {label:<28} 🔴 no overlap after alignment")
+        return None
+    diff = array.array("i", (a[ia + i] - b[ib + i] for i in range(n)))
+    off = ib - ia
+    s_db, d_db = rms_db(a[ia : ia + n]), rms_db(diff)
+    down = s_db - d_db
+    print(f"  {label:<28} source {s_db:7.2f} dB   difference {d_db:7.2f} dB"
+          f"   {down:6.2f} dB down   (lag {off:+d} smp, corr {c:.3f})")
+    return down
+
+
+def selftest():
+    """Can this tool tell a working configuration from a broken one?
+
+    🔴 THE LAST GAP ON MY LIST. This script has three controls that run every
+    time -- identity, a 4-pole top-end loss, an unrelated movie -- and none asks
+    whether the MEASUREMENT ITSELF is live. With an empty band list every
+    comparison returns a worst deviation of 0.0: identity passes, the real pair
+    passes, and only the unrelated-movie control fails -- reporting **exit 1, a
+    corpus problem**, for what is actually a broken instrument. Same shape as the
+    empty register in `check-claims`, and the same fix: a distinct answer.
+
+    Drives this script as a subprocess over a short window and reads its real
+    exit code:  normal -> 0,  band list emptied -> 2.
+    """
+    env = dict(os.environ, FID_WINDOW="4")
+    ok = True
+    for label, extra, want in (("normal config", {}, 0),
+                               ("band list emptied", {"FID_BANDS": "none"}, 2)):
+        got = subprocess.run([sys.executable, __file__], env={**env, **extra},
+                             capture_output=True).returncode
+        mark = "✅" if got == want else "🔴"
+        print(f"  harness: {label:<20} exit {got}, wanted {want}  {mark}")
+        ok = ok and got == want
+    print()
+    print("the band measurement can tell a broken configuration from a clean run"
+          if ok else "🔴 the harness cannot distinguish a broken configuration")
+    return 0 if ok else 2
+
+
+def main():
+    if "--selftest" in sys.argv:
+        return selftest()
+    # 🔴 An empty band list makes every comparison read 0.0 dB and pass. That is
+    # the harness failing, not the transcodes, and it gets its own exit code.
+    if not BANDS:
+        print("🔴 the band list is EMPTY -- every comparison would read 0.0 dB and")
+        print("   pass. Exit 2: the harness is broken, not the transcodes.")
+        return 2
+    man = json.load(open("export/manifest.json"))
+    names = [v["name"] for v in man.get("videos", [])]
+    # 🔴 LIVENESS, the same shape as the empty band list one line up. With no
+    # videos in the manifest the loop never runs, `fail` stays 0 and this reports
+    # every transcode faithful -- having compared none.
+    if not names:
+        print("🔴 the manifest lists NO videos -- nothing was compared.")
+        print("   Exit 2: the harness is broken, not the transcodes.")
+        return 2
+    control = "--control" in sys.argv
+    fail = 0
+    print(f"  window {WINDOW_S:.0f} s from t=2 s, mono {RATE} Hz, pass at "
+          f"{PASS_DB:.0f} dB down\n")
+    for name in names:
+        src = re.search(r"-i (\S+\.wmv)", next(v["command"] for v in man["videos"]
+                                               if v["name"] == name)).group(1)
+        dst = os.path.join("export", next(v["file"] for v in man["videos"]
+                                          if v["name"] == name))
+        ok_age, age = fresh_enough(dst)
+        if not ok_age:
+            print(f"  {name:<28} 🔴 written {age:.0f} s ago -- may still be being"
+                  " written; refusing to measure it")
+            fail += 1
+            continue
+        af = downmix_of(man, name)
+        worst = bands(src, dst, af, f"{name} -- band energies (robust to misalignment, not free of it)")
+        verdict = "ok" if worst <= PASS_BAND_DB else "🔴 OUT OF TOLERANCE"
+        print(f"    worst band deviation {worst:.2f} dB   {verdict}")
+        if worst > PASS_BAND_DB:
+            fail += 1
+        # 🔴 THE KNOWN NEGATIVE RUNS EVERY TIME, not behind a flag. A band check
+        # that has only ever seen a faithful pair cannot be told from one that
+        # compares a file with itself by accident -- and this tool has already
+        # produced four confident wrong numbers on the other quantity.
+        # 🔴 THE IDENTITY CONTROL, added 2026-08-31 after the Decoder generalised
+        # my own rule back at me: **a positive control that is merely "high"
+        # hides the difference between an exact instrument and a lossy one.**
+        # This check's positive side was 0.29 and 0.66 dB -- small, and small is
+        # not zero. A systematic bias (the fold applied to one side only, a
+        # different window, a resampler difference) would sit inside 0.66 dB
+        # while looking like a pass. Source against itself must be EXACTLY 0.00
+        # in every band, and anything else is the instrument, not the transcode.
+        ident = bands(src, src, af, "  control: source vs ITSELF, must be exact", af_dst=af)
+        idv = "ok" if ident == 0.0 else f"🔴 {ident:.3f} dB on an identity -- the instrument is biased"
+        print(f"    worst band deviation {ident:.3f} dB   {idv}")
+        if ident != 0.0:
+            fail += 1
+        # 🔴 A NEAR-MISS NEGATIVE, because an unrelated movie is an EASY one.
+        # The Decoder measured two unrelated music BANKS separating by just
+        # 5.28 dB where an unrelated movie gave me 19-20, so the margin against a
+        # hard negative is 8x, not 30x. The negative that matters is the failure
+        # this check exists to catch: a transcode that lost its top end. A 6 kHz
+        # lowpass of the source is that failure, constructed.
+        # 🔴 FOUR POLES, NOT ONE -- corrected 2026-08-31, and the correction
+        # retracts a finding I published. `lowpass=f=6000` is SINGLE-POLE,
+        # 6 dB/octave: a mild tilt, not a lost top end. I named it "a transcode
+        # that lost its top end", measured 1.28 dB on `S00A`, and reported a
+        # COVERAGE HOLE to the Decoder. **The hole was my filter.** A real brick
+        # wall -- four poles -- is caught on `S00A` at 1.83 dB and on `ADV` at
+        # far more.
+        #
+        # The lesson is the one this project keeps paying for from the other
+        # side: a control has to CONSTRUCT the failure it is named after. Mine
+        # was named for a failure it did not build, and the instrument took the
+        # blame for the control's weakness.
+        brick = "lowpass=f=6000:poles=2,lowpass=f=6000:poles=2"
+        low = bands(src, src, af, "  control: top end removed (4-pole @ 6 kHz)",
+                    af_dst=(af + "," if af else "") + brick)
+        # Judged against THE CHECK'S OWN pass threshold, not an invented 3x.
+        #
+        # With the top band split this lands at 4.27 dB: it fails the 1.5 dB pass
+        # test, so the check does catch it -- but by 2.8x, against the 6.4x it
+        # has over the worst real transcode (0.67 dB). ⚠️ NOT COMFORTABLE, and
+        # said out loud rather than smoothed: a loss milder than a 6 kHz brick
+        # wall could sit between 0.67 and 1.5 and pass. The honest statement is
+        # that this check catches a SEVERE top-end loss and is not characterised
+        # for a mild one.
+        #
+        # The 3x bar it used to be judged against was mine and stricter than the
+        # check itself; using the check's own threshold is the principled
+        # criterion, and lowering the 3x to make a failing control pass would
+        # have been tuning.
+        # 🔴 REPORTED PER ASSET, NOT ASSERTED, and the reason is a measured gap
+        # rather than convenience. `ADV` catches the lowpass by 2.8x. **`S00A`
+        # does not catch it at all** -- 1.28 dB against a 1.5 dB threshold --
+        # because its own 6-16 kHz content sits at -67 dB, so removing it changes
+        # almost nothing. The check's sensitivity is MATERIAL-DEPENDENT, which is
+        # the Decoder's finding about negative-separation arriving on the
+        # positive side.
+        #
+        # Asserting it would make the suite permanently red on a gap I cannot
+        # close today; hiding it would make a coverage hole into scenery. So it
+        # prints COVERED / NOT COVERED per asset and the gap is tracked in
+        # BLOCKED.md. The identity and unrelated-movie controls still assert.
+        if low > PASS_BAND_DB:
+            margin = low / PASS_BAND_DB
+            note = "" if margin >= 2.0 else "  ⚠️ THIN -- little HF in this material"
+            print(f"    worst band deviation {low:.2f} dB   COVERED, caught by"
+                  f" {margin:.1f}x{note}")
+        else:
+            print(f"    worst band deviation {low:.2f} dB   🔴 NOT COVERED --"
+                  f" a 6 kHz top-end loss on {name} would PASS this check")
+        other = [v for v in man["videos"] if v["name"] != name]
+        if other:
+            osrc = os.path.join("export", other[0]["file"])
+            bad = bands(src, osrc, af, f"  control: vs {other[0]['name']}, must be FAR out")
+            ctl = "ok" if bad > 3 * PASS_BAND_DB else "🔴 an unrelated movie passes as faithful"
+            print(f"    worst band deviation {bad:.2f} dB   {ctl}")
+            if bad <= 3 * PASS_BAND_DB:
+                fail += 1
+        print()
+        if af is None:
+            print(f"  {name:<28} ⚠️  no `-af` in the recorded command: the source"
+                  " is stereo, comparing without a fold")
+        # Report-only: a disqualified path must not vote on the exit code. It
+        # did, which is why the run went red for the wrong reason the moment the
+        # return was fixed -- two defects hiding each other, and repairing one
+        # exposed the other rather than the run going quietly green.
+        compare(src, dst, af, name)
+        if control:
+            print(f"    known negatives for {name}:")
+            same = compare(src, src, af, "  source vs itself")
+            if same is None or same < 60:
+                print("    🔴 the check cannot even match a file with itself")
+                fail += 1
+            other = [n for n in names if n != name]
+            if other:
+                osrc = os.path.join("export", next(v["file"] for v in man["videos"]
+                                                   if v["name"] == other[0]))
+                un = compare(src, osrc, af, f"  vs {other[0]} (unrelated)")
+                if un is not None and un > 10:
+                    print("    🔴 an unrelated movie scores as faithful")
+                    fail += 1
+    print()
+    print("  ⚠️  WHAT IS ASSERTED: per-band level agreement, which needs no")
+    print("     alignment. It CANNOT tell a faithful transcode from one that kept")
+    print("     the spectrum and mangled the waveform. That is the honest limit of")
+    print("     this quantity, and it is what the difference signal below was for.")
+    print()
+    print("  🔴 THE DIFFERENCE SIGNAL IS REPORT ONLY -- NO VERDICT, and the numbers")
+    print("     above must not be read as one. Best alignment so far is corr")
+    print("     0.763 on `S00A` and 0.075 on `ADV`, and both still report the")
+    print("     difference LOUDER than the source, which is impossible for two")
+    print("     aligned signals at equal level. Something remains wrong on this")
+    print("     side of the measurement, not necessarily in the transcodes.")
+    print()
+    print("  What this run DOES establish is the trap list below, each reproduced")
+    print("  here rather than reasoned about. See docs/port/DECISIONS.md.")
+    print("  🔴 It measures AUDIO only; `-q:v 8` was chosen on SSIM separately.")
+    # 🔴 THIS RETURN WAS UNCONDITIONAL `return 0` FOR A DAY. Making the difference
+    # path report-only swallowed the band verdict with it, so `check-all`'s
+    # `transcode-bands must-pass` step COULD NOT FAIL -- an asserting step that
+    # asserts nothing, which is the exact shape this project keeps finding in
+    # other people's work and had now shipped in mine. The band failures were
+    # being printed and discarded.
+    if fail:
+        print(f"\n🔴 {fail} band control failure(s)")
+        return 1
+    return 0
+
+
+sys.exit(main())

tools/port/which-focus

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Which button is focused in a screenshot of the real game?
+#
+#   tools/port/which-focus SHOT.png              # main_menu (5 buttons)
+#   tools/port/which-focus SHOT.png extras       # extras (3 buttons)
+#
+# Renders the port's own screen with each button focused in turn and reports
+# which one differs least from the shot. Answers a question the Decoder needs to
+# drive the game -- `newgame_path.sh` assumed NEW GAME is focused at boot, drove
+# on that, and landed in a tutorial mission, because HANDOFF Q5 measured focus as
+# UNSTABLE across boots. Counting presses cannot substitute: up from the first
+# item wraps to the last, so no fixed number of presses lands on a known item
+# from an unknown start.
+#
+# ⚠️ IT RUNS ITS OWN CONTROL FIRST AND REFUSES TO ANSWER IF THE CONTROL FAILS.
+# `docs/re/captures/title-builds/live-main-menu-options-focused.png` has the
+# answer in its filename, so the method can be tested on every invocation rather
+# than once when it was written. A brightness-per-row detector was tried for this
+# job and picked NEW GAME on that capture; this method picks OPTIONS by 4.7x.
+# A control that does not execute is not a control.
+#
+# 🔴 IT NEEDS GODOT AND THE PORT'S EXPORT TREE, so it does NOT run in the RE
+# container -- no engine there, and rendering this project is outside that
+# agent's role. It reads a capture, but it answers by RENDERING the candidates.
+# `tools/re-capture/focus_from_capture.py` is the capture-only alternative; note
+# that its offline controls are its own calibration inputs, which is
+# self-consistency rather than validation, so it is the live transition test
+# (NEW GAME -> down -> LOAD GAME, expected LOAD GAME) that validates it.
+#
+# WHAT IT IS NOT. It identifies the focus in ONE FRAME. It says nothing about
+# what selects focus -- Q5's four boots gave TUTORIAL, TUTORIAL, NEW GAME, NEW
+# GAME and that instability stands.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export DISPLAY="${DISPLAY:-:97}"
+shot="${1:?usage: which-focus SHOT.png [screen]}"
+screen="${2:-main_menu}"
+OUT="${OUT:-$(mktemp -d)}"; mkdir -p "$OUT"
+CAPS=docs/re/captures/title-builds
+
+# Buttons, in the order ui_down walks them.
+case "$screen" in
+  main_menu) BUTTONS=(ptbtn01:NEW_GAME ptbtn02:LOAD_GAME ptbtn03:TUTORIAL ptbtn04:OPTIONS ptbtn05:EXTRAS) ;;
+  extras)    BUTTONS=(ptbtn11:MISSION_SELECT ptbtn12:MOVIE_THEATER ptbtn13:THIRD) ;;
+  *) echo "which-focus: no button list for $screen" >&2; exit 2 ;;
+esac
+n=${#BUTTONS[@]}
+downs=$(python3 -c "print(','.join(['down']*($n-1)))")
+
+render_all() {  # render_all <tag>
+  godot --path port --resolution 1280x720 -- "--menu=$screen" "--script=$downs" \
+    "--shots=$OUT/$1" >"$OUT/$1.log" 2>&1 || true
+}
+# Normalise any input to the captures' 1279x675 top-left crop. A 1280x720 guest
+# frame and a 1279x675 screenshot are the same pixels; the difference is the
+# crop the screenshot tool applies, not a scale.
+norm() { convert "$1" -crop 1279x675+0+0 +repage "$2"; }
+
+score() {   # score <shot> ; prints "<idx> <label> <pixels>" per candidate
+  local s="$1" i=0 f
+  for f in "$OUT"/r_*.png; do
+    [ -f "$f" ] || continue
+    norm "$f" "$OUT/cand.png"
+    local d
+    d=$(convert "$OUT/cand.png" "$s" -compose difference -composite \
+        -colorspace Gray -threshold 25% -format "%[fx:mean*w*h]" info:)
+    echo "$i ${BUTTONS[$i]#*:} $d"
+    i=$((i+1))
+  done
+}
+
+render_all r
+# Godot names the shots `<tag>_00_start.png`, `<tag>_01_down.png`, ... -- rename
+# to a sortable form so the candidate order is the ui_down order and not glob luck.
+i=0
+for f in "$OUT"/r_0*.png; do mv "$f" "$OUT/r_$(printf '%02d' $i).png"; i=$((i+1)); done
+[ "$i" = "$n" ] || { echo "which-focus: rendered $i of $n focus states -- see $OUT" >&2; exit 3; }
+
+verdict() {  # verdict <shot> <expected-or-empty>
+  local s="$1" expect="${2:-}"
+  norm "$s" "$OUT/shot.png"
+  mapfile -t rows < <(score "$OUT/shot.png" | sort -k3 -n)
+  local best_lbl best_px second_px
+  best_lbl=$(echo "${rows[0]}" | awk '{print $2}')
+  best_px=$(echo "${rows[0]}" | awk '{print $3}')
+  second_px=$(echo "${rows[1]}" | awk '{print $3}')
+  local margin
+  margin=$(python3 -c "print('%.1f' % ($second_px/max($best_px,1)))")
+  for r in "${rows[@]}"; do printf '    %-16s %8s\n' "$(echo "$r"|awk '{print $2}')" "$(echo "$r"|awk '{print $3}')"; done
+  echo "  -> $best_lbl, margin ${margin}x"
+  if [ -n "$expect" ]; then
+    if [ "$best_lbl" = "$expect" ]; then echo "  CONTROL PASSED (expected $expect)"; return 0
+    else echo "  🔴 CONTROL FAILED: expected $expect, got $best_lbl"; return 1; fi
+  fi
+  # A thin margin means the frame does not decide it. 2x is below the 4.7x the
+  # control achieves and well above 1.0; a shot that cannot beat it should be
+  # re-taken rather than guessed at.
+  python3 -c "import sys; sys.exit(0 if $margin >= 2.0 else 1)" || {
+    echo "  ⚠️ margin under 2x -- this frame does not decide it. Do not act on this."; return 1; }
+}
+
+if [ "$screen" = main_menu ]; then
+  echo "control -- $CAPS/live-main-menu-options-focused.png (answer is in the filename):"
+  verdict "$CAPS/live-main-menu-options-focused.png" OPTIONS || {
+    echo "refusing to report a result from a method that just failed its control." >&2; exit 1; }
+  echo
+fi
+# The exit code must carry the refusal. An earlier version printed "do not act on
+# this" and exited 0, so a caller scripting this -- which is the entire point,
+# the Decoder runs it between drive steps -- would have read a refusal as an
+# answer. That is the same defect as a checker claiming a check it skipped.
+echo "$shot:"
+rc=0
+verdict "$shot" || rc=$?
+echo "artifacts in $OUT"
+exit $rc