fabi/Sylpheed
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
70d3a54acbdccf3e1ab77471d941fe499f8feb21
Sylpheed/docs/port/DECISIONS.md
MechaCat02 c3758e3850 port: land the play-tested work, and only that 
Takes the port branch up to 77320d5e -- the state the human play-tested on
2026-09-02 -- for SOURCE paths only. Not a branch merge: `auto/port-p6-audio`
is 366 commits and 938 files, and most of that must not land.

WHAT COMES IN (76 files, all human-confirmed working):
  * the logo splash animation. 08ed3dd1 found it: `pose_at` ASSIGNED the settle
    instant instead of clamping to it, so the splash never animated at all --
    and the same bug manufactured a passing harness result, because the harness
    photographed t past the settle. Confirmed by play-test: "cannot notice any
    obvious difference from the actual game."
  * gamepad input -- (A)/(B) bound additively (`ui_accept` ships with NO joypad
    binding), stick latched with hysteresis at the game's own 61% digitise
    threshold. This is what made (A), video-skip and Extras work at all.
  * menu navigation and flow, menu audio, the exporter, the authored
    declarations, and 23 verification tools under tools/port/.

WHAT IS DELIBERATELY LEFT ON THE BRANCH:
  * everything after c0ae460a -- the F5/F6 title-timing investigation, whose own
    tip commit calls itself a "hand-off for one-minute human checks". Unchecked
    by definition; it goes through the new review gate like anything else.
  * the OPTIONS menu work of 2026-09-03. Real, probably good, NOT play-tested.
  * the F1 repeat mechanism, which its own commit calls "deliberately inert".

WHAT MUST NOT LAND, AND WHY THE .gitignore CHANGED:
  545 MB of extracted game content was committed on that branch -- 850 sprite,
  audio and transcoded video files under `export-probe/` and `export-probe2/`,
  plus 246 MB of loose .wav and .tsv at the repo root. This repository's own
  rule, in this file, is "never game content".

  The rule was not missing. It was written, and it was tightened on that very
  branch, with a careful comment explaining why BOTH `export/` and `data/base/`
  had to be listed -- while the exporter was writing to a third name that
  nobody had thought to list. Enumerating names is the thing that failed. So
  the ignore rules now describe the SHAPE: any top-level `export*/`, game media
  by extension, and loose capture output at the root. Verified both ways -- it
  catches all four offenders and ignores nothing currently tracked.

Verified: `cargo check --workspace` clean; all nine GDScript files parse in
project context, with a positive control (an injected syntax error is detected,
3 lines) so the clean result means something. `tools/port/check-all` was NOT
run -- it needs the container, the export tree and a display.
2026-09-04 16:17:14 +02:00

900 KiB
Raw Blame History

Decisions

One entry per decision that outlives the container it was made in. Newest last. A decision that lives only in an agent's context is lost when that container dies, which is what this file is for.

339 sections. Search this before re-deriving anything.

P0 — the exporter, 2026-08-28

The exporter reads one authored file, and stamps its provenance into the output

export/ is derived and authored/ is hand-written, and the natural reading of that is that the exporter never touches authored/. But a screen has to be called something, and the disc does not name its builds — the identification of build 5 as the main menu is HANDOFF Q2, measured against a live capture, not a field.

Two ways to handle that:

  1. the exporter emits build_05.json and the runtime renames it from authored/screen_names.json;
  2. the exporter reads that map and writes main_menu.json directly.

Chose 2, with a condition: every name it applies carries name_source: "authored" and a name_why quoting the evidence, and check rejects an authored name with no why. The file that lands in export/ is therefore still honest about which of its fields is a measurement — which is the property the derived/authored split exists to protect — while a human opening the tree sees main_menu.json rather than having to resolve a rename in their head. A build nobody has identified exports as build_NN with name_source: "index", which is a locator and not a claim.

This is the only authored input the exporter takes. Everything else in authored/ is applied by the runtime over export/.

Sprites are per screen, not a flat pool

main_menu and extras both ship a ptbase.t32 and they are different pictures. A flat sprites/ directory would have silently collided; whichever screen exported second would have won, and the loser would have drawn the wrong background with no error anywhere. sprites/<subdir>/<screen>/<name>.png.

The format is executable

sylpheed-export check --out export validates a tree against docs/port/FORMAT.md with no disc in hand. It exists because "the export is correct" is otherwise an assertion, and because the P0 gate is "validates against FORMAT.md" — which is not a thing anyone can confirm by reading.

It reads the tree the way Godot will: as a stranger, with no access to the disc, the decoders, or the exporter's internals. It deliberately does not check the export against the disc — that is what sylpheed-cli screen render is for, at P1.

Checked that it bites, rather than assuming: five mutations of a valid main_menu.json — a broken paint_order permutation, a dangling focus_sprite, a reversed buttons list, a #rrggbbaa colour, an invented name_source — are each caught with a specific message.

The highlight sprite pairs by name; opt is exported but not believed

FORMAT v1 said focus_sprite came from the element's opt link. That reading was measured and refuted by the RE agent, and this export shows why plainly: on the main menu, opt chains ptloop01 → ptloop02 → ptbtn01 — two decorations and then a button. It is a linked list of something, and it is not focus.

The highlight is paired by sprite name instead (ptbtn01.t32 ↔ ptbtn01f.t32), which is HANDOFF's convention and holds for all 54 real pairs on the disc. It resolves all five main-menu buttons. The raw link is still exported as opt_link, renamed so that nothing downstream mistakes it for navigation, and so that whoever eventually decodes it has the data.

Note this is 🟡 a naming convention, not a decoded field. It is authored in effect, and lives in the exporter only because it is a rule over disc data rather than a value we chose.

The paint order is exported, not authored

Q3 decoded it — a u16 layer key at +0x0A of each T8aD sprite header, stable-sorted with declaration index. So it is read in the exporter, per the contract's own rule for a decoded answer, and paint_order in export/ is a derived field. "paint_order" is gone from unresolved; paint_order_ties replaces it, because the tie-break is still unknown and costs one element's blend on one screen.

Where an element has no T8aD header the key comes from the decoders' table of keys measured off the running game. That is a different kind of fact, so it is labelled: layer_source is "sprite", "implied" or "none", and a consumer that needs to know whether a layer is read or measured can tell.

Colours are exported as two fields with the byte order in the name

There are two modulate colours and they multiply: tint is RGBA, fade is ARGB and its high byte is the alpha that ramps. v1's single "#ffffffff" could not carry both and silently discarded the ramping alpha. They are exported as tint_rgba and fade_argb, raw hex, byte order in the key — because getting it backwards is silent and looks like an art bug rather than a parse bug.

t stays raw

HANDOFF Q1 is answered — linear ramp, 2 units per rendered frame, working conversion 1 unit = 1/60 s — but that conversion is measured off the running game, not read from the file, and the finding itself flags the 27.6 present- frames/second measurement as the part worth re-testing. If the game turns out to present at 60 Hz, every duration halves.

So t is exported exactly as the disc spells it, keyframe_time_unit stays in unresolved, and the conversion will live in one authored place at P2. One constant to change, in a file that says it is a decision.

The final keyframe has no t, and check enforces that

The disc has no time slot on the last keyframe of a group. A file that carries one there has invented it. check rejects it — this is the one place where the temptation to emit a plausible number is strongest and the resulting error is completely invisible.

P1 — Godot draws the screen, 2026-08-28

The Godot side reads the manifest, not a path

ExportTree is the only class that knows where export/ is: SYLPHEED_EXPORT if set, otherwise <project>/../export. Screens are addressed by their manifest name (main_menu), never by a file path, so the runtime never encodes the archive's subdirectory and a re-export that moves a file does not break it. It also checks format on both the manifest and each screen, and refuses a tree it was not built to read rather than half-drawing one.

Textures are read as bytes and decoded with load_png_from_buffer at runtime. They are deliberately not Godot-imported resources: export/ is gitignored and regenerated wholesale, and a .import sidecar per sprite would be derived state living next to derived state, invalidated on every re-export.

One CanvasItem draws the whole screen

ScreenView._draw walks paint_order and draws each element itself, rather than making a node per element and leaning on z_index. The export's paint_order is already back-to-front, so honouring it is a loop; expressing the same order through sixteen nodes' z-indices would hide the one thing that is still unresolved about it — the ties — behind Godot's own sibling rules, where a change in the export would silently become a change in Godot's tree order instead of a visible change in the draw sequence.

P1 draws rest and nothing else

Every element is drawn at its resting pose. No keyframe interpolation: that is P2, and it depends on the keyframe time unit, which is measured rather than decoded. A milestone whose gate is a pixel diff must not have a measured constant inside it, or the diff stops being evidence about the port.

For the same reason focused_id is empty at P1. Initial focus was measured as unstable boot to boot (HANDOFF Q5), so choosing one is an authored decision and it belongs to P5, where a human is pressing keys.

Nearest-neighbour, and why that is not a preference

TEXTURE_FILTER_NEAREST. The export is a 1:1 copy of the disc's own texels and elements draw at up to 500 %; a bilinear filter invents detail the disc does not have. It is also what the reference renderer does — ui_layout::blit maps destination to source by integer division — so a filter difference cannot masquerade as a placement difference in the diff.

The capture is the SubViewport, not the window

The screen is drawn into a SubViewport sized to the export's own design rectangle and shown through a container that scales it to the window. The first attempt captured get_viewport() and got 1235×695: there is a window manager on the Xvfb display and its title bar had eaten 45×25 px of a screen the export declares as 1280×720. A gate that compares a rescaled 1235×695 capture against a 1280×720 composite measures the compositor.

So --capture grabs the SubViewport texture: exactly the design rectangle, independent of the window, directly comparable with screen render with no crop and no resample. The windowed run is still worth doing — it is what proves a human sees the screen — but it is not what the numbers come from.

P1 gate — the diff, and what it found

tools/port/verify-screen renders every screen in the manifest both ways and reports the largest per-channel difference anywhere in the frame. Both renderers are held to the same inputs: the reference CLI built by build-reference-cli from the revision the exporter is pinned to (not /reborn/target/, which is a live mount that moves mid-iteration), --black because the screen carries its own background, and --primitives --animated because those are what make the CLI draw the same element set the port draws at rest.

screen build max per-channel Δ
main_menu 5 3 the P0/P1 gate screen
main_menu_jp 8 3
extras / extras_jp 6 / 9 4 / 3
press_start / press_start_jp 2 / 3 1
build_00 / build_01 0 / 1 3
build_10 / build_11 10 / 11 0 byte-identical
title 4 6 paint-order tie, below
title_jp 7 154 sampling phase, below

main_menu — the milestone's own gate — agrees to ≤3/255 on every channel of every pixel, RMSE 0.38 %, with no pixel differing by more than 4 %. 3/255 is what integer-truncating compositing in the CLI and float rounding on a GPU differ by; there is no structural disagreement anywhere in the frame.

Three screens exceed that, and each has a named cause rather than a threshold.

title: a tie in the paint order — neither renderer is wrong

Build 4 is the one screen where the CLI uses a paint order measured off the running game instead of deriving it. Compared against the order this port exports, every single disagreement is inside a tie — the two orders differ only among elements carrying identical layer keys (0x8083, the back2 glow group, and 0x80a0):

derived : … 15, 16, 17, 18, 0, 1, 2, 3, 4, 5, 7, …
measured: … 15, 18, 16, 17, 0, 2, 4, 7, 1, 3, 5, …

That is exactly the residual HANDOFF Q3 documents and this export already declares in unresolved: ["paint_order_ties"]. It is worth stating what it costs: 904 px in the glow band at (445,117)–(1195,313), all of them 4–6/255. The port keeps the stable sort, per HANDOFF's own recommendation. Nothing to fix, and nothing to tune — a "fix" here would be fitting the port to one screen's capture.

Two of the reordered indices (0x80a0) are kind & 0x4 template instances that both renderers skip, so the only real reorder outside the glow group is ptlogo2 against ptlogo_tm, which do not overlap.

title_jp: nearest-neighbour sampling phase — the CLI is the one I would call wrong

title_jp is the only screen in the export with a drawn element at a scale that is not a whole multiple of 100 %: ptlogo_eff2 at 125 %. It is also the only screen with a difference above 6/255. The two facts are the same fact.

At a non-integer ratio the two renderers pick different source texels:

  • ui_layout::blit samples the source at the destination pixel's top-left corner — sxi = col * sw / dw.
  • A GPU samples at the destination pixel's centre — floor((col+0.5)·sw/dw).

At 125 % those disagree on one column in five, which is why the differing pixels are ~30 above 100/255 strung along thin diagonal edges rather than a shifted region. At every whole multiple of 100 % they agree exactly, which is why the other eleven screens are clean.

Which is wrong: the CLI, I think. Corner-sampled nearest is a half- destination-pixel bias toward the top-left that no rasteriser produces, and the Xenon GPU that drew this screen sampled at pixel centres. But I have no framebuffer capture of title_jp and the disagreement is sub-pixel on one glow, so this is a reading, not a measurement — recorded in docs/port/BLOCKED.md rather than acted on. The port is not changing to match, because matching the CLI here would mean deliberately reproducing a half-pixel offset in order to make a number smaller.

extras: two pixels

Two pixels at 4/255. Rounding.

What the diff cannot tell us

The pivot question in docs/port/BLOCKED.md predicted that a P1 diff could not distinguish "anchor scale to the declared pivot" from "anchor to half the texture", because both renderers use the declared pivot. That prediction held: the port and the CLI agree on every scaled element, and that agreement is not evidence about which anchor the game uses. It stays open.

pteff05.t32 and pteff04.t32 have no sprite, and that is correct

RETRACTED 2026-08-29. This was wrong, and it was the most consequential thing on this page. See "The menu had no background" below.

P2 — keyframe animation, 2026-08-28

The time unit is authored, in one file, and says loudly that it is not on the disc

authored/timing.json. HANDOFF Q1 is answered — linear ramp, 2 units per rendered frame, 1 unit = 1/60 s — but that conversion is measured off the running game, not read from a file, which is exactly the case the derived/authored split exists for. It is expressed as keyframe_units_per_second: 60 rather than seconds-per-unit so the value is exact instead of a repeating decimal, and it carries the two independent lines that support it. t stays raw everywhere in export/; seconds appear only where this file is applied, which is one line of boot.gd.

exit_ramp_seconds is deliberately null. See below.

The timeline stops at the last timed keyframe, and never plays the exit

The last keyframe of every group carries no t — the disc has no time slot there. Across this export that final frame is an exit pose: for 116 of 134 elements it differs from the last timed keyframe in alpha only (a fade-out), for 12 it is the loading splash's scale-and-slide exit, and for 6 it is identical (no exit animation at all).

So the group is pre-roll → ramp in → hold → [exit], and the port plays it up to the hold and stops. Playing into the exit would mean inventing how long the ramp takes, because the disc does not say. That duration is the screen transition — HANDOFF Q7 measured it at ~0.4 s — and it belongs to P3, with its own evidence. This is why exit_ramp_seconds is null rather than 0.4: P2 has no business holding it.

The interpolation is checked by where it lands, not by inspection

For 8 of the 12 screens the settled timeline is byte-identical to the --pose=rest render. That is the useful assertion: the port walks the keyframes with an authored time unit and arrives, to the pixel, at the pose the pinned decoders independently identify as the resting one. tools/screen-strip reports this per screen, so a change to the interpolation that drifts by one unit shows up as a diff rather than as nothing.

The four that differ do so for two distinct reasons, below.

rest misidentifies six elements, and the running game says so

On main_menu, the settled timeline and rest differ in exactly one region: 400×470 at (440,108) — the bounding box of ptframe1 and ptframe2, and nothing else on the screen.

rest puts both at their first keyframe: off-position and fully transparent. The keyframes say they slide (620,108)→(440,108) and (403,267)→ (583,267) while fading 0x00→0xff, and then hold that pose for their last three keyframes including the untimed one.

docs/re/captures/main-menu-oracle.png, a capture of the running game, shows them: the bright circuit-frame bracket around the menu, with a ring at the bottom right. Cropping the same 250×180 region from the capture and from both renders puts the ring and its elbow trace in the port's timeline render pixel-aligned with the game's, and absent from the rest render. That is geometry, not luminance, so it does not depend on the capture's gamma or on the fact that it was taken with NEW GAME focused.

Why the decoders get it wrong, precisely

ui_layout::rest_plateau excludes a run of identical keyframes that ends the group, because that run is normally the exit — the comment cites the pause menu, where taking the trailing run erased the word PAUSE. That exclusion is right in general and wrong for an element with no exit animation, where the trailing run is the hold. The rule then falls back to an earlier run, which for a slide-in is the invisible pre-roll.

The condition that identifies the affected elements exactly, with no false positives in this export, is:

the final untimed keyframe has the same pose as the last timed keyframe

Six elements match it and rest misses all six: ptframe1/ptframe2 on main_menu and main_menu_jp, and pteff02 on title and title_jp. This is a finding for the RE agent about sylpheed-formats, not something this port fixes: the decoders are pinned and must not be reimplemented here. The port simply does not use rest — it derives the arrived pose from the keyframes, which needs no heuristic — and verify-screen still asks for --pose=rest so that renderer-vs-renderer diffing compares like with like.

Note what this says about P1: the port and the reference renderer agreed on main_menu to 3/255, and both were missing two elements the game draws. Two renderers reading the same field through the same decoder agreeing is not evidence that the field is right. docs/port/BLOCKED.md had already said that about the pivot; here it bit for real.

The title is not settled, and P2 does not claim it

title and title_jp differ between the two modes by much more (max 142 and 247), and there the disagreement is not the six-element bug alone. rest picks a mid-timeline hold for several glows (pteff01, ptlogoall_eff, ptlogoall_eff2, ptlogo_back2eff5) where the timeline runs on to a much brighter pose.

I could not settle which is right, and did not try to make the numbers agree:

  • No element's alpha ever reverses direction anywhere in this export, so the title's 4.48 s timeline is a slow one-way ramp, not a pulse — which removes the obvious reason to expect a loop, but does not prove there is none.
  • The only live title capture composites the PRESS Ⓐ plate (build 2) over the title (build 4), so it cannot be diffed against build 4 alone. Mean luminance is oracle 64.1, rest 62.8, timeline 80.0 — which looks like it favours rest, except that the plate adds brightness and rest is carrying a 25 % black dim quad (pteff02) that is itself one of the six misidentified elements. The comparison is confounded in both directions and settles nothing.
  • Both modes are visibly wrong anyway. Side by side with the capture, the port draws a washed-out cyan glow slab across the logo that the running game does not have — in rest mode too. That is a third problem, independent of this one, and it is P3's.

So: the timeline is the default because it is derived from the disc's own keyframes with one measured constant and no heuristic, and because it is proven right on the screen this milestone gates. On the title it is unverified, and P3 should not assume P2 settled it.

P2, corrected — the pin moved, and the settle rule was wrong, 2026-08-28

Answering the RE agent's question: which six, and on what screens

They asked, having found only two elements on the English main menu satisfying the condition this port proposed. The six span the whole 12-screen export:

element screens trailing run
ptframe1, ptframe2 main_menu, main_menu_jp alpha 0xff — visible
pteff02 title, title_jp alpha 0x00 — transparent

So four of the six are the pair they already found, once per language build, and their alpha rule accepts exactly those. The other two are pteff02, whose trailing run is transparent, so their rule excludes it and leaves rest at 0x40.

That exclusion is right, and their own measurement proves it. pteff02 is the 25 % dim quad; they measured the title render going from +13.14 to +0.55 against the plate-free capture once the dim is drawn. rest must therefore stay at 0x40 and must not move to the transparent trailing run — which is what their rule does. Two investigations converging from opposite directions.

The condition this port proposed was too loose; the alpha discriminator is the correct rule and the port has no amendment to offer.

The pin moved 8b6dbcf → 5414db3

Its own commit, and what I wanted from it is the fixed ui_layout::rest(). Pinned at 5414db3 rather than 4bc9706 where the fix was written, because 5414db3 is where it carries its disc-wide check — 30 of 13 991 elements move, 4 become visible, 0 become invisible.

The re-export is the evidence the change was contained: two files changed, and within them exactly four rest blocks — ptframe1/ptframe2 on both main menus moving from (620,108)/(403,267) at t=16 and alpha 0x00 to (440,108)/(583,267) at t=62 and alpha 0xff. Every diff line pairs; the other ten screens are byte-identical, pteff02 did not move, and no sprite changed.

The settle rule was wrong, and their title finding is what showed it

P2 shipped "hold the last timed keyframe", on the reasoning that the exit is the final untimed frame. That is wrong, and the title is the counter-example: pteff02 holds at t=46 with the dim at alpha 0x40 and then ramps to 0x00 by t=236. The exit is not only the untimed frame — it can be a long run of timed ones. Running to the end drops the dim and makes the whole screen ~13/255 too bright, which is exactly the luminance excess P2 recorded (oracle 64.1, rest 62.8, timeline 80.0) and could not explain.

A group is pre-roll → ramp in → hold → ramp out → post-roll, and a screen that has arrived sits on the hold. So the timeline now plays in and stops at rest, which is the decoders' identification of that hold and carries its own t. settle_units() is rest.t.

The check is that the disagreement vanishes: on all twelve screens the settled timeline is now byte-identical to the --pose=rest render, where before this change four of them differed by up to 247/255. The timeline's endpoint should be rest — the animation is what the timeline adds, not a different destination — so this is the property to want, and it now holds without a special case.

That also retires P2's open question about looping, from the other side: the RE agent measured that groups hold rather than loop (ptloop01/ptloop02 park off-screen at x=1521 and x=−839; 18 s of settled title sits at sd ≤ 0.01).

The reference renderer was stale for three diff runs

Worth recording as a process failure, because it defeated the project's whole verification method for a while and it failed silently.

After bumping the pin I rebuilt the reference CLI, and build-reference-cli reported success at rev 5414db3. verify-screen then showed main_menu jumping from 3/255 to 72/255. The natural reading — the port had regressed — was wrong. The port was right and the reference was a revision behind: the shared CARGO_TARGET_DIR still held a sylpheed-cli built from 8b6dbcf, and cargo reported Finished in 0.13s and left it in place. Building into a clean target directory produced a binary that resolves ptframe1 to (440,108) t=62; the shared one still said (620,108) t=16.

The old check — "does screen list run?" — cannot catch this, because a stale binary runs perfectly.

Two changes:

  • build-reference-cli builds into $CARGO_TARGET_DIR/reference-cli/$rev, a tree keyed by the pinned revision, so a new pin has no artifacts to reuse. A stable copy is placed alongside for consumers.
  • It then checks the binary against export/: both come from the same pin, so if the CLI resolves ptframe1's rest differently from what the exporter wrote, the two halves of the verification are not the same revision and it fails loudly. It compares the two rather than asserting a literal, so it stays true when the pin moves again.

docker/bin/ is baked into the image, so this takes effect on the next image build; until then the repo copy has to be invoked by path. The RE agent hit the same class of trap this session from the other side (./target/debug stale against a redirected CARGO_TARGET_DIR). It is worth naming the general shape: a build system reporting success is not evidence that the artifact you are about to trust is the code you pinned.

What this did not change

title (6/255), extras (4/255) and title_jp (154/255) are unchanged, and their diagnoses stand — a paint-order tie, two pixels, and nearest-neighbour sampling phase at 125 % scale. The title's swoosh defect the RE agent localised (drawn thick and white where the game draws it thin and pink) is untouched by any of this and remains P3's.

The menu had no background, and P1 called that correct, 2026-08-29

The pin moved 5414db3 → f817dd5 for 56cc7ac, "a RATC child's name is stated, not inferred". ratc::parse had named each child by scanning backwards for the last printable run of bytes before its magic. For pteff05.t32 the three trailing payload bytes are 38 41 58 — 8AX — which beat the real name, so the child registered under a name no element declares and resolved to no sprite.

pteff05.t32 is the full-resolution background of all five menu screens.

So every render this port has produced of a menu screen has been missing its background, and P1 wrote that up as a property of the disc: "the bundle declares them and carries zero RATC children for either, so there is no texture on the disc to export." That sentence was false. The bundle carries the child; the decoder was handing back the wrong name for it. Retracted above rather than edited away.

What the re-export shows

Six new sprites and nothing else: pteff05.png on main_menu, extras and their Japanese twins, pteff04.png on both titles. Per screen the JSON gains a sprite line and layer_source moves "implied" → "sprite" — the layer key is now read from the file instead of taken from the decoders' table of keys measured off the running game. That is the derived/authored ratchet turning the right way, in the exporter rather than in authored/.

pteff05.png is 1280×720; ptbase.png, which had been carrying the background alone, is 640×360 drawn at 200 %. The screen was being shown its own art at half resolution.

Measured against the live capture, not against the other renderer

Whole-frame RMSE of the settled main_menu against captures/main-menu-oracle.png:

RMSE
before this pin 8.05 %
with the real background 5.92 %

A 26 % reduction, and it is the right kind of evidence: the reference renderer was missing the same element for the same reason, so a renderer-vs-renderer diff could not have found this. It is the third time on this project that the capture caught something both renderers agreed on — the bracket, the title dim quad, and now the background.

verify-screen after the bump is unchanged in character: everything at 3–4/255 except title (6, the paint-order tie) and title_jp (155, the sampling phase). Both renderers gained the background together.

One thing the comparison says that I did not expect

Rendering with --focus=ptbtn01, which is how the capture was taken, makes the RMSE worse — 5.92 % → 7.00 %. The port replaces an element's sprite with its *f twin; sylpheed-cli's own --focus is documented as drawing the focused record over the base element. Those are different operations, and the capture shows a ring marker beside NEW GAME that the port does not draw.

This is P5's, not P2's, and it is not being guessed at here. Raised in docs/port/BLOCKED.md.

P3 — splash → title, unattended, 2026-08-29

The splash is located by entry index, because no rule can find it

The RE agent looked for a content predicate and there is none: design size fails (every extra composable bundle sampled is 1280×720, the same as every screen) and element count fails (fragments run 2…15 elements in GP_OPTIONS/GP_SAVE_LOAD while the splash halves are 3 and 7 — the ranges overlap).

So screen_builds is now is_build plus an authored allow-list of entry indices, in authored/screen_names.json under also_export, each with a why that says it is a locator and not a claim. This is safe in GP_TITLE and would not be in general: there, widening adds exactly four bundles and all four are real screens with zero fragments. That is why it is an allow-list rather than a loosened predicate.

There were two splash screens and the port had neither. Entries 11/14 are the developer logos (GAME ARTS / SETA / studio anima); entries 10/13 are the SQUARE ENIX publisher wordmark, the first thing the boot shows, and nothing in this project had noticed them. Both pairs are region twins — ™ on 10, ® on 13 — and the port shows one of each, not both.

authored/screen_names.json is now keyed by pak entry, not by ordinal

Widening the enumeration renumbers the ordinals, and a name that moves when the enumeration rule changes is not a name. The file had always called the entry "the stronger locator"; it is now the only stable one. In GP_TITLE the two coincide across all 16 entries, which is also the numbering sylpheed-cli screen --build N --all takes — so verify-screen now passes --all, and without it --build 10 would have landed on entry 12.

The two previously-unnamed plates therefore renamed build_10/build_11 → build_12/build_15. Their names were always locators; now they locate the right thing.

The exit is the group playing itself out, not a black rect over a freeze

HANDOFF's answer to ask 2 was (a), and it came with a test that discriminates rather than a plausibility argument. Under "a black quad over a frozen screen" every region is scaled by the same 1−α, so the button-region / background-region brightness ratio stays constant through the fade. Measured, it falls 6.495 → 5.574 → 3.105 → 2.125 → 1.935 — a 3.4× monotonic drop. The screen plays out: pteff00.prm ramps to opaque black while the labels, ptmsg, pteff10 and pteff12 ramp to transparent, and ptframe1/ptframe2 hold.

Implemented by giving the final untimed keyframe a synthetic time, exit_ramp_units after the last timed one, and then interpolating it like any other. One code path: the difference between arriving and leaving is only how far t is allowed to run, not a second kind of animation.

exit_ramp_units = 24 (~0.4 s) is authored, and authored/timing.json carries the RE agent's own reach caveat rather than smoothing it: the filmstrip is downsampled and the button region contains some background, so this pins the direction, not 0.4 s to ±0.05 s, and it is one transition pair.

Nothing waits on a timer the disc does not carry

dwell in authored/flow.json is deliberately empty. Each screen's dwell is its own keyframe group — the publisher wordmark reaches its hold at t=235 (3.92 s), the developer logos at t=190 (3.17 s), both read from the disc. Adding a hold on top would be inventing a number nobody measured. The pacing you see is the disc's own, and the file says where a measured number would go.

The last screen holds

A screen plays itself out because something is taking its place. Nothing takes the title's place yet, so the sequencer holds there. A boot that ends by fading to black is a boot that looks like it crashed. P4 puts the intro video in front of the title and P5 gives the title somewhere to go.

flow.json reproduces an observation and says so

Q6 closed with a negative: the order is in none of the four places it could have been, and a transition is a call with a name argument chosen by code. So this file is authored and its header says plainly that it reproduces what was watched, not what any file states. The intro video's place in the real boot is named as a gap rather than the order being quietly rewritten to hide it.

P3 gate

godot --path port -- --boot --film=/tmp/boot runs unattended:

publisher_logo  →  developer_logos at 4.65 s  →  title at 8.57 s
boot sequence complete after 13.05 s, holding on title

The filmstrip shows each screen fading in, holding, and fading through black into the next, and the title staying up. verify-screen covers all 16 screens now; the four new splash bundles come in at max 1–2/255 against the reference renderer. The three known differences are unchanged: title 6 (paint-order tie), main_menu 4, title_jp 155 (sampling phase at 125 % scale).

Answers taken from the RE agent without re-deriving them

  • Focus stays "replace". Over-vs-instead is unobservable: the focused sprite covers the base at 100 % of base-visible pixels, and the two compositions differ by RMSE 1.1 inside the button rect — under the gamma floor. The port's guess was right for the wrong reason, and the actual gap is that ptbtn0Nf.rat declares two sprites — ptbtneff01.t32, a glowing ring, and then the bright label — where ptbtn0N.rat declares one. The ring is P5's, and its placement inside the record is not decoded, so it will be authored from the capture and marked as such.
  • RMSE against captures has a floor, so stop chasing it. The capture is ≈ 255·(render/255)^γ with γ ≈ 1.49 on the menu and EXTRAS, 1.34 on the title, and it is a ramp the game installed (VdGetCurrentDisplayGamma at video init), not a capture-path artefact to subtract. Its reach is narrow — the flat patches it was fitted on are almost all dark — so the port will not extrapolate it across the range, and will not apply it to rendered output on this evidence. It is a comparison constant, not a rendering one.
  • Rotation is escalated to a human and the port has not acted. The RE half is answered — rotate about the declared pivot, measured against the GPU capture — and it has zero effect on the five screens at rest. The port will carry rotation_deg in a future FORMAT v3 because carrying a decoded field the renderer ignores beats dropping it, but it will not draw it until the divergence question is settled.

P4 — the intro video, 2026-08-29

Theora at 720p is fine here, and no runtime dependency is requested

MISSION §6 anticipated that Theora might be too poor at 720p and permitted the FFmpeg-GDExtension fallback to be proposed. It is not needed, and this was measured rather than judged by eye alone. SSIM against the decoded source over a 10 s sample: 0.9863 at -q:v 6, 0.9896 at 8, 0.9924 at 10. At 200 % zoom on the reel's hardest case — fine serif text and soft gradients over near-black, where Theora breaks first — q8 is indistinguishable from the source.

-q:v 8, and no GDExtension is being proposed or adopted.

-ac 2 because the source is 6-channel WMA Pro and Godot's Theora path is not a surround one. That downmix is a decision, so it lives in the recorded command where a modder can see and change it rather than in prose.

The exact command is in the manifest, per MISSION §6

export/manifest.json gains a videos array, each entry carrying the verbatim ffmpeg line that produced it. A modder who dislikes the quality re-runs one line instead of reverse-engineering what was done to their video — which is the whole reason this project converts the disc rather than reading it at runtime.

A cache, and why that is not a hand-edit

export/ is regenerated wholesale, but re-encoding 232 s of video on every run costs ~4 minutes to produce a byte-identical file, and an exporter nobody re-runs is worse than a cache. So each movie gets a .cmd sidecar recording the command and the source size, and the encode is skipped only when both match exactly. Any change to either re-encodes. This is derived state validating derived state, not a hand-edit.

The player renders into the design viewport, not beside it

First attempt parented the VideoStreamPlayer to the Boot node. It played, and every captured frame was black: the capture reads the SubViewport, and the player was rendering to the window. Worth stating as more than a capture bug — everything this port draws composes in the export's own 1280×720 design space, and a movie outside that space is outside the coordinate system every screen is expressed in.

Ⓐ skips, because Q9 measured it

The only input the port handles so far. HANDOFF Q9: one Ⓐ press skips a movie, measured — the title was reached at 57 s against a 193 s baseline. Menu navigation is still P5.

P4 gate

godot --path port -- --boot --film=… runs publisher_logo → developer_logos → ADV.ogv → title, unattended. The filmstrip shows the SQUARE ENIX ident, then the reel's live-action-styled CG, then the title. The movie's place in the boot is measured, not decoded — Q9 decodes ADVERTISE_MOVIE → ADV.wmv from the movie manifest, but where it sits in the boot order is what the RE agent watched, and authored/flow.json says so.

What I cannot verify from here

Audible playback. This container has no audio device — Godot falls back to the dummy driver. What is verified is that the Vorbis stream exists in the transcode, is 2-channel, and decodes. Whether Godot emits it audibly is unconfirmed and is stated as unconfirmed rather than assumed from the stream's presence. It is a cheap check for anyone with a sound device and an impossible one here.

RETRACTION — sylpheed-cli is not the oracle, 2026-08-29

This corrects a framing that runs through everything above, so it is a retraction rather than an edit. Every place this file called sylpheed-cli screen render "the reference renderer" — and it does so repeatedly, starting at P1 — overstated what it is.

The correction comes from the human, via the RE agent, in their words: Reborn "was/is just a GUI explorer and extraction CLI for verifying the decoding of the various files. It may very well be wrong." The oracle is the Xenia Canary capture and the game.

So tools/port/verify-screen is a consistency check between two decoders that share their assumptions, and a regression detector. It is not a correctness check, and agreement in it is not evidence of correctness.

The embarrassing part is that this file already knew

After the ptframe1 case, P2's write-up says: "Two renderers reading one field through one decoder agreeing is not evidence that the field is right." Then P1's numbers kept being quoted as though 3/255 against sylpheed-cli meant the port was right. Having the principle written down did not stop me leaning on the agreement — which is worth recording, because that is the failure mode, not ignorance of the principle.

Three times both renderers agreed and both were wrong, all three caught by a capture and catchable by nothing else:

what both got wrong how it surfaced
pteff05 the menu screens had no background the RE agent decoded the RATC child name
scale 0 drawn at full size instead of collapsed RE agent's control run
rest() ptframe1/ptframe2 invisible; the menu bracket missing main-menu-oracle.png

What changes

  • tools/port/verify-screen says all of this in its own header, calls the CLI the comparison renderer, and a DIFFERS row now means "we moved apart, find out which of us moved" rather than "the port is wrong".
  • The correctness question moves to the captures. The RE agent has committed nine of them with an index at docs/re/captures/ORACLE-CAPTURES.md, covering all five screens in scope — including a main menu with OPTIONS focused, whose difference from the unfocused menu isolates exactly what focus changes.
  • Three cautions travel with any capture comparison, and they are the RE agent's: the captures are not gamma-neutral (γ ≈ 1.49 menu, 1.34 title — there is a floor, do not chase it); geometry is sound (best alignment 0,0 at corr 0.9466, so a positional disagreement is real); and each is one moment of a still-animating screen, so compare settled poses or regions known to be at rest.

What does not change

The port keeps running verify-screen over all 16 screens every iteration. A consistency check is still worth having — it is total, it is cheap, and it is what catches a divergence the RE agent introduces on their side. It is simply not a grade, and this file will stop quoting it as one.

P5 groundwork — the focus record, checked against a capture, 2026-08-29

P5 is the lowest unfinished milestone (P0–P4 are gated above). This iteration did not implement navigation; it did the measurement P5 needs first, because the one thing P5 is built on — how a focused button is drawn — had three claims attached to it and none of them had been checked from this side.

The exporter already emits the focus record's second element

HANDOFF ask 3 answers with a 🔴: "what you are actually missing is the focus record's SECOND element" — ptbtneff01.t32, a 42×46 glowing ring, declared before the bright label in ptbtn0Nf.rat.

That gap is in the renderer, not the exporter. export/screens/title/main_menu.json already carries both, in declaration order, under focus.elements, for all five buttons — ptbtneff01 then ptbtn0Nf, each with its own pivot, rest pose and keyframes. Nothing needs to change in crates/sylpheed-export for the ring. What is missing is that screen_view.gd draws only one sprite per focused button. Recording this so P5 does not re-open the exporter looking for it.

The ring's size checks out exactly: ptbtneff01.png is 42×46, as stated.

The (7,7) focus offset survives a refutation attempt, uniquely

Ask 3 states the focused sprite covers the base at 100.0 % of base-visible pixels "once aligned properly (the true offset is (7,7), and at the centre alignment it reads a misleading 78–84 %)". P5 builds directly on this, so it was worth attacking.

Re-ran the RE agent's own metric on the exported PNGs — over every pixel where the base sprite is visible, the fraction where the focus sprite's alpha ≥ the base's — scanning the whole offset space, not just the stated answer:

alignment ptbtn01 ptbtn02 ptbtn03 ptbtn04 ptbtn05
(7,7) 100.00 % 100.00 % 100.00 % 100.00 % 100.00 %
geometric centre 80.58 % 79.20 % 79.58 % 79.45 % 79.45 %
pivot-to-pivot 80.58 % 86.59 % 87.40 % 79.45 % 84.58 %

The refutation fails, and more strongly than the original claim. Over a 15×14 offset scan, (7,7) is a unique isolated cell at 100 % on every one of the five buttons — every neighbouring offset, including (6,6) and (7,6), falls below 90 %. The centre and pivot alignments reproduce the 78–84 % band the RE agent reported as misleading. A claim that survives a search of its whole parameter space is worth more than one checked at a single point, so this is recorded as strengthened, not merely unrefuted.

(7,7) is not a constant to apply — it is what the declared positions already say

An earlier version of this analysis had the port disagreeing with the capture by 6 px. That was my arithmetic error and it is worth writing down, because it is the mistake this format invites: I computed each element's top-left as pos - pivot, which gives base→focus deltas of (13,13) and a 29 % coverage — a confident wrong number.

pos is the top-left. screen_view.gd:121 is Rect2(pos - pivot*(s - 1), natural*s): the pivot is the anchor scale grows about and it cancels at 100 %, which is exactly the "can be got wrong invisibly" the comment there warns about. Getting it wrong invisibly is what happened.

With pos as the top-left, base − focus is (542,162) - (535,155) = (7,7) directly, on four of the five buttons. So P5 draws each focus element at its own declared pos and needs no offset constant at all. Nothing to author.

The one real find: ptbtn04 is 1 px off the grid on the disc

The focus records sit on a clean 80 px pitch — 155, 235, 315, 395, 475. The base records do not: 162, 242, 322, 401, 482, i.e. spacings 80, 80, 79, 81. So ptbtn04's declared base→focus delta is (7,6), while the art itself aligns at (7,7) — the coverage scan puts ptbtn04 at 100 % on (7,7) and below 90 % on (7,6), the same as every other button.

This is 1 px of authoring jitter on the disc, not a decode error, and it has one consequence worth stating: do not derive the focus placement from the base by a constant. Draw the focus record at its own declared pos. A port that "simplified" this to base + (7,7) would put ptbtn04's focus art 1 px off, and would look right on the other four.

Verified against a capture, not against our other renderer

Diffing two oracle frames isolates what focus changes without any instrument in the path: live-main-menu.png vs live-main-menu-options-focused.png differ in one tight cluster of 6 338 px at x 506..702, y 398..445. ptbtn04 is the OPTIONS button, and the union of its focus record under the pos-as-top-left reading — ring ptbtneff01 at (500,396) 42×46 plus label ptbtn04f at (535,395) 172×56 — is x 500..706, y 395..451. Those agree on all four edges to within a few px of near-transparent sprite border.

Under the pos - pivot reading the same record predicts x 433..604, y 367..422, which matches nothing in the capture — and no button matches that cluster. The capture, not our renderer, is what settles it.

An instrument that failed its own control, and was therefore discarded

To locate the buttons independently I wrote a masked normalised-cross-correlation template matcher and ran it as PROTOCOL requires — through a control first: match each base sprite against the plain capture, where the declared position is known and the answer must be a (0,0) delta.

It returned deltas of (13,5), (6,−19), (12,21), (−16,22), (6,8) at NCC 0.096–0.206 — noise, with three of five pinned to the ±22 search boundary. The control fails, so the instrument is dead rather than tuneable, and none of its output is used above. The button art is dark, low-contrast and further crushed by the capture's γ ≈ 1.49 ramp, which is the likely cause; a matcher for this corpus would have to work on gradients rather than luminance. Filed so the next iteration does not rebuild the same broken tool.

What P5 still needs, and has not got

  • Initial focus is not stable across boots (Q5: 2× TUTORIAL, 2× NEW GAME). That is a value to author, with a why naming Q5 — it is not written yet.
  • The ring's own animation is unread. ptbtneff01's two keyframes go rotation_deg 0 → 360 at t=120 with no second timed keyframe, i.e. a full turn. Whether it spins continuously while focused, or turns once and holds, is the group-loop question again — answered "groups hold" for build-in animations, but a 360° hold and a 0° hold are the same pose, so this group cannot be told apart by its rest pose. Not guessed; raised below.

P5 — navigation, 2026-08-29

The gate is "a human clicks through it", and the artifact is a walk that proves the wiring rather than the intent: up (which wraps 01→05), five down, Ⓐ into EXTRAS, down, Ⓑ back — landing on the main menu with focus restored to EXTRAS.

xvfb-run -a godot --path port -- --menu \
  --script=up,down,down,down,down,down,accept,down,cancel --shots=/tmp/p5

Ten PNGs, one per step, each taken after the screen it produced had settled. Contact sheet handed over as share id 1788002507-ef4468a0a33a.

The scripted walk goes through the input system, not around it

--script posts InputEventAction through Input.parse_input_event and lets it arrive at _unhandled_input exactly as a d-pad's press would. Calling MenuFlow.move()/accept()/cancel() directly would have been shorter and would have proved nothing: the thing most likely to be broken is the wiring between a press and the cursor, and a direct call is precisely the part that skips it. The same reasoning says the settle wait must be real — a shot taken before the screen stops moving photographs a fade and calls it a menu.

What is authored here, and what is derived

Split deliberately, because P5 is where the two are easiest to blur:

where why
the ORDER of the items derived — each screen file's buttons, filled by the exporter from the button-role elements sorted by resting Y it is on the disc
where an item goes authored — authored/flow.json HANDOFF Q4 measured the destinations; they are not in the file
which item opens focused authored Q5 measured that it is not stable boot to boot
what Ⓑ does authored Q5, measured — except on the main menu, see below
⬅➡ do nothing authored, written as an explicit no-op so that "the game ignores it" and "we never wired it" are different lines of code

Four of the five main-menu destinations are goto: null with a blocked note. That is not an unknown: DIFFICULTY, the save-slot list, the lesson list and the settings menu were all measured, and they live in archives this export does not carry. blocked and none are kept apart so a later reader does not "discover" a gap that was a milestone boundary.

EXTRAS is the only main-menu destination inside GP_TITLE, and therefore the only Ⓐ-into-a-submenu this gate can actually walk.

The one navigation rule with nothing behind it

Ⓑ on the main menu → title. HANDOFF Q5 states it, and flow.json marks it authored — likely but UNPROVEN, because the title also self-returns after ~8–10 s idle and a single unrecorded observation cannot separate the two. The port implements it anyway — a menu with no way out is worse than a menu with a plausible one — and says in the file that it did. Asked of the Decoder this iteration; see BLOCKED.md.

Independent corroboration that the main menu is different from its submenu: the main menu's footer advertises only Ⓐ : OK, while EXTRAS' footer advertises Ⓑ : Back. That is on the disc, in ptmsg.png vs ptmsg2.png, and it is visible in both the port's render and the captures.

A press during a fade is dropped

Authored, and not measured. Nobody has watched what the game does with a button pressed mid-transition. Dropping invents less than queueing does: it cannot manufacture a press the game might have discarded. flow.json says so under navigation.input_during_transition.

--headless cannot draw, and the port hung instead of saying so, 2026-08-29

docs/port/PORT-MISSION.md and the loop prompt both name godot-headless as how this project runs unattended. It does not work, and the way it failed was the worst available shape.

Measured, not assumed. Under --headless Godot's dummy renderer never emits RenderingServer.frame_post_draw. Every capture path in boot.gd awaits it — --capture since P1, --film since P3, --shots as of this milestone — so all three blocked forever. Isolated by the difference between two runs:

godot --headless --path port --quit                                  # prints, exits 0
godot --headless --path port -- --screen=… --capture=…               # no output at all, killed at 40 s

The second produces zero bytes of output before it is killed, because Godot's stdout is block-buffered and never flushes. So the observable behaviour of an unattended headless capture was: silence, forever. In a loop, a job that waits reads as a job still working — this is the failure mode that costs a whole iteration and leaves nothing behind to say what happened.

Two changes, and deliberately not one:

  • --capture, --film and --shots refuse at startup under --headless, naming the flag and printing the xvfb-run line that does work. Refusing early rather than at the first frame means the run does not die halfway through a filmstrip with some frames written.
  • --script no longer waits for a drawn frame when it is not going to photograph one. Navigation is checkable where nothing draws, and that is worth keeping: godot --headless --path port -- --menu --script=… now walks the menus and exits 0 in about four seconds, which is a cheap regression check that needs no X server at all.

The Xvfb path is unchanged and is what produced the P5 artifact.

Refutation — the focus ring IS drawn rotated, and it is not at 0° in either capture

Attempted against the Decoder's 7eeae30 ("re(ui): the focus ring SPINS, the game draws it, and the leaf owns the f record"), point 2: that in the OPTIONS-focused capture the ring's bright head sits in a different angular position from the sprite's own, caught mid-spin. It survives, and the evidence is stronger than what was claimed.

Chosen for refutation because it is exactly what PROTOCOL says to aim at: a claim the port is about to build on, resting on an estimator (a brightest-region centroid) whose own control the Decoder reported as ±19.8°.

The test, and why it needs no absolute registration

live-main-menu.png has ptbtn01 focused; live-main-menu-options-focused.png has ptbtn04 focused. Both draw the same sprite, ptbtneff01.png — the export confirms the two focus records name the same file. So the two captures contain two instances of one 42×46 image, 240 px apart in design space, and the question "is it drawn rotated" becomes "are these two crops the same image at a different angle" — which needs no crop offset and no reference to our own renderer.

Method: sample each ring into a 360-bin angular luminance profile over the annulus band (r = 9…15 px, bilinear, 0.5 px radial step) and circularly cross-correlate. A rotation about the centre shifts that vector and changes nothing else.

The instrument was run through two controls before it was believed

control result
rotate a capture's own ring by a known 0/30/90/150/210/270/330° and recover it 0° error on all seven, peak corr 1.000
the same estimator on a ring-free 60×64 patch of the same capture peak corr 0.369 — it does not manufacture a match

The measurement

On one shared centre for all three images, so a centroid difference cannot masquerade as a rotation:

pair best shift peak corr corr at 0°
capture A vs capture B 134° 0.968 −0.064
sprite (unrotated) vs capture A 76° 0.969 −0.295
sprite (unrotated) vs capture B 210° 0.948 −0.181

210 − 76 = 134: the three measurements are internally consistent, which nothing in the method forced them to be. Sweeping the centre by ±2 px moves the A-vs-B answer over 117…161° while the peak correlation stays 0.9+ across the middle of that range, so the magnitude is ~134° ± ~15° and the precision claim stops there.

Evidence sheet — sprite, capture A, capture B, each cropped at the declared 42×46+500+156 / +500+396 — handed over as share id 1788002507-afe1ad843789. The phase difference is obvious by eye; the numbers are here so it is not only obvious by eye.

The two things this settles for the port

  1. The game draws rotation_deg on an element the English boot path shows. This is a second, independent confirmation on a different screen and a different element from the ptloop sweeps, and it moves HANDOFF ask 4 (should the port draw rotation) off "changes nothing at rest" — it changes the main menu's focus marker, in every frame.

  2. 0° is not a pose the running game shows. screen_view.gd currently draws the ring at its rest pose, which is rotation_deg 0, and both captures put it at 76° and 210°. So the port's focus marker is known to be wrong, not suspected — and the comment in screen_view.gd now says which two numbers it is wrong against.

Registration, as a by-product

The ring's annulus centroid lands at (32.94, 36.63) and (33.30, 38.90) in windows whose design-space prediction under a zero crop offset is (33.0, 37.0). Within ~0.4 px on the better-thresholded of the two. That corroborates ORACLE-CAPTURES.md's "1279×675, top-left aligned" directly, on a feature nobody chose for the purpose.

⚠️ Do not read the earlier P5-groundwork note "button text bands land at design y + 23" as a crop offset — it is an offset within the button sprite, and the two were nearly confused here.

What the port did NOT do about it

It did not start spinning the ring. The period is a guess with two unknowns and both belong to the Decoder:

  • the keyframes are t=120, rot 0 then an untimed rot 360. Under HANDOFF Q1's replicated reading ("+36 is the time the NEXT pose is reached") that is one revolution in 120 units = 2.0 s — but this port's pose_at implements the other reading, and switching it is a change to every screen's animation timing, not a P5 change;
  • "groups hold" (settled 2026-08-28) predicts the ring stops at 360° = 0°. Both captures show it elsewhere. That is either a spin that loops, or two captures both taken inside the first two seconds of focus. The port cannot tell those apart, and a wrong answer here is a visible continuous rotation on whichever button the player is sitting on.

Filed in BLOCKED.md and asked over the message channel. What settles it is two frames of one focused button a known time apart.

P5 end to end — and the title does not say PRESS Ⓐ, 2026-08-29

The gate walk above starts on a screen. This is the whole thing, unattended, in one run — the sequence PORT-MISSION names as the objective:

xvfb-run -a godot --path port -- --boot --play \
  --script=accept,down,down,down,down,accept,cancel,cancel --shots=/tmp/e2e

screen publisher_logo …           settles at t=235 (3.917 s)
  -> developer_logos at 4.70 s
  -> video ADV at 8.60 s
     video ended at 151.91 s
  -> title at 151.91 s
boot sequence complete after 156.30 s, holding on title
  menu on title
script[1] accept   (A) -> main_menu
…
script[6] accept   (EXTRAS) -> extras
script[7] cancel   (B) -> main_menu   focus restored to ptbtn05
script[8] cancel   (B) -> title
script complete after 166.76 s on title

Publisher wordmark → developer logos → ADV → title → Ⓐ → main menu → navigate → Ⓐ → EXTRAS → Ⓑ (focus restored) → Ⓑ → title. Contact sheet shared.

Two smaller things this run found, both fixed here:

  • the boot step's why in authored/flow.json still said "nothing takes the title's place until P5 gives it somewhere to go". P5 has. Rewritten to say what is actually true — --boot still stops on the title, and --play hands the held title over; the stop is not a bug and the handover is not another boot step.
  • an empty focus printed as a line that trailed off, which reads like a value went missing rather than like there is none. The title is a screen with no buttons that still takes Ⓐ, so it prints (none -- this screen has no focusable item).

Also confirmed on the way: entering a submenu directly (--menu=extras) and pressing Ⓑ enters the parent at its authored initial focus, not at a restored one — there is no history to restore, and MenuFlow.cancel only claims a restored focus when the stack agrees about where it is going.

🔴 The port's title does not tell the player to press Ⓐ

Found by running the objective end to end, which is the only thing that would have found it: the boot's last step is title (build 4), and build 4 has no PRESS Ⓐ BUTTON plate. P5 has now made Ⓐ the only way off that screen.

This is not a guess about the art. Both states are captured off the running game and they differ by exactly that plate:

capture
title without the plate title-builds/live-title-build4-no-plate.png
title with the plate title-builds/live-title-press-a.png

And the plate is already exported — press_start, GP_TITLE build 2 (HANDOFF Q2), sitting in export/screens/title/ unused by anything.

This is P3's gate, not P5's, and P5 is what exposed it. Recording rather than fixing, for two reasons:

  1. Which state an idle post-boot title shows — build 4 alone, build 4 with the plate over it, or build 4 then the plate after a delay — is behavioural, and the port has no oracle for a sequence. The game demonstrably has both states; nothing here says which one follows the intro movie. That is the Decoder's.
  2. Showing it would mean drawing two builds at once, which this port has never done — every mode loads exactly one screen. That is a real change to ScreenView, not a line in flow.json, and it should not be smuggled in under a navigation milestone on the strength of "it looks more right".

Filed in BLOCKED.md. Not blocking: P5's gate is Ⓐ into a submenu and Ⓑ back, and both work.

P6 — menu audio, 2026-08-29

The disc's menu sound reaches Godot as Ogg Vorbis: three cues and one music bed. Nothing in port/ has heard of XMA, sound.pak or Static.slb, and nothing in it reassembles anything — sylpheed_formats::media does that and the exporter converts what it hands back.

The cue offsets moved OUT of the exporter, into authored/

The previous iteration left crates/sylpheed-export/src/audio.rs holding the three Static.slb offsets as a Rust const CUES. That is wrong under MISSION §3 and the fix is the first thing this iteration did.

Those offsets are measured, not decoded. Static.slb has no RIFF, no seek chunk and no container: it is a packed run of whole 2048-byte XMA1 packets, and a wave is defined only by (offset, packet_count). Both numbers came from the running game — Canary with --xma_param_probe=true prints a stream's packet count and first 32 bytes when it is played, and searching those bytes in the bank gives the offset (HANDOFF Q8).

A measured value compiled into the exporter is a measurement wearing the costume of a decoded field. It reads as though the exporter derived it from the disc; nobody deletes it when the real answer lands, because nobody can see that there is anything to delete. So the table is authored/audio.json se.*, each row carrying its own why, and the exporter holds no cue table at all.

crate::video::MOVIES stays a const in the exporter, and the contrast is the point: Q9 decoded that mapping off the movie manifest on the disc. Same shape, different provenance, different home.

name_match is a field, and its absence means something

Q8 names SE_UI_CURSOR for the move cue by name match against the authors' own identifiers — a plausible guess, not the measurement. For Ⓐ, Q8 is explicit that the wave was not separated between SE_UI_DECIDE and SE_UI_SUB_WIN_OPN, so no name is claimed at all.

name_match therefore travels beside every cue in authored/audio.json and in manifest.json, and an absent one means nobody claimed a name — never that the binding is unknown. The binding is the measured part. Collapsing the two would turn "we did not separate two candidates" into "we do not know what this sound is", which is a different and much weaker statement than the one the RE agent actually made.

The BGM is NOT a choice, and this port spent an iteration believing it was

The first draft of authored/audio.json picked BGM_001, wrote a careful why explaining that the choice was arbitrary, and was wrong.

docs/port/BLOCKED.md carried the row that caused it: "not on the disc … the port is choosing a track, and that choice is authored." The menu's music is BGM_103, and it is in HANDOFF at 9ca1eb5 — the exact commit that page says it was reconciled against. So this was not staleness. The row was wrong when it was written.

What HANDOFF says is a negative with a bound, and the bound is the entire content of it:

the tables cannot say — SOUNDS, FILES and the bank headers name no screen. GamePart_Title's phase handler sub_821C5580 carries li r5, 1103 into a sound call; cue 1103 is BGM_103; and BGM_103.slb's two declared waves (3 876 864 / 3 930 112 B) are byte-for-byte the two streams the XMA probe saw decoding at the main menu. Static code, disc census and runtime all agree. "The port does not have to choose a track."

The failure is worth naming precisely, because "read HANDOFF more carefully" is not the lesson — BLOCKED.md's own staleness check passed, twice, and would pass again. A negative summarised without its reach reads as a bigger negative than it is. "The tables cannot say" became "it is not on the disc", and one word of scope was the whole answer. A row in BLOCKED.md must quote the reach.

It also cost a second thing worth recording: the port would have shipped a menu playing the wrong music with a confident why beside it saying the choice was deliberate. That is exactly the shape of error this project's vocabulary exists to prevent, produced by the machinery meant to prevent it.

The bank name carries .slb, and that is how the mistake surfaced

BGM_001 is not in sound.pak. BGM_001.slb is — media::read_sound_bank looks up name_hash(name) against the TOC, and the TOC hashes the file name. Static.slb worked from the first run only because the RE finding happens to write it with its extension.

So the wrong track never played: the export failed loudly with "BGM_001: not present in sound.pak". That is luck, not design — had the draft picked a name that happened to resolve, nothing would have complained. The why in authored/audio.json now records both the correct name and why the short form fails.

export_bgm now distinguishes the two cases it was conflating. A bank that is not in this disc's sound.pak is a missing asset: the manifest takes a warning and everything else still exports. Any other failure — a short read, a malformed bank — still stops the run, because a partly-read bank produces a file that plays.

The two stems are summed. That part is not a choice

Q10 also measured that a bank's sub-waves are two stems of one performance, played together — sample-synchronous, equal duration, on all 32 banks. Concatenating them is explicitly wrong.

Emitting them as two files would be wrong for a second, independent reason: MODDING rule 1 is one logical asset, one file, and handing a modder two stems to line up by hand is precisely the reassembly the exporter exists to have already done. amix=normalize=0 sums at unity rather than halving, because halving is a mix decision nobody made — and because a sum can clip, the peak is measured and reported rather than silently corrected.

The loop seam is ugly on purpose

🔴 SUPERSEDED — see "the menu BGM loop window" below and authored/audio.json's loop_start_why. The loop point exists: it is a runtime field set by XMASetLoopData, and for BGM_103 it is [9.44 s, 71.31 s], cycling every 61.87 s, which the exporter has trimmed to since. This section is kept because it is what the port believed when it shipped the seam, and the reasoning below — that inventing a loop point is worse than an ugly one — is why the wait was cheap. Every claim in the paragraph that follows is dead.

No loop-point field has been identified [refuted]. loop: "restart" replays from sample 0, so a listener hears the track's own fade-out and its trailing silence before the music comes back.

Trimming to the fade would sound better and would be worse. It would invent a loop point, and an invented one is indistinguishable from a decoded one a month later — which is the failure mode this whole project is organised against. The seam stays audible until a loop point is measured or a capture of the real menu looping settles it.

When a cue fires — two rules measured, one authored

  • Move fires on a press that actually moves the cursor. MenuFlow.move() already returned whether it did, which is why left/right stay silent by construction rather than by a rule written twice (Q5: ⬅➡ do nothing, and Q8: they play nothing).
  • Ⓐ and Ⓑ fire when the press does something, and not when nothing is bound. 🟡 This half is authored and NOT measured — nobody has watched the game take a dead press. Silence invents less: a sound the game does not make is a wrong fact you can hear, while a missing one is a gap. blocked counts as doing something, because those destinations were measured off the running game and are missing from this export, not from the game.
  • The bed starts when the menu becomes live and carries across submenus. play_bed is idempotent, because music that restarts every time you press Ⓑ is the kind of wrong that reads as "the audio works".

--audio= records the Master bus, because neither container has a sound card

docs/port/AUDIO-VERIFICATION.md §2. An AudioEffectRecord on the Master bus captures the mixed output from inside a headless run with no device at all, and that is the only thing that closes the loop the file opens: comparing an exported Ogg against the disc proves the asset is right and says nothing about whether the engine ever reached it.

The run prints AudioServer.get_driver_name() beside the file it wrote, because "recorded under a dummy driver" is a weaker claim than "heard" and the write-up has to be able to say which one it is making.

The WAV is saved in _exit_tree rather than beside each quit(). There are eight of those, and the one that would get missed is an error path — exactly the run whose audio somebody wants to look at.

check now refuses silence and clipping

sylpheed-export check gained an audio pass, and two of its rules are content checks rather than schema checks. That is deliberate. Silence is the audio failure that looks like success — a file of the right duration, the right channel count and the right size, full of zeroes — and it passes every structural check there is. Clipping is the other one, and the BGM can produce it because it is a sum at unity gain. The exporter measures both at export time; check refuses a tree whose peak is ≤ −90 dBFS or ≥ 0 dBFS.

Neither is a judgement about whether the audio is the right audio. Nothing in that binary can know that, and BLOCKED.md says which parts are still authored guesses.

A bug worth naming: the temp name ate the file extension

run_ffmpeg wrote to .back.ogg.partial — the temp-name-then-rename discipline this project uses everywhere, and which AUDIO-VERIFICATION.md records as already having caused a confident wrong number once.

ffmpeg picks its muxer from the output filename, so that is not a slightly uglier temp name; it is a hard failure before a byte is written: "Unable to choose an output format for '.back.ogg.partial'". video.rs already had the right shape (.ADV.partial.ogv) and this function was written from scratch without looking at it. The extension goes last.

Refutation — the three Q8 cue durations, checked end to end

The claim: HANDOFF Q8 publishes three cue lengths — move 0.533 s (8 192 B, 4 packets), back 0.344 s (4 096 B, 2), confirm 1.016 s (12 288 B, 6). P6 is built directly on top of these, which by PROTOCOL's own rule makes them the right thing to attack: refutation is cheapest where the other agent is most confident, and most valuable where the port is about to build.

Why they looked attackable. The three do not share a rate. Seconds per packet is 0.133, 0.172 and 0.169 — the move cue is 22 % off the other two. If a packet were a fixed span of audio, at most one of these numbers could be right.

Why that is not a refutation. An XMA1 packet is 2 048 bytes of bitstream, not a fixed span: it carries a variable number of 512-sample frames. At 48 kHz a frame is 10.667 ms, and the three durations come to 50.0, 32.3 and 95.3 frames — near-integers, which is what a variable-frames-per-packet encoding looks like and is not what an arithmetic slip looks like.

The measurement. The exporter reads (offset, packet_count) through media::se_wave_riff, decodes, and ffprobes the finished Ogg:

cue Q8 claims exported file measures
move 0.533 s 0.533 s
back 0.344 s 0.344 s
confirm 1.016 s 1.016 s

Verdict: survives, exactly, at every published digit. Recorded as a survival rather than a pass, because that is what PROTOCOL asks for — a claim that has survived an attempt is stronger than one nobody challenged, and the corpus should say which it is.

⚠️ Reach, stated so nobody over-reads it. This is not independent of Q8: the durations were derived from the same packet counts the exporter feeds in, so what it confirms is that reading those (offset, packets) through sylpheed_formats::media yields streams of exactly the claimed length — i.e. that the transcription into authored/audio.json and the assembly path are right. It does not confirm that these three waves are the sounds the game plays on those three events; that is Q8's own measurement, taken by playing them, and this port has no oracle to re-take it with.

The attempt did find something, just not here: see the BGM section above, where the port's own BLOCKED.md row failed the same kind of check.

The BGM bank has three sub-waves and HANDOFF says it has two

media::sound_bank_riffs("BGM_103.slb") returns three. HANDOFF Q10's census says a music bank is "exactly two waves of identical duration (32/32 banks on the disc)" — and that census is itself a correction, of an earlier reading that called BGM_001 three sub-waves and was refuted with "the 10 KB is the bank header".

The third comes from sylpheed-formats/src/slb.rs:380, to_xma_riffs: when a bank has a leading headerless packet region ahead of its first RIFF, that region is emitted as a sub-wave. It exists because the voice path needs it — VOICE_D_453 decoded to 0.14 s without it. docs/re/REFUTED.md already records the same region as what makes BGM_106–BGM_109 "break the two-wave rule".

The port sums all three and says so in the manifest. That is not the appealing answer — dropping sub-wave 0 would give a file matching the census, and it would have been one line. It is the correct one: which bytes belong together is the question sylpheed_formats::media owns, MISSION §2 names re-deriving it here as the single easiest thing in this project to get subtly wrong, and "the decoder returned something the corpus does not predict" is a finding to report, not a number to quietly adjust. Adjusting it would also have destroyed the evidence: a corrected export looks exactly like a correct one.

So the export ships the decoders' answer, the manifest carries a warning naming the contradiction, BLOCKED.md has the row, and the Decoder has the pointer. Until it comes back, the menu plays a sum of three things where the census predicts two, and every one of those places says so.

Clipping — and a comment of mine that argued for the thing that clipped

The BGM came out at +1.8 dBFS. The comment above the code that produced it said amix=normalize=0 sums at unity "because halving is a mix decision nobody made".

That was wrong in both halves. Unity summing is a decision, and it is the one that clips. And 1/n is not a taste call: it is the smallest constant that makes an n-input sum of unity-scale signals provably clip-free, which is precisely the reasoning video.rs already carried for its 0.4142-normalised 5.1 downmix — in this same repository, written by this same port, and not looked at. It preserves the stems' relative balance exactly, which is the only thing about the sum that Q10 settles.

It is written as an explicit volume= rather than left to amix's normalize=1 default, so the coefficient appears in the manifest's command line. A default is a decision nobody made and it can move under an ffmpeg upgrade — the same argument MISSION §6 makes about the downmix matrix.

The confirm cue is a different case and is not "fixed". It lands at +0.18 dBFS, and it is a single wave off the disc with no arithmetic of ours in it: the disc masters it near full scale and a lossy decode of a near-full-scale signal overshoots by a fraction of a dB. Attenuating it would mean altering a game asset to make one of our own numbers smaller. So check bounds the two kinds differently — a bgm peak ≥ 0 dBFS is refused outright, because it is our sum; an se is refused only above +1.0 dBFS.

🟡 That +1.0 is a judgement and not a measurement, and it is the weakest number in P6. Nobody has measured the overshoot distribution across a corpus of cues. If a cue ever trips it, the right response is that measurement, not a looser bound.

P6 gate — the audio is in the mix, and a null control says which part

No container here has a sound card, so "P6 works" cannot be answered by listening. docs/port/AUDIO-VERIFICATION.md splits the question into three, and these are the two that need no device.

1. The exported files, measured off the finished assets

se    back      -> audio/se/back.ogg    (0.344 s, peak  -5.7 dBFS)
se    confirm   -> audio/se/confirm.ogg (1.016 s, peak  +0.2 dBFS)
se    move      -> audio/se/move.ogg    (0.533 s, peak  -1.4 dBFS)
bgm   main_menu -> audio/bgm/main_menu.ogg
                  (87.744 s, peak -7.7 dBFS, bank BGM_103.slb, 3 sub-waves)

sylpheed-export check export passes: 16 screens validate, and every audio entry carries a peak and a duration inside its bounds. The three cue durations match HANDOFF Q8 at every published digit — see the refutation record above.

2. The engine, recorded off the Master bus

godot --path port -- --menu --script=down,down,accept,cancel --audio=…/p6.wav
  → recorded 6.037 s of Master bus (driver Dummy)
    peak 0.0 dBFS, RMS −21.1 dBFS

Non-silent is not the claim. A WAV of the right duration full of the bed would look exactly like this, and the cues could be missing entirely. So the cue was isolated with a null control: the same scripted walk with ⬅ in place of ⬇. Left/right are measured no-ops (Q5) and fire nothing, so the two runs differ by exactly two move cues and nothing else — same screens, same transitions, the same Ⓐ and Ⓑ cues in both, the same bed.

RMS
walk with two ⬇ presses −21.9 dBFS
walk with two ⬅ presses (null) −22.1 dBFS
difference −34.6 dBFS

The difference is not spread over the run. It is one burst beginning at t = 1.10 s and lasting 0.55 s — two overlapping 0.533 s move cues — with 22 of 237 windows above −70 dBFS and silence everywhere else, including across the Ⓐ and Ⓑ presses, which cancel because both runs make them. That is the cue reaching the bus, separated from the music that was playing over it.

The control that proved nothing, kept because it nearly passed

The first attempt paired --script=down,down against --script=left,left. The difference was bit-identical zero, which reads as "the cues never reached the bus" and would have been reported as a bug.

It was neither. Both runs recorded 1.115 s while the first press lands at ~1.17 s: the control ended before the event it was controlling for. A null result from an instrument that was not running is not a null result — PROTOCOL's "run your own instrument through a control" applies to the control too.

What this does NOT establish

  • That it sounds right. Everything above is correspondence and separation, not judgement. A ten-second human listen still answers something no measurement here does.
  • That the bed is at a sane level against the cues. 🔴 The Master bus peaks at 0.0 dBFS in the four-step run — the confirm cue is +0.2 dBFS on its own, so any music under it puts the mix on the ceiling. Per-file levels are the disc's and are fine; the runtime mix has no headroom. The port has not set a bus balance, because nothing measures one and an invented balance is the same class of mistake as an invented loop point. Recorded here rather than fixed quietly.
  • That "Dummy driver" means heard. It does not, and the run prints the driver name so a write-up cannot forget to say so.

One bug, in two dialects, both about a temp filename

The temp-name-then-rename discipline this project uses everywhere broke twice in this milestone, in two different tools, for the same underlying reason: tools dispatch on the extension, so a temp name must preserve it.

  • run_ffmpeg wrote .back.ogg.partial → "Unable to choose an output format", a hard failure before a byte was written.
  • boot.gd wrote p6.wav.part → save_to_wav appends .wav when the path does not end in it, producing p6.wav.part.wav; the rename then failed to find its source, its return value was not checked, and the run printed a success line naming a file that did not exist.

The second is the more dangerous shape, and it is the one this project has already warned itself about: a confident line of output pointing at nothing. The rename's return is now checked and the failure is loud.

P3, reopened — the boot title was missing the PRESS Ⓐ plate, 2026-08-29

P3 passed its gate with a boot that ended on build 4 alone. BLOCKED.md carried that as 🔴 from the start: both states were captured, so the art was never the question — the sequence was, and it is behavioural, so the port had no oracle for it.

It is answered. docs/re/title-plate-delay-measured.md (auto/no-disc-and-menu-captures at fb536df, not on main at the time of writing) measures two independent boots: the title presents without the plate, and the plate arrives 2.13 s later, the two runs agreeing to 6 ms.

Two builds at once, as two ScreenViews

ScreenView draws one screen. The obvious change was to teach it about a subordinate overlay screen; the change made was to put a second ScreenView in the same SubViewport, after the first.

That is what "two builds at once" actually is. Each build has its own timeline, its own textures and its own hold — the plate's group runs independently of the title's, which is the entire content of the finding — and Node2D siblings already paint in tree order. The alternative would have put an if overlay in every method that walks elements, and would have expressed the same information less directly. The export's paint_order still means what it always meant: an ordering within a build.

The delay is timed from where build 4 stops animating

Not from where the title first appears. This is the finding rather than a detail: measured from first-draw the two oracle runs differ by 0.48 s, because the build-in itself ran 1.64 s and 2.13 s and the emulator's frame pacing during an animation is not the game's clock. Measured from settle they differ by 6 ms.

So _boot_done — the moment the sequencer already had for "this screen has reached its hold" — is the landmark, and the overlay is due after_settle_seconds later. A number taken from the wrong instant here looks exactly like a measurement.

The overlay is attached to the BOOT STEP, not to the title screen

What was measured is the boot title. Whether the plate is there when the title is reached again — by Ⓑ from the main menu, or after the attract movie — is not measured, and hanging the overlay on the screen would quietly claim that it is. So it lives on the boot step in authored/flow.json, and _drop_overlay takes it away with the screen it belongs to. BLOCKED.md carries the gap.

Refutation — the RE agent's instruction contradicts the RE agent's measurement

The claim under test, quoted from the finding's "What the port should author": draw build 4, "when build 4 has settled, wait 2.13 s, composite build 2 over it".

It does not reproduce the measurement it came from, and the gap is 3.97 s. Build 2 is not a static plate: it has a group, and this port plays groups. press_start has one element, ptbtn00, and its fade_argb reads

t=214  0x00ffffff   pos (383, 560)      invisible
t=236  0x00ffffff   pos (383, 550)      still invisible, having slid 10 px up
t=238  0xffffffff                       full alpha
t=244  0xffffffff                       holds
  —    0x00ffffff                       the exit, untimed

At the measured 60 units/s that is 3.967 s from the group's start to full alpha. Compose the instruction with the group and the plate is first visible at settle + 2.13 + 3.97 = settle + 6.10 s. What was measured — the glyph counter leaving its no-plate value of 154 — is the plate becoming visible at settle + 2.13 s.

Neither obvious reconciliation works:

reading plate visible at measured
both groups start together 3.97 s (build 4 settles at 4.350 s) — i.e. 0.38 s before settle settle + 2.13 s
build 2's group starts at settle settle + 3.97 s settle + 2.13 s
build 2's group starts at settle + 2.13 s (the instruction) settle + 6.10 s settle + 2.13 s

To land on the measurement, build 2's group has to start 2.51 s after build 4's, which is not a landmark of anything.

Verdict: the instruction is refuted as written; the measurement is untouched. The measurement is an observation of the running game and this port has no standing to doubt it. What is refuted is the step that turns it into an authoring rule, and that step is an interpretation.

So the port ships the instruction, not its own arithmetic, prints the discrepancy on every boot, and files the row. This is the same call as the BGM sub-waves and for the same reason: reconciling two of the RE agent's numbers is a decoding question, and a port that quietly picks the one that looks right destroys the evidence — a corrected boot looks exactly like a correct one.

The first thing to check is about the instrument rather than the game: is "title settled", the glyph counter first reading 154, the same instant as the port's last-element settle (t=261, 4.350 s into the group)? If that landmark is earlier, the gap closes with nothing else moving.

Refuting the port's own claim: things in this export DO pulse

BLOCKED.md has carried this since P2, under the port's own raised question about whether groups loop:

no element's alpha reverses direction anywhere in this export, so nothing pulses, which removes the obvious reason to expect a loop without disproving one.

ptbtn00 reverses. 0x00 → 0xff → 0x00, in the table above, in the export, the whole time. The claim was never checked against press_start; it was checked against the screens P2 happened to be animating. The RE agent has now measured the running game pulsing this exact element at a mean 2.24 s.

So the reason to expect a loop is back — and the port still does not draw one, because no reading of this group produces 2.24 s: the whole group is 268 units = 4.47 s, and from its first keyframe 54 units = 0.90 s. The plate is drawn arriving and then holding at its settle (t=238, alpha 0xff), which is what every other screen does and what the static oracle capture live-title-press-a.png shows. Which instant a repeat restarts from is filed, not guessed.

--boot --capture= — one frame instead of six hundred

The boot had no artifact of its own except --film, a PNG every 0.25 s for the whole 156 s run, to answer one question: is the plate on top of the title at the end. --capture was a --screen-only flag taken in _ready, which for a boot run is 150 s too early. It is now deferred to the end of the sequence when --boot is given.

P3 gate — the boot ends on two builds

godot --path port -- --boot --capture=…/p3-plate.png
  → boot sequence complete after 155.86 s, holding on title
    overlay press_start due at 157.99 s (+2.13 s after settle)
    overlay press_start raised at 158.00 s, 1 element(s), settles at t=238
    ⚠ plate raised at settle+2.13 s but its own group reaches full alpha 3.97 s
      later, so it is first VISIBLE at settle+6.10 s -- the measurement is
      settle+2.13 s.
    boot ends on title + press_start at 161.99 s
    drew 16: ptbase2, ptloop01, …, ptcopyright
    overlay press_start at t = 261.00 units, drew 1: ptbtn00

The PNG shows the title logo with PRESS Ⓐ BUTTON under it — build 4 and build 2 in one frame, which this port had never drawn.

Two things the run made obvious and that are now fixed:

  • The capture reported only the base build's elements. The first composited capture printed drew 16 and no mention of the plate, which reads as though the overlay had not drawn at all. The overlay gets its own line; folding its elements into the first list would have reported a screen that does not exist.
  • --screen=<a> --overlay=<b> raises the same composite immediately, by the same code path, with no delay. It exists because the only other way to see two builds was a 156 s boot of which 137 s is the intro movie — and under Xvfb's software Theora decode that is several minutes to answer "is the plate on top of the title". It applies no delay: the delay is a measurement and lives in authored/flow.json. The boot-mode narration is suppressed there, because a log line that describes a sequence it is not running is worse than no log line.

P5 — the focus ring spins, 2026-08-29

The ring was drawn at 0° and the file said so: "THIS IS KNOWN TO BE WRONG, and is drawn anyway because the right answer is a guess." What was missing was the period, and it is now measured — docs/re/focus-ring-spin-measured.md (auto/no-disc-and-menu-captures at 4fa3099): a continuous spin, from eight evenly spaced autocorrelation peaks over nine revolutions, with no angle estimated anywhere — both angle estimators failed their own controls and were not used.

The period comes off the disc; the RE agent supplied only that it repeats

ptbtneff01 declares two keyframes that differ in nothing but rotation_deg, 0 → 360, the first timed at t = 120 and the second untimed. The port turns once per 120 units. Nothing is authored: the number is on the disc, and what the measurement adds is that the turn repeats rather than stopping at 360 = 0, which "groups hold" could not distinguish because those are the same pose.

ScreenView.spin_period_units is the rule, and it is structural and narrow: exactly two keyframes, differing only in rotation, by a full 360, first timed and second untimed. Disc-wide check over this export: 16 of 212 elements match, and all 16 are focus rings — ptbtneff01 on the five main-menu buttons and ptbtneff02 on the three EXTRAS buttons, in both locales, every one declaring t = 120. Zero false positives.

That check is the point rather than a formality. The measurement was taken on one button of one screen; a rule that also caught something else would be extrapolating it to elements nobody watched.

⚠️ It is a rule about shape, not a decoded field. Nothing on the disc says "this loops". The day a loop flag is decoded, this goes.

Verified on the port's own render, with the RE agent's own control

Captures at --time= 2.0 … 4.0 s on the settled main menu, ptbtn01 focused:
t=2.0 vs t=4.0 (one full period apart), whole frame 0.0000 / 255 — bit-identical
t=2.5, 3.0, 3.5 against t=2.0, inside the ring's box 3.60, 3.71, 3.58 / 255
sum of box luminance across eight phases spread 0.027 % of the mean

The last row is deliberately the RE agent's own observable: they separated rotation from a brightness pulse by showing total annulus brightness is conserved while per-bin brightness moves. The port's render conserves it to 0.027 % (theirs was 0.4 % over 16 s, with capture noise in it). A filmstrip of the four quarter-period phases shows the bright head at top, right, bottom, left.

Two things it does not settle

  • Direction. The port turns 0° → +360°, the sign the disc declares. No signed angle was ever measured — the estimator that would have given one failed its control and was not used.
  • Phase across a focus change. The port drives the ring off the screen clock, so moving the cursor does not restart the turn. The alternative — the record's group restarting when the record is instantiated — is the stronger claim, and the oracle run held focus on one button throughout, so nothing separates them. Two frames straddling a focus change would.

P3, corrected — the plate needs no authored delay at all, 2026-08-29

Last iteration the port refuted the RE agent's authoring instruction ("when build 4 has settled, wait 2.13 s, composite build 2") with arithmetic off the disc, shipped the instruction anyway rather than pick between two of their numbers, and printed the discrepancy on every boot.

The refutation held, and the answer that came back is better than either option the port offered: author nothing. 5b0a6e6.

The premise that failed was the port's, and it will bite again

🔴 rest.t is not when a screen settles. It is the last hold keyframe before the exit.

Checked here rather than taken on trust. title's ptlogo1:

t=26  (-116,-7) 150%  a=0x00      the pre-roll
t=42  (179,186) 101%  a=0xe0      it has arrived
t=251 (184,193) 100%  a=0xff      5 px and 31 alpha steps later, 3.5 s on

It stops moving at t=42 and then creeps for 209 units. rest.t = 251 is the end of that creep, not the arrival. The title's visible build-in is over at t = 118, where pteff01, pteff02 and ptlogoall_eff finish together.

Every reconciliation the port computed last iteration was wrong by exactly that error: reading rest.t put build 4's arrival at 4.350 s instead of 1.967 s, and the "2.51 s, which is not a landmark of anything" that looked so damning is (4.350 − 1.967) + 0.13 — the error itself, wearing a decimal point.

One clock, and the interval is declared

units
build 4's last build-in ramp t = 118
ptbtn00 reaches a = 255 t = 238
difference 120 units = 2.000 s

Measured: 2.138 s and 2.132 s. The 6.7 % is presentation rate — 120 units in 2.135 s is 56.2 units/s, the emulator running 28.1 fps against a nominal 30, and the corpus had independently measured the idle title at 28.5 fps before these runs.

So authored/flow.json carries "clock": "shared" and no delay, boot.gd raises the overlay when the step's screen loads rather than at its settle, and overlay.time_units = view.time_units — assigned, not accumulated, because two independently advanced clocks drift by a frame here and there and the whole content of the finding is that 120 units is a fixed interval on one timeline.

⚠️ The general hazard, stated by the RE agent and worth repeating where the port will read it: discount a wall-clock number off that oracle by ~6 %. It is Canary's presentation rate baked into whatever it measures. A port at a true 30 Hz that authored 2.13 s would be visibly late.

Refutation — two of the RE agent's numbers for the same 120 units disagree by 2 %

Both findings measure the same declared quantity: 120 keyframe units of wall clock, during a static hold, in Xenia Canary.

implied presentation
plate: settle → plate, two runs 2.138, 2.132 s → mean 2.135 s 28.10 fps
ring: one revolution, seven spacings 2.18 2.16 2.18 2.16 2.16 2.20 2.20 → mean 2.177 s 27.56 fps
disagreement 0.042 s = 1.97 %

That is seven times the plate finding's own run-to-run agreement of 6 ms, and it lands on the argument that finding uses to justify trusting itself: "the build-in is where frames are dropped; the static hold is not. A model in which the game's own timing varied would have to move both." Two static-hold measurements are exactly what should agree under that model.

A second, smaller arithmetic slip in the same place: the ring page reconciles 2.177 s against a band of "27.6–28.8 fps", saying the measurement "sits at the top of that band". It does not sit in it. 60 rendered frames at 27.6 fps is 2.1739 s; the mean needs 27.56 fps and the two slowest spacings (2.20 s) need 27.27 fps. Four of the seven spacings are above the band's top.

Verdict: the containment claim is refuted; the spin, the period and the reconciliation are untouched. Either the presentation rate genuinely differed between the two sessions — which the plate page's own corroboration argues against for static holds — or the ring's revolution is not exactly 120 units. The corpus should say which, because they are the same claim measured twice.

🟢 Nothing in the port moves either way. spin_period_units uses the declared 120 units at 60 units/s = 2.000 s of port time, which is the true-30 Hz value both readings agree the disc means. This is a corpus consistency problem, not a port one — which is why it is filed rather than worked around.

The corrected boot ended one build too early, and the capture showed it

Moving the plate onto the shared clock also moved the boot's exit, and the first capture taken afterwards was visibly darker than the one before it. The cause is pteff00, the title's black fade quad: it ramps 0xff000000 → 0x00000000 over t=16…261, so at t=243 — where the run was quitting, overlay.settle_time() after the overlay was raised — the frame is still ~7 % black.

The plate arrives at t=238; build 4 is not finished until t=261. The boot now ends at the later of the two, and says which in the log:

  -> title at 145.79 s
  overlay press_start raised at 145.79 s, 1 element(s), settles at t=238
  boot ends at 150.14 s, once both builds have arrived (t=261)

Worth recording because of how it presented: nothing failed, no warning was printed, and the only symptom was a frame slightly darker than the previous run's. A gate artifact that silently drifts is the failure mode this project keeps meeting — and it was caught only because there was a previous capture to compare against.

P7 — the new-game intro, 2026-08-29

S00A.wmv has been in export/video/ since P4 (MISSION §6 put both movies in scope at once). What P7 needed was for something to play it and for the run to end somewhere defined.

The port skips two measured screens, and says so on screen

The real chain is NEW GAME → DIFFICULTY → SELECT DATA → Ⓐ on a save slot → ~4.5 s → S00A (HANDOFF Q4 measured the screens, Q9 decoded the movie and then measured its onset off the running game at 0.96–1.000 with a strictly monotone playhead over 25 consecutive 0.5 s samples).

DIFFICULTY and SELECT DATA are measured destinations that are not GP_TITLE builds, so no screen file exists to go to. The port therefore jumps from NEW GAME to the one thing in that chain it has.

That is a gap, not a sequence, and the whole design here is about not letting it read as one:

  • MenuFlow.accept returns a new kind, video, rather than folding this into blocked. The caller has to announce the skip, and a distinct kind is what forces it to.
  • The runtime prints it every time: (NEW GAME) -> the real chain is DIFFICULTY -> SELECT DATA, then the movie. Neither screen is in this export.
  • authored/flow.json carries skipped_chain as data, so the names of what is missing live beside the decision rather than inside a GDScript string.

A port that quietly jumped from NEW GAME to the intro would be showing a sequence the game does not have, with nothing on screen saying so. That is the exact failure this project keeps meeting from the other direction.

What happens after the movie is authored, and had to be

The game goes into mission 1. Gameplay is out of scope (PORT-MISSION §7), so "returns to a defined state" is a decision, and P7's gate says as much. The port returns to the title: the boot's own end state, so a run that finishes the intro lands somewhere a player can start again from. Nothing measured says the game does this, and after_video.kind is "authored".

The 4.5 s gap is left empty on purpose

Q9 measures the movie starting ~4.5 s after Ⓐ on the save slot. What is on screen for those 4.5 s was never observed — the run that would have shown it hit the documented sub_823070B0 cache crash after SELECT DATA.

GP_TITLE does carry a loading screen (below), and 4.5 s is about the right shape for one. That is precisely why it is in BLOCKED.md and not in flow.json: a plausible filler that nobody watched is the kind of thing that is indistinguishable from a measurement a month later.

A script timeout that would have failed every movie

--script's per-step timeout is 20 s, to stop an unattended run waiting forever on a screen that never settles. S00A is 93.9 s, so the first scripted new-game run would have been killed at step 1 and reported as "never settled".

Raising the constant would have been wrong in the other direction: a movie stuck at frame 0 would then hang the job, and a job that waits is worse than a job that fails, because it does not look like a failure.

So the test is liveness, not duration: while get_stream_position() advances, the deadline moves with it; a stalled movie still trips the same 20 s.

Found while looking: GP_TITLE's four unnamed builds are LOADING screens

build_00, build_01, build_12, build_15 have never had names. Every element in all four is pgloading_* — pgloading_processing.png, pgloading_circle1, pgloading_delta, pgloading_ring — and LOADING is one of the three screen names the RE agent read out of the title part's state function.

Two variants: 0/1 carry 7 elements, 12/15 carry 10.

They are not renamed here. The archive's own pairing (adjacent for 2/3, +3 for 4…9 and for 10/13, 11/14) suggests 0 is 1's twin and 12 is 15's, but which member of each pair is which locale is an inference, and a name is exactly the kind of thing that stops being questioned once written. Handed to the RE agent, who can answer it from a capture in one look. BLOCKED.md has the row.

⚠️ And one of them is a second casualty of the rest.t problem. pgloading_eff00.prm on entries 12/15 is a full-screen black quad whose group runs 0xff000000 at t=38 → 0xff000000 at t=48 → 0x00000000 untimed: black, held, then clear. Its rest.t is 38, where it is fully opaque. A port that draws that screen at its declared rest draws a black rectangle over the entire loading screen. The title's case only dimmed a frame; this one hides everything. Filed with the settle_time() row it belongs to.

Refutation — attempted on the fade-quad census; it survives, with a caveat

The claim (HANDOFF, on transitions): "in GP_TITLE exactly the six screen builds carry it while the six overlays do not", where "it" is the full-screen black .prm quad whose keyframe group is the transition.

The test, over the whole export: count builds carrying a full-screen primitive with black in its keyframes.

16 builds exported; 12 carry one.
Of the 12 `is_build` bundles (excluding the 4 authored splashes): 8 carry, 4 do not.
  carry:  title, title_jp, main_menu, main_menu_jp, extras, extras_jp,
          build_12, build_15
  do not: press_start, press_start_jp, build_00, build_01

8 and 4, not 6 and 6. But the two extras are build_12 / build_15, and their quad is a different shape:

transition quad (pteff00.prm, title) loading quad (pgloading_eff00.prm)
0xff000000 t=16 0xff000000 t=38
0x00000000 t=261 0xff000000 t=48
0xff000000 untimed 0x00000000 untimed
shape black → clear → black black → held → clear

The transition quad returns to black on exit; the loading quad does not. Read strictly — the quad whose group is the transition — the claim holds.

Verdict: survives. The refinement is worth recording anyway, because the naive test over-counts by two and somebody will run the naive test. There are two kinds of full-screen black .prm in GP_TITLE, and only one of them is a transition.

P7 gate

godot --path port -- --menu --script=accept --audio=…/p7.wav

  menu on main_menu, focus ptbtn01
script[1] accept
  (NEW GAME) -> the real chain is DIFFICULTY -> SELECT DATA, then the movie.
               Neither screen is in this export.
  -> video S00A at 1.18 s (/work/export/video/S00A.ogv)
     video ended at 94.93 s
     -> title (authored: authored)
  menu on title, focus (none -- this screen has no focusable item)
script complete after 99.28 s on title
recorded 98.453 s of Master bus (driver Dummy)

The movie ran 93.75 s against a declared 93.9 s, the run ended on the title, and the Master bus recorded 98.453 s: pcm_s16le, 44.1 kHz stereo, RMS −22.2 dBFS.

What this does not show, stated because it would be easy to imply otherwise: the recording contains the menu bed and the movie together, and this run did not separate them. So it establishes that the engine reached an output for 98 s of a run whose middle 94 s was a movie — not that S00A's own audio track is in the mix. Separating them wants the P6 null-control method (a paired run that differs only in the movie), and that is not done here.

🔴 Peak 0.0 dBFS again. The same runtime-headroom problem P6 filed: per-file levels are the disc's and are fine, the Master bus has no headroom, and the port has set no bus balance because nothing measures one.

One more file read while it was being written

ls reported the recording as 3 702 828 B; ffprobe on the finished file reports 17 367 084 B / 98.452608 s — a factor of 4.7. ffprobe is right and the ls caught it mid-flight.

AUDIO-VERIFICATION.md opens by naming this failure and the port has had the temp-name-then-rename discipline since P6, which is what makes it worth writing down rather than shrugging off: the discipline protects a reader who opens the path, and it does not protect a reader who stats it at the wrong moment. Size on disk is not a measurement of a file somebody else is still writing. Ask the decoder, not the directory entry.

Modding — rule 4 was never implemented, 2026-08-29

docs/port/MODDING.md is explicit that modding is "a design constraint on the exporter today — not a milestone to add later", and its rule 4 is base-and- overrides: a mod replaces a file by shadowing its path, so a modder edits nothing under the derived tree and re-exporting is always safe.

Nothing read data/mods/ at all. The directory has existed since the monorepo merge with a .gitkeep in it and no code path anywhere — exporter or runtime — that looked at it. Eight milestones shipped past that.

One resolver, and every read goes through it

ExportTree.resolve(rel) returns the mod tree's copy when one exists and the derived tree's otherwise. read_json, texture, video and MenuAudio all call it, so a mod can replace a screen's JSON, a sprite, a cue, the music bed or a movie — every asset kind the port reads.

MenuAudio was reading tree.root.path_join(...) directly and had to be changed. Left alone it would have made audio the one asset kind a mod could not touch, for no reason a modder could have guessed — which is the failure mode rule 4 exists to prevent.

There is deliberately no manifest of what a mod contains and no registration step: the path is the registration, which is the whole of the rule.

⚠️ One tree, not a stack. Several mods layering over each other needs a load order, and a load order needs a rule nobody has asked for. Said out loud in data/mods/README.md rather than answered.

A modded run must not look like an unmodded one

Every shadowed file is printed the first time it is read:

mod: sprites/title/main_menu/ptbtn01.png  <-  /work/data/mods/sprites/…/ptbtn01.png

MODDING says "did I break it?" is answered by disabling a mod. That is a fine last resort and a poor only resort, so the log names the replacement instead.

The first version of this got it wrong in an instructive way: it printed a summary in _ready, before a single asset had been read, and so always said (nothing shadowed yet). A report structurally incapable of reporting anything is worse than no report, because it looks like an answer. It now announces each shadow at the moment it happens.

Gate

A synthetic 203×43 magenta PNG — nothing disc-derived — dropped at data/mods/sprites/title/main_menu/ptbtn01.png:
pixels changed between the two renders 8 501 of 921 600 (0.92 %)
bounding box of the change x 542…744, y 162…204 — 203×43, the sprite's own size
sylpheed-export check export afterwards 16 screens still validate

The changed region is exactly the sprite and nothing else moved.

data/mods/ was not gitignored, and that is a hole in a hard rule

"Never commit game assets" has been enforced on export/ and data/base/ since P0. But a mod is usually an edited game asset, and data/mods/ was fully tracked — so the one directory a user is invited to put modified sprites in was the one directory git would happily take them from.

.gitignore now excludes everything under it except the README.

The naming split is not mine to resolve

MODDING.md describes the tree as data/base/; PORT-MISSION.md §3, the exporter, ExportTree and .gitignore all say export/. Both are mission files, and PROTOCOL is clear that only the human changes a mission, so this is raised rather than picked. .gitignore has ignored both names on purpose since P0.

It matters here for one concrete reason: MODDING's layout has base/ and mods/ as siblings, and today they are not — the tree is export/ at the repo root while mods are data/mods/. The resolver takes SYLPHEED_MODS or defaults to data/mods/, which is what exists; if the tree is ever renamed to data/base/ the sibling rule becomes natural and that default can go.

Refutation — the paint-order key, and the reach of its tie-break

The claim (HANDOFF Q3): paint order is "a u16 layer key at +0x0A, decoded", with the tie-break filed 🟡 as "eight candidates refuted; costs one element's blend on one screen".

First pass: 2 of 16 screens did not match a stable sort by layer key — both loading screens, build_12 and build_15.

That was my test, not the claim. pgloading_eff00.prm carries no layer key at all — layer: null, layer_source: "none": it is a primitive with no sprite header, and the exporter's implied-name fallback produces nothing either. My sort put a keyless element first; the decoders put it last.

Completing the rule as "stable sort by layer key, elements with no key last" gives 16 of 16. And last is right: pgloading_eff00 is the full-screen black quad, and HANDOFF's own sentence is that the fade quad paints last.

Verdict: survives, with the rule completed. Worth recording because the published statement does not say where a keyless element goes, and there is at least one in the archive.

🟡 But the tie-break's reach looks understated. Census over this export:

elements sharing a layer key with another element: 105, across 12 of 16 screens

HANDOFF characterises the cost as "one element's blend on one screen". 105 elements on 12 screens is a much larger surface than that. Most of those ties are probably invisible — two elements that share a key and never overlap cannot show a difference — but probably is doing the work in that sentence, and nothing has measured which. The port is unaffected either way: it draws ui_layout::derived_paint_order verbatim and derives no order of its own.

Correction — the runtime "clipping" I flagged 🔴 twice was overstated

P6 and P7 both filed 🔴 "the runtime mix has no headroom" on the strength of a peak reading of 0.0 dBFS off the Master bus. Measured properly:

samples at full scale of total longest clamped run
P6 walk (5.944 s) 43 0.0082 % 10 samples — 0.23 ms
P7 new-game run (98.453 s) 24 0.00028 % 11 samples — 0.25 ms

That is not a headroom defect. It is the disc's own confirm cue, mastered near full scale (+0.18 dBFS after a lossy decode), touching the ceiling for a quarter of a millisecond on a transient — and possibly only in the recording's 16-bit conversion, since Godot mixes in float and AudioEffectRecord saves s16.

Nothing is changed, and that is the point. Attenuating the mix to buy headroom would be an unmeasured decision about level — the same class of thing this port refused for the BGM loop point and the stem balance. Refusing it there and taking it here would be inconsistent, and it would trade an inaudible 0.25 ms clamp for an audible change nobody measured.

A peak reading is not a clipping measurement. One sample at 0 dBFS and two seconds of square wave give the same number, and I reported the first as though it were the second — twice, in red, in two milestones' write-ups.

The P1 regression harness had been broken since the monorepo merge, 2026-08-29

tools/port/verify-screen is the P1 gate's regression detector: Godot's drawing of a screen against sylpheed-cli screen render of the same build. It had not been run since P1, across four milestones that changed the renderer — rotation, the focus record, the spinning ring, two builds composited at once.

It could not have been run. It resolves its reference binary to a path that build-reference-cli stopped being able to produce. That script greps crates/sylpheed-export/Cargo.toml for

sylpheed-formats = { git = "…Syplheed-Reborn.git", rev = "…" }

and the monorepo merge (65cefa7) replaced that line with { path = "../sylpheed-formats" }. The grep returns nothing, the script exits 1, and the binary left at reference-cli/sylpheed-cli is whatever predated the merge — here, three hours older than the sources and built from a revision nothing in the tree points at any more.

Running the diff against it would have compared the port to a decoder from another era and called the result a regression check. DECISIONS.md already carries "The reference renderer was stale for three diff runs" from P2. This would have been the fourth, and the mechanism was different: not a forgotten rebuild, but a build step that could no longer succeed and a consumer that only checked whether the file existed.

The fix is a deletion, not a repair

The revision-keying solved a two-repo problem: /reborn's target/ was a live mount of the other agent's checkout and moved mid-run, so a pixel disagreement against it had a free variable in it. The monorepo removed that problem by construction — the exporter, the reference and the port now read one decoder, the working tree's. So verify-screen builds sylpheed-cli from the workspace. SYLPHEED_CLI still overrides for anyone who wants to pin one deliberately.

The baseline, all 16 screens

build_00/01        max 3    over3 0       OK
press_start(_jp)   max 1    over3 0       OK
title              max 6    over3 790     DIFFERS
main_menu(_jp)     max 4    over3 0       DIFFERS
extras(_jp)        max 3    over3 0       OK
publisher_logo(_r) max 1-2  over3 0       OK
developer_logos(_r) max 2   over3 0       OK
title_jp           max 155  over3 20498   DIFFERS
build_12/15        max 0    over3 0       OK

No new drift. Four milestones of renderer change and the only screen with a substantial disagreement is title_jp — which is the same one P1 recorded and left open: ptlogo_eff2 is the single drawn element in the whole export at a scale that is not a whole multiple of 100 % (125 %), and the two renderers pick different source texels there. ui_layout::blit samples at the destination pixel's top-left corner, a GPU at its centre. The port has still not changed to match, because matching would mean reproducing a half-pixel bias on purpose to make a number smaller. Only an oracle capture settles it.

title's 790 pixels at ≤ 6/255 are the same class, one texel wide, on the logo's scaled edges. main_menu and main_menu_jp say DIFFERS on a max of 4 with zero pixels over the bar — a couple of pixels differing in a single channel.

max alone could not tell 2 pixels from 25 000

The script reported only the largest difference anywhere in the frame, so main_menu (two pixels) and title_jp (2.8 % of the frame) produced the same verdict. It now also reports how many pixels are over the bar.

The bar itself is not raised. Tuning a threshold until things match is the failure the script's own header warns about; adding a second number is information, not a loosened bound. ⚠️ The count is thresholded on greyscale luma while max is a per-channel maximum, so they are not two views of one measurement — a per-channel check counts 957 on title where the luma count says 790.

What this harness cannot see, stated because the OK rows look reassuring

It renders --pose=rest. That is deliberate — it holds both renderers to the same declared pose so the test is port vs reference and not rest vs timeline — but it means none of this iteration's or the last four's visible work is under test: not the spinning focus ring, not the plate composited over the title, not any timeline behaviour, not audio. Sixteen OK rows are a statement about the resting composite and nothing else.

And it remains what its header says: a consistency check between two renderers that share their assumptions. Both have been wrong together three times — pteff05, scale-0, rest() — and each time only a capture caught it.

Refutation — "builds 0/1 and 10/11 are the loading screen" is false in the index space this export uses

The claim, from the RE agent 2026-08-29, answering the port's ask to name GP_TITLE's unnamed bundles: "builds 0/1 and 10/11 are the loading screen, decoded from their own pgloading_* element names."

In this export, entries 10 and 11 are the splash screens, and it is not close:

entry elements
10 palogo_eff0, palogo_sqex, palogo_sqex_eff
11 palogo_eff0, palogo_gamearts, palogo_seta, palogo_anima …
12 / 15 pgloading_eff00, pgloading_loop1, pgloading_str …

Entry 10 is the SQUARE ENIX wordmark and 11 the developer logos — which the same agent identified, in the answer to the port's ask 1, as "entries 10/13 are the SQUARE ENIX publisher wordmark, the first thing the boot shows".

Verdict: the finding is almost certainly right and the index space is wrong. Over the twelve bundles is_build accepts — entries 0,1,2,3,4,5,6,7,8,9,12,15 — ordinals 10 and 11 are entries 12 and 15, which are exactly the two dressed loading variants. So "0/1 and 10/11" is the is_build ordinal, and this export addresses by pak entry index.

Why this is worth a section rather than a shrug. authored/screen_names.json is keyed by entry index, and the exporter's own comment says why: "keyed by ENTRY, not by the enumeration ordinal — widening the enumeration to reach the splash renumbers the ordinals, and a name that moves when the rule changes is not a name." Someone reading that message and writing keys "10" and "11" would name the publisher wordmark and the developer logos as loading screens, and the export would validate, and the boot would still run.

Two enumerations of the same archive differ by exactly the four bundles the port had to add an allow-list to reach. That is the sharpest possible demonstration of why the exporter switched, and it has now nearly caused the error it switched to prevent. Reported; the names are still the RE agent's to give.

The intro's missing dialogue was an export gap, not a transcode bug, 2026-08-29

A human play-test heard music under the boot intro and no voices. The obvious reading is that the 5.1→stereo fold dropped the centre channel, and it is wrong.

ADV.wmv carries music and effects only. On this disc a cutscene's voice is a separate asset: one continuous XMA stream in sound.pak, bound to the movie by the manifest in tables.pak (ADV → VOICETRACK = VOICE_ADV). Nothing was dropped — grep -rn voice crates/sylpheed-export/src/ returned nothing, because the exporter had never been asked for it. The transcode was correct the whole time, which is why every measurement on it passed.

That is worth stating plainly because the failure looked exactly like a codec bug, and docs/port/AUDIO-VERIFICATION.md is full of ways to measure a transcode against its source. Every one of them would have come back clean.

The binding is resolved, and must never be matched by name

audio::export_voice takes exactly one route: media::resolve_movie_voice_region(source, movie, VoiceLang::English), which walks movie → cue token (manifest) → sound id (registry) → a [start, end) byte region of the continuous stream. The cheap route — read VOICE_<movie>.slb — was not taken, and the reason is a measurement:

movie resolved region inside the bank named after it?
ADV 433 930 240…437 044 592 yes
S00A 452 798 464…455 499 120 yes
RT01A 437 044 592…437 345 648 no — it is inside VOICE_ADV.slb

⚠️ Name-matching is correct on exactly the two movies this port ships, and wrong on the radio cutscenes. It would have exported clean, verified clean against both in-scope movies, and returned the wrong recording the moment anybody widened the export. This is the failure mode MISSION §2 names — one playable thing is not one archive entry — in its most convincing disguise: the spot-checks a person would actually run are the ones it passes.

Three choices, and why none is a guess

  • One file per movie, per MODDING rule 1, and the region's chunks are summed — see the correction below, because the first version of this paragraph said the opposite and was wrong.
  • Mono, folded from the stream's own declared channel count, probed with ffprobe rather than assumed. This is not pedantry: pan silently ignores a channel the input does not have — measured this iteration on the 5.1 fold below, where FLC/FRC/SL/SR vanished with no warning at all — so a stereo matrix applied to a mono voice track is not an error, it is a −6 dB attenuation that nothing reports. A track that is already mono is passed through untouched.
  • No sync offset, and no length clamp. The voice plays from the video's first frame, so nothing is authored. The decoded length is recorded in the manifest beside the movie's own length rather than trimmed to it: the voice has no shared container to disagree with, so a length mismatch is the only symptom a resolution error would ever show, and clamping would delete it. That decision is the reason the error below was caught in the same hour it was made.

Correction, within the hour — the chunks are stems, and I had concatenated them

The first version of export_voice joined the region's chunks end to end and produced 359.201 s of voice for a 137.437 s movie, and 255.460 s for a 93.779 s one. Both ratios sit near 3, and both regions decode to 3 chunks.

The manifest said so on the first run, because the length was recorded against the movie's instead of being clamped to it. A clamp — which is what sylpheed-viewer does, and what media's own doc comment invites with "trimmed by the caller's length clamp" — would have produced a file of exactly the right duration containing the wrong audio, and every check in docs/port/AUDIO-VERIFICATION.md would have passed it.

Decoding each chunk and timing it (crates/sylpheed-export/examples/voice_chunks.rs):

movie movie length chunk 0 chunk 1 chunk 2
ADV 137.437 s 84.553 137.324 137.324
S00A 93.779 s 68.072 93.694 93.694
RT01A — 0.009 34.034 —

Chunks 1 and 2 are equal to six decimals and each span the whole movie. That is HANDOFF Q10's decoded shape — two stems of one performance, played together; do not concatenate — showing up on a second asset kind. They are summed at 1/n, exactly as export_bgm sums a music bank.

⚠️ Chunk 0 is dropped and its status is open. Its duration matches nothing: 84.6 s under a 137 s movie, 9 ms under RT01A. docs/re/REFUTED.md records to_xma_riffs's hybrid branch emitting a leading headerless packet region ahead of the real RIFF waves, and docs/port/BLOCKED.md already carries that as an open row against BGM_103, where media returns three sub-waves against a census of two. This is the same signature on an independent asset kind — good corroboration, not proof, and the port is not entitled to close it. So the selection rule is written in terms of the measurement (keep the longest duration and everything tying with it), and every dropped chunk is named in the manifest with its length.

This is the media-assembly trap MISSION §2 names, and it caught me: I wrote a doc comment asserting concatenation, gave the reason, and had it wrong. What saved it was refusing to clamp — the one decision in the first version that was made for the right reason.

What a None means

A movie whose region does not resolve is genuinely unvoiced — the honest answer for most hokyu_* resupply cutscenes — and gets a manifest warning, not a substitute. The corpus already paid for the alternative: resolving unbound movies through a shared demo line played the wrong recording.

This is decoded, not authored, so it runs outside the authored/audio.json block in main.rs. Nothing new goes in authored/; there is nothing here we decided.

Refutation, of my own exporter — MISSION §6 pins a downmix matrix, and the exporter ships a different one

The claim under test is the port's, not another agent's, and it has been in video.rs since P4: that the 5.1 fold is normalised by 1/(1 + √½ + √½) = 0.4142 because "the unnormalised form was measured too and clips: peak 0.0 dBFS."

That sentence rests on a peak reading. docs/port/BLOCKED.md records this port withdrawing a 🔴 runtime-clipping flag on precisely the grounds that a peak reading is not a clipping measurement — one sample at full scale and two seconds of square wave give the same number. So the justification for deviating from a matrix a human pinned was produced by an instrument this port has already declared unfit for the question.

Measured properly, over the whole of both movies

Decoded to 32-bit float so nothing is pre-clamped, then counted: samples at or over full scale, how many exceed it by more than 1 dB, and the longest consecutive run.

peak RMS ≥ full scale > +1 dB longest run
ADV, MISSION §6 matrix +4.26 dBFS −14.55 4 406 / 13 187 900 1 874 16 samples (0.333 ms)
ADV, exporter's matrix −3.39 dBFS −22.21 0 0 —
S00A, MISSION §6 matrix −1.34 dBFS −18.73 0 0 —
S00A, exporter's matrix −8.99 dBFS −26.39 0 0 —

The claim survives, and the reasoning behind it does not. The pinned matrix genuinely overloads ADV: not one stray sample but 4 406 of them, 1 874 more than a full dB over, wanting 4.26 dB more headroom than the container has. That is a different animal from the 43 samples and 0.25 ms transient I withdrew a flag over, and the number that separates them is the magnitude, not the count.

But the same table refutes the scope of the fix. S00A never clips under the pinned matrix — it peaks at −1.34 dBFS. The exporter attenuates it by 7.65 dB to solve a problem it does not have, because 0.4142 is derived from a theoretical worst case (every channel correlated at full scale at once) that neither movie comes near.

Control, before believing any of it

The pinned matrix names FLC, FRC, SL and SR, and a 5.1 source has none of them. ffmpeg neither errors nor warns — measured at -loglevel warning, the output was empty. So the literal string was decoded alongside its three-term 5.1 reduction (FL = 1.0·FL + 0.707·FC + 0.707·BL) and the two outputs compared: bit-identical, 52 751 600 bytes. The reduction is what runs, and it is the matrix §6 intends. That silence is itself the trap the mono fold above guards against.

Not changed, and deliberately so

MISSION §6 is a human decision of 2026-08-29, and the level of a mix is exactly the kind of thing §6 reserves — "adjust it deliberately, as a commit". Three options, and choosing between them is not mine:

  1. Keep the pin. ADV clamps on 4 406 samples. Rejected on the measurement.
  2. Keep the exporter's 0.4142. Preserves the two movies' relative loudness exactly, costs 7.65 dB, and is safe by construction for any movie a modder drops in.
  3. One measured constant, 1/1.6339 = 0.612. The smallest single scalar under which no in-scope movie clamps: +3.39 dB over today, still one constant so relative loudness is untouched. Tuned to two files, but the exporter's own check refuses any export whose peak reaches 0 dBFS, so a third movie that needed more headroom would fail loudly rather than clamp quietly.

Per-file normalisation is not on that list: it would put ADV 4.26 dB below S00A and change how two cutscenes sit against each other and against the menu bed, which is an aesthetic decision with nothing measured behind it.

What changes today is only that the deviation is visible: video.rs now cites MISSION §6 by name and says it departs from it, and the export carries a manifest warning with these numbers. Before this, a reader of the manifest could not tell that a pinned human decision had been overridden at all — the command line was recorded faithfully, and recording the command you ran does not disclose that it is not the command you were given.

The voice reaches the output, and a null control says so quantitatively

+ voice ADV in the log proves only that play_voice found a stream and called play(). Whether the audio arrives at the Master bus is a different question, and docs/port/AUDIO-VERIFICATION.md §2 exists because it is.

The control needed no test-only code: MODDING rule 4 already shadows any exported asset by path, so 140 s of silence dropped at data/mods/audio/voice/ADV.ogg mutes the dialogue and changes nothing else. Two --boot --skip-at=25 --audio=… runs, then astats over the same 14 s of movie:

peak RMS
ADV.ogv's own audio (the bed) −6.239 −24.941
the exported voice alone −7.614 −27.965
run with the voice muted −6.251 −25.126
run with the voice playing −5.415 −22.913

The muted run reproduces the bed to 0.01 dB peak / 0.19 dB RMS, which is what makes the other row worth reading. And the mixed run is not merely louder: two incoherent sources at −24.941 and −27.965 dBFS predict a sum at −23.184, and the run measures −22.913 — 0.27 dB out. The voice is in the mix, at the level its own file says it should be.

⚠️ Under the Dummy driver. Per AUDIO-VERIFICATION, "recorded under a dummy driver" is a weaker claim than "heard", and no measurement here says the recording is the right dialogue for this cutscene — only that the file the exporter resolved is the one reaching the output at the expected level. The two runs are also not sample-aligned (they differ by 1.7 s of wall clock), which is why the RMS trough column is omitted: it moved by 40 dB between runs on window placement alone, and peak and RMS are the two numbers that survive that.

Ⓐ does skip the intro in this build, so the play-test's report is not this bug

--skip-at=25 on a --boot run: video skipped at 25.02 s, video ended at 25.02 s, title at 25.02 s. The press goes through Input.parse_input_event and arrives at _unhandled_input exactly as a pad's would, so the wiring from press to skip is live. What that does not cover is a real key event from a focused window, which is the difference between this run and the human's — and, separately, whether the game permits skipping an attract movie at all is HANDOFF Q9 and still 🟡. If the answer is no, this path is deleted rather than debugged.

Refutation of my own two-stem reading — and it had already been adopted elsewhere

Two hours after writing that a voice region's equal-length chunks are "HANDOFF Q10's decoded two-stem shape", the Decoder asked me to decode the leading chunk — it has no XMA1 decoder in its container — and the decoder run refuted the claim I had made.

Equal duration was a shape match, and I carried Q10's music census across to voice on the strength of it. The content does not support it:
S00A chunk 2 digital silence — 4 497 300 samples, peak −inf
ADV chunk 2 0.60 × chunk 1 (best-fit scalar), residual 26.8 dB below the target

About 95 % of ADV's second chunk is a −4.4 dB copy of the first. Two chunks of equal length, one silence and the other a scaled near-duplicate, are not two stems of one performance. ⚠️ The claim had already travelled — it is quoted in the Decoder's voice-region-leading-chunk.md — which is the failure PROTOCOL names: a wrong belief moving faster than its correction, through two documents that share a source.

What it cost, and what changed

Summing chunk 1 with silence at 1/n put S00A's dialogue 6.02 dB down for nothing: the exported file peaked at −16.2 dBFS against a source chunk peaking at −4.2. export_voice now drops a digitally silent chunk before the sum. That is arithmetic, not a content judgement — a silent input contributes nothing to a mix and counting it in the normalisation is simply my error.

What ADV's near-duplicate chunk 2 is remains open and it is still summed. Whether the game plays both is a decoding question; 26.8 dB of residual is not nothing, and dropping a chunk because it correlates with another would be answering it.

The leading chunk, decoded — structure, and not one word about content

The Decoder's ask was "cutscene dialogue or mission dialogue". ADV region

  • 1392, 394 packets: 84.553 s, stereo, 48 kHz, peak −2.48 dBFS, RMS −24.80, with 6 silent gaps over 0.4 s below −50 dB totalling 45.3 s — 54 % silence, the same duty cycle as the two full-length chunks (54 %, 55 %). So it is speech-structured audio: not a header, not padding, not noise.

🔴 Which is as far as a measurement goes. Cutscene or mission is an identification and this agent has no ears and no oracle. Envelope cross-correlation against the full-length chunks peaks at 0.768 at the last lag in the search range, which is where a statistic lands when it has found nothing, and it is not evidence. The Decoder's 🟡 stands, and its own leading hypothesis — an in-mission VOICE_D_* line — is untouched by any of this. The byte-span test it already built settles it the moment those regions are enumerated; nobody has to listen.

Taken from the same message: bank_header_len, not riffs.len()

The Decoder's census warns that eight bank-header regions also yield three chunks, so the chunk count cannot say which structure you are in. This exporter never used the count — it selects on decoded duration, which is why it already handles both cases: RT01A's 10 300 B leading chunk decodes to 9 ms and falls out on its own. But a duration tie is an observation and bank_header_len is decoded, so the rule switches the day c1f3608 reaches main. sylpheed-formats is a path dependency and merging another agent's topic branch is not the port's to do.

The mono fold I warned about, in the comment directly above the code that did it

export_voice's first version folded to mono by averaging every declared channel, and the doc comment above it said, in as many words, that "pan silently ignores a channel the input does not have — so a stereo matrix applied to a mono voice track is not an error, it is a −6 dB attenuation that nothing reports."

It then did exactly that. Per-channel astats on both voice streams:

channel 1 channel 2
ADV chunk 1 peak +0.000 dBFS peak −inf
S00A chunk 1 peak −4.207 dBFS peak −inf

The voice is a mono recording carried in a nominally stereo stream, and averaging it with silence cost 5.94 dB — which is most of why S00A's exported dialogue sat at −16.2 dBFS against a source chunk peaking at −4.2 (the other 6.02 dB was summing a silent chunk, corrected in the same iteration).

Checking the declared channel count is not checking the content, and only the content is the fold. live_channels now measures which channels carry signal and averages only those. sylpheed-viewer's pan=mono|c0=c0 reaches the right answer here for a reason it does not state; this reaches it for a stated one, and would still be right if a stream ever did carry two live channels.

Worth recording as a pattern rather than a bug: three defects this iteration were all the same shape — a silent chunk in a sum, a silent channel in a fold, and a pan matrix naming channels that do not exist. Each is an input that contributes nothing being counted in a divisor, and none of them is visible in anything but a level.

The leading chunk is the TAIL of the full one — measured, and it is why the region over-covers

The Decoder settled by byte-span analysis that a voice region's leading chunk is the movie's own dialogue, 17 of 17 — killing its own standing hypothesis that it was an in-mission VOICE_D_* line — and asked whether dropping it is therefore a truncation. It has no XMA1 decoder; this container does.

Envelope cross-correlation, sliding with overhang allowed at both ends and normalised over the overlap only. ⚠️ This corrects an earlier number of mine: a first pass scored 0.768 and I called it nothing, correctly — that search only tried lags where the shorter chunk fitted wholly inside the longer one, and it peaked on the boundary of its own range.

best r at lag overlap
ADV chunk 0 → chunk 1 0.998 +52.8 s 84.5 s
S00A chunk 0 → chunk 1 0.932 +25.6 s 68.0 s
control — ADV chunk 0 against itself 1.000 0.0 s —
control — ADV chunk 0 against S00A chunk 1 0.289 — 28.2 s

Both lags put chunk 0 flush against the end of chunk 1: 52.8 + 84.55 = 137.35 s against chunk 1's 137.324, and 25.6 + 68.07 = 93.67 against 93.694.

Confirmed in the sample domain — lag refined to ±1 sample on the loudest second, then a scalar best-fit over the whole overlap: ADV +52.8000 s, gain 0.833, residual 16.70 dB below the target; S00A +25.6320 s, gain 0.365, residual 23.15 dB. 98–99.5 % of the energy is a scaled copy: the same material at a different gain, not bit-identical, which is what a lossy decode at two gains should look like.

So dropping chunk 0 removes a duplicate, and is not a truncation — the exporter's existing behaviour is right for a better reason than the one it gave. 🟡 The manifest note has NOT been rewritten to say so. The structural claim — that the region over-covers because it re-presents its own tail, and that this accounts for the whole 2.6× — is the Decoder's to write down; this page reports the measurement and says which is which. The note stays hedged until its page carries the conclusion, and the hedge is true either way.

⚠️ The 504 464 B constant was deliberately not converted. The Decoder found the region anchor sitting that far after the true predecessor trailer on all 17 and pointedly declined to call it missing dialogue. Converting it needs a byte↔time mapping, and the numbers above are the reason there isn't one: chunk 1 is 1 118 268 B and chunk 2 is 1 171 516 B for the same 137.324 s, so bytes per second is not constant even inside a single region. Any figure in seconds off that constant would be invented.

Third reading of a voice region, and this one is decoded: three presentations of one take

export_voice has now read the same bytes three ways in one session, and each reading was ended by a measurement rather than by an argument:

  1. Concatenate the chunks — 359 s of dialogue for a 137 s movie.
  2. Sum them as HANDOFF Q10's two stems — refuted here: S00A's second full-length chunk is digital silence, ADV's is 0.60 × the first with 26.8 dB of residual.
  3. Keep one stream. ✅ This one is decoded, and not by me.

The Decoder settled the shape disc-wide without a decoder, by counting stream starts inside every inter-descriptor span: 258 spans hold one stream, 28 hold three, and nothing holds two or any other number. The 95 movie-voice regions decompose 70 + 8 + 17, and the 8 are independently the same 8 its first census flagged. So a region carries three presentations of one take — which is exactly 359 = 84.55 + 137.32 + 137.32, the first clipped by its crate's own 1.5 MB predecessor guard.

It also cross-checked my correlation by a route needing no decoder: if the leading chunk is the tail of a full stream, the whole leading stream should be one complete take, and ADV's 504 464 + 808 304 = 1 312 768 B at chunk 0's byte rate is 137.323 s against my measured 137.324. Two instruments, no shared assumption.

So summing was wrong for a third reason: a take plus a 0.60 × copy of itself is ~4 dB louder and coloured, not a mix of parts. The exporter keeps one stream and performs no arithmetic on it.

🟡 Which stream is a recommendation, not a decoded field. The selector is the highest byte rate among the equal-duration survivors, on the Decoder's advice. Nothing on the disc says which presentation the game plays, and on ADV this picks the quieter of the two — −8.3 dBFS against 0.0. That is in the manifest in those words so the choice is visible and reversible; it is the one part of this that a capture could still overturn.

check moves voice off the strict peak bound as a consequence. It sat with bgm because it was a sum this exporter produced; it is now a single wave off the disc, mastered near full scale — ADV's louder presentation measures +0.0003 dBFS at source — and refusing that would be refusing the disc's own mastering.

The 504 464 B constant: I refused the conversion, and refusing was right

The Decoder asked whether I would spend a decode converting its anchor offset to seconds, and I declined because bytes per second is not constant even inside one region. It has since found the stronger reason and withdrawn the ask: the constant is structural, not proportional — identical on all 17 regions despite their differing durations. A proportional prediction lands within 8 bytes on ADV, which is a coincidence, and is 4 305 B out on S00A. A seconds figure off that constant would have been invented, and it would have looked corroborated on the first movie anybody checked.

❔ Why the disc stores three presentations at all is unanswered, by either of us.

The transcode cache had never hit, because the wipe ran first

video::transcode has carried a cache since P4. It writes a .cmd sidecar with the exact ffmpeg command, the source's byte count and its channel count, and skips the encode when all three still match. Its doc comment says why: "without it every re-export pays ~4 minutes to produce a byte-identical file, and an exporter nobody re-runs is worse than a cache."

It had never hit once. main.rs clears the output tree wholesale — and the remove_dir_all runs immediately before the check, deleting the sidecar and the output it stamps. The cache tested a file it had just erased.

This session ran the exporter six times and paid the full Theora encode every one of them, producing five byte-identical files. Roughly 48 minutes. Nothing reported it, and nothing could have: a cache is silent when it works and silent when it does not, and the only symptom is a wall-clock cost that looks like the job simply being slow.

⚠️ It is worth being specific about how this hid, because the ingredients are ordinary. The cache is correct. The wipe is correct. Each carries a doc comment explaining itself, and neither mentions the other. The defect exists only in their ordering, which is stated in neither, and the cost is invisible in every artefact the export produces — the tree is byte-identical either way.

The fix keeps the wholesale guarantee rather than trading it away

The obvious repair — stop wiping — would break what the wipe is for: a screen that stops being exported stops existing, rather than lingering as a stale file that still validates. So the wipe now spares exactly video/, and prune_videos deletes anything in it this run did not claim. Everything else is still cleared outright.

That is a cache, not a hand-edit, and the distinction matters against MISSION §3: nothing in export/ is authored, the sidecar is derived from the command the exporter itself computed, and any change to the command, the source size or the channel count re-encodes. A modder who edits an .ogv by hand gets it overwritten on the next export, exactly as before.

🟡 Not measured yet: that a cached run reproduces the same tree. The claim is structural — the skip is keyed on the whole command string — but "the second run produces the same bytes" is checkable and has not been checked.

settle_time() — the answer arrived, and it refutes my own 🔴 more than it confirms it

The Decoder took the port's top ask and measured the boot on a cold profile with no shader cache (auto/no-disc-and-menu-captures at 4bd4779, docs/re/boot-settle-times-measured.md). It confirms the principle I filed: the title's rest.t is 251 units = 4.183 s where its art is finished at about 2 s, so rest.t is not when a screen arrives.

But my row said more than that, and the extra part is wrong. It said "everything the boot sequencer paces off that landmark is therefore late", and named publisher_logo and developer_logos. So I measured the port the way the game was measured — visible span, not arrival-to-arrival — with --film at 4 fps and a per-frame greyscale mean:

port, visible span game, three cold boots
publisher wordmark 4.25 s 4.297 / 4.604 / 4.370 0.05 s under the lowest
developer logos 3.50 s 3.508 / 3.503 / 3.366 dead on
black hold between ≈0.25 s 0.2 – 0.3 s inside
title settled → plate 2.000 s (declared 120 units) 2.247 s inside, at ~28 fps presentation

The splashes are not late. They match. ⚠️ And the reason my earlier reading said otherwise is worth keeping: I had compared the port's transition timestamps — 4.68 s and 3.94 s, arrival to arrival — against the game's visible spans. Those differ by the exit ramp plus the black hold, about 0.6 s, which is the whole of the discrepancy I was about to chase. This corpus has been bitten by exactly this before, in the plate delay: "timed from where build 4 stops animating, not from where it first appears — measured the other way the two runs differ by 0.48 s against 6 ms."

So the port paces the boot correctly, and rest.t is a wrong landmark whose blast radius is much smaller than I claimed: on the screens the sequencer actually advances off, rest.t plus the 24-unit exit ramp lands where the game lands. What it still affects is _script_settled, which waits longer than it needs to before photographing — a slow test, not a wrong frame.

dwell_seconds stays null, and the question is now closed rather than open

authored/timing.json says of it: "If a capture ever times the real boot, this is where that number goes." A capture has now timed the real boot, and the answer is that nothing goes there — the disc's own keyframe groups reproduce the game's dwells to 0.05 s and 0.01 s. The field stays null for a measured reason instead of an absence of one.

Taken from the same page, and not taken

  • ✅ The 120-unit plate delay stands. The Decoder ran a refutation of it that failed instructively: its probe's title_static mark gave 3.203 s, which on a cold boot looks like a real effect. It was the instrument — the mark fires during the crossfade out of the attract movie, with the glyph count still 0. Re-measured from content: 2.247 s. The port changes nothing, and the declared 120 units is what it keeps.
  • 🔴 No Ⓐ→menu dwell is authored. It measured 3.763 s and contains a 1.53 s guest load stall — the third independent reproduction of that stall, this one on a cold cache, so it is not a warm-cache artefact. It is emulator time, not a game constant.
  • 🟡 Menu build-in 0.531 s and Ⓑ→title 0.482 s are not authored either, and that is the Decoder's own caveat rather than my caution: they rest on one run, where the plate delay and the load stall are each cross-checked against independent prior evidence. The port is within ~0.1 s of both with its existing 24-unit exit ramp, so authoring them would replace a disc-derived number with a provisional measured one and gain nothing measurable.

The voice presentation is now unambiguously the port's choice, and the recommendation behind it was withdrawn

The Decoder has withdrawn "highest byte rate": its sentence read "the highest-rate, highest-gain one is chunk 1", and those two criteria select different streams — ADV chunk 1 is 1 118 268 B at 0.0 dBFS, chunk 2 is 1 171 516 B at −8.3. The rule named one and the parenthetical named the other. I implemented the rule faithfully and got the quieter presentation.

What the file can still say is decoded and does not adjudicate it: the fmt chunk is a 32-byte XMAWAVEFORMAT whose +0x20 is a declared PsuedoBytesPerSec — 8 142 and 8 530 on ADV's two, matching the computed rates to 0.02 % — but wEncodeOptions (0x10d6), channel count and channel mask are byte-identical across the presentations. Nothing in the header ranks them.

⚠️ One more observable, measured here and not in that page: the two presentations differ in channel layout. ADV chunk 1 is mono-in-stereo — channel 2 digitally silent — while chunk 2 is dual-mono, both channels identical at −8.318574. So they are not two encodes of one file differing only in rate.

Also recorded, because it cost the Decoder time: sylpheed-cli audio info is not to be trusted on these. Its "16 channels / 4310 Hz / 2-bit" is wBitsPerSample, wEncodeOptions and the channel fields read at the wrong offsets — its XMA1 reader is misaligned. That is a tool in this repository reporting confident nonsense, and it is the second time a renderer or reader of ours has been believed before it was checked.

Refutation of my dual-mono inference — the measurement stands, the generalisation does not

I argued that highest_rate had no case because ADV's higher-rate presentation is dual-mono while its louder one is mono-in-stereo, so the extra bytes buy a duplicated channel rather than fidelity. The Decoder tested that disc-wide, as a refutation attempt, and it fails.

Over the 28 three-stream cues, the stream-3 / stream-2 size ratio runs:

min median max sd within 15 % of 1.0
0.0778 1.2565 2.9163 0.5057 12 of 28

Declared rates scatter with them — S06A is 5 661 against 16 513 B/s. A 37× spread is not a duplicated channel.

The channel measurement itself stands: ADV chunk 1 really is mono-in-stereo and chunk 2 really is dual-mono at −8.318574, and that is this port's own decode, which the Decoder could not re-run and did not dispute. What fails is the step from one asset to the format.

What this changes, and what it does not

Nothing in the export changes. loudest is a per-asset content rule — it reads the peak of the actual streams in front of it — so a scattering structural ratio cannot undermine it, and ADV's dialogue at +0.3 dBFS instead of −8.7 is plainly the better outcome either way.

What changes is the reason, in four places: authored/audio.json's presentation_why, the selector comment in audio.rs, BLOCKED.md's row, and this page. The honest statement is narrower and slightly less satisfying: highest_rate was never refuted — it was never argued for, and neither is loudest. Which is exactly why the entry is marked chosen rather than measured, and why one capture deletes it.

⚠️ This is the third claim of mine in two iterations that generalised a single-asset observation — after "the chunks are two stems" and "everything the sequencer paces off rest.t is late". All three were true of the thing I looked at. The pattern is not carelessness about the measurement; it is reaching for the rule the measurement would imply if it held everywhere, and writing that down in the same breath. The corpus catches it because someone else runs the census.

Two things in that data that are not mine, recorded so they are not lost

  • S12B's three streams are byte-size identical (14 396 each).
  • BIRD_224 is three-stream and is not a movie cue — so the three-stream shape is not exclusive to cutscenes, which narrows how it was described to this port earlier. Neither affects export_voice, which only resolves movies.

Two rows of the P1 baseline were comparing blank frames and reporting OK

docs/port/BLOCKED.md has carried a 🔴 since P3: "the loading screen's fade quad rests OPAQUE BLACK … it will bite whoever first draws a loading screen." It had already bitten, in the one place nobody looks — the regression harness.

build_12 and build_15 render as pure black in both renderers: mean 0, max 0, on the Godot side and on sylpheed-cli's. The difference between two blank frames is zero, so verify-screen scored them max 0 over3 0 OK — the strongest verdict it has. Two of sixteen rows were comparing nothing against nothing, and the committed baseline reads as sixteen passes.

That is worse than a missing test. A missing test is visible in the count.

The cause, isolated by a control rather than by reading

build_00 and build_01 are the plain loading variant — the same screen minus three elements. They render: mean 1.913, max 214.5. build_12/build_15 add pgloading_baseeff, pgloading_loop5 and pgloading_eff00, a 1280×720 primitive whose rest is 0xff000000 — opaque black — at t=38, inside its own opening black hold (0xff000000 at 38, 0xff000000 at 48, clear on the untimed final). It carries layer_source: "none", so paint order puts it last, over everything.

Same screen, one element different, one renders and one does not. That is the diagnosis, and it did not require an opinion about rest.

The rule I was about to write, and the census that killed it

The obvious reading is that rest.t = 38 is wrong because it precedes the element's last timed keyframe at 48 — so "rest.t before the last timed keyframe" would flag the pathology. I ran the census before writing the rule, and it does not survive: 152 of 212 elements in this export have rest.t earlier than their last timed keyframe. It is the norm.

What actually distinguishes this element is its content, and the reach of that is one:

screen full-frame primitive rest.t last rest fade
build_12 / build_15 pgloading_eff00 38 48 0xff000000
extras / extras_jp pteff00 64 74 0x00000000
main_menu / main_menu_jp pteff00 70 80 0x00000000
title / title_jp pteff00 261 269 0x00000000
title / title_jp pteff02 46 236 0x40000000

pgloading_eff00 is the only element in the whole export whose resting pose is a fully opaque full-frame quad — 1 of 212. Every other full-frame primitive rests clear or at 25 %. One instance is not a rule about rest, and keying the renderer on "an opaque full-frame quad at rest is probably wrong" would be a content heuristic of exactly the kind this port refuses elsewhere.

So nothing in the renderer changed, and the harness did

The screens stay black. Nothing draws a loading screen, and the honest position is that either rest is mis-identified for this one element — a decoding question, asked — or the screen really does begin fully black and --pose=rest is simply the wrong thing to photograph it at.

What changed is that a blank pair can no longer score. verify-screen now checks both frames for ink first and reports BLANK -- both renderers drew nothing; this row proves nothing. It is not a failure — the port may legitimately have nothing to draw — and status is untouched, so an unrelated DIFFERS still fails the run. The corrected baseline:

build_00/01        max 3    OK          press_start(_jp)   max 1    OK
title              max 6    DIFFERS     main_menu(_jp)     max 4    DIFFERS
extras(_jp)        max 3    OK          title_jp           max 155  DIFFERS
publisher_logo(_r) max 1    OK          developer_logos(_r) max 2   OK
build_12 / build_15                     BLANK  ← previously OK

Fourteen rows, not sixteen. No new drift among the fourteen.

Refutation attempt — the loading-screen variants, and it survived

The Decoder's ui-title-build-map.md says entries 0/1 are the plain loading variant at 7 elements and 12/15 the dressed one at 10, the three additions being pgloading_eff00, pgloading_loop5 and pgloading_baseeff. Checked against this export, which addresses by pak entry:

entry elements
0, 1 7 — eff01 eff02 line loop1 loop3 loop4 str
12, 15 10 — the same seven plus baseeff, eff00, loop5

Exact, in both the count and the identity of the three. The claim survives, and it paid for itself immediately: the two variants differing by exactly the black quad is what made build_00 a control for build_12 and turned "the loading screen is black" into "this one element blacks it out".

🔴 The voice export is known incomplete — the game decodes all three streams at once

The Decoder booted with Canary's --xma_param_probe=true — the cvar whose own comment exists to say which sub-wave a movie's .slb the game decodes — and the answer is that it does not pick one. It decodes all three, concurrently, in three separate XMA contexts.

ctx packets byte_size disc payload (RIFF − 60)
0 632 1 294 336 1 294 396
1 546 1 118 208 1 118 268
2 572 1 171 456 1 171 516

Three-way, byte-exact. So "three presentations of one take, pick one" is refuted by the running game, and the question I had been arguing about — which presentation — has no answer, because its premise was wrong.

This one was not caught by a census, and could not have been

The last three claims of mine that overreached were all killed by counting something. This one survived every count available: the streams really are equal-duration, one really is silence, one really is 0.60 × another with the residual 26.8 dB down. Every measurement was right and the frame around them was wrong, and no amount of looking harder at the file would have moved it — the file says ChannelMask = 0x0002 on all three. It took the running game.

That is the mission's own sentence arriving in practice: the Port has no oracle — if it needs to know what the game does, it asks. I did ask, repeatedly, and each time for the wrong thing: which stream, rather than whether the premise held.

What changed, and what deliberately did not

The behaviour is held. Reverting to the 1/n sum is not obviously less wrong: an equal-gain sum of channel pairs is not a downmix — MISSION §6 makes exactly that point when it pins an explicit matrix for the movies' 5.1 fold rather than letting ffmpeg default — and the sum cost S00A 6.02 dB when one stream was silence. Swapping one guess for another on the strength of a message is what produced this entry twice already.

What changed is that the wrongness is now loud. ⚠️ This failure sounds like success: a single stream decodes to clean, audible dialogue, so nothing a listener hears reveals that two streams are missing. So it is stated in three places a reader cannot miss — a top-level manifest.json warning per movie, the console line (1 of 3 streams [refuted] -- KNOWN INCOMPLETE), and the entry's own why — and 🟡 became 🔴 in authored/audio.json and BLOCKED.md.

🟡 "They are 5.1" is the Decoder's hypothesis and is not established. Three concurrent stereo streams is six channels and N stereo streams is how XMA carries multichannel on the 360, which would explain the differing byte rates, the near-silent stream, and why cues are 1-stream or 3-stream and never 2. Against it: all three declare ChannelMask = 0x0002 identically, which is odd for distinct channel roles. Nothing here builds on it.

What settles it, and it is asked: a recording of the game's own output over ADV, through the PulseAudio null sink (AUDIO-VERIFICATION §3). Candidate combinations of the three decoded streams can then be correlated against what the game actually played — which turns the channel-role question from a decode into a fit against an oracle. Twenty seconds over dialogue is enough.

The measurements survive; only their meaning moved

S00A's silent stream and ADV's 0.60 × relationship are untouched and now read as facts about channels: 0.60 × with the residual 26.8 dB down is what a correlated channel pair at a lower level looks like, and a silent channel is an unused one. Nothing measured here is retracted. What is retracted is every sentence that called them presentations.

🔴 The oracle capture does not contain the intro — a controlled negative

The Decoder took the capture I asked for — adv-game-output-6ch.wav, 70.2 s, 6 ch, 48 kHz, shared as 1788018994-16f9d19d90b8, taken at 68aa192 — described as "the FULL mix, the movie's own WMA track plus the three XMA streams".

It contains none of them. Envelope cross-correlation, sliding with overhang, normalised over the overlap, minimum 30 s of overlap so a short window cannot win on an edge:

capture ch against best r runner-up margin
c0 ADV bed 0.361 0.359 +0.003 no match
c1 ADV bed 0.407 0.403 +0.004 no match
c0 voice stream 1 / 2 / 3 0.42 / 0.26 / 0.27 — ≤ +0.006 no match
c1 voice stream 1 / 2 / 3 0.47 / 0.34 / 0.34 — ≤ +0.006 no match
c0 BGM_103 (menu bed) 0.271 0.260 +0.011 no match
c0 S00A 0.351 0.349 +0.002 no match

The margin is the number that matters, not r. A match has a peak; these have a plateau — best and second-best differ by 0.001–0.016 across every pairing, which is what a statistic does when no alignment exists.

Three controls, because a negative from an uncontrolled instrument is worthless

  1. The instrument finds matches on this data. bed vs bed → r = 1.000, margin +0.115. Voice stream 2 vs stream 3 → r = 1.000, margin +0.300.
  2. My reference really is the movie. The .ogv transcode against the disc's own ADV.wmv → r = 1.000, margin +0.114. So a failure to match is not my transcode.
  3. Time drift is ruled out. A stretched playback would break a long correlation while still matching locally, with the best lag climbing monotonically. Five-second windows of the capture slid over the whole bed give best lags of 4.95, 15.30, 119.35, 50.75, 29.35, 83.95 s — scattered across the movie, not monotonic, and every margin ≤ 0.017.

What I can say, and what I will not

Said: this capture cannot answer the channel-role question, and it is not the intro's audio. Not said: what it is. It is 70 s of something, all six channels carrying signal at RMS ≈ −27 dBFS, matching nothing this port exports. Diagnosing it is the Decoder's side of the wall and I have handed it back rather than guessing.

⚠️ One measurement on the file that may help them. Split as 5.1, channels 3 and 6 are byte-identical — same MD5, not merely the same peak and RMS to six decimals. An exact duplicate pair inside a six-channel "surround" output is consistent with the Decoder's own warning that the 6-channel frame is Xenia's hardcoded kFrameChannelsDefault, not the guest's request. It weakens, further, any reading of that file as evidence of a 5.1 game mix.

The voice export stays exactly as it is

Still one stream of three, still marked 🔴 in the manifest, the console line and authored/audio.json. The capture changed nothing, which is the correct outcome for a measurement that failed: the question is open, and it was open before. What would have been wrong is treating a 70 s recording as an oracle because it was expensive to obtain.

Resolved the same day — it was the capture path, and the duplicate pair was the thread

The Decoder found the cause and withdrew the capture: PulseAudio was remapping between two mismatched channel maps, and a 6-channel remap silently drops and duplicates. Its control needs no emulator and no disc — six channels, six different tones, the same sink and the same parec invocation — and came back 400 / 3200 / 200 / 800 / 800 / 200 for an input of 400 / 800 / 200 / 1600 / 3200 / 6400. Two source channels were gone entirely. Setting the sink's channel_map to the guest's own returns all six.

So the negative was right and, more usefully, the byte-identical pair I reported was the thread that unravelled it. That is worth recording precisely, because it was nearly not reported at all: it began as an idle check of two channels whose peak and RMS matched to six decimals, and the only reason it became evidence is that a coincidence at six decimals is cheaper to hash than to explain.

Withdrawn with the file, both the Decoder's: "all six channels carry signal", and the non-zero-surround observation offered as weak support for a 5.1 guest mix. Unaffected: the three-XMA-context concurrency result, which is read from the emulator's own log rather than the audio path, on two independent boots.

What the port took from it: tools/port/check-capture

A capture now has to pass a provenance check before anyone analyses it, and it is one command. It splits the file, hashes every channel and fails on any duplicate pair. Documented in docs/port/AUDIO-VERIFICATION.md §5.

Run through its own controls, both directions, because a checker nobody controlled is the thing this whole incident is about:

  • six distinct tones → PASS;
  • the remap's own output pattern → FAIL, naming all four duplicate pairs;
  • the corrupt game capture → FAIL on ch2 == ch5.

⚠️ The known-bad control is the part worth reading. All six of its channels report a peak of −18.063656 dB — identical to six decimals — while containing three duplicate pairs. A level check cannot see this failure at all. That is why the tool hashes rather than measures, and it is why the corrupt capture's "plausible per-channel levels" were never evidence of anything.

The tool says so itself: it is necessary, not sufficient. Passing means no channel was duplicated; it says nothing about whether the right thing was recorded. A capture should survive both that and §1's correlation against a known source before anything is concluded from it — and the one that was analysed here would have failed the cheap check in thirty seconds.

The corrupt file is withdrawn from the exchange (share drop), so the next agent cannot pick it up and repeat the work.

🔴 Take 2 is clean, my instrument was not, and the negative had to be re-earned

The Decoder's second capture passes check-capture — I re-ran it myself rather than cite theirs — carries a screen log, and was recorded with the sink's channel_map set equal to Canary's own. It is a good file.

⚠️ One provenance discrepancy, minor but worth stating: the message gives 253.3 s; the file is 318.539 s. The screen log runs to 316 s and is consistent with the file, so this is a mis-stated number rather than a bad capture — but a length quoted in a provenance claim should match the artefact.

The retraction that came out of measuring it

Take 2 also showed no alignment with the bed or the voice streams. Before reporting a second negative I asked whether the method could do the job at all, by building a synthetic mix — the bed plus the three voice streams — and hunting the bed inside it.

It failed. r = 0.415, against the r > 0.8 bar my earlier negatives were judged against.

So the instrument that produced "the capture contains no ADV audio" could not have found ADV audio in a mix even when it was certainly there. That conclusion was right — the Decoder's tone control proved take 1 corrupt independently — but it was right by luck, and I reported it as measurement. The three controls I was pleased with tested the wrong things: that the method finds a clean signal in a clean reference, which was never the task.

The rebuilt instrument, calibrated in both directions

Band-limit so the target dominates, then judge on lag and margin, not on absolute r — the r > 0.8 bar is correct clean-against-clean and meaningless for a component in a mix.

hunting band against r lag margin
the bed 40–180 Hz mix containing it 0.663 0.0 s ✓ +0.111
the bed 40–180 Hz voice-only mix 0.262 wrong ✗ +0.005
voice stream 2 300–3000 Hz mix containing it 0.810 0.0 s ✓ +0.248
voice stream 2 300–3000 Hz the bed alone 0.358 wrong ✗ +0.005

A 20–50× separation in the discriminating statistic. Documented as AUDIO-VERIFICATION.md §6.

And now the negative, supported

Every one of take 2's six channels, against both targets, sits in the known-absent regime:

bed (40–180 Hz) voice stream 2 (300–3000 Hz)
margins +0.000 … +0.014 +0.001 … +0.017
lags −58 … +255 s, scattered −72 … +183 s, scattered

Take 2 contains neither the movie's WMA bed nor the cutscene voice, on an instrument that demonstrably finds both when they are present.

What that leaves, and it is not mine to answer

Two captures, differently configured, the second provably free of the channel-map fault, with a screen log saying the movie was on screen — and neither carries either audio source. That points away from a one-off setup error. The possibilities I can see are a capture path that still loses the guest's mix, or the guest not emitting these sources at all during the movie, and only one side of that wall can tell them apart. Handed back with the numbers.

⚠️ If it is the second, it reaches the port directly: the export's movie audio comes from the .wmv's WMA track, and if the game never plays that track, then ADV.ogv's audio is wrong in a way no amount of transcode fidelity would fix. I am not asserting that — it is a question about what the game does — but it is the reason this is worth another boot rather than being written off.

Every music bank was summed at 1/3 when only two sub-waves are music — 3.52 dB, since P6

The Decoder's message about BGM_102 came with declared durations from the corrected XMA1 PsuedoBytesPerSec, and checking my export against them turned up a defect of mine that had been shipping since P6.

export_bgm summed every sub-wave media returned and scaled by 1/n. Decoded and timed, the three banks are identical in shape:

bank sub-wave 0 sub-wave 1 sub-wave 2
BGM_103 10 300 B → 0.009 s, peak −inf 3 876 924 B → 87.744 s 3 930 172 B → 87.744 s
BGM_102 10 300 B → 0.009 s, peak −inf 1 151 036 B → 37.482 s 1 269 820 B → 37.482 s
BGM_001 10 300 B → 0.009 s, peak −inf 4 466 748 B → 173.809 s 4 673 596 B → 173.809 s

Sub-wave 0 is digitally silent in all three, and 10 300 B is 10 240 + a 60-byte RIFF wrapper — 10 240 B being exactly what the Decoder's disc-wide census identifies as the bank header. So it is not a stem. Counting it in the divisor put every real stem at 1/3 instead of 1/2: 3.52 dB of attenuation on all the menu music this port has shipped since P6.

Dropping it is arithmetic, not a decoding decision — a silent input contributes nothing to a sum, and this is the same rule export_voice already applies. Measured after the fix: main_menu.ogg goes −7.69 → −4.20 dBFS, +3.49 dB against 3.52 predicted, the remainder being Vorbis.

⚠️ This is the third instance of one defect in this pipeline — a silent chunk in the voice sum, a silent channel in the mono fold, and now a silent sub-wave in the music sum. Each was invisible in every check except a level, and each time the divisor was computed from how many inputs there are rather than how many carry signal. That is the shape to look for, not the individual bug.

It also closes a 🔴 that has been open since P6

docs/port/BLOCKED.md carried "media::sound_bank_riffs returns three sub-waves where HANDOFF Q10's census says two" as a disagreement the port shipped deliberately. The census was right; the third was never a stem. The export now reports 2 sub-waves and the warning is gone — closed by measurement on my side, corroborating the Decoder's c1f3608 from a different direction (decoding it, rather than counting headers).

The declared-rate method, cross-checked a third time — and one correction

Their declared lengths against my decodes: BGM_103 87.750/87.749 vs 87.744; BGM_102 37.487 vs 37.482; BGM_001 173.821 vs 173.809. Agreement to 5–12 ms on three banks. The method is good for lengths.

🟢 Refutation attempt, and the conclusion survives while the reasoning does not. The Decoder wrote that BGM_001 reads "173.821 s declared against your decoded 167.663 s — a gap of 6.158 s", explaining it as "declared is the encoded stream, decoded is where the audio stops." A full decode of BGM_001 yields 173.809 s of PCM, not 167.663 s. The 167.663 figure is where the music fades out, measured from the audio; the stream then continues, silent, to its declared end. So declared and decoded agree to 12 ms and the trailing silence is inside the decode, not the difference between two methods. The cross-check stands — better than stated, since it is now three banks rather than a coincidence — and the sentence explaining it should go.

Take 2 was starved, my correlator was fine, and check-capture was incomplete

The Decoder diagnosed take 2: a starved capture. Verified here independently rather than taken on trust — 35.6 % of frames silent on all six channels, 10 482 alternating runs, median burst 13.5 ms and gap 3.9 ms, a 17.4 ms period at 57 Hz. Their untruncated original reads 39.3 % and 10 595 runs; the difference is exactly the truncation, and every other number agrees.

So my rebuilt correlator was working correctly on a file that could not carry the signal. ✅ And the alarming reading it produced — "the game may not play the .wmv's WMA track, so ADV.ogv's audio has been wrong since P4" — is not supported by this capture, and is not refuted either. It is withdrawn as a concern arising from evidence, and nothing is changed on account of it in either direction. That matters more than it looks: it was the most expensive-to-act-on hypothesis in the port, and it came from a file that could not speak to it.

The real deliverable: my own checker passed the starved file

check-capture tested only for duplicated channels, so it cleared a recording that was 36 % holes. A provenance check that passes the artefact it was built in response to is not a check.

It now measures starvation too. ⚠️ Two thresholds I invented were both wrong, and the controls caught both — which is the part worth recording:

  1. Counting exact-zero frames. Real audio crosses zero constantly; a clean voice track scored 5 947 "gaps" of median 0.0 ms and was called starved. A gap is a run, not a sample. Only runs ≥ 1 ms count.
  2. Gap count and median length. A genuine music bed shows 454 gaps at a median of 1.4 ms — quiet 16-bit passages really are zero for milliseconds — so neither statistic separates it from a starved file.

What separates them is the rate:

gaps/s median gap all-channel silence
the starved capture 32.9 3.9 ms 35.6 %
a real music+SFX bed 3.3 1.4 ms 1.1 %
a voice track, 53 % pauses 0.03 — —

Bar set at 20 gaps/s — 1.6× below the bad case, 6× above the worst good one, derived from the controls rather than chosen and then justified. Controlled in both directions: real stereo bed PASS, six distinct tones PASS, starved capture FAIL. It also now reports a data chunk declaring 0 bytes, which is what a file copied while still being written looks like.

🔴 The voice channel roles are not obtainable this session

Both capture routes are closed and the Decoder has said so plainly. The monitor sink is starved by construction — it advances at wall-clock rate and substitutes silence, so every moment the emulator runs slow is a hole, and deleting the holes warps the timebase rather than repairing it. The route that works is an internal tap at SDLAudioDriver::SubmitFrame, and that needs a Canary rebuild whose cost they have measured: the build root build-canary targets does not exist in that container, the warm tree is configured against the same missing path, so it is a full reconfigure and compile on a box with ~700 MB free and a history of parallel builds OOM-killing the host.

A whole session for one probe. That is a human's call and neither agent should start it mid-loop. Until then the port keeps authoring with the known recorded: one stream of three, 🔴 in the manifest, the console line and authored/audio.json.

The settle run carries an unmeasured real-time factor — and the numbers it touches were already unauthored

The Decoder has withdrawn one of the two arguments propping up its settle-time run. It had claimed the plate pulse period was an internal clock proving the run was not slowed; re-examined, that estimate rests on one interval at a 125 ms sample interval (±6.7 %), and re-running the trough-picking gives 2.628 s rather than the 2.369 quoted — an adjacent local minimum had been counted as a separate trough. Against the corpus's 2.24 s that is +17.3 %. It is too weak to show anything and cannot resolve a real-time factor below ~7 %.

✅ Nothing in the port moves, and this is the second time in two iterations that the right call was to have authored nothing.

number from that run anchored by did the port take it?
title → plate, 2.247 s three prior readings (2.13 / 2.132 / 2.138) and the disc's declared 120 units ✅ it is what the port already draws
menu build-in, 0.531 s nothing ❌ not authored
Ⓑ → title, 0.482 s nothing ❌ not authored
Ⓐ → menu, 3.763 s contains a 1.53 s load stall ❌ explicitly refused

Checked rather than remembered: grep over authored/ and port/scripts/ finds no 0.531 and no 0.482. The only build-in reference in the tree is the plate arithmetic — t=118 → t=238, 120 units — which is the anchored leg.

I declined those two because they were one-run figures the Decoder had itself flagged, and because the port was already within ~0.1 s of both from the disc's own keyframes. That reasoning has now been joined by a second, independent one I did not have at the time: a few per cent of slowdown sits inside them undetected. A provisional measurement adopted over a decoded number would have imported an error nobody could see.

verify-dwell — the comparison that refuted my own 🔴, made repeatable

Last iteration I measured the port's visible spans against the oracle's dwells by hand, and it refuted a red flag I had filed myself: rest.t is the wrong settle landmark, but "everything the sequencer paces off it is therefore late" was false, and I nearly went and re-paced screens that already matched.

That check existed once, in a transcript. It is now tools/port/verify-dwell.

screen               port         oracle (3 cold boots)      verdict
publisher wordmark   4.25 s       4.297 / 4.604 / 4.370      agrees
developer logos      3.75 s       3.508 / 3.503 / 3.366      agrees

⚠️ The trap it exists to prevent is in its header, because it is the whole point: a port's transition timestamps and the oracle's visible spans are not the same quantity — they differ by the exit ramp plus the black hold, about 0.6 s, which was the entire discrepancy I was about to chase. This corpus has been bitten by the identical confusion before, on the plate delay, where the two readings differ by 0.48 s against 6 ms.

The bar is the oracle's own run-to-run spread, plus one film interval. Three cold boots of the real game differ by 0.3 s; agreeing more tightly than the oracle agrees with itself would not mean anything, and a tighter bar would be a number chosen to look impressive. The developer-logo span read 3.50 s on the hand-run and 3.75 s here — one film interval apart, both inside the bar, which is the tool reporting its own resolution honestly rather than hiding it.

The oracle's numbers are quoted in the script as a test fixture and labelled as the oracle's, with the RE document they come from. Nothing in the port derives them and nothing may.

The PRESS Ⓐ plate pulses — authored per element, because the census forbids a rule

The human listed pulsation as first-class and the port drew nothing at all: the plate's focus record ptbtn00f was never reached, because press_start has no buttons and nothing is focused.

That it loops is measured, not assumed. The corpus timed the pulse four times — 2.12 / 2.19 / 2.34 / 2.31 s — and you cannot measure a period unless the thing repeats.

The rule I was going to write, and the census that forbade it

The spinning ring is a rule in the renderer (spin_period_units) and it earns that: 16 of 212 elements match its shape and all 16 are focus rings, zero false positives. So I looked for the analogous shape for a pulse — a group whose keyframes vary only in alpha, whose first and last alpha are equal, a closed cycle. ptbtn00f fits it exactly: 0 → 6 → 74 → 80 → 80 → 74 → 6 → 0.

Censused before writing it: 82 of 212 elements match. ptcopyright, palogo_sqex, ptmsg, ptlogo_back2, and every _eff fade-in-hold-fade-out on every screen. A renderer rule on that shape would make the copyright notice pulse.

Narrowing to focus records leaves exactly one distinct element (plus its JP twin). A rule justified by n = 1 is a special case wearing a rule's clothes. So the pulse is a lookup in authored/timing.json, keyed <screen>/<element>, and the census is recorded beside it so nobody widens it later.

The period is the element's own group — and the alternative is stated

129 units: its last timed keyframe is t=105, and the final untimed keyframe is reached exit_ramp_units (24) later. No new constant — 24 is the same authored value every other element's exit already uses. That is 2.150 s at 60 units/s, or 2.295 s at the ~28.1 fps the emulator presents, against measurements of 2.12–2.34 s. It sits inside the spread at either rate.

⚠️ It is a choice, and the alternative cannot be ruled out: the cycle could restart at the group's first keyframe (t=6) rather than at 0, giving 123 units = 2.050 / 2.189 s — also inside the measured spread. Nothing available separates them. t=0 is taken because it is where every other group in this port starts, which is consistency and not evidence, and authored/timing.json says so.

A fifth reading is recorded and not averaged in: the Decoder re-picked its troughs and got 2.628 s having previously reported 2.369 from the same run, then withdrew the estimate as too weak to resolve better than ~7 %.

Verified the way the ring was — bit-identity one period apart

20 authored periods is 2.15 × 20 = 43.00 s = exactly 172 film frames, so frames N and N+172 must be the same frame:

max difference
f_055 vs f_227 (43.00 s) 0/255
f_060 vs f_232 (43.00 s) 1/255
f_070 vs f_242 (43.00 s) 1/255
f_079 vs f_251 (43.00 s) 0/255
control — f_070 vs f_243 (43.25 s) 58.7/255

The control is what makes the rest mean anything: a quarter-second off the period differs by 58.7, on the period by 0–1. Measured on the held boot title, where the glow-box mean swings 26.0 ↔ 37.7 — a real pulse, not a static glow.

✅ The oracle finally speaks: the exported voice IS the game's centre channel

The Decoder's fourth capture is the first faithful one — --gpu=null takes the guest from 0.70× to 0.96× real time so Xenia stops padding, an ALSA file tee in front of a paced slave removes PulseAudio's wall clock entirely. 59.7 s, 0.35 % silence, one gap in the whole file, six distinct channel hashes. Checked here independently: it passes check-capture, and its header sizes verify exactly (RIFF 34 369 572 / data 34 369 536 against 34 369 580 actual).

The correlator was already calibrated, so the fit was a re-run rather than a rebuild. Controls first, on this instrument: known-present margin +0.248, known-absent +0.005.

Speech band, 300–3000 Hz

FL FR FC LFE RL RR
stream 1 (leading) +0.013 +0.006 +0.012 +0.009 +0.012 +0.005
stream 2 — the one exported +0.238 +0.171 +0.305 +0.011 +0.035 +0.006
stream 3 +0.240 +0.173 +0.307 +0.009 +0.054 +0.006

r = 0.989 on FC, margin +0.305 — above the known-present control. And the bed, in the low band, is the mirror image: FL 0.763 / FR 0.838 / RL 0.805 / RR 0.817, all agreeing on the same lag, and FC 0.317.

What is established, and what is not

✅ The capture contains ADV's audio, at lag ≈ +6.6–6.7 s — agreed by two independent bands and by six channels.

✅ The dialogue is in the centre channel and the bed is in the four corners. FC carries the voice and not the bed; FL/FR/RL/RR carry the bed and not the voice. That is a textbook film mix, and it is measured rather than inferred from a header — which matters, because the header says ChannelMask = 0x0002 on all three streams and would never have told us.

✅ The port's exported voice file is the material the game plays in FC. The loudest choice in authored/audio.json — which I recorded as an unjustified choice — selects the dialogue. A mono voice file played into the mix is the right approximation of a centre channel.

⚠️ Streams 2 and 3 are indistinguishable to this instrument, and that is expected: I measured months-of-iterations ago that stream 3 is 0.60 × stream 2 with the residual 26.8 dB down. They are the same take at two levels, so they correlate identically with everything. This does not say loudest picked the right one of the two — only that whichever it picked is the dialogue.

⚠️ Stream 1 is not detectable in this window, margins +0.005…+0.013. Consistent with it being the tail of stream 2 (measured earlier at r = 0.998) and with a 59.7 s window that starts before the tail.

🔴 The 1 of 3 streams [refuted] warning stays. Nothing here explains what the other two contribute to the game's output, and the export still ships one. What changed is its character: it is no longer "one of three, contents unknown" but "the centre-channel dialogue, plus two streams whose relationship to it is measured and whose role is not."

⚠️ And the reach: 59.7 s of a 137 s movie, one run, at 0.96× real time. The --gpu=null route costs video, so this capture has no screen provenance — its provenance is the XMA probe showing ADV's three streams decoding during the run, which for an audio question evidences the thing recorded rather than what was on screen.

The stripping control passes — S00A is obtainable, and the gate is cleared

The Decoder made this the gate on S00A, and it is the right call: ADV plays itself on boot so it can be captured with --gpu=null at 0.96× real time, but S00A starts ~4.5 s after Ⓐ on a save slot, which needs a driven run, which needs screens, which rules out --gpu=null. So S00A is necessarily the 0.70× rendered route with ~10 % additive padding — and is only worth a boot if stripping that padding is exact.

It is. A real music+SFX bed (137.37 s, carrying 454 genuine zero runs of its own) had 1 149 holes inserted at 8.37/s to +9.9 % length, matching the observed ALSA profile, then was stripped and correlated in the low band:

r lag margin
original vs itself — ceiling 1.000 0.0 s +0.141
padded vs original — what padding costs 0.436 −12.2 s +0.006
stripped vs original — recovered 1.000 0.0 s +0.142
stripped vs original-also-stripped 1.000 0.0 s +0.143

Two things worth reading off that table.

First, padding at that profile destroys correlation completely — r 0.436, margin +0.006, which is the known-absent regime. That independently confirms, on a file whose contents I control, that the earlier captures were unusable for the reason claimed rather than for some other reason.

Second, recovery does not require stripping both sides. The stripped capture matches the unstripped source at the ceiling. That matters operationally: the port's reference assets never need touching.

⚠️ What the control does not license. Stripping removes genuine silence too and cannot tell the two apart. On this material the genuine runs total 0.71 s in 137 s and cost nothing measurable; on material that is mostly silence they would. And the whole thing rests on the substituted-versus-additive distinction — it is valid for Xenia's ALSA padding, which inserts, and it is vandalism on a PulseAudio monitor capture, which substitutes. tools/port/strip-padding says so in its header before it says anything else, because running it on the wrong artefact would look like it worked.

Its output is byte-identical to the control's own stripping, so the tool and the experiment are the same operation rather than two implementations that agree.

The correctness harness the docs promised for eight milestones did not exist

tools/port/verify-screen, line 20, since P1: "Use tools/port/verify-capture for the correctness question." There was no such file. The port has had a harness comparing itself to sylpheed-cli — two renderers sharing its assumptions — and none comparing it to the game, while its own documentation said otherwise.

docs/re/captures/ORACLE-CAPTURES.md is blunt about why that matters: two renderers agreeing proves nothing, and this corpus has been bitten three times — the dropped pteff05 background, the scale-0 rect, rest() — each invisible to a render-vs-render diff and obvious against a capture.

tools/port/verify-capture now exists. Five screens, against framebuffer captures of the real game:

screen RMSE differing note
main_menu 14.79 0.25 % focus state may differ
extras 15.29 0.46 % focus state may differ
title 21.07 1.82 % ptloop sweeps never stop
publisher_logo 10.77 1.00 %
developer_logos 9.37 0.39 %

No screen shows a large connected blob — the shape a missing or misplaced element makes, and the shape all three historical failures made. The differences are scattered, and the two largest have stated causes.

74 % of main_menu's difference is the oracle's own focus signature

The corpus ships live-main-menu.png and live-main-menu-options-focused.png — the same screen with a different button lit. Their difference is what focus changes, measured by the oracle against itself. Of the port's 2 159 differing pixels, 1 599 — 74.1 % — fall inside that signature. So the bulk of the disagreement is a state mismatch (the port focuses NEW GAME, authored, because HANDOFF Q5 measured initial focus as unstable), not a rendering defect.

Refutation attempt — the tone curve survives in its stated reach and not past it

ui-render-tone-curve.md models the relationship as capture = 255·(render/255)^γ, γ ≈ 1.34–1.49, measured on dark flat patches (render ~0–60), with "nothing constrains midtones or highlights" written into its own reach.

I tried to fit that γ and got contradictory answers three times, and the contradictions were mine. Binning every structurally matched pixel of main_menu by render level gives the relationship directly:

render capture implied γ pixels
8 4.04 1.20 183 026
16 7.89 1.26 227 630
24 15.57 1.18 100 945
32 26.15 1.10 87 474
40 38.07 1.03 86 094
48 53.96 0.93 85 255
64 78.52 0.85 6 509
96 130.44 0.69 1 682

✅ The claim survives where it was measured. In the darks the capture really is darker than the render and γ > 1.

🔴 It is not a single power law. The implied exponent falls monotonically and crosses 1.0 near render ≈ 44 — above that the capture is brighter. One exponent cannot express a curve that crosses unity, which is precisely why my whole-frame fits kept returning γ = 1.00: the darks want more than 1 and the midtones want less, and they cancel.

So the corpus's stated reach was not a hedge, it was the finding. ⚠️ And the exponent in the darks measures 1.18–1.26 here against the page's 1.49 for this screen — a disagreement I am recording rather than resolving, since they fit selected flat patches and I binned every matched pixel.

The tool reports the curve, not a best exponent

Two earlier versions of verify-capture reported a best-fit γ and were wrong both times — once by fitting across a 74 % structural mismatch, once by extrapolating past a reach the measurement's own authors had written down. Extrapolating a measurement past its stated reach is how this tool got it wrong twice, and the answer was not a better fit but a different instrument: a table somebody can argue with.

Identifying the capture's focused button — and my harness was posing the port wrong

The Decoder attached an honest caveat to its reproduction of the tone-curve refutation: its bins included the focus-state mismatch, so it was "not a clean second opinion". That is removable, and removing it found a defect of mine.

The method, with a known-answer control

--menu=main_menu --script=down,down,down,down walks focus through all five buttons and shoots each. Compare every one against a capture; the minimum identifies the focused button. The control is the capture whose answer is in its own filename:

render focus vs live-main-menu-options-focused vs live-main-menu
ptbtn01 NEW GAME 6 351 531
ptbtn02 LOAD GAME 7 087 7 094
ptbtn03 TUTORIAL 6 230 6 237
ptbtn04 OPTIONS 1 292 6 364
ptbtn05 EXTRAS 6 073 6 080

✅ The control picks OPTIONS, by 4.7× — the answer the filename gives. ✅ So the test is trustworthy, and live-main-menu.png has NEW GAME focused, by 11.5×.

Which is what the port already focuses. authored/flow.json's initial_focus: ptbtn01 was chosen because HANDOFF Q5 measured focus as unstable across boots — four boots gave TUTORIAL, TUTORIAL, NEW GAME, NEW GAME — and it is one of the two observed states. It is now also the state of the committed capture. ⚠️ That is corroboration, not a decode: Q5's instability stands, and this identifies one frame rather than a rule.

The defect: verify-capture rendered menus with no focus at all

--screen= draws no focus record, so the harness had been comparing main_menu to the oracle in a state the oracle was never in. Rendered properly, with --menu=:

before after
main_menu 0.25 % differing, RMSE 14.79 0.06 %, RMSE 13.21
extras 0.46 %, RMSE 15.29 0.20 %, RMSE 13.38

A 4× improvement on main_menu that was entirely my harness posing the port wrong, not the port drawing wrong. Worth stating plainly: the first run of a new correctness harness reported a discrepancy, and three quarters of it was the harness.

And the Decoder's caveat resolves to nothing — measured, not assumed

Re-deriving the transfer curve on the correctly-posed pair gives 1.20 / 1.26 / 1.18 / 1.10 / 1.03 / 0.94 at render 8…48 — unchanged from the mismatched run. So the focus-state contamination it flagged really did not move the trend. Its reproduction stands as a second opinion after all, and that is now a measurement rather than a hope.

tools/port/which-focus — the Decoder asked for a detector, and it carries its own control

S00A is blocked on knowing which button a screenshot has focused. newgame_path.sh assumed NEW GAME is focused at boot, drove on that assumption, and landed in a tutorial mission — because HANDOFF Q5 measured focus as unstable across boots. And counting presses cannot substitute: ⬆ from the first item wraps to the last, so no fixed number of presses lands on a known item from an unknown start.

The Decoder's own attempt — a per-row brightness statistic — failed the control, picking NEW GAME on the capture whose filename says OPTIONS. The render-difference method passes it, so it is now a script that agent can run.

It runs the control on every invocation, not once when it was written

control -- live-main-menu-options-focused.png (answer is in the filename):
    OPTIONS      1285      <- picked
    EXTRAS       6073
    ...
  -> OPTIONS, margin 4.7x     CONTROL PASSED

If that fails, the tool refuses to report a result at all. A control that does not execute is not a control, and this one cannot be skipped.

Three checks, and one of them independently reproduces a corpus measurement

input verdict margin
live-main-menu-options-focused — known answer OPTIONS 4.7×
live-main-menu — the question NEW GAME 11.4×
live-extras — known from the corpus MISSION SELECT 4.2×
live-title-press-a — no menu at all refuses 1.0×

The extras row is a second known answer I did not plant: authored/flow.json already records "MEASURED: EXTRAS opens focused on MISSION SELECT (live-extras.png)", and the tool reaches it independently.

The title row is the negative control. A frame with no menu in it gives a margin of 1.0× and the tool says "this frame does not decide it. Do not act on this."

⚠️ And that refusal now carries a non-zero exit code. The first version printed the warning and exited 0 — so a caller scripting it, which is the entire point, would have read a refusal as an answer. That is the same defect as a checker claiming a check it skipped, and it is the fifth instance of that shape between the two of us this session.

What it is not: it identifies focus in one frame. It says nothing about what selects focus; Q5's instability stands.

The title's 1.82 % — three of my own explanations refuted, and the format has no blend mode

title is the port's largest disagreement with the oracle, and last iteration I attributed it to the moving ptloop sweeps without checking. That attribution is wrong, and so were the two hypotheses I formed after it.

❌ Not the sweeps. ptloop01/ptloop02 are 399×180 at (441, 270) — small and central — and their exported keyframes hold pos, scale and rotation constant, varying only alpha. The difference peaks at x ≈ 1088, nowhere near them.

❌ Not an over-held element. --screen holds every element at its own rest.t, so I added --no-hold to render the other answer. Playing the title's groups past their rest fades the whole screen to black by t = 5.2 s — 30.97 % differing against 1.82 % held. Holding at rest is right.

❌ Not a timing offset. Sweeping the build-in: 24.05 % at t=1.6, falling monotonically to 1.68 % at t=4.18 and 1.82 % settled. The capture is at the settled end; there is no earlier moment that fits better than marginally.

What it actually looks like: a horizontal redistribution

Signed difference (port − capture), by cell:

x=0 x=320 x=640 x=960
y=0 +1.1 −13.1 −6.6 +16.0
y=169 +2.1 −8.3 +4.2 +9.9
y=338 +5.8 −4.5 −0.0 +3.2
y=507 +3.9 +3.3 +2.0 +2.3

The port is darker centre-left and brighter right, and it nearly cancels — whole-frame means 63.8 against 62.5. That is not a level error and not a tone ramp; it is brightness in the wrong place. And it falls in exactly the rows spanned by the two wide elements ptlogo_back2 (1118×262 at 71,126) and ptlogo_back2eff (1133×280 at 64,117), with the column profile falling off past x≈1152 against their right edges at 1189 and 1197.

🔴 The export carries no blend mode, so the port cannot draw one

ptlogo_back2eff's exported keys are declared, id, index, keyframes, kind_raw, layer, layer_source, pivot, rest, role, sprite. There is no blend field, in this element or in FORMAT.md at all. The port composites everything with normal alpha.

If the game draws _eff layers additively, a wide gradient sprite would produce precisely this signature — surplus where the sprite is bright, deficit where the underlying art is brighter than the sum — and nothing in the export would reveal it. That is a decoding question, not a port one, and it is asked rather than assumed. ⚠️ It is a hypothesis I have not tested; I am recording it because the three I could test are dead.

A separate rest.t casualty, recorded and not acted on

pteff02 is a full-frame primitive whose group runs 0x40000000 (25 % black) at t=46 → 0xd4000000 at 76 → 0xcc000000 at 118 → 0x00000000 at 236. Its rest.t is 46, so the port holds a 25 % black veil the screen's own timeline removes. This is the third instance of rest.t naming a hold that is not the settled state — after the loading screen's opaque quad and ptlogo1's creep. ⚠️ It does not explain the residual — removing a darkening veil would make the port brighter still, and it is already brighter where it disagrees — so it is recorded rather than fixed.

And a new diagnostic

--no-hold plays a screen past its rest instead of clamping each element at rest.t. Added because the question "is the held pose what the idle game shows" could not be asked otherwise. ⚠️ Its first version set the flag thirty lines before view exists and silently rendered nothing — caught because the comparison loop found no files, not because anything reported an error.

🔴 The exporter dropped nested .rat leaf geometry on 45 elements — and it is the title's 1.82 %

The Decoder overturned one of my three eliminations, and it was the one I was most confident about. I ruled out the ptloop sweeps because "399×180 at (441, 270), keyframes hold position constant" — that is the parent's record. The geometry is in the leaf, and the exporter never opened it.

parent (what the export shipped) leaf ptloopNN.rat
ptloop01 scale (100, 100), rot 0, pos (441, 270) fixed scale (100, 600), rot +30°, x sweeping −639 → −39 → 1521
ptloop02 scale (100, 100), rot 0, pos (441, 270) fixed scale (100, 800), rot −45°, x sweeping 1721 → 1111 → −839

Two ~1080 and ~1440 px quads leaning opposite ways and sweeping across the frame, against two 400 px sprites drawn upright and static in the middle. That is exactly the signature I measured — darker centre-left, brighter right, nearly cancelling — and the Decoder's GPU capture puts their centres at x ≈ 467 and 992, which are the two cells where my signed difference peaked.

ui_layout's own doc comment had said so: "the rotated quads come from its two nested .rat leaf records, which the census never opened." Neither did this exporter. It opened a leaf in exactly one place — highlight_name, for focus records — and nowhere else.

It is not two elements. It is 45

screen elements with a dropped leaf
main_menu, extras, press_start (+ JP twins) every button — ptbtn01.rat … ptbtn13.rat, ptbtn00.rat
title, extras ptloop01.rat, ptloop02.rat
build_00/01/12/15 pgloading_loop1/3/4/5.rat
title_jp ptlogo_eff2.rat — two elements

⚠️ The buttons are the benign case and screen.rs already knew it: "a BASE record's leaf duplicates the parent's placement and the two can differ by a unit (ptbtn04: parent y=401, leaf y=402). There the parent wins." The ptloop case is the opposite — the parent carries no geometry at all and the leaf carries all of it. 🟡 And title_jp's ptlogo_eff2 is the element DECISIONS has recorded since P1 as the single largest render disagreement in the export, "the one drawn element at a scale that is not a whole multiple of 100 %". It has a two-element leaf. That is a lead, not a conclusion.

Emitted, deliberately not drawn

Element::leaf now ships the decoded leaf, and one read_leaf closure serves both it and the focus path — a second copy is how the case would go missing again.

🔴 ScreenView ignores it, and that is the honest state. Parent and leaf each carry their own alpha ramp on a different span — parent 0 → 255 over t=70…238, leaf 255 → 0x80 → 255 over t=150…600 — so how the two compose is a decoding question, and drawing the leaf on a guess would replace a visible 1.82 % gap with an invisible wrong one. verify-screen confirms nothing moved: title still max 6 / over3 790, main_menu max 4, title_jp max 155.

✅ Additive blending is refuted — the Decoder tested T8aD +0x04 bit 0x02 as an additive selector and "every measure worsens". My blend-mode hypothesis from last iteration is dead, and the export carries no blend field because none has been found: the per-draw capture records primitive type, index count, shader hashes, texture bindings and vertex attribute 0, and no RB_BLENDCONTROL.

🔵 And this makes the port's biggest oracle gap the same item as the rotation question already standing with the human. sylpheed-cli screen render deliberately does not rotate, which is why both renderers show it — the Decoder measures its own residual as tiles running −38.6 then +33.8 and cancelling, the same shape as mine. It is a shared decode gap, not a defect in my compositor, and MISSION's "Needs a human decision — rotation" now has a number attached: 1.82 % of the title's pixels, in a signature that can be recognised.

The leaf composition is decoded and implemented — and it does not close the 1.82 %

The Decoder decoded the rule I refused to guess: draw the leaf on its own timeline; do not multiply the parent's alpha in. Multiplying is refuted, not merely unsupported — at the fitted time the parent has expired (its group returns to 0 at t=250 and holds), so leaf × parent / 255 predicts zero for both quads and the sweeps would be invisible. They are drawn.

The fit is worth repeating because of its shape: the game's own composed alpha is observable in the per-draw vertex colours (C3FFFFFF/B6FFFFFF = 195 and 182), fitting only those two numbers against the two leaf ramps gives one consistent time t = 355, and the same t then predicts quad centres at 981 and 478 against 992.0 and 467.2 measured. No x entered the fit.

Implemented: _draw_leaf runs the leaf unclamped — like the spinning ring, and for the same reason. Held at its own rest.t the leaf sits at x = 1521, entirely off the right edge, so holding would delete the sweeps rather than settle them.

🔴 And it changes nothing measurable. The title is still 1.82 %

t units differing
4.35 s 261 1.82 %
5.917 s 355 1.81 %
7.00 s 420 1.79 %

At t=355 my interpolation puts the leaf's top-left at x ≈ −324 — off-screen left — where the Decoder's model puts the quad's centre at 981. Those cannot both be right, and the gap is not something to tune away: it is a disagreement about how the leaf's keyframes become a placed quad, most likely in the pivot and the rotation about it. Handed back with both numbers.

So the honest state: the exporter no longer drops the data, the composition rule is implemented as decoded, and the port's largest oracle gap is exactly where it was. Fixing the export was necessary and was not sufficient.

Two flagged elements deliberately not drawn

authored/rendering.json narrows drawing to ptloop01/ptloop02 — what the decode covers — while the exporter keeps flagging all 15.

  • title_jp/ptlogo_eff2 — parent 125 % at (412,96), leaf 100 % at (402,66). The same shape, and the element DECISIONS has recorded since P1 as the largest render disagreement in the export. The Decoder said plainly "I have not tested it." Drawing it would extend a decode past the case it was fitted on — the failure this port has made four times this session.
  • pgloading_loop5 — leaf scale (0, 0). A zero scale is one of the three historical failures this corpus names, so it is exactly where a guess costs most.

⚠️ And neither can be adjudicated here. title_jp has no oracle capture, and verify-screen compares against sylpheed-cli, which draws no leaves at all — so any leaf drawing increases that divergence whether it is right or wrong. Its max went 155 → 232 when they were drawn, and that number is not evidence in either direction. Recognising it as uninformative is the reason it did not become a justification.

The −324 was the old keyframe association, and the corrected one is available today

The Decoder found it and it is not geometry: my leaf path pairs each pose with the next pose's time. Fed my pairing into its own interpolation, it reproduces −324 to the digit. Corrected, t=355 gives top-left 781 and centre 980.5 against 992.0 measured — so there was never a 1 300 px pivot mystery to look for, and I am glad I said the two numbers instead of hunting one.

🔴 Correcting BLOCKED: this was never gated on a branch landing

docs/port/BLOCKED.md has carried the keyframe-record-layout row as "NOT taken, and it cannot be taken yet … sylpheed-formats is a path dependency, so this reaches the port only when that branch lands on main."

That is wrong. The corrected association is in this checkout, behind an environment variable:

// Set `SYLPHEED_KF_TIME_SHIFT=1` to read `W[k-1]` as block `k`'s time
// ("the word is the time the NEXT pose is reached") instead of `W[k]`.

It has been switchable the whole time. I read that file twice this session — once for rotation_deg, once for the leaf note — and did not notice the switch.

The experiment, run: mixed, and not decisive for the reason that matters

Re-exported with SYLPHEED_KF_TIME_SHIFT=1 and asked the oracle:

screen default shifted
main_menu 13.21 / 0.06 % 13.81 / 0.10 % — worse
extras 13.38 / 0.20 % 13.95 / 0.24 % — worse
title 21.07 / 1.82 % 20.41 / 1.86 % — RMSE better, area worse
publisher_logo 10.77 / 1.00 % 9.05 / 0.75 % — better
developer_logos 9.37 / 0.39 % 8.86 / 0.33 % — better

⚠️ And it does not adjudicate the association, because the port's renderer is built for the other one. Under the shift the untimed keyframe moves from last to first — the leaf reads t=None at x=−639, then t=150, t=540 — while pose_at is written around "the final keyframe carries no t, so it is given a synthetic time exit_ramp_units after the last timed frame." So this measures a renderer/association mismatch, not the association. BLOCKED said as much: the change touches pose_at, settle_units, spin_period_units, exit_ramp_units and the plate.

Export reverted to the default. Adopting the shift is a real piece of work — re-deriving the exit ramp, the settle, the spin period and the plate against a layout where the untimed frame is the first — and doing it hastily at the end of an iteration is how a 1.8 % gap becomes five wrong ones.

⚠️ The methodological point, which is the Decoder's and is the best thing here

Its rule matched because alpha at t=355 sits inside a long segment where a one-keyframe shift barely moves it, while x sweeps 1 560 px over the same span. It confirmed on the insensitive quantity; I was wrong on the sensitive one; and neither of us saw it until the two were compared.

Check a new interpretation against the fastest-moving field you have, not the one that happens to agree.

That is a different failure from the ones this session has collected — not an uncontrolled instrument, but a control chosen where it could not fail.

❔ A residual 11.5 px (980.5 against 992.0) is left over and is not to be fitted. A rotation about a declared pivot rather than the centre would displace by roughly that; if it still matters once the association is adopted, it gets measured rather than derived.

Re-running the P5/P6 gate after eight iterations of changes

The leaf path, the plate pulse, the BGM level, the voice export, the focus fix and a new diagnostic flag have all landed since the gate was last actually run. The mission's test is "a human presses a d-pad and Ⓐ and moves through those screens", and I had been verifying pieces of that against captures without once re-running the whole walk.

It works. Nine steps, unattended:

step
⬇ ×4 ptbtn01 → ptbtn05 focus moves, every frame drawn
Ⓐ EXTRAS → screen extras, focus ptbtn11
Ⓑ back to main_menu, focus restored to ptbtn05 HANDOFF Q5's rule, live
⬆, Ⓐ ptbtn04 OPTIONS, destination outside this archive prints the gap rather than pretending

Filmstrip shared as 1788027380-788b1faafc3e. Every shot is non-blank (frame means 31.5–33.1).

The sound is verified by a null control, not by a detector

I first tried an onset detector: count sharp level rises in the recording. It found one onset in the walk — and the same one in the music bed alone, which contains no cues. The 50 ms envelope cannot see a short cue over the bed. ⚠️ The right response to a detector that cannot separate its control from its subject is to stop using it, not to widen the window until the numbers look better. That is the shape this session has hit five times.

So the same technique that settled the voice: shadow the three cues with silence through data/mods/, run the identical walk, and compare.

peak RMS
walk, cues playing +0.0003 dBFS −18.36
walk, cues silenced −4.74 dBFS −20.78

Silencing three sound effects costs 4.74 dB of peak and 2.43 dB of RMS, and the walk's peak is set by a cue rather than by the music. The mod log confirms exactly three files shadowed. No detector, no threshold, and the control is the same run with one input changed.

⚠️ Recorded under the Dummy driver, as everything audio here is. It shows the cues reach the Master bus at the right moments; it does not show they are the cues the game plays — that is HANDOFF Q8, and authored/audio.json still carries the offsets as measured rather than decoded.

Pinned formats-pin-2026-08-29c — and the knob I tested last iteration was retired

🔴 I tested the wrong switch. SYLPHEED_KF_TIME_SHIFT is a superseded partial fix: it got the association right but left pose 0 untimed, which is exactly why the untimed keyframe appeared to "move from last to first". It does not exist in the current parser. The real correction is the default in the tagged crate, with the old reading behind SYLPHEED_KF_TIME_LEGACY=1 — the opposite polarity from what I had.

So last iteration's five rows measured a renderer/association mismatch against a knob nobody should use. I suspected they were not decisive; I did not suspect the knob itself was retired.

The consequence is smaller than I budgeted for: there is no untimed keyframe

A placement group is an 8-byte header then frames × {u32 time; 36-byte pose}, so pose 0's time is the group's lead-in word and every pose is timed, including the last. Measured on the re-export: 866 keyframes, 0 untimed.

pose_at's premise — "the final keyframe carries no t, so it is given a synthetic time exit_ramp_units after the last timed frame" — does not invert, it disappears. The branch is now dead code rather than wrong code, which is why nothing needed re-deriving to adopt this.

And the leaf reads as the Decoder's table says: t=0 x=−639, t=150 x=−39, t=540 x=1521. At t=355 that interpolates to x = 781 — the top-left it predicted, and the 1 300 px discrepancy is gone.

Pinned by tag, which is what MISSION §2 is for

"The RE agent tags when it lands something you need and tells you over the message channel — that is how you stay current without floating."

That is precisely what happened, so crates/sylpheed-export/Cargo.toml now pins formats-pin-2026-08-29c by tag. ⚠️ BLOCKED.md was wrong in both directions — it said the change "cannot be taken yet" and that it arrives only when the branch lands on main. It arrives when the tag is pinned.

🔴 The cost, stated rather than discovered later: sylpheed-cli builds from the workspace crate, so until this reaches main the exporter and the reference renderer read different decoders, and verify-screen is comparing two eras rather than detecting drift. verify-capture is unaffected — it compares the port against oracle captures and never touches the CLI — and it is the check that matters. Revert to the path dependency the day the tag is an ancestor of main.

What the oracle says

screen before after
publisher_logo 1.00 % 0.75 %
developer_logos 0.39 % 0.33 %
extras 0.20 %, region 736×525 0.19 %, region 398×295 at (441,230)
main_menu 0.06 % 0.06 %
title 1.82 % 1.82 %

The splashes improve outright. ⚠️ extras is the interesting row: the area barely moved but its differing region collapsed onto the sweep position (441, 270) — the residual is now localised to the one element still in question rather than spread over the screen.

The title does not move. Its row is now posed at t=355, the Decoder's fitted sweep time, because the leaf group ends at t=600 with the quads parked off-screen at x=1521 — posing at the settle simply omits them. ⚠️ t=355 is not the time that minimises the difference: t=390 measures 1.65 %. Picking that would be fitting the pose to the score, which is what this harness exists not to do.

Refuted — my own "the single non-whole-multiple scale in the export"

DECISIONS has said since P1 that ptlogo_eff2 is "the single drawn element in the whole export at a scale that is not a whole multiple of 100 % (125 %)". That census was parents-only. Opening the 45 leaves finds thirteen distinct non-whole-multiple scales — 75, 96, 99, 101, 103, 112, 125, 150, 204×208, 210×220, 250 — and 125 % is among the rarest at two occurrences. ptlogo1/ptlogo2 carry 101/103/112 on the English title.

The claim's real content was "the only one the port draws" — a fact about my element set, not about the disc. Corrected.

🔴 And ptlogo_eff2 stays withheld, now for a stronger reason than caution. Its 125 % is a pop, not a steady scale: scale-0 → 125 % → scale-0 between t=50 and t=107, ≈0.95 s. The leaf draws at 100 %, as two superimposed copies at alpha 160 and 80, each rotating 360° over 960 units — 16 s per revolution. If parent scale gates the leaf it is a 0.95 s flash; if the leaf runs free it spins for 16 s. Nothing on the disc chooses, title_jp has no oracle capture, and the Japanese-locale capture MISSION has parked is what would settle it.

The 11.5 px was the fit's resolution, and the lesson inverts

The Decoder closed it by adding observables, not by tuning — the vertex buffer carries positions and colours at the same instant, so all four quantities must agree on one t:

observable solved t precision
quad A x 357.88 ±0.12 units
quad B x 357.58 ±0.12 units
quad A alpha 355.75 ±1.54 units
quad B alpha 354.09 ±1.89 units

Alpha moves only 0.27–0.33 levels per keyframe unit, so one byte of quantisation is worth 1.5–1.9 units, which at 4 px/unit is 6–8 px of sweep. That is the whole of the 11.5 px. At t = 357.7 the centres land within 0.70 px and both alphas inside one level.

⚠️ The lesson is the earlier one inverted, and this is the half worth keeping. Checking a wrong rule against alpha made it look confirmed. Here the same insensitivity manufactured a residual that did not exist. So an insensitive quantity does not merely fail to falsify — it invents error. Solve on the fastest-moving field; check the slow one; never the reverse.

I was already looking for a pivot rule to explain 11.5 px when they wrote. There was nothing to find.

Refutation attempt — the pivot claim, checked here and survived with a nuance

They state the leaf pivot is (200, 90) on a 399×180 sprite, "the pivot is the centre, so rotation displaces it by nothing." Checked against my own export: pivot [200, 90], sprite 399×180, true centre 199.5, 90.

✅ Survives. ⚠️ With one correction of no consequence: the sprite is odd-width, so the pivot is the centre to within half a pixel, not exactly. Against their −0.70/−0.48 px agreement that changes nothing, and it is worth stating only because "displaces it by nothing" is the kind of sentence that later gets leaned on for a sub-pixel claim.

verify-capture now poses the title at t=357.7 rather than 355: RMSE 21.07 → 20.92, differing 1.82 % → 1.81 %. Marginal, and it is the right pose for a stated reason rather than a better number.

ptlogo_eff2 is withheld for a better reason than mine

I was withholding it out of caution about untested generalisation. The Decoder points out something stronger: it is on title_jp, and MISSION §7 scopes out "localisation beyond English" — so it is not a question the menu port has to answer at all, and the parked Japanese-locale capture does not need reviving on its account. authored/rendering.json now says that first and the undecidability second. Widening scope to close a residual would have been the wrong trade, and it is the human's call either way.

🔴 The focus ring had silently stopped, and BLOCKED had listed it

docs/port/BLOCKED.md said the record-layout change touches five things: pose_at, settle_units, spin_period_units, exit_ramp_units and the plate. I checked pose_at and deleted exit_ramp_units, reported that, and did not work the rest of the list.

spin_period_units required "the first timed and the second untimed". Under the corrected layout the ring reads t=0 rot=0 and t=120 rot=360 — both timed — so the rule returned 0 and the focus ring stopped spinning. Nothing reported it: a period of 0 is a legal "this element does not spin".

Rewritten to take the span between the two poses. On the ring that is 120 − 0 = 120 units, the same number the old rule produced, which is a small piece of evidence that the corrected layout is self-consistent rather than merely different.

Verified the way P5 verified it — bit-identity one period apart, on the ring's own 60×60 box so the ptloop sweeps cannot confound it:

separation mean difference
+120 units (one period) 0
+120 units again 0
+30 units (quarter) 8.61
+60 units (half) 8.88

⚠️ Getting there took three wrong instruments, and the sequence is the lesson. A whole-frame max saturates on one rotating edge — adjacent frames scored 131 while their mean was 0.022. A live --menu filmstrip jitters by up to a frame, which is ~3° of ring, and its cadence cannot be pinned. And a whole-frame comparison is dominated by the sweeps, which move 480 px over one ring period. --focus=<id> was added so a --screen run can draw a focus record deterministically, which is what made the check reproducible at all.

The plate's period is now the disc's 105, and it disagrees with the measurement

Under the corrected layout ptbtn00f runs t=0 (alpha 0) → t=105 (alpha 0) — a closed cycle with every pose timed.

✅ The ambiguity this entry carried is gone. It used to say the cycle might restart at t=6 rather than 0, giving 123 units, and that nothing separated the two. There is now one reading.

🔴 And the number is worse against the oracle, which is stated rather than avoided. 105 units is 1.750 s; scaled by the factor the ring shows between its declared 120 units and its measured 2.177 s (×1.089), 1.906 s — about 17 % below every one of the corpus's four timings (2.12 / 2.19 / 2.34 / 2.31 s). The old 129 gave 2.34 s, at the top of that range, which is exactly why it looked right.

129 was the last timed keyframe plus exit_ramp_units, and that constant is deleted. A period built from a constant that no longer exists cannot stay, even though it fitted better. So the port ships the disc's number and says it is wrong, rather than keeping a number that agreed with the measurement for a reason that has evaporated.

Verified: the plate is bit-identical 105 units apart (mean diff 0) and differs at 30 units (0.83). ❔ What would resolve the disagreement: whether the group loops from its start at all, or holds at alpha 0 between cycles. Asked.

The plate's period is 120, decoded — and it was falsified with my own ring number

The Decoder found it in the format: a nested record is itself a RATC bundle, and its header's +0x08 is the loop length — the same field ui_header_time_disc already tests at the top level. A record's keyframes need not fill it, and the slack is a hold at the final pose. ptbtn00f is 105 units of ramp inside a 120-unit cycle, so the glow rests dark for 15 units. The five ptbtn0Nf records fill their 120 exactly, which is what shows the slack belongs to that record rather than to the format.

Disc-wide over 1 781 timed nested records: 92.3 % declare exactly their last keyframe time, 7.7 % declare more, 0 declare less. That last row is the falsifier — a cycle cannot restart before its own last pose — and it never fires.

The decisive test used this port's number, not theirs

Both candidates need the same emulator pacing factor, and the ring measures it independently: declared 120 units → 2.177 s → 1.0885.

plate period nominal factor needed for the measured 2.12–2.34 s
105 units 1.750 s 1.211 … 1.337 🔴 excludes 1.0885
120 units 2.000 s 1.060 … 1.170 ✅ contains it

105 cannot reach the measured range under any pacing the ring also satisfies. Two different elements in different bundles, measured in separate runs, tied only by both declaring 120.

⚠️ My three readings of this number, in order, are the useful record: 129 (105 + exit_ramp_units) fitted the measurement for a reason that later evaporated; 105 (the group length) I shipped knowing it was 17 % short; 120 is decoded. And the 123-vs-129 pair I once called unseparable straddled the right answer without containing it — which is the sharpest argument I have seen against treating "two candidates, nothing separates them" as if the truth must be one of the two.

Verified: bit-identical 120 units apart (mean diff 0), 0.061 at a quarter and 0.888 at half. Still authored, because the pinned tag does not expose +0x08 yet — delete the entry the day a tag does.

Their rest() flag, checked rather than assumed

They warned that a focus record is exactly the kind of element rest() mishandles, since a pulse's last hold is not its resting state. Censused: 34 focus-record elements in the export, and only 2 have a varying alpha — both ptbtn00f, EN and JP. Their rest.alpha is 80, identical to their peak, which is precisely the pathology described. The port does not hit it because the plate is drawn through the loop path, and the other 32 are constant-alpha, so rest() is safe for them. Bounded, not hoped.

✅ A settled screen is ONE instant, and it collapsed three residuals at once

The Decoder's finding, applied: rest() returns each element's last hold keyframe chosen independently of every other element. That is right for anything that ends the screen settled and exactly wrong for a transient — the title's ptlogo_back2eff1 is a two-frame flash (0 until t52, 255 at t54–56, 0 by t58), so its last hold is the flash peak and rest() left it burning. There are five of them, and rest() drew all five at once.

The settled instant is the longest interval containing no keyframe time, over a bundle's top-level elements. Reproduced independently here before adopting: title [160, 236], midpoint 198 — the Decoder's number to the unit. ⚠️ The top-level restriction is what makes it match: including the ptloop leaves gives [269, 540] instead.

Against the oracle

screen before after
title 20.92 RMSE, 1.81 % 14.61 RMSE, 0.26 %
publisher_logo 9.05, 0.75 % 2.17, 0.01 %
developer_logos 8.86, 0.33 % 3.05, 0.01 %
main_menu 0.08 % 0.08 % — unchanged, window too narrow
extras 0.19 % 0.19 % — unchanged, window too narrow

Seven times fewer differing pixels on the title, seventy-five times fewer on the publisher splash, whose differing region is now a 13×18 box. This is the largest correctness gain the port has had, and none of it is mine: it is a decode, computed from the keyframe table with no reference to any capture.

⚠️ It is applied only where the window is wide, and that bar is not invented

The widths in this export split with nothing in between: press_start 214, publisher_logo 190, developer_logos 145, title 76 — then main_menu 12, extras 12, the loading screens 8 and 4. A 12-unit "settle" on a menu that builds in until t=70 is a gap between staggered ramps, not a settled pose.

The bar is 30 units: the Decoder's disc-wide census puts the knee there (30 % of bundles ≥ 30, 42 % under 10, the latter mostly loop* fragments meant to be in motion), and this export's own screens sit 4× either side of it with nothing between 12 and 46. Two independent populations agreeing on where to cut is what makes it a bar rather than a preference.

Checked unbroken: the boot pacing is unmoved (developer_logos@4.26, title@7.91, developer agrees) and the scripted walk still runs end to end with focus restored.

Their census, and a framing of mine they sharpened

I reported "34 focus-record elements in the export, only 2 with a varying alpha". Disc-wide it is 210 varying, 202 with rest() at the peak, across 1 130 focus records — 116 in GP_DEBRIEFING_PILOTLOG, 54 in GP_MOVIE_THEATER, 30 in GP_HANGAR_ARSENAL, 8 in GP_LEADERBOARD, and 2 in GP_TITLE.

My 2 is right because GP_TITLE has 2. ⚠️ But "only 2 have a varying alpha" reads as a fact about the format and is a fact about one pak — and the pathology sits in exactly the screens a wider port reaches next. The sentence was true as measured and false as remembered, which is the failure this corpus keeps finding, and it was mine this time.

⚠️ And they corrected a framing I had: I called rest.alpha == peak "the pathology". It is worse than that — a pulsing element has no resting pose at all. The question rest() answers is malformed rather than mis-answered, because the element's state is a phase, not a value. pose_at(t) with t inside the record's own declared cycle is the only well-formed query on one.

🔴 Worth carrying for whenever this port grows: GP_LEADERBOARD's py_ranking_btn01f swings 255 → 127 → 255 with no two adjacent keyframes equal, so rest() falls through to its longest-dwell rule and returns 244 — neither peak nor trough. A glow stuck at its peak is visibly wrong; one stuck at 244 of a 127–255 range looks entirely plausible, and nothing reports it.

✅ And a free second instance of the loop-length decode from a pak neither of us was looking at: py_ranking_btn01f's ramp ends at t=90 inside a declared 120 — 30 units of hold, the same shape as the plate's 105-in-120.

Their "do not draw all five flashes" flag — checked, and it does not apply here

The Decoder armed a draw capture before the title exists and caught the build-in on the console: ptlogo_back2eff1 in frames 130–131, eff2 at 133, eff4 at 133–135 — and eff3 never drawn at all. Not a miss: a flash's peak is 2 keyframe units, which at that run's pacing is 0.85 of a presented frame, so which flashes get sampled is a matter of phase. The console shows a subset on any given play, and the warning was that drawing all five would read heavier than the real thing.

Checked rather than reasoned about. Sweeping the port's build-in with --no-hold:

t flashes drawn
54, 56 eff1
58 eff2
60 eff2, eff3
62 eff3, eff4
64 eff4, eff5
66, 68 eff5

The port draws them sequentially, never more than two at once, and the two only overlap where their declared windows abut. That is the stagger the disc declares, not a pile-up — the pile-up was the rest() bug, and it is fixed.

⚠️ So the difference from the console is presentation rate, not content. At 60 fps each 2-unit flash gets ~2 frames; at the console's pacing it gets 0.85, so some are skipped. A frame-by-frame comparison of the build-in against a console capture will therefore show flashes the console missed, and that is a fact to know rather than a bug to fix. It is also why the settled-frame comparison — the one verify-capture makes — is unaffected: at t=198 none of the five is drawn.

Three things of theirs worth recording

✅ My top-level restriction was verified, not merely accepted: top-level [160, 236] width 76, versus [269, 540] width 271 with the ptloop leaves included — an instant after every top-level element has exited. Worth having on their page, because the rule as described permits the wrong reading.

✅ The 120-unit loop is confirmed from the guest's own vertex data, not inferred from pixels: the glow quad's per-vertex colour alpha is the element's fade alpha, giving an observed range of 0…80 against a decoded peak of 80, exact and unfitted, over 20 cycle starts. Fitting the decoded ramp gives RMS 13.16 alpha levels against 38.18 for the same ramp reversed — if the shape carried no information those would be equal.

📌 A trap noted for whenever this port grows draw-stream tooling: a 2D draw's identity is its vertex geometry, not its bound texture, because these sprites sample large shared pages. Matching on texture dimensions told them first that no flash is ever drawn, then that ptbase2 and pteff04 are drawn in frames 75–105 — which are the intro movie, whose YUV planes are 640×360 targeting 1280×720. Two errors, opposite directions, one pass, neither loud.

✅ The publisher_logo residual was a missing black hold, and we had both dismissed it

I had carried this as "0.03 s outside a composite bound, probably a property of the bound rather than the game", and the Decoder agreed. We were both wrong, and the way it was settled is the point: I stopped reasoning about the bound and filmed the transition.

At 0.05 s the port fell straight out of the publisher's fade into the developer logos — mean 5.06 → 0.32 at t=4.20, then 5.65 at t=4.25. There was no black frame at all, where the oracle measures a 0.17–0.23 s pure-black plateau (HANDOFF Q7). The bound was fine. The port was missing a fifth of a second of black, and had been since P3.

Authored at 12 units, because on the boot path there is nothing to read it from: publisher_logo and developer_logos each carry a single palogo_eff0 — a 1280×720 primitive with one keyframe at t=0, static, not a transition ramp. The menus' quad declares black for 12 units and 12/60 = 0.200 s sits in the middle of the measured range, so the number is the disc's where a screen has one.

Filmed after: t=4.25, 4.30, 4.35, 4.40 all at mean 0 — four black frames, 0.20 s — then the developer logos at 4.45.

before after
publisher interval 4.26 s, DIFFERS 4.47 s, agrees
developer interval 3.62 s, agrees 3.73 s, agrees

The settled-frame comparisons are untouched, as they should be — this is pacing, not pixels.

⚠️ The lesson is about the shape of the dismissal, not the number. "A 0.03 s miss against a bound composed from two measured ranges plus jitter slack is more likely a property of the bound" is a plausible explanation, it was offered and accepted by both of us, and it was wrong. The composite bound was the reason the miss looked small — the underlying gap was 0.2 s — and a plausible explanation for a small number is exactly how a real defect stays hidden. The film cost one command.

ptlogo_back2eff3 — recorded, deliberately not acted on

The Decoder has reproduced across two independent build-ins that the console never draws eff3: 0 draws against ~5 expected, while eff1 gets 4, eff2 3 and eff4 6. Three explanations are ruled out — sampling phase (eff3 is non-zero over six units against a 2.23-unit step, and frames at t=60.1 and 62.3 sit inside it drawing eff2 and eff4 instead), a draw the log cannot see, and a bad position guess (no quad anywhere is within ±30 of the expected 408 width; the spectrum jumps 262 → 748).

❔ But why is not established — nothing in eff3's record differs from its neighbours: same kind 0x0, same keyframe shape, same u4/u8, same scale.

🔴 So the port keeps drawing it, and that is a decision rather than an oversight. Dropping an element the disc declares, on a measurement with no mechanism behind it, is authoring a behaviour neither agent can derive — and nothing this port gates on would notice either way: the flashes live only in the build-in, and verify-capture compares the settled frame at t=198 where none of the five is drawn. Acting would buy no measurable fidelity and cost an unexplained exception in authored/.

What would change it: a mechanism in the record, or a gate that measures the build-in against a capture. Until then the port is visibly wrong for two frames during a build-in nobody compares, which is the cheaper of the two wrongs.

The narrow settle windows are harmless, and I can now say why

Adopting the settle instant left main_menu and extras on per-element rest() — their windows are 12 units, below the 30-unit bar — and I recorded that as a gap. It is not one. rest() is malformed only for a transient, and the transients are precisely on the screens whose windows are wide:

screen window transients
title 76 ptlogo1/ptlogo2 ×4, pteff01, ptlogo_back2eff1…5, ptlogoall_eff
publisher_logo 190 palogo_sqex_eff
developer_logos 145 palogo_*_eff ×3
main_menu 12 none
extras 12 none

The discriminator is returning to dark far before the screen's own end — ptlogo_back2eff1 is dark again at t=58 while the title runs to t=269 — as opposed to the ordinary fade-in-hold-fade-out that every menu element has, where rest at 255 is the settled pose and the final 0 is the exit.

⚠️ I am not claiming that as a rule. Two screens having narrow windows and no transients could be coincidence; it is n = 2, and n = 2 is where I have gone wrong before. What it does mean is that nothing measurable is being left on the table by the 30-unit bar today.

Refuted, mine — "the menu residual is localised on the ptloop sweeps"

I have written that twice. It came from reading the bounding box of the differing pixels, which sat at (441, 230) — the sweep position. Tested by sweeping the leaf's phase against the live-menu captures:

main_menu, sweep phase differing
t=60 (barely on screen) 0.063 %
t=350 (mid-screen) 0.183 %
t≥600 (parked off-screen) 0.061 %

✅ Two things fall out. The capture shows no sweeps: the port matches best when they are off-screen and three times worse when they cross the middle. And with them parked the residual's box is 834×358 at (445, 167) — the button column, which is where the focus signature lives, not the sweep position.

On extras the same test moves the box (398×295 at the sweep position at t=70, 736×525 spread at t=700) while the magnitude barely changes: 0.192 % against 0.200 %.

🔴 So the box moves with the sweeps and the residual does not. A bounding box over scattered pixels tells you where the outermost differing pixels are, not where the difference is — and I had been quoting it as if it localised a cause. verify-capture prints that box, so this is a caution about reading my own tool.

And a first piece of evidence on whether the sweeps loop

The disc gives one pass, t=0…600, ending parked off-screen at x=1521. ORACLE-CAPTURES.md says the title's sweeps "move continuously", which I had taken as implying a loop. The idle main-menu capture matches best with them off-screen, which is evidence they run once and park.

⚠️ One capture, one screen, and "best match" is a weak instrument for an absence — but it is the first evidence either way, and it points against looping. The loop-length field the Decoder decoded (+0x08 of a nested record's header) would settle it outright; it is not in the pinned tag.

Refuted — "the developer splash is one composited quad, the bounding box of the three logos"

The Decoder observed the game submitting one 525×259 quad at (378, 155) on the developer splash and read it as the bounding box of the three logos, warning that drawing three sprites there draws something the console does not. The arithmetic does not support it, and the port keeps drawing three.

bounding box
the three logos 500×421 at (390, 164)
gamearts_eff + seta_eff 521×261 at (379, 154)
the observed quad 525×259 at (378, 155)

A 259-tall quad cannot contain the three logos, which span y 164…585: palogo_anima alone starts at y = 449, thirty-five pixels below that quad's bottom edge. The observed quad matches the union of the two _eff glows to about four pixels in every dimension.

⚠️ And those two are transients — my own census flagged them, dark again by t=45 — so a frame containing that quad is a build-in frame, not the settled screen. Consistent with a draw capture that starts early, which is exactly what theirs does.

I cannot see their draw stream, so I have sent the arithmetic rather than a verdict. What I will not do is stop drawing an element on a claim whose stated identification excludes that element from its own bounding box.

The black hold is 9 units, not 12 — measured in draws rather than luminance

I authored 12 from HANDOFF Q7's luminance plateau of 0.17–0.23 s, supported by the menus' transition quad declaring black for 12. The Decoder counted submitted quads instead, which is the better instrument: luminance cannot separate the outgoing fade's tail from true black.

Frames 21–125 submit palogo_sqex fading to alpha 7; frames 126–129 submit no sprite quad at all; 130–153 fade the developer splash in from alpha 34. Four presented frames at 2.284 units/frame — a rate derived from the disc as its own clock, because that run ran at 13.1 fps against 28 elsewhere — gives 9.1 units = 0.152 s, ±1 frame 6.9–11.4.

⚠️ It disagrees with the luminance figure and the disagreement is the point. 0.114–0.190 s against 0.17–0.23 s overlaps only at the top, and the true black is shorter than 9 even so: both boundary frames still carry picture. My 12 was also supported by analogy — a different screen's quad on a different path, where the boot splashes carry no quad at all. A number that fits by analogy loses to one measured in place.

verify-dwell's bound moved with it. Both screens still agree: publisher 4.42 s, developer 3.78 s.

The title's sweeps loop — measured, and the field could not have told us

The disc gives one pass (ptloop01 t=0…600, ptloop02 t=0…720), each ending parked off-screen, and the port ran them once. The oracle says they loop: across two title dwells the sweep quad oscillates over its whole x range and resets hard to the same start — one reset in the first dwell, two in the second.

🔴 And the loop-length field could not have settled it, which corrects a hope I had stated. Both records declare exactly their last keyframe time — slack zero — and "loops at 600" and "runs once for 600 and stops" write the identical header. 92.3 % of records on the disc are in that state, so the field discriminates only where there is slack, as the plate's 105-in-120 had.

Implemented and verified on the two sweeps' least common multiple, since they have different periods: 600 and 720 realign at 3600 units = 60 s.

separation mean difference
+3600 units (LCM) 0
+1800 units 0.438
+600 units (ptloop01 only) 0.100

⚠️ Scoped to the title, because that is where it is measured. The menus declare the same 600/720 and nothing on the disc distinguishes them, but my own weak evidence points the other way there — sweeping the phase against live-main-menu.png, the port matches best with the sweeps off-screen (0.061 %) and three times worse mid-screen (0.183 %), and if they looped the sweep is on screen for roughly 73 % of the cycle. Two weak signals in opposite directions is a reason to scope, not to pick.

The menus' residual is the tone floor, not structure — and extras is not really 3× worse

extras sits at 0.19 % differing against main_menu's 0.06 %, on two screens of the same family, and that gap wanted explaining.

Signed difference (port − capture), by cell:

x=0 x=320 x=640 x=960
extras y=169 +12.13 −3.64 +2.43 +10.60
extras y=338 +12.29 +1.36 +1.42 +9.05
main_menu y=169 +11.63 −0.68 +3.01 +10.24
main_menu y=338 +11.03 +3.93 +2.92 +8.84

The two screens are nearly identical, and the port is uniformly +9 to +12 brighter in the dark outer columns — which is exactly the transfer curve I measured earlier: γ > 1 in the darks, capture darker than render. There is no dipole, no displacement, no missing element.

So the 0.06 % / 0.19 % gap is not a difference in fidelity. The thresholded count only sees pixels differing by more than 64 levels, which are text and sprite edges; the two screens simply have different amounts of high-contrast edge. The level disagreement, which is what a tone term produces, is the same on both.

⚠️ This is the bounding-box lesson again in a different costume. I had two numbers, 0.06 and 0.19, and took the ratio as meaningful. It is a count of threshold crossings, and a count of threshold crossings is not a measure of how wrong a screen is.

A diagnostic trap of my own, worth writing down

My first pass at this reported 10 of 18 elements "transparent at rest" on extras — the buttons, the title, the frames — and looked exactly like a missing-element bug. It was not. --screen=NAME without --time renders at t = 0, and pose_at clamps t to minf(t, settle_units), so t=0 stays t=0 and every element is still at its first keyframe. Passing --time=2.0 draws 18 of 18.

The tool was right and my invocation was wrong, and the failure looked like a serious defect rather than an empty argument. Same family as the instrument traps this session has collected — and mine was the one that reported a worse problem than existed, which is the direction that wastes an iteration rather than hiding one.

Refutation attempt — their 239.8-unit figure, checked from my export

The Decoder converted the boot's black gap using the disc as its own clock: "palogo_sqex declares alpha ≥ 1 for 239.8 units and is drawn in 105 frames → 2.284 units/frame." That 239.8 comes from their reading of the record; I have the same element in my export and can compute it independently.

palogo_sqex ramps 0 → 255 over t=15…30 and 32 → 0 over t=251…255. Under the linear ramp the port already uses, alpha first reaches 1 at t = 15.0588 and last exceeds it at t = 254.8750:

239.816 units.

✅ Survives, to four significant figures. It matters more than a spot-check: that number is the denominator of the units-per-frame conversion behind the 9-unit black hold I just authored, so an error in it would have propagated straight into a constant I ship. Two derivations from different sides of the same record agreeing to 0.02 % is what makes that constant safe to hold.

🔴 The loading screens are black at every instant — which proves the layer rule wrong for a layerless element

build_12 and build_15 have rendered blank since P3, and I had filed it as a rest() casualty: pgloading_eff00 is a 1280×720 quad whose rest is opaque black. It is not that, and the corrected keyframe association makes it provable rather than suspected.

Every element's declared alpha window on build_12:

element opaque / visible gone by
pgloading_eff00 (black quad) t=0 … 38 at alpha 255 clears at t=48
pgloading_loop4 t=8…32 38
pgloading_loop1 t=16…32 40
pgloading_line t=18…26 32
pgloading_str t=22…28 34
pgloading_loop3 t=24…26 34
baseeff, eff01, eff02, loop5 t≈16…32 32–40

The quad is fully opaque across the entire span in which any content is up, and it only clears at t=48 — by which time every other element has faded to zero. Rendered at t = 20, 30, 36, 40, 42, 44, 46, 50 units with the timeline playing, the frame is mean 0 at every one.

So this is not a bad choice of pose. Under the port's current layer rule there is no instant at which this screen shows anything, and a loading screen that is black for its whole life is not what the game does. That is a proof by contradiction, not a preference.

The rule under suspicion is mine, and it is narrow

pgloading_eff00 carries layer_source: "none" — no layer key at all — and the exporter sorts a layerless element last, i.e. on top. Its paint_order is [6, 7, 8, 9, 1, 5, 4, 2, 3, 0] with element 0, the quad, drawn last.

⚠️ Every other full-frame primitive in the export has a layer key — main_menu, extras and title all give their pteff00 0x00008030 — so this rule only ever bites here, which is exactly why it survived eight milestones behind two screens nobody draws.

❔ Where a layerless element sorts is a decoding question and I am not answering it. If the game sorts it first — behind everything — the screen renders and the quad becomes a backdrop rather than a cover, which is what a 1280×720 black rectangle at the bottom of a loading screen would sensibly be. That reading is consistent with the contradiction above, which is not the same as being established, and I have asked rather than flipped the sort.

✅ What this does settle: verify-screen's BLANK verdict on those two rows was the right call. It reports that both renderers drew nothing and that the row proves nothing — and sylpheed-cli agrees with the port here precisely because it shares the assumption under suspicion. Two renderers agreeing, again.

Their eff3 retraction — my refusal was right, and my refutation found the same bug

The Decoder has withdrawn "the game never draws eff3". It draws all five, in the declared stagger, in both title entries. And the mechanism was the one my developer-splash refutation had already caught one layer down: a draw batches several quads and the log dumps only the first 8 vertices, so min/max over a line's vertex list merges them. eff3 (788…1196) lies entirely inside eff4 (447…1196), so the union is exactly eff4's extent and eff3 vanished with nothing anomalous to see. My 525×259 was gamearts_eff merged with seta_eff by the identical mechanism.

⚠️ The part worth carrying is theirs: three explanations were reported "ruled out", and all three were aimed at the wrong failure — the "a draw the log cannot see" check counted draws with no geometry when the hiding place was draws with partial geometry. Refuting three wrong hypotheses is not evidence for a fourth, and a list of failure modes written by whoever built the instrument is the least likely to contain that instrument's blind spot.

Nothing in the port changes: eff3 was never dropped, and the developer splash still draws three sprites.

The forced backdrop: two of sixteen screens were black for their whole life

build_12 and build_15 — the two dressed loading screens — rendered as pure black at every instant of their declared timeline. Not at rest, where a wrong rest.t could explain it: at t = 20, 30, 36, 40, 42, 44, 46 and 50 units with the timeline playing, mean 0 in every frame.

That is not a defect you can attribute to a pose. A screen that is black for its entire life is impossible on its face, and it is the kind of impossibility that survives a render-vs-render diff: verify-screen scored those two rows max 0 mean 0 over3 0 OK — the strongest verdict that script has, awarded for comparing nothing against nothing. Both renderers were black because both share implied_layer_key. The blank guard now in verify-screen was written after that, and it is what turned the pass into a row that says it proves nothing.

The rule, and whose it is

It is the Decoder's, decoded from the file rather than inferred from the render:

An element that covers the screen and is fully opaque at some instant cannot paint above anything visible at that instant. Where the elements visible during its opaque span are all of them, its position is forced to first.

pgloading_eff00 is a full-screen quad at alpha 255 from t=0 to t=38, clearing at t=48; every other element on those screens peaks around t=8–32 and is gone by t=32–40 — entirely inside the opaque span. Under a layer-key sort it painted over all nine of them, at every instant they existed. Hence black.

What is implemented, and the two limits that are not negotiable

forced_backdrop_first in crates/sylpheed-export/src/screen.rs, as a post-pass over ui_layout::derived_paint_order. Two restrictions are copied from the Decoder verbatim because each one was found by a test that failed:

  • 🔴 Elements with no sprite only. Applied to sprites, the rule claimed 22 .t32 textures must sort first against their own layer keys. An element's alpha says nothing about whether its texture covers the screen — most of a sprite may be transparent. The assertion that caught this was one the Decoder had nearly deleted as over-strict.
  • 🔴 Not a name heuristic. *base* first / *eff* last matches 77 of 80 and fails on exactly the three families that cross it: palogo_eff0, pgloading_eff00, pzeff00. palogo_eff0.prm is named like an overlay and is measured painting first. The name is not the rule; occlusion is.

⚠️ Reach: it assumes straight alpha-over. Blend mode is undecoded, and an additive quad at alpha 255 would not occlude. It is a lower bound on one element's position, not an ordering — 80 elements are forced, 50 are constrained but not forced, and this says nothing about those 50.

The controls

Both are the Decoder's prior measurements off the running game. No new oracle run was made for this change, by either agent.

primitive measured our opaque instants outcome
palogo_eff0.prm first 256 (they measured 211) ✅ forced first
pteff00.prm last 2 (they measured 2) ✅ still last

pteff00 is the one that would break if this were implemented as "push every layerless element down". It is the fade cover: opaque at t=0 and again at t=269, its screen's entry and exit, and transparent for the 253 instants between. The constraint never binds it, and it remains last on all four title-family screens.

The palogo_eff0 count differs — 256 against 211 — because we take the opaque span to the screen's last keyframe (255) and they stop at 210. It changes no verdict here, since the element is opaque across the whole span either way, but the two spans are not the same span and only one of them can be the screen's. Filed in BLOCKED.

An element holds its final pose to the end of the screen; it does not vanish at its own last keyframe. Reading palogo_eff0's span as 0..=0 — it declares a single keyframe — would make the splash's backdrop a one-instant event rather than the thing on screen for the whole splash. Rendering build_12 confirms the hold directly: the frame is constant from t=30 to t=60 with the timeline running.

What changed, measured

  • build_12/build_15: mean 0 at every instant → ramps in over t=0…30 and holds (mean 1.95, max 214.5). The two BLANK rows are gone from verify-screen.
  • The splashes are unmoved against the oracle: publisher_logo 0.01 %, developer_logos 0.01 % differing region, unchanged before and after. ⚠️ That is non-regression, not confirmation — verify-capture poses at the settle instant, and the ordering does not necessarily bind there. The evidence for the rule is the Decoder's two controls and the impossibility of a permanently black screen, not this row.
  • Six verify-screen rows now DIFFER: the six screens the rule touches. The reference sylpheed-cli builds from the workspace sylpheed-formats, which does not have the rule. That disagreement is expected and must not be tuned away — it ends when a pinned tag carries the Decoder's change, at which point this post-pass is deleted rather than kept in two places.

It also explains 36 builds the Decoder had filed as "coming out one colour": pzeff00.prm is forced first in 32 of 32 of them. Those were wiped by our own sort.

Refutation attempt — the forced-backdrop rule's quantifier, and whether it misses a case

The rule fires only when all other elements are visible during the opaque span. That is a strict quantifier, and a strict quantifier fails quietly: an element that is a full-screen opaque backdrop but misses the bar by one dark element would keep its layer-key position and go on hiding the screen, exactly the defect the rule was written to fix. So the question worth asking of somebody else's rule is not "is it right" but "is it enough" — and that one I can test without an oracle, over every layerless full-screen element in GP_TITLE.

screen element opaque instants others visible forced
build_12, build_15 pgloading_eff00 39 9 / 9 ✅
developer_logos ×2 palogo_eff0 211 6 / 6 ✅
publisher_logo ×2 palogo_eff0 256 2 / 2 ✅
title, title_jp pteff00 2 3 / 23 —
main_menu ×2 pteff00 2 7 / 15 —
extras ×2 pteff00 2 5 / 17 —
every screen pteff02 0 — —

The rule survives, and the margin is the reason. Nothing sits near the boundary. Every element that fires does so at 100 % of the others; every element that does not is at 13–47 %, and pteff02 never reaches alpha 255 at all, so no quantifier could fire on it. There is no borderline case in this archive for a stricter or looser reading to disagree about — which is the answer I could not have gotten by re-checking the six screens where it already fired.

It also reproduces the Decoder's second control number exactly: they report pteff00.prm forced below 3 of 23, and title measures 3 of 23 here. With their opaque-instant count of 2 already matched, two of their three published figures for that control now come out of an independent implementation unchanged. The third — palogo_eff0's 211 against our 256 — remains the span disagreement filed in BLOCKED.md, and note that the 211 is the number our developer_logos row does reproduce. That is worth saying plainly: the disagreement is not a constant offset, so "they stop 45 instants early" is not the explanation, and whatever it is differs per screen.

⚠️ What this does not test: whether the rule is right about the 50 elements it calls constrained-but-not-forced, and whether alpha-over is the blend mode. Both are the Decoder's to settle. It tests completeness within one archive, which is the half I can reach.

The 256/211 was never a disagreement — and my own census had already said so

The Decoder answered the span question, and the answer is that both numbers are right. palogo_eff0.prm appears on both splashes: the publisher pair (entries 10, 13) runs to t=255 and gives 256 instants, the developer pair (11, 14) runs to t=210 and gives 211. I computed the publisher; their page quoted the developer.

Worth noting how that came out, because it is the one part I can claim: the refutation census in the section above reported 256 on publisher_logo and 211 on developer_logos, in the same table, and concluded "the disagreement is not a constant offset, so 'they stop 45 instants early' is not the explanation". The resolution was already sitting in my own output before their reply arrived. What I got wrong was filing it as a disagreement at all — I compared one of my two numbers against one of theirs and did not check the other row of my own table against it. A per-screen quantity needs the screen named next to it, and my BLOCKED.md row named neither.

The span convention, confirmed rather than assumed

The span is 0 ..= max keyframe time over EVERY element in the build, and an element holds its final pose past its own last keyframe.

That is exactly what forced_backdrop_first implements, so nothing changes in the port. Two things they add that are worth having in writing:

  • the hold is not a convenience: a group holds at its last keyframe rather than looping, and the header's +0x08 never falls short of the last keyframe — the slack is that hold;
  • +0x08 and the elements' maximum are interchangeable, zero disagreements disc-wide. We use the elements' maximum. It stays, and this paragraph is the note that the two were checked equivalent rather than assumed so.

The hold decides 55 % of verdicts, and the oracle picks it

Reported by them over 130 keyless full-screen primitives (their measurement, not reproduced here — their page is docs/re/structures/ui-forced-backdrop.md, ⚠️ not yet on main as of this commit):

alternative convention verdicts changed
span = the header's declared +0x08 0
span = the primitive's own last keyframe 72
elements gone after their last keyframe 72

So the reading I very nearly shipped — span = the element's own last keyframe — would have changed 55 % of the verdicts disc-wide. My first implementation did exactly that, and palogo_eff0 is the case that catches it: a single keyframe at t=0, opaque for one instant, nothing else up yet, so the rule calls it free — against a game measured painting it first. The convention is not a matter of taste; the oracle rules one out.

✅ None of our six verdicts rests on it. pgloading_eff00 is first under all four conventions and pteff00 is free under all four; only palogo_eff0 moves, and only under the convention its own measured order excludes.

The sharper form of the verify-screen failure

Theirs, and it is better than how I wrote it: those two solid-black frames were not two witnesses. Both renderers read implied_layer_key, so their agreement carried no information — a correlated failure is indistinguishable from a confirmation. What caught it was not a second opinion but that the agreed answer was impossible on its face. "Is this result even possible?" beats "do two implementations agree?" whenever the two share an ancestor, and in this project they nearly always do.

The boot gate still holds

Re-run after the reorder, since the rule changed the paint order of the first two screens in the boot path: publisher_logo → developer_logos → ADV (skipped at 8.12 s) → title + press_start overlay, plate at full alpha at t=236, complete at 10.83 s holding on the title. No script errors.

The clock freezes at settle — the port's settle window, seen from the other side

The Decoder measured GP_TITLE build 4 in the draw stream and found the top-level clock advances through the build-in, stops inside the settle window, and holds. The exit ramp is not on a timer; it plays when something makes the screen leave.

Their interval is [160, 236]. The exporter computes title's settle window as [160, 236, 198]. Those are the same two numbers, and they were not obtained the same way: mine is the longest keyframe-free interval over top-level elements, read out of the file with no game running; theirs is where a captured clock stops advancing. A heuristic I adopted because it collapsed three pixel residuals at once turns out to name the exact interval the game holds in. That is the first evidence for the settle instant that does not come from the port's own renderer.

The file agrees from a third direction: ptcopyright sits at alpha 255 from t=160 to t=238 — it reaches full opacity precisely as the window opens.

Refutation attempt — their declared spans, checked against the file

Their draw-stream argument cites what the file declares, which I can check without a capture:

their claim the file
ptlogo1 declares an exit at t=264 last keyframe t=264, alpha 0 ✅ exact
ptcopyright alpha ≥ 1 for 106 units, t=138…244 keyframes at t=138 and t=244, alpha 0 at both ✅ endpoints exact

Both survive. One quibble, and it is only that: the instants with alpha ≥ 1 number 105, t=139…243, not 106 — the endpoints they bracket with are themselves alpha 0, so 106 is the keyframe span rather than the visible one. It changes nothing in their argument, whose force comes from 1 050 frames against either number.

What this costs the port, and it is not nothing

authored/timing.json and authored/flow.json both said "a screen's dwell is its OWN keyframe group" and "the pacing is the disc's own". 🔴 That is refuted. Build 4 declares about 120 presented frames and dwelled ~1 100 — nine times its own timeline. The group is not the dwell.

The decision is unchanged and still right: hold zero extra rather than invent a number. What was wrong is what the port claimed for it. Leaving when the group ends is not reproducing the disc's pacing — it is leaving at the moment the game starts waiting. Both files now say so, and so does boot.gd, where the comment had inherited the same claim.

✅ The structure was already right, and this is the part the measurement confirms: _advance is caused by the next screen arriving, never scheduled off a timer, and the port's own comment already read "a screen plays itself out because something is taking its place". exit_ramp_units was deleted for an unrelated reason and its absence is now doubly justified.

⚠️ Only build 4 is measured, and build 4 is the one screen where the port is unaffected — it is the boot's end state and holds indefinitely. The two screens this actually governs, publisher_logo and developer_logos, have no measured dwell at all. The port's boot is known too fast [refuted] on both, by an unmeasured amount. Nothing here is a number for them.

🔴 WITHDRAWN, and this paragraph stood for days after the withdrawal was written. "Known too fast on both" is false: the splash dwells are declared on the disc — publisher t=0…255, developer t=0…210 — corroborated over three cold boots to 1.1 %, and the port was already emitting each declared value plus the 9-unit black hold, exactly. See Withdrawn — "the boot is known too fast [refuted]".

Found 2026-08-30 by the Decoder's rule: grep the corpus for the claim, not for the file you were working in. I wrote the withdrawal as a new section and left the original assertion untouched, so a reader arriving here first got the dead answer with nothing to warn them — the same failure as a correction that never reaches the manifest, one layer up.

🔴 Withdrawn — "the boot is known too fast [refuted]". The splash dwells are declared, and the port was already playing them

Last iteration I took the Decoder's build-4 measurement — declared ~120 presented frames, dwelled ~1 100 — and wrote into three files that the port's boot is "known too fast [refuted] on both splashes, by an unmeasured amount". That is withdrawn. It was wrong, and the way it was wrong is the interesting part.

They then measured the splashes directly, over 3 cold boots:

splash declared at 60 units/s corpus wall clock
publisher (entries 10, 13) t = 0…255 4.250 s 4.30 / 4.60 / 4.37
developer (entries 11, 14) t = 0…210 3.500 s 3.51 / 3.50 / 3.37

The developer agrees to 1.1 %, two of its three runs to 0.3 %. And the port emits 4.400 s and 3.650 s — each declared value plus the 9-unit black hold, exactly. ✅ The pacing was right the whole time and no code changes.

What I actually did wrong

Not the arithmetic — the generalisation. Build 4 is the title, whose exit is caused by something outside its timeline, so it holds. A splash's exit is caused by nothing, so it plays its declared timeline and leaves. The title is the exception, not the rule. I had one screen, it was the one screen in the boot the port is structurally unaffected by, and I used it to overturn the two it governs.

I wrote at the time that a ratio from one screen is not a unit of pacing, and declined to scale the splashes by nine. That refusal was right and is the only reason this cost nothing but documentation. But refusing to apply the number while adopting the conclusion it implied was half a caution: I still let one screen's behaviour rewrite what the port claimed about two others. The correct move was to file build 4 as measured and leave the splashes alone, which is what the file now says.

And the unit stays units

🔴 The Decoder's own container timed those same two dwells 15–20 % longer than both the declared values and the corpus — same disc, same declared timeline — and three independent readings of that container's frame rate disagree with each other. A seconds figure is one emulator's pacing on one run. The declared units are on the disc. authored/flow.json dwell therefore takes units, and only for a screen measured to wait beyond its group.

This also retires the "two timestamps would settle it" ask I filed: timestamps were the wrong thing to author, and the measurement's own result says so.

Refutation attempt — their two splash boundaries are not anchored the same way

Their draw stream reports "publisher wordmark frames 6–119" and "developer glows 123, wordmarks 140–209". Taking those spans against the declared groups:

splash declared units their frames units / frame
publisher 255 6…119 = 114 2.237
developer 210 123…209 = 87 2.414

Within one continuous boot, on one guest, those should be the same number. They differ by 7.9 %, and the discrepancy runs the same direction as the error split they have open — publisher +4.1 % where the developer is 1.1 %.

The file suggests why, and it is not the guest's clock: the two boundaries are anchored on different elements. The developer span starts at its glows; the publisher span is reported as starting at its wordmark. Those are 15 units apart — every wordmark on both splashes is alpha > 0 from t=16, every glow from t=1 — and the publisher has a glow, palogo_sqex_eff, visible t=1…44, structurally identical to the developer's three. So either frame 6 is the publisher's glow and is mislabelled, or the publisher span genuinely starts 15 units later than the developer's and the two are not comparable quantities.

⚠️ I cannot tell which from here — it is their log, and the answer is one grep for palogo_sqex_eff in it. Recording it because a 7.9 % internal inconsistency and an unexplained 4.1 % error on the same screen are more likely one problem than two. ⚠️ It also does not touch the corpus comparison, which is a separate instrument (3 cold boots, not this draw log); their 4.1 % may still be real.

Their corrected boundaries check out against the file — all six, exactly

The Decoder found the cause of the 7.9 % I reported, and it was worse than the anchor mismatch I proposed: the developer splash batches six quads into one draw and their log dumps only the first two. While the three glows are alive they occupy that prefix, so the three wordmarks are invisible to the log until the glows stop at t=45. "Developer wordmarks first drawn at frame 140" was the logging prefix shifting, not the game. The anchor difference I found was a symptom; the truncation was the cause. It is also what hid palogo_anima.

Their fix is to count indices / 4, which the 8-vertex dump cap cannot touch. Every one of the six resulting calibration points matches this export:

splash their transition their t export
publisher 1→2 quads 15 palogo_sqex joins at t=16
publisher 2→1 45 palogo_sqex_eff ends t=44
publisher last drawn 255 group ends t=255 ✅
developer 3→6 quads 15 three wordmarks join at t=16
developer 6→3 45 three glows end t=44
developer last drawn 210 group ends t=210 ✅

The two 15-vs-16 rows are a half-open boundary, not a disagreement: they name the last frame at the old count, the export names the first instant at the new one.

✅ A second thing falls out that neither of us was looking for: their quad counts are 1 and 2 on the publisher against 3 and 6 on the developer, and a count restricted to sprite-bearing elements reproduces exactly that. So palogo_eff0 — the layerless forced backdrop — is not in the batch they log, confirmed from the file. Their instrument and this export agree on which element is the odd one out, having disagreed about it in every earlier iteration.

Refutation attempt — does the drift actually explain the corpus's 4.1 %?

Their four segment rates recompute exactly (1.765 / 2.165 / 2.308 / 2.357; the developer's two agreeing to 2.1 %, the run rising 33.5 %). The explanation is that the publisher runs in the first seconds where the rate is furthest from its later value. Testing what that predicts for the corpus:

publisher ÷ developer ratio
declared (255 ÷ 210) 1.214
their drift predicts 1.369
corpus, 3 cold boots 1.278

Sign confirmed, magnitude not. The corpus ratio does sit above declared, which is what the drift predicts and is real evidence. But their container's drift would inflate it by 12.8 % where the corpus shows 5.3 % — roughly 2.4× too strong. So drift of some size is doing the work; drift of their size is not.

⚠️ And the reason to be careful here is that the move is the one I just got wrong: the 4.1 % is a property of the corpus, a different instrument (3 cold boots, elsewhere), and the drift was measured in their container. Transferring it is exactly what I did carrying build 4 onto the splashes. A general warm-up is plausible for any emulator, so this is not baseless — but it is unconfirmed for the corpus, and the magnitude gap is the evidence that the corpus's drift is not theirs. It cannot be closed without the corpus's own frame log.

✅ Untouched by any of it: the declared 255 and 210, and the port's 4.400 s / 3.650 s. Neither uses their draw log.

The guard this puts on keyframe_units_per_second

⚠️ "No single units-per-frame figure describes a run" is a statement about emulator presentation pacing, and a later reader could easily take it as grounds to revisit the port's 60. It is not. 60 is the game's logical unit rate (HANDOFF Q1, measured), the port renders at its own frame rate and converts through it, and guest pacing cannot reach it. authored/timing.json now says so at the constant itself, where someone about to change it will read it.

The n=1 disclosure, and the one port constant that rests on a single run

The Decoder disclosed that their ARM=early capture silently loses its trigger ~40 % of the time — two of five runs logged ARMED EARLY and produced no draw log at all, indistinguishable in the session log from a run that armed. So every draw-stream figure of theirs is n = 1.

That is worth more than the number it was attached to, because the port authors constants from those runs. Auditing which: exactly one, black_hold_units = 9. Everything else comes from the disc (the declared dwells 255/210, the settle window, the plate period), from the exporter, or from multi-sample measurements (Q1's unit rate over seven frames, Q5's navigation).

9 is not wrong, and three of its supports have moved. Its conversion used a 105-frame count their own truncation fix has revised to 114; its second corroboration (2.231) is the figure behind their retracted plate period; and a run-average units-per-frame is the wrong shape for a 3–4 frame event now that the rate is known to rise 33 % across a boot. Redone on their corrected local segments, their two runs give 8.95 and 6.71 units.

⚠️ Those two were reconciled as replicating "within the ±1 both are quantised to". Overlapping error bars are not agreeing central values — one frame is a third of this quantity. The range is ~6.5–9.2 and the port sits at the top of it.

The value stays. Changing it would be my arithmetic on their instrument, and this port does not author a number the corpus has not given; it is filed as a proposal in BLOCKED.md with the one run that would settle it. ✅ And what is not in doubt is that the hold is real: until this was implemented the port had no black frame at all where the oracle measures a plateau.

Their statistics, checked

Their per-boot excesses reproduce exactly: +0.89 %, +8.24 %, +6.79 %, spread 7.35 pp, wider than the 5.30 pp gap under test — so boot 1 alone essentially is the declared ratio. Their concession is right and my 2.4× cannot carry the weight I gave it.

One refinement, which cuts against their concession rather than for it: their 2.3 σ uses the population SD (3.178). At n = 3 the sample SD (3.892) is the right estimator, giving 1.89 σ — their run is less of an outlier than they credited themselves with. Testing the other question, whether the corpus mean differs from their prediction, gives t = 3.27 on 2 df, p ≈ 0.08. Neither framing reaches significance, which is where both of us landed anyway.

📌 Their sharpening of the instrument point is the keeper: a truncated log and a --screen=NAME render at t=0 both return a complete, well-formed answer to a different question. That is why neither looks like an error — nothing inside either view can tell you it is not the view you asked for.

P6 gate — sound on the P5 walk, verified, and the tool I nearly shipped instead

tools/port/verify-menu-audio. Until now the evidence that P6's gate was met was that audio.play("move") appears in boot.gd — evidence that a call is written, not that a sound reaches the bus. Those differ, and this project has the case to prove it: the black hold was implemented, called, and emitted nothing for five milestones.

It needs no sound card. Godot records the Master bus to a WAV under the Dummy driver. Three runs on main_menu: the walk (down,down,accept,cancel,up) and two controls — wait×5 for the bed alone, and left×5 for presses that reach _unhandled_input and are bound to nothing (Q5: left/right do nothing).

check result
a dead press is silent bit-identical to the bed alone, 114 688 samples
move on the bus r=0.201 at 1.85 s, bed-only 0.016, margin +0.185
confirm r=0.945 at 2.14 s, bed-only 0.371, margin +0.574
back r=0.660 at 2.42 s, bed-only 0.195, margin +0.465
cue order vs script order consistent

The order is the strongest line and it is free: the correlator is never told where to look, so three different templates landing in script order is three independent searches agreeing with the log. move's absolute r is low because it is the quietest cue under the loudest part of the bed; the margin over the same template against the bed is what carries it.

🔴 What it cannot conclude, and must never be read as: that these are the cues the game plays. That binding is HANDOFF Q8, the Decoder's, and nothing here re-measures it. This tool cannot tell a correct cue from a confidently wrong one.

The instrument I nearly shipped

The first version counted envelope bursts above a multiple of the bed level. It reported 4 cues on one run and 0 on the next, from the same script — its answer was set by two hand-picked constants, the multiple and a minimum run length, and the bed level is not constant across a run. I caught it only because I ran it twice.

The replacement has no such constant: the exported cue file is its own template, the search covers the whole recording, and the verdict is a margin over that same template matched against the bed-only control.

⚠️ Cue length is deliberately not asserted. The audible part of a cue is far shorter than its wave — 0.12–0.38 s against authored 0.344–1.016 s — because the bed masks the tail. "Elevated for 0.13 s" is a fact about the bed, not the cue, and I came close to filing that gap as a defect.

A check that could not be made independent

I tried to verify Q8's cue durations against the exported waves. They agree exactly — 0.533 / 1.016 / 0.344 — and the agreement is worthless: the exporter decodes from Q8's own offsets and packet counts, so the duration is determined by the claim under test. It confirms the export is faithful to the authored table, nothing more. Recording it because "I checked and it matched" is exactly what a correlated instrument feels like from the inside.

Their .tbm self-refutation does not reach this archive — and it fixes my guard anyway

The Decoder downgraded 38 of the forced-backdrop rule's 80 verdicts from decoded to inferred: those elements are .tbm, declaring fade ffffffff, and a solid white quad painted first at alpha 255 would make the screen white. No screen is white, so a .tbm's white is a modulation on a texture and its element alpha says nothing about coverage — the .t32 mistake one file extension further out.

✅ No verdict the port ships is affected. All six forced elements here are palogo_eff0.prm and pgloading_eff00.prm, role: primitive, kind_raw 0x10, fade 0xff000000. They fall in the 42 that stay decoded. And no layerless full-screen element anywhere in GP_TITLE has a non-black fade — checked across all 16 screens, so the downgrade cannot touch this archive.

But their diagnosis applies to my code regardless: an element's alpha is not its texture's opacity, and only an untextured primitive makes the two the same fact. My guard was sprite.is_none() — a symptom test, the same shape as the one they say fixed their symptom and not their cause. It would keep admitting a .tbm that this exporter happens not to emit a sprite for.

The guard is now the positive test, role == "primitive". It changes no verdict today — the six are identical before and after, 16 screens still validate — and it is correct by construction if the corpus grows.

⚠️ Not adopted from their message: their reading that the blend question now narrows to pbafc.prm. That is theirs to settle and the port draws no additive quad either way.

Coverage is now tested per instant, because scale animates

The Decoder found that forced_backdrop judged screen coverage from the declared size alone, ignoring scale — and the disc carries its own counterexample. pbafc.prm declares 844×600 at alpha ff, which reads as a screen-filling cyan wash; it is scaled 2 % × 3 % and draws about 17×18 px, strobing and travelling x=178→291. A moving glint. A rule reading its declared size would call it screen-covering.

The port had the same gap and it is closed. scale_at interpolates scale on the same linear ramp as the fade, and coverage is folded into the opaque-instant test rather than checked once: an instant counts only where the element is both alpha 255 and covering. That is the rule's own wording — "covers the screen and is fully opaque at some instant" — where the previous code tested the two halves at different times.

The static size prefilter is now deliberately not a rejection: an element scaled above 100 could cover the screen from a smaller declared size, so rejecting on declared size would have replaced one version of the bug with its mirror.

✅ No verdict moves. Six forced elements before and after; 16 screens validate; the oracle figures are identical to the digit (publisher_logo 0.01 %, developer_logos 0.01 %, main_menu 0.07 %, extras 0.19 %, title 0.26 %). Their claim that all 80 forced instances sit at scale 100 reproduces on the GP_TITLE subset, and more strongly: no layerless full-screen element anywhere in this archive has a non-100 scale on any keyframe.

It is in for the reason they gave, which is the right one: the data that would break it demonstrably exists on this disc. That is a better argument than a failure would have been, because it does not require the bug to happen first.

Their blend-robustness argument, checked

They classify the blend mode undecodable with reach and argue the rule does not depend on it, for a black quad:

drawn first drawn last
alpha-over, α=255 correct blanks the screen
additive, α=255 correct — adds nothing correct

The table holds. An additive black quad contributes nothing at any position, so both orders are correct under it; only alpha-over distinguishes them, and it picks first. "First" is right under both hypotheses, "last" under one — so forced_backdrop's verdict is robust to a question neither of us can close.

It also explains a detail of the original bug that I had not accounted for: "layerless sorts last" was wrong under alpha-over and merely pointless under additive, which is why those screens came out solid black rather than empty. The symptom was diagnostic of the blend mode all along.

⚠️ Not evidence that the blend is alpha-over, and I am not recording it as such. It is the reason the port can stop waiting on it. pbafc.prm remains the sole additive candidate and is outside the rule at 17×18 px; the port draws no additive quad either way.

P7 gate — the new-game intro plays and returns, and a defect I nearly invented

--menu=main_menu --script=accept walks the P7 path: Ⓐ on NEW GAME announces the two measured screens this export skips, opens S00A, plays it to its natural end at 93.33 s against the manifest's 93.9, and returns to the title. Nine film frames across the movie are distinct and non-black (mean 10 → 140). The gate asks for "plays, then returns to a defined state"; that is both halves.

The near-miss, which is the part worth keeping

Checking that the movie's audio actually reached the Master bus, I correlated the recording against the exported S00A.ogv audio and got r = −0.0068 at the movie's known start, with the correlator passing its own positive control at r = 1.0000. A working instrument returning zero at the right place. I was one step from filing "the movie's own audio never reaches the bus" — which would have been a serious P4/P7 defect, and the inverse of the human's original report that the intro "plays music but no voice".

It is false. Re-run on the boot path, where no menu bed is playing:

against the bed-free recording r at
ADV voice 0.8855 movie start 7.6 s
ADV movie audio 0.4178 movie start 7.6 s

Both present, at the same start. The movie's audio is simply quieter than the voice mixed on top of it, and in the P7 run the menu bed masked it below detection while the louder voice survived. The bed carries across into the movie — play_bed is documented as carrying across submenus — so the P7 run was never a clean measurement.

🔴 The lesson is about the control, not the bed. I validated the correlator on clean data and then ran it on masked data. A positive control proves the instrument works on the material it was given; it says nothing about whether the instrument can see through an interferer that was not in the control. A negative result needs its own positive control under the same masking, and this is the third time in this corpus that an unvalidated negative nearly became a finding — after "10 of 18 elements transparent at rest" and the burst counter that read 4 cues on one run and 0 on the next.

tools/port/verify-video-audio's header already warned that a fidelity comparison needs cross-correlation alignment and an agreed downmix. It was right, and I would add the third condition it did not know to state.

⚠️ What is not settled: whether the bed should carry into the movie and on to the title after it. It does, it is authored that way, and nobody has watched the game do either. That is a separate question from this one and is not filed as a defect — only as unmeasured.

✅ Also checked, from their compose finding: GP_TITLE declares 115 .t32, 45 .rat, 18 .prm and no .tbm at all, and every non-primitive element has a resolvable sprite. The "draws no pixels for an unresolvable element" hazard — the shape that hid pteff05 from both renderers — does not reach this archive.

ScreenView.skipped was correct and unread since P1 — now it says so itself

The draw loop has always tracked what it could not draw, with the comment "a silently missing element looks like art". Nothing ever printed it. For eight milestones the port could drop an element on every frame and report it to nobody.

That is the same shape as the black hold — implemented, called, emitting nothing until somebody filmed it — and as verify-screen scoring two blank frames OK. A fact that needs someone to remember to look at it is a fact that goes unnoticed, so _note_structural prints from inside ScreenView rather than returning a value for a caller to surface. Routing it through a caller is exactly what did not happen.

Only structural skips are reported — (no sprite in the export) and (sprite failed to load). (transparent at rest) is ordinary animation, true of every element at some instant, and reporting it would bury the two that mean something under the one that never does.

✅ Nothing is being skipped today: 0 across every screen, on the boot path and per-screen. This is a guard, not a fix. The export corroborates it — no missing sprite PNG, no element at alpha 0 on every keyframe, none at scale 0.

🔴 And the first version of that scan was a false pass

My first run reported "0 structural skips" on ten screens. screen_view.gd did not parse. I had inserted a line at three tabs inside a four-tab block — the Python assert old in s passed because a three-tab string is a substring of a four-tab line — which orphaned a continue. Godot loaded nothing, printed nothing, and grep -c faithfully counted zero.

A count of zero from a dead script is indistinguishable from a count of zero from a clean one, and I had already written the sentence claiming the clean reading. The scan now counts the screen summary line as a positive control: if the script did not run, summary-lines=0 says so, and the zero cannot be read as a pass. That is the third time this session that a well-formed answer to a different question nearly became a finding.

⚠️ Note the mechanism, because it will recur: matching indented code by substring is unanchored, and it silently matched a shallower indent than the one in the file.

Refutation attempt — "the element declared first paints first"

All six of the port's forced-backdrop elements sit at element index 0. So on those six screens the rule's verdict is indistinguishable from a far simpler hypothesis I had not tested: the first-declared element is painted first. If that held, forced_backdrop would be an elaborate way to reproduce the file's own ordering, and my six verdicts would be no evidence for it at all.

It is refuted, on 8 of 16 screens. Index 0 is not painted first on build_00/build_01 (position 2), extras (7), title (13), title_jp (18) and — decisively — main_menu, where index 0 is pteff00, painted last, position 15 of 16. pteff00 is the Decoder's own measured control: the game puts the first-declared element on top of that screen.

So declaration order is not paint order, the six coincidences are coincidences, and the rule is not redundant.

⚠️ What survives as a real limitation: those six screens, taken alone, cannot distinguish the two hypotheses. The evidence separating them comes from elsewhere in the archive. Worth stating because it is the exact weakness in the Decoder's pfbase.tbm upgrade — "element 0 of the save/load frame, and the measured order starts [0, 1, 2, …]". An order that equals the trivial order is weak evidence for any rule, since every rule preserving declaration order agrees with it. ✅ Their claim survives, but on evidence they did not cite: it is main_menu's pteff00 that rules out the trivial reading, not the save/load frame itself.

The menu bed plays under the cutscene, nobody decided that, and it stays

MenuAudio.stop_bed() exists and is called from nowhere. So the music that starts when the main menu goes live runs through the cutscene and on past it — and since authored/audio.json sets loop: "restart", it then loops. Both follow from the source and the authored data alone; no measurement is needed to establish them.

The port therefore emits two unrelated music tracks at once during S00A: the movie carries its own music and effects, and the menu bed is underneath it.

It is not being fixed, and that is the decision

PORT-MISSION's rule is to leave an unmeasured detail plainly wrong rather than plausibly invented, and this is the textbook case for it. Music over a cutscene is wrong in a way any listener catches in one second. Ducking or stopping the bed would sound entirely right — and would be a guess about a game nobody has watched. The audible version gets fixed; the plausible version ships forever.

So _play_video now announces it, the way skipped_chain already announces the two screens NEW GAME jumps over:

  -> video S00A at 1.13 s (…)
     🔴 the menu bed is STILL PLAYING under this movie -- unmeasured,
        left audible on purpose (BLOCKED.md: does menu music duck?)

It fires on the menu path and correctly stays silent on the boot path, where no bed has started. stop_bed is kept, not deleted: the day a capture says whether the game's menu music ducks under a movie, it is the one line to change.

⚠️ This is the mirror of ScreenView.skipped from the previous iteration — a fact recorded and never surfaced, against a capability provided and never used. Both were invisible for the same reason: nothing fails when they are missed.

🔴 And my correlator is not trustworthy on music under music

Chasing this I ran the envelope correlator over the P7 recording repeatedly and got answers that moved with the window and the template: the bed at r=0.42 with one template and no peak at all above 0.4 with another; a post-movie window search whose range excluded the correct answer and duly reported the bed's own loop as unidentifiable. I was drafting "46 s of unexplained audio after the movie" when the explanation was the authored loop: "restart" sitting in a file I had not re-read.

The instrument is sound where it was validated — discrete SFX against a bed, with margins of +0.5 over a negative control. It is not sound for music under music at comparable level, where every candidate scores 0.15–0.42 and nothing separates. ⚠️ A margin is only meaningful against a control at the same SNR, and I did not have one here. That is the fourth near-miss of this kind, and the first where I would have invented an anomaly rather than a defect.

Nothing in this section rests on that correlator. The finding is stop_bed having no caller, which is a fact about the source.

wait:<seconds>, and the bed's loop seam is 3.4 seconds of silence

The port could not be asked to run for a stated duration. A bare wait script step is pass — it returns as soon as the screen settles — so nothing happening after the settle point was observable from a harness at all. The music bed made that concrete: an 87.7 s track whose restart nobody had watched, on a harness whose longest menu run was under seven seconds.

--script=wait:105 fixes that, and the first thing it found was the answer.

The bed loops, exactly where it should

Recording the Master bus over 132 s with nothing but the menu playing — no movie, no voice, a clean signal — the bed's t=2…17 s template matches twice:

r pass begins
first pass 0.947 0.0 s
second pass 0.885 87.8 s

The track is 87.7 s. So loop: "restart" does what authored/audio.json says: replays from sample 0 at the track's end, no trimming, no loop point. ✅ First end-to-end observation of P6's looping behaviour.

And the seam is measurably as bad as it was authored to be

loop_why predicted "the listener hears the track's own fade-out and the silence after it before the music comes back". Measured off the bus:

window around the seam RMS
−8 … −4 s 2057
−4 … −2 s 714
−2 … −0.3 s 431
+0.3 … +2 s 2164

and 36 consecutive 50 ms windows below peak 300, from 84.40 s to 87.80 s — about 3.4 seconds of near-silence before the music returns. That is long enough to read as the music stopped, not as a loop.

The claim was right and is now a number. ⚠️ It does not license trimming to the fade: that would still invent a loop point, and an invented one is indistinguishable from a decoded one a month later. The measurement is recorded to make the cost of the missing loop point concrete, in authored/audio.json.

🔴 My first wait: was wrong by 39 %, and the way it was wrong matters

It used create_timer, which counts down on the frame delta. In an idle scene this container throttles and the delta it reports is not the time that passed: a requested 30 s took 41.7 s of wall clock while the port reported 30. Measured against date either side of the process, with a no-wait control to subtract 1.21 s of startup.

Now polled on Time.get_ticks_msec(): 30 s requested, 31.38 s wall, +4.6 %.

⚠️ This is idle-specific and is not a general clock fault, which I checked before writing any of it down. Over a whole boot, where things are animating, the port's clock tracks wall clock to within 4 % — 10.43 s wall against 10.82 s reported. So the port's animation timing is sound and the earlier splash-dwell agreement (4.400 s and 3.650 s against declared 255 and 210 units) stands; I had briefly believed it did not.

What is genuinely unsound is _elapsed while idle: it reported 23.21 s across 30 real seconds of waiting. Every timing the port prints during animation is fine; a timing that spans a wait is not.

📌 The reason to care: the only reason to hold a screen is to observe something on a real clock — an audio loop, a timeout, an idle return. A timer that silently ran 39 % long would have put every such observation at the wrong instant, and the bed-loop result above would have been the first casualty. It survived only because the seam was read off the recording's clock, which the bed's own known length calibrates.

Two harness bugs, and the defect the second one was hiding

1. --capture with --script photographed the frame before the script

--capture fired in _ready and quit. With --script that is before the first press: at t=0.133 s, with 10 of 16 elements still transparent. Two runs differing by two down presses came out bit-identical, and I read that as "runtime focus never changes" — a confident wrong finding that --shots contradicted within a minute.

Fixed: with a script, the capture defers to the end of the run, through the same _capture_to member the boot path already used. Verified — the two runs now differ at max 235, and the capture lands at t=82 units instead of t=8.

2. --boot --capture= wrote no file at all — ✅ FIXED, see below

_finish_boot() is reachable only from the overlay-quit branch, but the boot quit first: line 412 exits when _film == "" and _overlay_spec.is_empty(), and _overlay_spec is cleared when the overlay is raised. So a plain --boot ended at 10.99 s, 1.2 s before its own scheduled 12.21 s, and the capture never happened.

Confirmed pre-existing by stashing my changes and re-running. Fixed by also requiring _overlay_quit_at < 0.0. The boot now runs to 12.19 s, prints "boot ends on title + press_start", and writes the file.

⚠️ The flag has a doc comment explaining that it exists so the boot has an artifact of its own instead of a 600-PNG filmstrip. It has been producing nothing. A flag that silently writes no file is the same failure as ScreenView.skipped and stop_bed: provided, plausible, and never exercised.

3. 🔴 And the artifact it now produces shows the plate is missing

The boot's end frame is bit-identical to --screen=title at the same instant — max difference 0. The PRESS Ⓐ plate is not in the port's end state.

ptbtn00's own fade explains it exactly:

t 0 214 236 238 244
alpha 0 0 255 255 0

The plate is visible for 8 units — 0.133 s — and the boot captures at t=246.54, two and a half units after it has gone.

That is not an accident of frame timing; the code chose it. _overlay_quit_at takes max(view.settle_time(), overlay.settle_time()), and its comment says why: "the plate arrives at t=238 and build 4 is still fading up from black until t=261 … quitting when the plate lands photographs a title that has not finished presenting." Both halves are true, and together they mean the two states cannot both be in one frame. The port picked the title, and the consequence — that the plate is in no artifact at all — was never written down.

⚠️ I am not moving the trigger. The earlier reasoning is sound and the measurement it protects is real; picking the other instant would trade a missing plate for a visibly dark title, which is the swap that was already made once and regretted. What settles it is what the game does with the plate after t=244 — filed.

📌 Worth naming: defect 3 was invisible while defect 2 existed. A capture flag that writes nothing cannot show you a missing element. The broken tool was hiding the thing the tool was built to find, and neither was noticed because the absence of a file looks exactly like not having run the command.

What was not wrong, and how I nearly recorded that it was

Runtime focus works. Per-step --shots across down,down differ at max 232–233, with the differing boxes tracking down the button column. My contrary reading came from analysing 410 f_NNN files after asking for --shots=…/s — the filenames did not match the flag I passed, and that was visible in my first ls. A verbatim re-run produces six correctly-named per-step shots. I do not know where those 410 files came from, which is itself the point: I drew a conclusion from a file set whose provenance I never checked.

The PRESS Ⓐ plate: four bugs in a row, and a number I have been misquoting

Last iteration I filed that the plate was visible for 8 units and simply missed by the boot's capture instant. That was wrong in the direction that matters: the plate could not be drawn at any instant at all, and three separate faults had to be removed before it appeared. The fourth is a correction to figures I have quoted to the Decoder repeatedly.

1. --time= was silently ignored on half the screens

pose_at did if holding: t = settle_instant. The requested instant was discarded on every screen with a settle window ≥ 30 units — title, press_start. The flag parsed, the log printed the time asked for, and the pose came from somewhere else entirely.

ScreenView.frozen now marks an explicitly pinned instant and skips both clamps.

2. The settle window picked an interval where nothing is visible

press_start's keyframes are 0, 214, 236, 238, 244. The widest keyframe-free gap is 0…214 — the dead stretch before the plate exists, where ptbtn00 is alpha 0 throughout — so its settle instant was t=107, and every question about that screen was answered there.

🔴 A gap in which nothing is visible is not a settled state. The exporter now rejects those intervals. press_start becomes [214, 236] — 22 units, under the runtime's 30-unit bar — so it falls back to each element's own hold, which is the plate, opaque, as the disc declares it.

⚠️ It disturbs no window the settle instant was measured on: title keeps [160, 236], the interval the Decoder's draw stream independently found the game's clock freezing in.

3. An authored entry of mine was suppressing the decode

Even then the plate stayed dark, because authored/timing.json's looping_focus_records entry for press_start/ptbtn00 made _draw take the focus path — which draws the focus record instead of the base sprite:

with the entry without
press_start t=236 max 0 max 252.5
t=240 max 0 max 252.5
t=250 max 15.3 max 252.5

I authored that entry to give the plate a glow. It substituted a dim glow at the wrong phase for the element's own bright sprite, on the screen whose entire content is that sprite. Deleted — an authored guess that overrides decoded data with a worse answer is removed, not tuned. The glow is not claimed either way; drawing both would be a rendering rule nobody has measured.

✅ The boot's end artifact now contains the plate: mean 95.7 in its region against 33.6 for the title art alone, and the overlay reports drew 1: ptbtn00 where it reported drew 0.

4. 🔴 verify-capture has been measuring a different pose than it reported

It passed --time=5.9617 for the title — t=357.7 units, the Decoder's refined sweep fit — and that value was never applied, because of fault 1. Every title figure this tool has printed, including the 0.26 % I have quoted to the Decoder more than once, was measured at the settle instant, t=198, under a note claiming t=357.7.

Honouring the flag made it visible: t=357.7 is past the title's own group, which ends at t=269, so the whole screen posed at its faded-out final keyframes and the disagreement went to 30.97 %. The instant was only ever meant for the ptloop leaf, which runs to t=600 and is looped separately by loop_leaf. Applying it to the whole screen was always wrong and was harmless only while it was ignored.

The splashes had the same shape: --time=99 was an idiom for "settled" that worked only because it was discarded. Both rows now pose by omission, and the tool's note says what it does.

before now
title 0.26 % (labelled t=357.7, actually t=198) 0.21 % at t=198, labelled t=198
publisher_logo 0.01 % 0.01 %
developer_logos 0.01 % 0.01 %
main_menu 0.07 % 0.08 %
extras 0.19 % 0.19 %

The agreements were real; the stated pose was not. Corrected with the Decoder, since they have those numbers.

The flag audit that started it

All 16 flags boot.gd parses were exercised for an observable effect after last iteration's two silent ones. --pose=rest (max 111 against the timeline), --play (enters the menu), --no-hold (max 255 on two screens) all pass. --time was the one that did not, and it took a screen whose content is a single late spike to make the failure visible.

The title's residual is the sweep phase, and the sweeps fit at ~400 units, not 357.7

Last iteration I found verify-capture was passing the Decoder's refined sweep fit as --time=5.9617 and having it silently discarded, so the value had never been tested. Asking for it also destroyed the frame — t=357.7 is past the title's own group end at t=269 — which is why nobody noticed.

--leaf-time=<seconds> separates the two clocks: the screen sits at its settled pose, the ptloop leaf is placed at whatever phase is under test. That makes the fit testable for the first time.

Controls first

  • The renderer is deterministic — three runs at one leaf phase are bit-identical, max difference 0. So variation across phases is signal, not noise.
  • The sweeps are detectable — two phases differ over 0.3953 % of the frame at a 10 % threshold. A comparison at this scale can see them.

The fit

Sweeping the leaf across its full 600-unit span against live-title-build4-no-plate.png, structural disagreement at a 25 % threshold:

leaf phase differing
240 units 0.1410 %
320 units 0.3395 %
357.7 — the Decoder's fit 0.2532 %
390 0.0129 %
395–402 0.0124 %
405 0.0127 %
440 0.2033 %

A sharp basin at 390–415 units, an order of magnitude below everything around it, and 20× better than t=357.7.

What that means, and what it does not

✅ The title's 0.21 % residual is the sweep phase, not structure. At the fitted phase the disagreement falls to 0.0124 % — the same order as the splashes' 0.01 %. The port's title rendering is structurally right; the sweeps were simply somewhere else in their loop.

🔴 The port does not adopt 400 units, and verify-capture is not re-posed to it. That would be tuning until they match, which this repository's own tooling header warns against. The port loops the leaf freely — there is no phase parameter to set — and 400 units is a property of that capture's instant, not of the game.

⚠️ Reach: this assumes the port's leaf geometry and sprite are otherwise correct. A systematic error in how the sweeps are drawn could be absorbed by shifting the phase, and one capture cannot separate those. What makes the result worth having anyway is the sharpness — a 20× drop over 40 units is not something a geometry error would produce at a wrong phase.

⚠️ And it does not tell the Decoder their 357.7 is wrong as a measurement of whatever they measured it on. It says the phase that matches this capture is ~400. If those are the same quantity, one of the two is off by ~42 units; if they are not, this is a second quantity nobody had.

A second capture closes the sweep-geometry question, and the plate matches at 0.00093 %

Last iteration's leaf-phase fit came with a caveat I could not close: a systematic error in how the port draws the sweeps could be absorbed by shifting the phase, and one capture cannot separate those. A second capture can, and live-title-press-a.png — the title with the plate — was sitting in the corpus unused.

The second capture fits at a different phase, and better

capture pose differing
live-title-build4-no-plate.png settled, leaf at ~400 units 0.0124 %
live-title-press-a.png t=237, everything 0.00093 %

Two independent captures, two different sweep phases, both fitting to 0.01 % or better. A geometry error in how the sweeps are drawn would leave a floor in both, and at a phase-independent level. Neither has one. ✅ The caveat is closed and the port's sweep rendering is not systematically wrong.

The two phases are also consistent with each other rather than merely different: the plate is opaque only at t=236–238, so a frame containing it is early (t≈237) and a frame without it is either earlier or later. The no-plate capture fits at leaf ~400 — 6.7 s in, well past the plate's window — and its filename says it is build 4 alone. Both readings agree on where each frame sits.

⚠️ I nearly drew a further inference — that the no-plate capture dates the plate's disappearance and therefore answers the BLOCKED question about whether the plate stays up. It does not: the filename says build4-no-plate, so the capture was taken of build 4 alone, deliberately without the overlay. It carries no information about how long a plate lasts. That row stays open.

Capture 1 is not a whole-screen instant, which corroborates loop_leaf

Sweeping the whole screen's time against the no-plate capture, the best is 0.1483 % at t=230, degrading sharply past 240 as the group fades out — an order of magnitude worse than the leaf-only fit's 0.0124 % at phase ~400, which the main timeline cannot reach without fading everything.

So that capture is not "the screen at instant t". It is the screen settled with the sweeps still looping — which is exactly what authored/rendering.json's loop_leaf_on_screens: ["title"] models. That decision was authored from the leaf's zero slack; this is the first independent evidence for it.

🔴 The 1 % floor was the plate not being drawn at all

Before any of that, every sweep phase against capture 2 gave a flat ~1.0 %, with the residual a row of glyph-sized blobs on the plate's own position.

--screen=X --overlay=Y pushed the raw elapsed clock into the overlay — 9 units at the moment --capture fires. press_start is transparent until t=214. So the one flag whose entire purpose is put the plate on the title drew nothing and reported drew 0, and the frame read as a title with no plate.

A static overlay now poses at its own arrival. The --boot path is untouched: there the shared clock is the finding — the 120 units between build 4's last ramp and the plate's a=255 is a fixed interval on one timeline.

⚠️ My first patch for this was wrong and I nearly committed the comment for it: I wrote that "nothing outside a boot sequence drives the overlay's clock". It is driven — from view.time_units, every frame. The symptom was identical either way, and only re-reading the log after the fix failed showed the cause was the opposite of what I had written down.

The new row

title_plate joins verify-capture at 0.00% — two orders below every other row, which makes it the most sensitive regression detector in the harness.

⚠️ Its instant is fitted, not measured. t=237 is where this capture's content places it, found by sweeping. Choosing which frame to compare against is what every row here does, but the 0.00093 % is a floor for that pose, not a general statement of accuracy.

--focus= did nothing on the menu path, and the corpus had an untested focus capture

Two unused live captures were sitting in docs/re/captures/title-builds/. live-main-menu-options-focused.png is the menu with OPTIONS focused — the only capture of a known focus state — and it was untestable, because --focus= silently did nothing on the --menu path.

The flag parsed, was stored in _force_focus, and was applied to view.focused_id at startup — and then _menu_enter overwrote it with the authored initial focus on every entry. Every run logged focus ptbtn01 whatever was asked for, and all five buttons produced the same frame. It is now pushed into the menu model, not just the view, so navigation continues from where it was forced rather than jumping back on the first press.

The port's focus rendering is right, measured against the oracle

Rendering each of the five buttons focused, against each capture:

focused vs live-main-menu-options-focused vs live-main-menu
ptbtn01 NEW GAME 0.7352 % 0.0705 %
ptbtn02 LOAD GAME 0.8204 % 0.8378 %
ptbtn03 TUTORIAL 0.7220 % 0.7365 %
ptbtn04 OPTIONS 0.1355 % 0.7449 %
ptbtn05 EXTRAS 0.7029 % 0.7236 %

Each capture picks out exactly one button, by 5× and 10×. This is the first time the port's focus rendering has been checked against the game at all — the harness's own main_menu row uses an authored focus, so it could never have caught a focus error.

What that settles, and what it does not

✅ The port draws focus on the right button, distinguishably. ✅ live-main-menu.png shows NEW GAME focused, so the authored initial_focus: ptbtn01 matches the one frame it can be checked against.

⚠️ It does not overturn HANDOFF Q5, which measured initial focus as unstable boot to boot across four runs. One capture showing ptbtn01 is consistent with instability, not evidence against it. The value stays authored, with the agreement recorded beside it. Reading this as "initial focus is settled" would be exactly the over-generalisation from a single observation that this corpus keeps having to withdraw.

main_menu_options joins verify-capture at 0.13 %.

⚠️ Still unused: live-attract-title-press-a-band.png, a 1279×120 strip rather than a full frame. It needs a banded comparison the harness does not do, so it is named here rather than quietly left out.

The last unused capture, placed — and its residual is the oracle's, not the port's

live-attract-title-press-a-band.png was the one live capture nothing consumed. Following last iteration's rule — an unused capture is a signal about the harness — it turned out the same way as the previous two: nothing about the capture was unusable, the harness simply could not compare a band. It is 1279×120, not a full frame.

Placing it

Sliding it down the render, structural difference against the port:

y differing
300 51.99 %
500 19.61 %
515 9.14 %
520 0.354 %
525 8.87 %
555 24.02 %

y = 520, a 25× drop over five pixels. Measured, not guessed. Sweeping the instant at that offset puts it at t = 236–238 — the plate's own opaque window, the same instant the full-frame title_plate row fits.

🔴 The 0.354 % is not the port's error

Three comparisons separate it:

differing
port's band vs live-title-press-a's same band 0.000 %
live-title-press-a's band vs the attract band (oracle vs oracle) 0.301 %
port's band vs the attract band 0.354 %

The port reproduces one capture's band exactly. The two captures differ from each other by 0.301 %, which is nearly the whole residual.

And that oracle-to-oracle difference is two thin horizontal strips — 248×5 px and 206×1 px — which is the shape of a sub-pixel edge difference or capture noise, not of a state difference.

⚠️ I had started writing that the attract-returned title differs from the boot title, which would have been a finding about the game inferred from 0.3 % of a band. It is two hairlines. The connected-component breakdown is what stopped it, and I would not have run it if the number alone had looked small enough to dismiss or large enough to report — it was in the range where you have to look.

So title_band joins the harness at 0.35 %, and its job is to stay near the oracle-to-oracle gap, not to reach zero. A row whose target is not zero has to say so, or the next person tunes toward it.

✅ All eight live captures in the corpus are now used. Three were sitting idle and all three were blocked by the harness, not by the capture: an overlay posed at t=9 that drew nothing, a --focus= overwritten on every menu entry, and a banded comparison that did not exist.

MODDING.md had five rules and no check. Now it has one, and all five pass

MODDING.md opens by calling modding a constraint on the exporter today, not a later feature. Nothing verified it. That is the shape this port keeps finding — a rule stated, believed and unexercised: the black hold implemented and never called, ScreenView.skipped written and never read, stop_bed provided and never used, --focus parsed and overwritten on every menu entry.

tools/port/check-modding covers all five. Every one passes today, so it is a guard, not a fix: its value is that the next thing to break one says so.

rule check result
1 — one asset, one file every referenced sprite present, none orphaned, no split names 174 / 174, exact
2 — recognisable names no hex or hash-shaped filenames none
3 — modern formats extensions confined to json/png/ogg/ogv (+ sidecars) clean
4 — base and overrides data/mods gitignored and read by the exporter both
5 — provenance every generated JSON carries a source 17 / 17

It is proved to fail

A check that has never failed has not been shown to work — the lesson from check-capture, which once passed a file with 36 % holes punched through it. Three controls, each failing correctly with a non-zero exit:

  • a .cmd sidecar with its header stripped → rule 3;
  • a bogus.bmp in the sprite tree → rule 3;
  • one orphaned PNG → rule 1, "174 referenced, 175 present".

The one thing it found: an unlabelled generated file in the asset tree

The two .cmd encode-cache sidecars sat beside the .ogvs in the modder-facing tree with no line saying what they were — a bare ffmpeg command next to a video reads as something to edit or delete. They now carry a header stating that they are generated, are not assets, and that the way to change a video is an override under data/mods/.

Two details worth keeping:

  • the header is excluded from the cache key, so rewording it does not re-encode four minutes of video. A cache that punishes documentation gets documented once and never again.
  • the sidecar is now refreshed whenever its text differs, not only when a re-encode happens. It used to be written inside the !fresh branch — which meant a header change could never reach an existing export, because nothing that reads the header triggers the write that updates it. The explanation would have been correct in the source and absent on disc. Confirmed: two consecutive exports, 20 s and 19 s, header present, no re-encode.

And a question I asked the Decoder that I could partly answer myself

Last iteration I asked whether the 0.301 % between two of their captures implies a capture-path floor on every comparison in the corpus. It does not, and I had the evidence already: the port matches live-title-press-a.png at 0.00093 % full-frame and 0.000 % across the band. A general floor could not coexist with either number. So the 0.301 % is specific to the attract band capture, and my 0.01–0.2 % rows are not sitting on a hidden floor. ⚠️ What that does not settle is why those two frames differ — still theirs, and still worth an answer.

Five authored values had no reader — including the one I asked for measurements into

Applying the prior from the last six findings — a rule or capability nothing exercises turns out broken or inert when someone looks — to authored/ itself. Grepping every authored key for a reader in the exporter or the runtime:

key file status
dwell flow.json 🔴 no reader — now wired
ramp timing.json no reader — now asserted
left_right flow.json no reader — now asserted
input_during_transition flow.json no reader — now asserted
stems audio.json no reader (stems_why is carried; the sum is hardcoded)

Everything else — se, bgm, voice, boot, screens, navigation.wrap, draw_leaf_for, loop_leaf_on_screens, keyframe_units_per_second, black_hold_units, archives, also_export, presentation, loop_mode, initial_focus, skippable, then_video, after_video — is read.

🔴 dwell is the one that mattered

Its own text says "when a capture times the real boot, the extra hold per screen goes here." A number placed there did nothing. Two iterations ago I asked the Decoder for measurements destined for exactly that slot; had they arrived, they would have been filed into a value with no reader and the boot would have been unchanged, silently — and I would have reported the boot as matching.

It is wired now, and stays empty. Nothing is authored into it: the splash dwells are declared on the disc and measured to agree. Wiring the slot so that a future number has an effect is the opposite of adopting one.

⚠️ I wired it to the wrong branch first, and it did nothing — silently. Holding longer after settle changes nothing, because the screen still leaves when exit_time() + black_hold arrives and the extra hold is absorbed. A dwell has to delay the departure. I found it only because I tested the control: +120 units moved the transition 4.46 s → 6.43 s, +1.97 s, with the video following by the same amount. Reproducing the exact defect I was removing, inside the fix for it, is the strongest argument I have for testing that a wire carries current rather than that it exists.

The other three are asserted, not implemented

ramp, left_right and input_during_transition describe behaviour the port hardcodes. That is fine for a record and dangerous for a switch, and they are written like switches — setting left_right to "move" would change nothing and warn nobody.

Rather than invent the missing implementations, _check_authored_invariants asserts the value the port was built against, naming the file. Changing one now produces an error instead of silence.

That is precisely the distinction left_right's own why claims to be making — "written out rather than left unhandled so that 'the game ignores it' and 'we never wired it' are different lines of code" — and which was not in fact being made, because nothing read the value that was supposed to make it.

✅ The validator is called, not merely defined. A validator nobody invokes is the same defect it exists to catch, and this file now documents six other instances of exactly that.

Verified: clean boot with no invariant errors and unchanged timings; setting left_right: "move" produces the error; all five MODDING rules still pass; the oracle rows are unmoved.

FORMAT.md declared the port's own export invalid, and a failed export is not atomic

Continuing the audit that has now found seven unexercised rules: FORMAT.md is the open format spec — written for a stranger reading the tree with no access to the disc or this exporter. So the question is whether what it promises is what sylpheed-export check enforces.

Five documented requirements, each broken in a copy of the tree:

broken caught
unresolved removed from a screen ✅
peak_dbfs removed ✅
peak_dbfs = −120 (silence) ✅
duration_s removed ✅
peak_dbfs = 0.0 on an se passes

The last row is the doc's error, not the code's

FORMAT.md said flatly that check "refuses a tree whose peak is ≤ −90 dBFS or ≥ 0 dBFS". The implementation is kind-dependent and deliberate: a bgm is a sum we produced, so a peak at or above full scale is our arithmetic and is refused outright; an se or voice is a single wave off the disc, mastered near full scale, whose lossy decode overshoots by a fraction of a dB, and those are allowed to +1.0.

🔴 And the doc was wrong about the port's own export. It ships confirm at +0.18 dBFS and the ADV voice at +0.31 — both above 0. A consumer implementing a validator from FORMAT.md would have rejected a valid tree, and the file that exists to let someone check our work without trusting us would have been the thing that misled them. Corrected, with the +1.0 marked as the judgement it is.

✅ Verified both directions: a bgm forced to 0.0 is refused with "a SUM we produced clips"; an se at 0.0 passes.

🔴 A failed export leaves a tree that is not an export tree

Found by accident, and worth more than the way it was found. Testing the new stems assertion, the exporter bail!ed part-way — and left export/ with no manifest.json at all. Every subsequent tool then reported "has no manifest.json — is that an export tree?", which reads as a broken harness rather than as the aftermath of a deliberate failure.

⚠️ It cost me a wrong reading immediately: the first run of the requirement audit above reported every case as "no manifest", and I nearly recorded that the validator was checking nothing. It was checking a tree that had been half-written.

The exporter writes the manifest last, which is the right order — a manifest is a claim about a tree, and a manifest for a tree that was never finished would be worse. So this is filed rather than fixed: the behaviour is defensible and the message is not, since "is that an export tree?" describes the symptom and hides the cause. What a stranger needs to be told is the last export failed; re-run it.

check-all, a verdict that ignored its own statistic, and a claim of mine that was wrong

Eleven tools under tools/port/ and nothing ran them together, so each had to be remembered individually. That is the ninth instance of this port's recurring shape — correct, documented, unexercised — one level up: the checks were the thing nobody was running.

tools/port/check-all runs the four that assert (check, check-modding, check-capture-controls, verify-menu-audio), prints the oracle table, and handles verify-screen specially. All eleven were exercised first and none had rotted; which-focus independently picks NEW_GAME at a 93.8× margin, which is a second instrument agreeing with the capture fit's 10×.

Two things it is careful about:

  • the six exploratory tools are not listed as passes. They produce artifacts for a person to look at and have no verdict; counting them would invent six.
  • verify-capture is reported, not asserted — it always exits 0. Its header is right that the numbers are not a target, but not a target is not not a regression detector, and nothing would notice title_plate moving off 0.00 %. Named as a gap rather than papered over; a real fix needs stored baselines, and what a baseline means when the pose is fitted is a decision, not a chore.
  • the verify-screen allowance expires on its own condition. It is allowed to fail only while formats-pin-2026-08-29d is not an ancestor of origin/main; the day it lands, check-all fails instead. A suppression with no expiry is just a hidden failure.

🔴 The verdict ignored the statistic added to inform it

verify-screen computes over3 — how many pixels exceed the bar — because "a single max cannot tell 2 pixels from 25 444", its own words. The verdict was then decided on max alone. So main_menu (max 4, over3 0) read DIFFERS while extras (max 3, over3 0) read OK: one unit on one pixel separating two frames that are equivalent at the bar.

⚠️ Not fixed by raising the bar, which this file rightly forbids. The bar is still 3. A frame with no pixel over it now gets its own verdict, ROUNDING, instead of being lumped in with a real disagreement. Tenth instance: the fix was implemented, documented, and never wired to the thing it was for.

🔴 And "six expected DIFFERS [refuted]" — which I have told the Decoder more than once — was wrong

The true count was ten, now eight after the rounding fix:

screens count explained
the forced-backdrop six 6 ✅ the pin: two decoder eras
main_menu, main_menu_jp 2 ✅ now ROUNDING, not a disagreement
title, title_jp 2 🔴 not explained

title differs on 790 pixels and title_jp on 20 498, and neither is the forced-backdrop rule — those screens have no forced element. I had a blanket allowance covering two disagreements I had never accounted for.

My hypothesis for them is refuted. authored/rendering.json notes that the consistency harness compares against a renderer that draws no .rat leaves, so the port's ptloop sweeps looked like the obvious cause. Emptying draw_leaf_for and loop_leaf_on_screens changes the numbers not at all — 790 and 20 498 either way. verify-screen poses at rest, where the leaves evidently do not draw. Filed as open.

⚠️ title_jp is a localisation screen and out of scope (MISSION §7). title is on the boot path and is not.

The title disagreement, localised — and the question I filed for it was the wrong one

Two iterations ago I filed title's 790-pixel disagreement with sylpheed-cli as needing the Decoder: "which elements does sylpheed-cli draw on build 4 at rest". That was a hypothesis dressed as a question, and it is wrong. I could answer it myself, and did.

What is established

  • The pixels cluster in one place: x ≈ 938–1162, y ≈ 172–310, as blobs of 20–66 px. That is ptlogo_back2eff1's position, pos=[938, 194] — one of the six ptlogo_back2eff* glows, all of which carry a sprite and no declared size, so the texture supplies it.
  • 🔴 Both renderers draw it. The region reads mean 95.60 in the port and 95.08 in the CLI. So the premise of my filed question — that one draws an element the other does not — is refuted. A set difference of element lists would have answered nothing.
  • It is not a placement offset. Rolling the port's frame by every combination of ±1 px makes it worse by two orders of magnitude — 790 pixels aligned against ≥ 175 406 for the best shift. The images are registered; they differ in content on 0.086 % of the frame.

What is not established, and why I am not guessing

The mechanism. My next hypothesis was edge antialiasing, and the test failed its own control: the edge mask classified 92 % of the frame as edge, so the 25.2 % of differing pixels landing on it is below chance and the instrument is dead. A number from it would have been noise wearing a decimal point.

The ask is downgraded rather than left standing

BLOCKED.md's row asked for the wrong thing on a refuted premise, which is worse than no row: it would have spent someone else's time confirming a difference that is not there. Corrected.

⚠️ And the residual value is genuinely low. This is two of our own renderers disagreeing on 0.086 % of one frame, on a screen where the port matches the oracle at 0.21 % and its plate variant at 0.00093 %. verify-screen's own header says a DIFFERS means "we moved apart, go find out which of us moved" — here neither moved from the game. It stays visible as a DIFFERS rather than being allowed, because an allowance is how the two title rows hid inside "six expected" in the first place.

Auditing BLOCKED.md found three stale rows, and the undated ones were all three

BLOCKED.md opens by warning that it goes stale "within the hour. It has." Nothing audits it. So I read every live row against a running port instead of against my memory of it.

Three were wrong

P3/P5 — the title screen was the worst, and had been for weeks. Every factual claim in it is false: the boot does not end on a plateless build 4, press_start is not unused, and the port has drawn two builds at once since the plate-delay work. Verified this iteration — boot ends on title + press_start, overlay press_start … drew 1: ptbtn00, plate region mean 95.70 against 33.6 for the bare title.

🔴 And a row four lines below it was already marked answered and TAKEN for the same question. Two rows on one question, one struck and one live claiming the opposite — and the live one was the stale one. A reader taking the page at face value would have believed the struck row was the old news.

P4 — is an attract movie skippable led with "the port could not tell which bug that is". It can and it did: DECISIONS.md records Ⓐ does skip the intro in this build, and every boot run since prints video skipped at …. Corrected to 🟡 — (a) answered, (b) still needs a capture.

P6 looping was not wrong, only thin. It now carries the measured cost: the bed loops at 87.8 s against the track's 87.7, and the seam is 3.4 seconds of near-silence. The missing loop point now has a price expressed as a number rather than as the adjective "ugly".

The undated rows are the ones that rotted

Checking which sections record the HANDOFF commit they derive from — the standing instruction, and the thing this page's own header demands — splits the file exactly:

sha
every prose section added since 2026-08-29 ✅ all
every row in the two tables 🔴 none

And all three stale rows were in those tables. That is about as close to a controlled experiment as this page will produce: the rows with no date are the rows nobody could tell had aged.

⚠️ I have not back-dated them. Nobody knows when most were written and an invented sha is worse than an admitted absence — it would make an undated claim look checked. Both tables now say so at the top, and carry the date they were last audited against a running port.

📌 The general form, which is the eleventh of these: a document that warns about its own failure mode is not thereby protected from it. This page has said "it goes stale, it has" since P1, in a header everyone reads and nobody acts on. The warning was doing the work of a check.

The record already answered last iteration's question, under headings that name it

Last iteration I investigated title's and title_jp's disagreement with sylpheed-cli, ruled out leaves and placement offsets, watched an edge test fail its own control, and filed the mechanism as unknown — to the Decoder as well as here.

Both were already explained in this file, under title: a tie in the paint order and title_jp: nearest-neighbour sampling phase. Headings that name the two screens in question.

Both still hold, checked rather than assumed

  • title — the CLI uses a paint order measured off the running game; the port derives one. Every disagreement is inside a tie. Verified against the current export: title still ties on 0x8083 (the back2 glow group, 5 elements), 0x80a0 (7) and 0x8010 (2), and the export declares paint_order_ties in unresolved. The old entry costs it at 904 px in the glow band, all 4–6/255; I measured 790 px at x≈938–1162, y≈172–310, max 6 — same band, same magnitude, count moved with the export.
  • title_jp — ptlogo_eff2 at 125 %, where the CLI samples the source at the destination pixel's top-left and a GPU samples at its centre. The entry claims it is the only drawn element in the export at a non-integer scale ratio. 🟡 A whole-export census finds 26 such keyframes — until it is restricted to elements visible at rest, which is the pose verify-screen uses. Then there is exactly one: title_jp/ptlogo_eff2. The claim survives, and it survives narrowly enough to be worth the check.

🔴 The failure is navigability, not memory

6 502 lines, 111 ## sections, 243 ###, and no index. So "has this been decided already?" had no cheap answer, and the expensive answer — re-deriving it — looked like diligence. It also cost the Decoder a message reporting an open question that was closed.

tools/port/index-decisions generates a contents block, and check-all runs --check. ⚠️ Two things about the design, both learned the hard way in the same half-hour:

  • it carries no line numbers. The first version did, and writing the index shifted every line below it — a fixpoint that failed its own --check on the first run. Worse, appending a section would silently invalidate all of them.
  • it is checked, because a stale index is worse than none: it would answer "is this already decided?" with a confident no. That is exactly the failure it was built to prevent, and building an unchecked one would have reproduced it one level up — which this port has now done often enough that I looked for it deliberately.

📌 The twelfth instance, and a new species. The first eleven were "correct, documented, unexercised." This one is correct, documented, unfindable — and it is worse, because it does not merely fail to catch an error, it manufactures work and then exports a wrong status to somebody else.

🔴 Twenty-one messages to a dead address, each one warning me it was dead

Every SendMessage I sent the Decoder from 2026-08-29 onward came back with:

accepted by the server for that session, but delivery is not confirmed: it has not reported that it can receive cross-session messages

Twenty-one times. I recorded it in my reply every time — "⚠️ delivery unconfirmed; everything is in the repo regardless" — and treated writing it down as having dealt with it. It was not a caveat. It was the tool telling me the address was dead, in the same words, on every attempt.

The cause

I addressed bridge:session_01QsEPXW…, copied from the from= of an inbound message. That is a session ID, and it died when the Decoder restarted. PROTOCOL.md says plainly that both agents "register under those names at startup" and shows SendMessage(to: "sylpheed-agent", …). Names survive a restart; session IDs do not. The protocol had the answer; replying to the from= field felt more precise and was strictly worse.

Why this one is the worst of the thirteen

The other twelve were things nobody was looking at. This one had an alarm, and the alarm fired every single time. I did not miss it — I read it, wrote it into my own status line, and carried on. Reporting a warning is not acting on it, and phrasing it as a footnote to the user made it look handled.

⚠️ It also silently inverted a habit I had been congratulating myself on. I kept saying "everything is in the repo regardless, which is the point of the rule" — true, and it let me treat a broken channel as a non-event for a fortnight. The repo did carry the findings. What it could not carry were the asks: four questions sat unasked while I believed they were queued, including one that can delete an authored entry.

What changed

Re-addressed by name after ListAgents, and the send came back without the warning — which is what a working channel looks like, and what twenty-one unworking ones did not.

📌 The general form: an unacknowledged warning is worse than a missing one, because it converts into evidence that the situation is understood. The fix is not "read the warnings" — I read them all. It is that a warning repeating unchanged across attempts is a state, not a footnote, and the second identical one should have been treated as a failure rather than a fact about the world.

The forced-backdrop pass is load-bearing on two screens, not six

I have said "six forced elements" since implementing the rule, and checked after every change that no verdict moved. That measured the pass's stability, never its necessity. Removing it entirely answers the other question:

screens order without the pass
publisher_logo, publisher_logo_r, developer_logos, developer_logos_r byte-identical
build_12, build_15 first element becomes pgloading_loop5 — the black screen returns

Four of the six are redundant. palogo_eff0's layer key is 0x00000000, layer_source: implied — lower than the lowest sprite key on those screens (0x0000a100) — so the crate already sorts it first and the occlusion rule merely agrees.

🔴 The two that matter have no key at all. On build_12/build_15, pgloading_eff00 carries layer: null, layer_source: none — the only two elements in the export with neither a read nor an implied key. Their position rests entirely on the occlusion constraint, with nothing to fall back on. That is the port's single strongest dependency on a rule it did not decode, and it was hiding inside a count of six.

Which is also what makes the rule worth having

An agreement on four screens where a key already existed is not evidence — it is the rule reproducing the crate. The two screens where it is load-bearing are the two the rule was found on, and the argument for it there is not the key (there is none) but that a permanently black screen is impossible on its face.

⚠️ So the honest statement, replacing the one I have been repeating: the rule decides two screens and confirms four. I will not describe it as six again.

The layer-key census this came out of

layer_source count which
sprite — read from the file 160 everything with a texture
implied — the crate's, measured per name 16 pteff00, pteff02, palogo_eff0, pgloading_eff00
none — no key exists 2 pgloading_eff00 on the two loading screens

✅ Every layerless primitive's position is implied or absent, never read — and FORMAT.md requires a consumer to be able to tell, which layer_source delivers. The Decoder's own page says pteff00's place on top "is still a measured per-name entry, not a decoded one"; the port inherits that through layer: 0xfffffffe, layer_source: implied and declares it. Nothing is being passed off as decoded that is not.

Re-running the Decoder's necessity census: every figure reproduces, and what that is worth

They took the stability-vs-necessity correction disc-wide and published the instrument with it — "so you can re-run it rather than trust it". I did, from a worktree at their branch, across all 33 archives their census names:

theirs my re-run
forced instances 80 80
decided by the rule 62 62
merely agreed 18 18
decided, by extension 38 .prm / 24 .tbm 38 / 24
decided rows listing a keyless element all all 62

Exact, on every figure. ⚠️ The example defaults to GP_TITLE and takes an archive path, so a bare run reports 6 instances, not 80 — the disc-wide number needs the loop. Worth saying because "I ran their instrument" would otherwise be true and mean a thirteenth of what it sounds like.

🔴 What this verification is not

I ran their code. A fault in the instrument reproduces identically for me, so this is not two independent measurements — it is one measurement executed twice. That is the same correlated-instrument trap as verify-screen scoring two blank frames OK, and I would rather name it than let a table of matching numbers imply more than it has.

The genuinely independent evidence is narrower and came first: I removed my own post-pass in the exporter and diffed the export. Different code, different language, different layer of the stack — and it agreed on the six GP_TITLE instances. Their crate-side run agrees with that. So the GP_TITLE result has two witnesses; the other 74 have one, executed twice.

The consequence for the port

Both of the port's decided screens are inside the 62, and every one of the 62 is keyless — so the impossibility argument ("a screen black at every instant of its own timeline cannot be right") is carrying all of them alone, with no key beneath it anywhere. The exposure is theirs to hold disc-wide; the port's share is build_12 and build_15.

⚠️ 24 of the 62 are .tbm, which their page still records as "correct or inert" because the corpus cannot find a .tbm's pixels. None are in GP_TITLE — checked again: 115 .t32, 45 .rat, 18 .prm, no .tbm — so nothing the port ships depends on that half. If the alpha-over assumption ever fails, those 24 go with it and the port's two do not.

A second witness for the pixel-cost claim, from a different renderer

The Decoder moved the necessity question to a new layer rather than re-running the sort — they rendered each of the 62 deciding builds twice and diffed the pixels, finding that on all 38 .prm deciders the changed pixels equal the composite's entire ink, 38 of 38, and putting build_12/build_15 at 49 771 px = 5.40 % each.

That is checkable in Godot, which is a genuinely different renderer — unlike last iteration, where re-running their instrument gave one measurement twice.

build_12, --pose=rest ink
with the rule, threshold > 0 59 530 px (6.46 %)
with the rule, threshold > 1 48 368 px (5.25 %)
without the rule 0 px at both

✅ The strong form holds. Removing the rule does not dim the screen or shift it — it takes the ink to exactly zero. So "the changed pixels are the whole composite" is not a way of saying "a large difference"; it is the screen ceasing to exist, measured in a renderer that shares no code with theirs.

Their 49 771 sits between my two thresholds, 2.9 % above the > 1 count. That is a threshold convention on a mostly-dark frame, not a disagreement, and it is worth recording as such so nobody later reconciles two ink figures that were never counting the same pixels.

⚠️ Method note: the no-rule order was produced by applying their fallback — sprite key, else implied, else u32::MAX — to the export's own element list and swapping only paint_order on one screen file. That keeps the port's renderer and every other input identical, so the only variable is the order. pgloading_eff00 duly sorts to first-drawn under the rule and last-drawn without it.

Their point 4 is the pattern catching one of their own

They report that the 24 .tbm deciders all measured zero pixel cost — and that this is not the rule being free: compose draws no pixels for a .tbm at all, so their position cannot change a pixel by construction. The control asked whether the composite had ink, which it always does. A control that could not fail.

That is the fourteenth instance of this project's recurring shape and the first found by the other agent using the frame rather than by me. It leaves the .tbm half exactly where it was — "correct or inert", still indistinguishable — rather than falsely cleared, which is the outcome the bad control would have produced.

✅ Nothing the port ships is affected: no .tbm in GP_TITLE, and the port's two deciders are .prm.

Reconciling the two ink figures, and what "has its own key" is resting on

The Decoder reconciled our build_12 ink counts and corrected a mistake I would otherwise have made in their favour.

theirs mine gap
RGB > 0 49 771 59 530 9 759 px
RGB > 1 48 043 48 368 325 px — 0.67 %

🔴 Their 49 771 was never a threshold figure. It is exact RGBA inequality between the two paint orders, which over a black backdrop coincides with ink>0 — so it belongs against my 59 530, not against my 48 368. Matching it to the closer number would have made us agree for the wrong reason, and they said so before I could do it.

Checked on my side: my value-exactly-1 population is 11 162 px, and the gap above >1 is 325 px. So 9 434 of the 9 759-px gap — 96.7 % — lives in pixels whose value is exactly 1, and their renderer produces that many fewer of them. Their claim holds structurally, not just in headline.

✅ Two conventions worth carrying, both theirs:

  • >0 is not portable between renderers on a mostly-dark frame; >1 is. Any cross-renderer ink figure needs its threshold named. This corpus has spent real effort on residuals at the 0.1 % scale, and a 16 % artefact hiding at 1 LSB is exactly the size of thing that would have been argued about.
  • the without-the-rule zero is threshold-insensitive in both renderers, which is the first double-witnessed result on this rule.

One refinement on the 18 confirmations

They sharpened my summary: the 18 are worse than "the crate agreeing with itself" — 14 have their own key so the rule never fires decisively, and 4 are builds where every element is forced, so the tie-break gives the same order regardless. None is evidence in either direction. Agreed.

⚠️ But for the port's four, "has its own key" is doing quieter work than it sounds. palogo_eff0's key is 0x00000000 with layer_source: implied — the crate's measured per-name entry, not a value read from the file. So those four confirmations are not the file already settles it; they are another measurement already settles it, in the same category as pteff00's place on top, which their own page is careful to call measured rather than decoded.

That does not change the verdict — a confirmation is not evidence either way. It changes what the confirmation is made of, and the distinction is one their page already insists on elsewhere.

Not one of the 80 has a decoded key — and the port's four are the rule's oracle check

The Decoder took the key-source question disc-wide and the answer is stronger than either of us had it: 0 of the 80 forced instances carry a key read from the T8aD header. 14 have an implied_layer_key, 66 have nothing.

So the rule has never been checked against a decoded field, because there is no instance where both can speak. That is what a keyless-element fallback necessarily looks like — but it removes a check a reader would assume exists.

The port's six are the same pattern exactly, verified from the export:

count
read from the file 0
implied — measured in the running game 4 palogo_eff0 on the four splashes
nothing at all 2 pgloading_eff00 on build_12/build_15

They retracted something in the direction that costs them

Last round they wrote that "none of the 18 is evidence for the rule in any direction", and I agreed and repeated it. They have since separated two questions I had let run together:

  • does the rule change the composite there? No — the sort already had a key. That is the necessity count and it stands.
  • does the rule get the right answer there? Yes — and this is the only place it can be asked. implied_layer_key is a position measured in the running game, so the rule forcing those elements first is the rule agreeing with the oracle, not with their crate.

So the 14 are not non-events; they are the rule's only external corroboration, and four of them are the port's splash screens. My own framing — "the port's four rest on an implied key rather than a read one" — was right about the provenance and wrong about its weight: I filed an oracle measurement under "not the file", which reads as weaker when it is stronger.

⚠️ ✅ The revised state, which I expect to be stable: 38 .prm deciders with a measured pixel cost, two double-witnessed · 24 .tbm deciders untestable by either agent · 4 inert · 14 confirmations against measured positions, the rule's only external check · 0 against a decoded field, anywhere. The impossibility argument carries all 62.

📌 Closing this thread on my side. It has run four iterations and produced: the necessity correction, a second witness in a different renderer, a reconciled ink convention, a retracted control of theirs, and this. It has also stopped being about the port — nothing in build_12/build_15 has moved since the rule landed, and the remaining questions are the Decoder's to hold. Continuing would be refining someone else's page.

A withholding reason that was false, and the measurement beside it that was not

authored/rendering.json names three leaf records the exporter flags and the port does not draw. Auditing the reasons rather than the behaviour:

🔴 build_12,15/pgloading_loop5 — the reason was wrong

It read "leaf scale (0,0). A zero scale is one of the three historical failures this corpus names." That describes t=0 and t=30 and nothing after them.

What the leaf actually holds, read from the export: one element, pgloading_ring, with a sprite, whose scale ramps 0 → 250 → 800 → 1000 while its alpha rises to full at t=55 and falls to nothing by t=130. An expanding, fading ring — a loading pulse, not a degenerate record.

⚠️ And it is visible at the instant this port poses. build_12's settle window is [40, 48], so the pose lands near t=44, where the ring interpolates to scale 140 at alpha 143. Withholding it is not declining to draw nothing; it is declining to draw something, and the one-line reason concealed which.

✅ It stays withheld, on the reason that always applied and is already written below it in the same file: there is no way to adjudicate it here. The loading screens have no oracle capture — the Decoder records them as unreachable from the title path — and verify-screen compares against a renderer that draws no leaves. Drawing it would put unadjudicable content on a screen, which is the test ptlogo_eff2 also fails. Behaviour unchanged: build_12 still renders 59 530 px of ink.

📌 The two entries in that list were written to different standards. The title_jp/ptlogo_eff2 reason is four paragraphs, states the scale as a pop (0 → 125 % → 0 over 0.95 s), works through both readings and says why neither can be chosen. The pgloading_loop5 reason was one line and false. Same file, same author, same day — the difference is that one was interesting and one was a loading screen.

✅ The measurement in the same paragraph checks out

That paragraph also claims "its max went 155 → 232 when they were drawn" for title_jp. Reproduced by adding ptlogo_eff2 to draw_leaf_for and re-running: 155 → 231, with the differing pixels going 20 498 → 58 313. One off a number recorded days ago, which is rounding rather than drift.

So the file's measurements were sound and its reasoning was not, in adjacent sentences. That is worth naming: I have been auditing whether numbers are right far more often than whether the sentences around them are.

The sweep discriminator resolves: different frames, and a sweep position cannot date one

The Decoder answered ask #2 — t=357.7 was never fitted against a PNG. It comes from title-draw-capture-vertex-colours.log, a GPU per-draw capture of the vertex buffer the game submitted: two quad centres and two vertex alphas, four observables solved at once, nothing rendered by either of us.

They then handed me the discriminator rather than running it, because the fit is against my renderer: if your ~400 is pteff03 and your frame is inside the first cycle, pteff03a in that same frame must sit at centre 295.

Run from the export, with their published t=355 centres as the control:

leaf phase pteff03 centre pteff03a centre
t=355 — their control 980.5 (published 981) 477.7 (published 478)
t=400 — my fit 1160.5 294.9

✅ 294.9 against a predicted 295. The discriminator is satisfied: the two numbers describe different frames, and neither of us is wrong. My computation also reproduces their control to half a pixel on both quads, which is what makes the 295 worth anything.

Why the two numbers could never have matched

The sweeps are nested records on a free-running loop with cycles of 600 and 720 units — read from my own export as each leaf's last keyframe, matching their header +0x08 — while the top-level clock stops at settle. So two captures of one settled title share a screen time and not a sweep phase, by construction.

🔴 The rule to carry: a sweep position cannot date a frame. I had been treating my ~400 as a property of the capture — it is a property of how long that title had been up, which is exactly what the settle window makes unmeasurable.

And the two are not comparable in kind. Their 357.7 is a joint fit where both leaves agree; mine poses one phase. With 600 and 720 the phases coincide only every 3 600 units — 60 s — and their draw capture caught both inside their first cycle, which is the only window where one number can cover both.

✅ My --leaf-time is right for this by accident rather than design: it sets one phase, and loop_leaf takes fposmod against each leaf's own span, so the two diverge correctly past 600. The sweep I ran covered 0–600, inside the first cycle, where a single value is unambiguous.

Their refutation attempt on my number, which failed

Worth recording because they published it: they hypothesised my fit was minimised by the quad leaving the screen — "best fit" meaning "draws least", the same shape as their .tbm control that could not fail. At t=400 quad B is fully on screen and quad A is 319 of 400 px wide. The number is fitting something present, and it survives.

Their trap, run against my tree — and I found its mirror instead

The Decoder's Ⓐ blocker turned out to be the sign-in dialog, already described in canary-scripted-input-traps.md §3 and in boot_menu.sh's header. Their lesson: a measurement whose only record is a script comment is invisible to the document that needs it — and they asked whether I have findings living in exporter comments.

I ran it: every measurement-shaped token inside a comment in crates/sylpheed-export/src/, port/scripts/ and tools/port/, checked against everything in docs/.

✅ Seven candidates, and six were my matcher's fault — thousands separators (1 950 px), a range written 0.70-0.82 % in one place and 0.1355 % in the other, precision differing between 9.1 and 9.14. The findings themselves are all in DECISIONS.md, including the one that looked most alarming: the leaf comment's "981 and 478 against 992.0 and 467.2 measured off the capture" is recorded, and the 11.5 px residual has its own paragraph saying it is not to be fitted.

🔴 The one real defect is the opposite trap

check-capture's control table and AUDIO-VERIFICATION.md both record the voice control, and they had drifted: 53.3 % in the tool, 53.2 % in the doc, twice each.

Neither can be re-measured — that control file was transient and is gone — so there is no way to say which copy aged. The Decoder lost a finding because it had one record, in a script comment. I lost a digit because a finding had two records and nothing kept them equal, and both copies look authoritative.

Fixed by removing the duplicate rather than picking a winner: the doc is the record and the tool cites it. The commented explanation keeps both numbers, since naming the drift is the only part that could not be reconstructed later.

⚠️ And it corrects something I sent the Decoder

I told them my computation "reproduces your published centres to half a pixel" — 980.5/477.7 against 981/478. True, and model against model: their published figures are their fit's centres, not the capture's. Against the capture this corpus already records 992.0 and 467.2, an 11.5 px residual, in a paragraph that says it is not to be fitted.

So the half-pixel agreement is two derivations of one model agreeing, which is the correlated-instrument shape I have been careful about all week and did not apply to my own message. The discriminator result is unaffected — 294.9 against a predicted 295 is a different quantity — but the strength I attached to the control was overstated, and I have told them so.

The plate pulses — measured, and the port was wrong on the boot's end state

Ask #1 came back the other way. Held at the title with no input, the plate oscillates continuously — two windows in one boot, ~23 cycles each, no decay, no settling — and 🔴 it never goes off: the plate-absent floor is 159 thresholded green pixels and the pulse bottoms at 714, four and a half times that.

That reading is what makes the mechanism recoverable. A glow alone cannot do it: ptbtn00f ramps 0 → 80 → 0. A steady base plus a pulsing glow can, and 714 and 1520 are exactly base-only and base-plus-glow.

And the port already had the base right. ptbtn00's fade to 0 at t=244 is its exit ramp, which plays when the screen leaves; while the screen is held the base sits at its own hold, alpha 255 at t=238. What was missing was the glow.

The defect was in the renderer, not in the deleted entry

_draw treated a looping record like a focused one — drawing it instead of the base sprite. For a focused button that is right and measured (the focused sprite covers the base at 100 % of base-visible pixels). For the plate it substituted a dim glow for a bright sprite, which is why the plate vanished and why I deleted the authored entry on 2026-08-29.

I deleted the right thing for the wrong reason. The entry was correct; the branch it landed in was not. A looping record now draws over the base, and the entry is restored with the measurement behind it.
plate region, base only 95.68
base + glow at peak 115.52
measured period over 10 cycles 1.980 s
declared 120 units at 60 u/s 2.000 s — ratio 0.990

✅ The pulse appears on the boot path, where the overlay runs on the shared clock. It does not appear under --screen=title --overlay=press_start, because a static overlay poses at its own arrival — my own earlier fix — so its clock never advances. That is correct for a still frame and worth knowing before anyone reads a flat plate there as a regression.

What is authored, and what is refused

120 units, not seconds, on the Decoder's own instruction: their run measured 2.530 and 2.540 s and an earlier corpus run 2.24 s — one declared number through two emulator pacings (×1.27 and ×1.12 against a nominal 2.000 s). Hardcoding 2.5 s would author a loaded container's clock.

⚠️ Their three limits are carried into authored/timing.json verbatim: one boot, two windows inside it are not two boots; it does not distinguish the boot title from an attract-loop title, since run 1 opens at t≈255 s against Q9's ~193 s baseline; and 🔴 714/1520 is not an alpha ratio — the counter is thresholded pixels, so no duty cycle or ramp shape may be read from it. The port draws the record's own declared ramp and infers nothing about its shape.

Oracle rows unmoved; every asserting check passes.

A static overlay now advances, and a refutation attempt on the pulse floor

The static overlay was frozen at its arrival, which was my fix overshooting

--screen=X animates X. --screen=X --overlay=Y froze Y, because the fix for the original defect — the raw elapsed clock pushed in, 9 units at capture, plate drawing nothing — replaced a frozen-too-early overlay with a frozen-at-arrival one. One command animating one build and freezing the other is an inconsistency, and the plate pulse is what made it visible: the plate oscillated on the boot path and sat flat here, which reads as a regression and is not one.

Now offset, not pinned: the overlay begins at its own settle and takes the same delta the main view takes. Verified — the static path pulses over the same range as the boot path, 95.85 → 115.41 against 95.68 → 115.52. Still frames are unaffected (--time freezes both) and title_plate holds at 0.00 %.

📌 Both halves of this were mine, a week apart: the original bug, then the over-correction for it. The over-correction was invisible until a third change — the pulse — gave it something to be wrong about. A fix that overshoots leaves no symptom until something else needs the part it disabled.

🟡 Refutation attempt — their pulse floor of 159 green pixels

Their measurement gives a plate-absent floor of 159 thresholded green pixels, a pulse minimum of 714 and a peak of 1520, the floor measured on live-title-build4-no-plate.png — a capture I hold. So it is checkable.

It is not reproducible from the published description. Across the plate region (513×48 at +383+551) my counts are 3–5× theirs at every threshold:

green > no-plate press-a ratio
100 676 9 369 1 : 13.9
150 528 5 732 1 : 10.9
180 462 4 908 1 : 10.6
200 411 4 272 1 : 10.4
theirs 159 1 520 1 : 9.6

No threshold produces both numbers, so their region must be a tighter crop than mine. Neither the region nor the threshold is stated on the page.

✅ The finding survives in the part that matters. The ratio is stable at 1 : 10.4–10.9 across a wide threshold band and brackets their 1 : 9.6, so "the plate-present frame carries about ten times the green of the plate-absent one" is robust to how it is counted. What cannot be checked is the absolute figures — and those are what the "never goes off" conclusion is stated in.

⚠️ This is the convention we agreed two iterations ago, applied to their own new page: a cross-renderer pixel figure needs its region and its threshold named. I raised it there about my numbers drifting between two files; the same rule makes a published measurement unverifiable when a reader has the capture and not the crop. Raised as a documentation gap, not a defect — nothing in the port's implementation depends on the absolute counts, only on "steady base plus pulsing glow", which the ratio supports.

Their pulse floor reproduces exactly once the predicate is named — 159, to the pixel

I challenged their 159 / 714 / 1520 as unreproducible: my counts over the plate region were 3–5× theirs at every threshold. They published the method — whole 1280×720 frame, and a three-channel predicate (g>130) & (g−r>45) & (g−b>45), not green>N.

Applied to the capture I hold:

theirs mine
floor, live-title-build4-no-plate.png 159 159 — exact
pulse minimum 714 live-title-press-a.png gives 753, 5.5 % apart
"never goes off" ratio 714 / 154 = 4.6× 753 / 159 = 4.7×

✅ The floor reproduces to the pixel, and the load-bearing claim now has an independent witness: a capture from a different session, counted by me, lands at 753 against their pulse minimum of 714. My region-and-single-channel counts were simply the wrong measurement — the method statement was the whole difference.

📌 The challenge was worth making and the outcome was not the one I expected. I raised it as "your figures are unverifiable"; the answer was "here is the predicate", and then they verified exactly. What the challenge actually bought was their own geometry bug: naming the method exposed that the 159 floor came from a 1279×675 capture while the pulse frames are 1280×720 — two crops silently compared. They have replaced it with a same-run, same-geometry floor of 154.

So a demand for reproducibility found a defect that was not the one being demanded. ⚠️ And note which direction it cut: my counts were the wrong measurement and theirs had a real flaw, at the same time. "One of us must be right" was never the shape of it.

Their retraction, and whether the port banked it

They retract citing a faulting run's dumped logged_profile_slot_0_xuid = "" as evidence no profile was signed in: Xenia dumps the config file, before command-line overrides — a run launched with --mute=true dumps mute=false, four for four. So that dump cannot say what any run did.

✅ Checked: the port's docs never cite it. The Ⓐ diagnosis is recorded here as retrodicted, not demonstrated, and nothing in the port depends on it. Their A/B now supplies the demonstration — 3 811 swallow lines against 0, and a main menu at the documented 327 glyphs — with the limits they state: one run per leg, and leg A shows the swallow, not the crash.

⚠️ Also worth carrying: their first A/B pair was void. The detector fired on a single frame over threshold and caught the intro movie's green flashes ~6 s before the title, in both legs. The presses were real — each skipped the rest of the movie, which is Q9's behaviour — but the pair tested nothing. A detector that can fire on one frame will fire on the wrong one.

My rendered pulse, counted in their units — and #4 refutes the voice value without fixing it

The pulse lands in the right range, and I am not tuning the depth

Their predicate makes my render comparable to their measurement for the first time. Counting the boot's held title with (g>130) & (g−r>45) & (g−b>45) over the whole frame:

theirs mine
plate-absent floor 154 —
pulse minimum 714 805
pulse peak 1 520 1 420

✅ Same range, and both ends far above the floor — so "never goes off" holds in the port's own render, not just in their capture. The trace oscillates cleanly: 1413, 1359, 930, 857, 805, 830, 1182, 1413, …

⚠️ My pulse is 24 % shallower (615 against 806). I am not tuning to close that, and their own limit says why: "714/1520 is not an alpha ratio — the counter is thresholded pixels, so dim pixels drop out first." A depth measured this way is a fact about the threshold as much as about the glow, and matching it would be fitting my alpha ramp to a counter neither of us claims is linear. The port draws the record's declared ramp.

#4 refutes the voice value from the output side

They recorded 148 s of the game's own output over the boot intro — ALSA tee, --gpu=null, 0.15 % silence, with provenance from the XMA probe rather than a screenshot. Five of six channels carry distinct content, no channel is a copy of another, and the largest pairwise correlation is 0.70 between FL and FR.

🔴 So presentation: "loudest" — keeping one stream — cannot be right. It was already labelled known-wrong here because the game decodes all three concurrently; it is now refuted by what the game plays.

✅ And it stays unfixed, on their instruction. The stream→channel mapping is not run — that correlation is their next iteration — and changing the mapping now would swap one authored guess for another. A guess that is labelled is a better position than a guess that is fresh, because the label is what stops it being believed later. authored/audio.json records the refutation and keeps the value.

⚠️ Two of their limits are the kind I would otherwise have skated past: this says nothing about which stream lands where, so it does not make summing right; and "6 channels" is not evidence the game is 5.1 — that count is Xenia's hardcoded kFrameChannelsDefault. The evidence is that five of them differ, which a stereo guest cannot produce. The number of channels in a capture is a property of the capture.

The voice export now carries every qualifying stream — and a unity sum was refused by our own check

#4 is answered and it reframes the question the port had been asking. ADV.wmv carries one audio stream and it is WMA Pro 5.1, not XMA — so "which of three voice streams to ship" was missing the bed entirely. The movie's own track is the bed; the three streams are additional.

Solving capture = 0.600 × movie + residual per channel, the gain is 0.600 uniformly (−4.44 dB), and the residual is three signals at three positions — front pair (r 0.918), rear pair (r 0.929), and a centre whose partner LFE is empty to −115 dB. 🔴 The load-bearing number is LFE reproducing to −115.73 dBFS: where nothing is added the two decoders agree essentially exactly, so the other residuals are added content, not codec mismatch.

presentation: "all" now keeps every equal-length non-silent survivor: ADV 2 of 3, S00A 1 of 3. The third ADV chunk is the leading one this port had already measured to be the tail of another (r=0.998, lag flush against its end) — correctly dropped — and S00A's others are digitally silent. The top-level warning now keys on kept < present rather than on "more than one stream exists", so it still fires and says what is absent.

🔴 A unity sum was tried and check refused it

First attempt summed at unity, on the precedent of stems: "sum" for a BGM bank. ADV came out at +2.62 dBFS, over the +1.0 bound, and the validator rejected the tree.

It was right, and the precedent did not transfer. A BGM bank's two waves are stems of one signal; these three are positions in a 5.1 field. A stereo downmix weights them 0.4142, 0.2929 and 0.2929 — which sum to one whatever the assignment. So the total is fixed even though the distribution is unknown, and dividing by the input count preserves that total while claiming nothing about which stream sits where. ADV now lands at −3.1 dBFS.

⚠️ Note this is the opposite of the two divisor bugs this file already carries. Those were wrong because an input contributing nothing sat in the divisor — a silent chunk summed, a silent channel averaged. Here every input carries signal and the weights genuinely sum to one. "Divide by N" is not right or wrong in itself; it depends on whether the inputs are parts of one signal or parts of one field, and I reached for the wrong precedent first.

What is still not claimed

⚠️ Which stream sits at which position is not determined — their assignment is by position, not content — so the port builds no 5.1 and applies no positional downmix. ⚠️ Their correction to the earlier census page is carried too: the ALSA permutation [0,1,4,5,2,3] does not apply to that capture; recomputing with no assumed order gives the identity, so the "BR is 82 % silent" channel was really LFE, which reconciles with the movie's own 80.64 % silent LFE. I had recorded the census's channel labels; they are corrected here rather than left standing.

Every asserting check passes.

Their stream assignment does not fit my region — weights NOT applied

The assignment is settled on their side by byte_size: ctx0 (1 294 336) → FL/FR, ctx1 (1 118 208) → FC with LFE silent, ctx2 (1 171 456) → BL/BR, giving the port weights 0.4142 / 0.2929 / 0.2929. Applying them needs their contexts to be my chunks. They are not.

bytes
their three contexts, summed 3 584 000
my whole resolved voice region for ADV 3 114 352
difference +469 648 — 15 % larger than the region they must fit in

My region yields three chunks, one of which is an 84.553 s / 806 972 B leading chunk this port measured to be the tail of another (r=0.998, lag flush against its end) — and 806 972 is none of their three sizes. That leaves two real streams totalling 2 307 380 B, and no pair of their contexts matches it: the closest is ctx1+ctx2 at 2 289 664, out by 17 716 B.

🔴 So the weights are not applied. Assigning positions on a byte-size match that does not hold would be worse than the current divide-by-count, and their own figures say how much worse: a swapped assignment is wrong by 11.76 dB. The export keeps presentation: "all" with the count divisor, which claims nothing about placement.

⚠️ What I am not claiming: that their assignment is wrong. It is derived from a probe of the running decoder; mine is resolve_movie_voice_region's byte range off the disc. One of the two spans is not what the other thinks it is, and that is a decode question in their lane, not a mixing question in mine. The numbers above are the whole of what I can say.

📌 This is the first time in this exchange that taking a settled result would have been the wrong move. Every previous round ended with me adopting something — sometimes after checking it, once after they retracted it. The discipline that mattered here was checking whether the identifiers resolved before using the conclusion they index, and the identifier was a byte count I happened to be able to test.

What I did take

✅ One mixer gain, not two — the same 0.600 scales the movie bed and the voice — is worth having independently of the assignment, and is recorded. ⚠️ Not baked in as a constant: whether 0.600 is a fixed mix constant or a volume setting is unknown, and the port applies no gain of its own either way.

✅ And their two failed instruments, which look like results and are not: envelope correlation returns 0.86–0.95 for every stream against every channel, because all six residual channels share the dialogue's activity timing — a matrix of 0.9s reads as a strong finding and is the opposite. Sample-level correlation returns ≈ 0, because the XMA decode's framing offset is unknown. I have used envelope correlation as my main audio instrument all fortnight; that it saturates where the content shares timing is a limit I did not know it had.

The resolver starts late, and my "duplicate tail" was a real stream all along

My refusal to apply their weights found a defect in their decoder: resolve_movie_voice_region starts inside the first stream. For ADV, ctx0 declares 632 packets (1 294 336 B) and the resolver's leading chunk is 394 (806 912 B) — late by exactly 238 packets, 487 424 B. A whole number of packets, so an offset rather than corruption; extending by 238 makes to_xma_riffs yield all three declared sizes. Disc-wide, 24/24 single-chunk regions are fine and 8 of 10 three-chunk regions start mid-stream.

🔴 Which re-reads a measurement of mine, without touching the measurement

This port measured the leading chunk as "the TAIL of the kept stream [refuted]" — envelope correlation r=0.998, lag flush against that stream's end — and dropped it as an understood duplicate.

The correlation was right and the conclusion was wrong. If the three streams are simultaneous and the region starts 238 packets into ctx0, the surviving fragment is ctx0's later 62 %, which aligns with the later part of the others — flush against the end. That is precisely what I measured. Same number, and it means the opposite of what I read into it: not a duplicate tail to discard, but a start-truncated simultaneous stream. The port has been dropping a real stream.

⚠️ I first suspected the instrument, because they had just shown envelope correlation saturating at 0.86–0.95 across every stream/channel pair. Tested on the actual dialogue: a 30 s window against other windows of the same take gives r = 1.0000 at zero offset and −0.08 … +0.08 everywhere else. It localises sharply. Their saturation is a different regime — concurrent streams sharing timing at zero lag — and does not reach a lag search over one track.

So the instrument was sound, its control was adequate, and the error was entirely in the inference. That is a less comfortable finding than a broken tool: there was nothing to fix, only something I concluded.

Not fixed here, deliberately

The port still drops chunk 0. Including it correctly needs one of two things I do not have:

  • the corrected span — theirs, and they explicitly say not to extend blind: ADV is start − 238×2048, but for the other seven affected regions the exact clip is unknown, their audit's figure being an upper bound (243 for ADV where the truth is 238);
  • or an alignment decision — chunk 0 is missing its head, so summing it from sample 0 would be wrong by 84.5 s against 137.3 s. Aligning it flush to the end is what the measurement implies, and implementing that on my own authority is the invention the last twenty rounds have been about not making.

✅ The assignment itself still stands — their ratio test was chosen to be immune to the clipping — but ⚠️ chunk 0's absolute level was measured over 62 % of its stream, so its 0.05 dB agreement is luckier than it reads.

The export knew the voice was incomplete; the runtime did not say so

The manifest has carried a full account of the voice export's gap for weeks, and the runtime printed + voice ADV and nothing else. That asymmetry is the dangerous one for audio specifically: a reader of manifest.json gets a paragraph, and a person listening gets clean dialogue with no way to learn that a stream is absent from it.

This port already governs the same situation elsewhere — NEW GAME announces the two measured screens it jumps over rather than skipping them silently. Audio had no equivalent, so:

  • ManifestAudio gains incomplete, one line naming what an asset is known to be missing. Absent means nothing is known to be missing — never that the asset was checked and found complete.
  • MenuAudio carries it alongside the stream, and _play_video prints it at the moment the voice starts.
     + voice ADV
       🔴 KNOWN INCOMPLETE: 2 of 3 streams. The running game decodes all 3 …

Verified on both paths — the boot's ADV and P7's S00A.

🔴 And the first version of the message was false for one of the two assets

It read "one is a start-truncated stream this export drops". That is ADV's story: its dropped chunk is the start-clipped remainder of ctx0. S00A's dropped chunks are digitally silent — a different reason entirely — and the message would have told anyone running the new-game intro something untrue about their own asset.

Caught by reading the output for both, which took one command and which I nearly skipped because the ADV line was obviously correct. The wording now states the counts and points at the entry's why, because which streams are dropped and why is not the same story twice and a single sentence cannot carry both.

⚠️ Worth naming as its own shape: a message generated once from a template but true only for the case it was written against. It is the failure mode of every generic warning, and it is harder to see than a wrong number because the sentence is well-formed and confident in both places.

The voice export is complete — new pin, and the cause was a "within one bank" cap

formats-pin-2026-08-30. The cause of the late start was a second condition on the start filter: end - s < 1_500_000, "only within one bank". ADV's predecessor trailer sits 3 618 816 B before end, so it was rejected and start fell back to anchor — a TOC offset, not a stream boundary. That is exactly why it hit regions over 1.5 MB (the multichannel three-stream ones) and never the single-stream ones. 17 of 95 movies took the fallback.

before after
ADV region 3 114 352 B 3 618 816 B
ADV streams kept 2 of 3 3 of 3 — complete
S00A streams kept 1 of 3 2 of 3, the third digitally silent
ADV peak −3.1 dBFS −2.84 dBFS

✅ The voice export is now complete for both movies, closing a defect that was open for this entire session — and my re-reading of the "duplicate tail" as a start-truncated simultaneous stream is what the fix confirms. ADV drops zero chunks; the runtime no longer prints its incomplete line.

🔴 And the incompleteness warning was crying wolf on S00A

With ADV fixed, S00A still read KNOWN INCOMPLETE at 2 of 3 — because its third chunk is 93.694 s of exact zeroes. A dropped silent stream is not missing content, and a warning that fires on it teaches a reader to ignore the one case that means something.

Exported gains content_waves — how many sub-waves carry signal — and the warning, the console line and the manifest's incomplete all key on kept < content rather than kept < present. Both movies now report no gap, correctly.

⚠️ Second time in two iterations that this warning was wrong in the cautious direction: first a template message true only for ADV, now a gap claimed over silence. Over-warning is not the safe failure it looks like — it is the failure that makes the next real warning unreadable.

A second movie, in the predicted direction

They note only ADV has external ground truth; the other 16 rest on their own sweep. S00A is a second data point from a different movie: its kept count went 1 → 2 because a chunk that was previously a different duration now matches the others at 93.694 s — exactly what restoring a truncated first stream predicts.

⚠️ It is not independent ground truth — it is my exporter reading their fixed crate — but it is a different asset than the one the fix was derived on, and the outcome was predicted before it was observed. Recorded as that and nothing more.

Oracle rows unmoved; MODDING rules pass.

The positional weights are applied — keyed by byte size, so the key is a check

With the span fixed, ADV's three chunks map onto the Decoder's contexts exactly — each is a declared byte_size plus the 60-byte RIFF header to_xma_riffs prepends:

chunk bytes − 60 context position weight
0 1 294 396 1 294 336 ctx0 FL/FR 0.4142
1 1 118 268 1 118 208 ctx1 FC, LFE silent 0.2929
2 1 171 516 1 171 456 ctx2 BL/BR 0.2929

authored/audio.json gains voice.stream_weights, keyed by declared byte size, and the exporter applies positional weights only when every kept stream's size is in the table — otherwise it falls back to the count divisor.

🔴 The key is the check. Two weeks ago these same sizes did not fit the region the resolver returned, and that is how a 238-packet late start was found. Applied by position instead, the weights would have gone onto the wrong streams in silence. S00A matches nothing here and keeps the divisor: extending by position would assume the ordering generalises from one movie, which is exactly the inference the byte-size key exists to prevent.

ADV now mixes at 0.4142 / 0.2929 / 0.2929 and lands at −2.87 dBFS.

✅ An unlooked-for structural confirmation

The generated filter folds chunks 0 and 2 from two live channels (0.5*c0+0.5*c1) and chunk 1 from one (c0). live_channels found that independently, by measuring which channels carry signal — and it matches the Decoder's structural claim that ctx1 is the only stream with a digitally silent channel, and LFE the only channel with an empty residual. Their evidence is a decomposition of the game's output; mine is a peak measurement on the disc's own chunks. Different sides, same structure.

🔴 Unexplained: verify-menu-audio's dead-press check has started failing

Its first assertion — five presses bound to nothing produce a Master bus bit-identical to five waits — now reports DIFFER, reproducibly across three runs. The two recordings diverge at 0.085 s, differ on 92 % of samples, and have different durations (1.300 s against 1.207 s) where they were previously identical.

⚠️ I have not identified the cause and am not guessing at one. It is not the voice change — that touches only the voice export, and neither control run plays a voice. The candidates I can name and have not separated are the new pin, the plate-pulse draw path, and the static-overlay clock.

📌 What the failure does expose is a weakness in the test I wrote: it compares two separate process runs and assumes bit-determinism across them. That premise held for weeks, which is why it looked like a strong assertion — no thresholds, no tuning. It is strong only while startup is deterministic, and nothing in the test checks that it still is. A comparison within one run, or an explicit determinism control, would not have this failure mode.

Filed rather than patched: silencing it would remove the only check that a dead press stays silent, and I would rather have a failing check than a passing one whose premise I have stopped believing.

External ground truth for every three-chunk region — the movies' own durations

They have no external check on the 15 regions beyond ADV, and no route to one that does not go through the port or the emulator. There is one reference in reach that owes nothing to their crate: each movie's own duration, read from its WMV. A start-truncated stream must decode shorter than its movie — ADV's was 84.55 s against 137.71, a 38 % deficit.

Dumping every region with their adv_voice_dump and decoding each chunk:
three-chunk regions found 25
chunks decoded 75
chunks more than 5 % short of their movie 0
largest deviation of any chunk 1.78 %

✅ No region is still truncated. The reference is external — the durations come from /disc/dat/movie/*.wmv, which their resolver never touches — so this is the independent confirmation S00A alone could not be. What it does not cover is whether a region's start is byte-exact; it catches truncation, which is the defect that existed.

🟡 A population discrepancy worth their attention. Their page says "8 of 10 three-chunk regions start mid-stream". I find 25 three-chunk regions on this disc, not 10. Both numbers cannot describe the same population, and I cannot tell from here which is the different one — a filter of theirs, or a difference in what adv_voice_dump returns after the fix. Reported, not resolved.

🔴 My first run silently covered half of them and said it was clean

It reported "0 of 13 three-chunk regions have a short chunk". There were 25. cargo run inside a while read loop consumes stdin, so every second line of the movie list was eaten — the covered set was positions 1, 3, 5, 7… exactly.

The result was correct for what it measured and the population was half what the sentence implied. I caught it only because 13 did not match the 25 I had counted one command earlier, and I nearly did not compare them — the finding I wanted was "0 short chunks", and it was there.

⚠️ This is the shape I have been cataloguing all fortnight arriving in my own shell loop: a silently reduced sample presenting as a complete one. It is the truncated-log trap, the --screen default at t=0, and the checker whose input was smaller-but-valid. Redirecting the loop's input to fd 3 fixes it; noticing it at all was luck, and the general defence is to state the population and the coverage in the same breath, which the second run does.

The menu bed loops at 61.93 s — and my 3.4 s "ugly seam" was mine, not the game's

The Decoder captured 240 s parked on the menu, reached in 26.8 s via the XMA-log oracle they wrote down rather than a screenshot. Two findings, and both cut against what this port had authored:

  • 🔴 No seam. Zero runs ≥0.3 s below median−18 dB in 232 s of the real menu.
  • 🔴 Not the wave's length. r = −0.009 at 87.750 s; top lag 61.909 s. A second instrument agrees — 30 s slices located inside the decoded waves show playback advancing exactly +5.00 s per 5 s and wrapping at 61.93 s, three times, against a control that finds slices cut at 10/45/70 s at 10.00/45.00/70.00.

The loop is [≈0, 61.93) of an 87.744 s wave, so the final ~25.8 s — the fade-out and trailing silence — is never played. The game loops before the fade.

What this port had recorded, and how confidently

loop: "restart" replayed from sample 0 at the wave's end, and I measured the resulting seam off my own Master bus: 36 near-silent 50 ms windows spanning 84.40–87.80 s, about 3.4 seconds. I wrote that up as the price of a missing loop point, put it in BLOCKED.md to raise Q10's priority, and sent the Decoder a message describing it as the cost of the field nobody had found.

It was our seam. The measurement was correct and the attribution was wrong — a defect in the port's own loop, reported as a property of the disc.

⚠️ That is the second time this fortnight I have measured something real and assigned it to the wrong side. The first was reading a start-truncated stream as a duplicate tail. Both were cases where the number was solid and the sentence around it named the wrong cause, which is a failure mode no amount of instrument control catches.

The fix, and why it trims the file

Godot loops a whole file, so a loop region has to be the file. BgmSpec gains loop_end_s and the exporter trims: the bed is now 61.930 s, and the runtime's existing whole-file loop is then correct by construction rather than carrying a loop point nothing could honour.

✅ Verified on the port's own bus over 131 s: 5 near-silent 50 ms windows, no run ≥0.2 s — against 36 windows and 3.4 s before. The seam is gone.

⚠️ Recorded limits: the loop start is inferred, since [0.0, 61.93) and [0.25, 62.18) are not separated at their resolution — the port takes 0 because a bank's data begins there, and says the choice was not measured. And a modder replacing main_menu.ogg is now replacing the loop region, not the whole bank; MODDING rule 1 still holds (one logical asset, one file) because the logical asset is what the game plays.

🔴 And their "8 of 10" was a truncated file, not a count

They have withdrawn it: the audit run was cut short, the committed file ends mid-list at S11A with no summary line, and they read a partial file as a complete one. So "the defect is specific to multichannel regions" is now unsupported — possibly true, not shown, and my 25 stands unopposed.

📌 Their tell and mine were the same on the same day, from opposite directions: their table had no summary line and mine had a population that didn't match a count from one command earlier. The defence that covers both is to state the population and the coverage together — and theirs adds a second: refuse to read a table whose summary line is missing.

The dead-press check was passing by luck, and the luck ran out

Two iterations ago verify-menu-audio's first assertion — five presses bound to nothing produce a Master bus bit-identical to five waits — began failing. I filed it undiagnosed and named three candidates: the new pin, the plate-pulse draw path, the static-overlay clock.

It is none of them. Three identical invocations of the same command give two outcomes:

run duration
1 1.207438 s
2 1.300317 s
3 1.207438 s

The difference is 0.092879 s = exactly 4096 samples, one mixing buffer. The recording quantises to whole buffers, and a one-buffer shift moves both the length and the alignment of everything inside it. So a byte-for-byte comparison of two separate runs cannot hold.

🔴 The premise was never guaranteed — it was luck. It held while the run's timing sat away from a buffer boundary, and a larger export (three voice streams where there had been one) moved it onto one. A test that passes by luck reports the luck running out as a regression in the code, which is exactly what it did: I spent two iterations listing suspects in the port, and the port was never involved.

⚠️ It also passed for weeks looking like the strongest assertion in the harness — exact equality, no threshold, nothing to tune. That was true and it was resting on an assumption nothing checked. Strength of the assertion said nothing about soundness of the premise.

The fix keeps what mattered

Still exact equality and still no threshold; the comparison may now slide by whole buffers, which is the one degree of freedom the recorder actually has. In practice it finds +0 or +1.

✅ And it can still fail, which is the part worth proving: ctrl against walk — a run that really does contain cues — differs at every alignment.

📌 The general form, and it is not the same as the earlier entries: those were checks nobody ran, or that ran and answered a different question. This one ran, answered the right question, and rested on a property of the environment that was never verified and had no reason to be stable. The thing to state alongside an assertion is not only what it checks, but what it assumes about the machine.

Independent confirmation of the 1.5 MB cap — the mechanism, not just the conclusion

Their census settles the population — 104 movies, 95 resolved, 25 three-chunk, confirming my count — and corrects their own claim twice: "specific to multichannel regions" holds (17 of 17 changed regions are three-chunk, 0 are one-chunk), while "all three-chunk regions were broken" is false, since 8 of 25 were already fine.

The 8 they name are the checkable part, because the cause predicts them. A region trips the end - s < 1_500_000 filter only if its span exceeds the cap. Measuring every three-chunk region's span myself:

set count span range
never affected — their 8 8 71 680 … 1 400 832 B
affected — their 17 17 2 023 424 … 6 516 736 B

✅ The cap separates the two sets exactly, with no violations, and it is not marginal: there is a 622 592 B gap between the largest unaffected region and the smallest affected one, with 1 500 000 sitting inside it. That confirms the mechanism — a byte-size threshold — and not merely the list of names, which a coincidence could reproduce.

🔴 My first run of this reported seventeen contradictions

It printed 🔴 CONTRADICTS against all 17 affected regions and 0 for the unaffected — a clean, consistent, entirely wrong pattern. Every span read 0 B, because awk '{print $NF+0}' took the trailing B of = 3618816 B rather than the number.

Had I sent that, I would have told them their causal account was refuted 17 out of 17 — and it would have looked strong, because the failure was uniform and fell exactly along the line under test. A broken extractor produces a pattern shaped by the question, not by the data, and the more structured the question, the more convincing the artefact.

⚠️ What saved it was the 8 unaffected regions reading 0 B too. A span of zero is impossible for a region that resolves, and the "confirming" half of the table was as broken as the refuting half — which is only visible if you read the half that agrees with you as carefully as the half that does not.

📌 Their note about my dead 8 of 10 sharing a digit with the 8 genuinely unaffected regions is the same hazard from the other side: a wrong number that resembles the right answer is the one most likely to survive into a later document. They wrote the coincidence down rather than quietly replacing the figure, which is what makes it safe.

The loop is a runtime field, the two readings conflict, and the port keeps what it shipped

The loop point is decodable — loop_start/loop_end in the XMA decoder context, set by XMASetLoopData, logged by Xenia without a patch. But the values imply a cycle of roughly [10 s, 72 s] against the [0.25, 57.18 s] their audio tracking gave, and neither reading is withdrawn.

✅ Two predictions of theirs were refuted by their own data, which is the part that makes the conflict credible rather than a slip: loop_start is not ~0 (it is 11.6 % into the stream), and a linear bits→seconds conversion yields 62.34 s and 63.29 s for two stems that must stay sample-synchronous — 0.95 s apart is impossible, so the data refutes the linear assumption on its own. XMA frames are variable-length in bits.

The port keeps loop_end_s: 61.93, on their instruction and because the length survives better than the placement: 61.93 rests on an autocorrelation that used no wave at all.

The one check the port could add, and what it is worth

Neither of their instruments asked whether the trim joins smoothly. Over 126.5 s of the port's own bus, the wrap at 61.93 s and again at 123.86 s shows a maximum adjacent-sample step of 212 and 208, against a whole-file median of 132 and a 99.9th percentile of 3 737. The join is not a click.

⚠️ It does not discriminate the two readings, and saying so is the point: a smooth join means the waveform does not jump, not that the loop is musically right, and a cut landing near a zero crossing is smooth wherever it falls. I recorded it as evidence that nothing is audibly broken and explicitly not as support for 61.93 over [10, 72].

🔴 What the conflict costs if the runtime fields win: this export is about ten seconds short, since [61.93, 72] would be content the game plays and we omit. Filed with that number rather than as "the loop point may move", because the former is weighable and the latter is not.

Their diagnosis of their own locator is the entry to keep

"A control easier than the measurement does not bound the measurement's error." Their locator's control matched slices cut from the wave itself — exact copies — where the real task was matching a capture differing by decoder, gain and mix. The clean +5.00 s stepping showed it was self-consistent, not that it had locked to the right phrase, and music with repeated sections is exactly where a locator aliases.

📌 That is the same shape as my awk '{print $NF+0}' reading every span as 0 B: in both cases the output was internally consistent and structured, and in both the tell was in the rows that agreed — my confirming half read impossibly too, and their control was passing a problem it never had to solve.

The duration is confirmed and the window is wrong — and the start is now a visible field

They stopped converting the runtime fields and timed them instead: a probe tailing the Apu debug log, stamping read_offset on arrival, watching three wraps — each from its own loop_end to its own loop_start, with both contexts wrapping at the same instant every time.
observed cycle 61.56 s, 62.06 s → 61.81 s
authored here 61.93 s
difference 0.2 %

✅ The length is settled, and by instruments sharing nothing: a wall clock between decoder events against an autocorrelation that never touched the wave. Both contexts wrapping together is the sample-synchrony the linear bit conversion could not produce — the same conversion that gave 62.34 and 63.29 s for two stems that must be synchronous, and so refuted itself.

🔴 The window is wrong. loop_start is at 3.6 M bits — 11.6 % of the stream, about ten seconds — not the 0.25 s their earlier tracking gave. So this export has the right duration over the wrong window: it replays the bank's intro every cycle and omits the tail the game plays.

📌 My smooth-join check has a second use I could not have anticipated. It said the wrap is not a click, and explicitly not that the loop is musically right. That distinction is now load-bearing: it explains why a wrong ten-second window went unheard. A cut near a zero crossing is smooth wherever it falls — including on the wrong ten seconds. A check whose limits are written down keeps working after the thing it was checking turns out to be wrong.

Not re-cut — and the assumption is now a field

Their instruction is to wait: the exact start is not measured. Linear back-extrapolation says ~9–13 s, and linearity is refuted by the same run, where the bit rate varies 4.4 % within one stream.

But loop_end_s alone silently asserted a start of zero, and that start is now known to be wrong. So the entry gains loop_start_s, authored as 0.0 and flagged as wrong, with -ss applied before -t so the pair is (start, duration) and moving the start cannot silently change how much is kept.

⚠️ An assumption a reader has to infer from a missing field is not one they can weigh. This is the same move as layer_source — the export must let a consumer tell a measured value from an assumed one — applied to a value I had been carrying implicitly for two days.

✅ The new path is proved before it is needed: with loop_start_s = 10.0 the command carries -ss 10 -t 61.93 and the output stays 61.930 s — a window, not a truncation. Restored to 0.0; the export is byte-unchanged. When the start is measured this is a one-value edit, not a code change.

The loop window is measured — -ss 9.44 -t 61.87 — and the near-silence count tracked the error

The region is [9.44 s, 71.31 s] of an 87.744 s wave: the first 9.44 s is an intro played once, the last 16.4 s a fade-out never played. Two derivations on both stems, neither converting bits to seconds — the conversion that had refuted itself by giving two sample-synchronous stems 62.34 and 63.29 s.

✅ 61.87 replaces 61.93, 0.1 % apart. The measured value is taken because it has the loop's own endpoints under it; the autocorrelation that produced 61.93 never touched the wave and agreed to a tenth of a percent, which is what makes both worth having.

The port's own near-silence count tracked the window's correctness

window near-silent 50 ms frames in ~127 s
no trim, restart at the wave's end 36, spanning 3.4 s
[0, 61.93] — right length, wrong window 5, no run ≥0.2 s
[9.44, 71.31] — measured 0

That is a real corroboration from this side and it was not designed as one. The old window kept part of the bank's quiet intro; the measured one excludes both the intro and the fade, so no quiet stretch survives anywhere in the loop. The count fell monotonically as the window got closer to right.

⚠️ Wrap continuity is unchanged and still not evidence: max adjacent-sample step 287 and 354 at the two wraps against a 99.9th percentile of 3 812. As before, a cut near a zero crossing is smooth wherever it falls — the silence count discriminated where the step count could not.

🔴 A stale why reached the manifest for two days

Correcting loop_end_why and loop_start_why left loop_why — the field the exporter concatenates into manifest.json — still asserting that the loop would be "AUDIBLY WRONG AT THE SEAM [refuted]", that "no loop-point field has been identified [refuted] anywhere", and that trimming "would INVENT a loop point". All three refuted; all three shipped to any consumer reading the export.

A correction that does not reach the artifact a consumer reads has not been made. The corrections existed, were accurate, and were in the wrong fields.

⚠️ And my first check of the fix reported the stale text still present — because the replacement quotes the refuted sentences in order to name them, so a substring search finds them inside the paragraph saying they are false. I had to read the context to see it. That is the "check the rows that agree" lesson landing on a grep: the match was real and its meaning was the opposite of what the search implied.

Why the wait for 9.44 was cheap

Their note is worth keeping: it was not that the field predicted the value, but that loop_end_s alone was asserting a start of zero in a form no reader could weigh or find — and that proving 10.0 produced a window rather than a truncation before the real value existed meant arriving at 9.44 was a one-value edit with a clean baseline behind it.

Applying "grep the corpus for the claim" to my own corpus

The Decoder found that a claim they refuted in a new page was still standing in bgm-two-stems.md and in HANDOFF.md — the page a reader is told to consult instead of the rest. Their rule: grep the corpus for the claim, not for the file you were working in. Run against mine, on four claims I refuted this fortnight:

claim where state
"the leading chunk is the TAIL of the kept stream" audio.rs → manifest.json 🔴 still shipping
"six expected DIFFERS [refuted]" BLOCKED, DECISIONS marked
"the boot is known too fast [refuted] on both" DECISIONS 🔴 standing, unmarked
"the only thing making the plate reappear" BLOCKED marked

The one that shipped

The dropped-chunk explanation in the exported why still told readers the leading chunk "IS understood: the TAIL of the kept stream [refuted]". That interpretation was refuted — the correlation was sound, but what matched end-flush was a start-truncated simultaneous stream, because the resolver began 238 packets inside it.

⚠️ And it was wrong twice over, in the shape I had already fixed once: S00A's dropped chunk is the silent one, not a leading chunk, so the sentence described a case that was not present. A template message true only for the case it was written against — the second instance of that exact defect in this file, which suggests the first fix taught me nothing general.

Replaced with a per-case account that names the refutation rather than deleting it.

The one that was standing

"The port's boot is known too fast [refuted] on both, by an unmeasured amount" — withdrawn days later, when the splash dwells turned out to be declared on the disc and the port already exact. I wrote the withdrawal as a new section and left the original untouched, so a reader arriving at the older paragraph got the dead answer. Annotated in place, pointing at the withdrawal.

And a false positive that is its own lesson

BLOCKED.md matched "the only thing making the plate [refuted] reappear" — inside my own correction, which quotes the refuted claim in order to name it. That is the grep trap I documented two days ago, caught by the very audit that trap exists to complicate. Naming a refuted sentence keeps it greppable, which is the price of not deleting it, and the check therefore needs a human read of every hit rather than a verdict from the match alone.

📌 Their delivery-check point pairs with this: a control proves the instrument reads correctly, a delivery check proves the experiment happened at all. Their second Ⓐ was never delivered — 2 pad lines is one press — and "the press did nothing" and "there was no press" are identical from the screen. My equivalent is that a correction can be written, be accurate, and never arrive.

A refuted-claim register, because the audit found what the audit found

The Decoder ran my corpus audit against theirs and found four refuted claims still standing — including one they had corrected in a message to me, agreed with, and written a METHOD entry about, without landing the correction for a full iteration. Their sharpening: acknowledging a correction in conversation feels like making it and isn't.

A hand audit finds the instances present on the day it runs. It does not stop the next one. So tools/port/check-claims is a register: each row is a claim this corpus has refuted, and every occurrence must carry an explicit [refuted] sentinel within 400 characters. check-all runs it.

🔴 It found four more than my hand audit did

My manual pass checked four claims and found two problems. The check, on the same four, found four further unmarked occurrences I had read past — including one in authored/audio.json and one in the very table where I had written "standing, unmarked" about a different claim.

The marker is a sentinel, not a keyword, and that mattered

The first version matched a per-claim keyword near the hit — "refuted", "WITHDRAWN". Every one of its failures was a quotation sitting inside a correction whose wording happened not to contain the keyword: a table cell reading "standing, unmarked", a sentence reading "the real count was ten".

⚠️ The temptation was to widen the window or add synonyms until those passed. That is tuning a threshold until the answer comes out right — the failure this corpus has spent a fortnight cataloguing, arriving in the tool built to catch it. So the marker became a token the author must place. It cannot be satisfied by phrasing, and its absence means exactly one thing.

The cost is honest and is the point: 21 existing quotations had to be marked by hand, and a new refuted claim means a new row plus marking what already quotes it.

✅ Proved it fails: removing one sentinel makes the run report that claim unmarked and exit non-zero.

What the register cannot do

⚠️ It only knows claims someone has entered. A refuted claim nobody registers is invisible to it, so this is a ratchet on known corrections and not a search for unknown ones — the audit still has to happen first. And it enforces marking, not correctness: a sentinel next to a sentence that was never really refuted would pass and be wrong in a new way.

📌 Their other finding is the one I acted on separately: a "kept for the record" block still asserts. BLOCKED.md's voice row had a struck heading and three sentences below it asserting in the present tense — that the 1 of 3 warning stays, that stream 1 is "consistent with being stream 2's tail", that streams 2 and 3 are indistinguishable. All three resolved days earlier. Marking a heading superseded does not mark the sentence a reader lands on, so the resolution now sits at the top of the cell and names each superseded sentence.

State of the port, and a claim I built on for a week without checking

Every asserting check passes: the format validator (16 screens against sylpheed.screen/3), all five MODDING rules, the capture-control sweep, the refuted-claim register, the decisions index. The oracle rows sit at the tone floor — title_plate 0.00 %, both splashes 0.01 %, main_menu 0.06 %, main_menu_options 0.15 %, extras 0.19 %, title 0.21 %, title_band 0.35 % against its own oracle-to-oracle gap. The P5 walk runs and ends on the title.

🔴 The refutation attempt this iteration was of something I had already used

The claim that reframed the entire voice question — ADV.wmv carries one audio stream and it is WMA Pro 5.1, not XMA, so the movie's own track is the bed and the three streams are additional — is checkable in one command against the disc:

index=0  codec_name=wmapro  channels=6  channel_layout=5.1  sample_rate=48000
1 audio stream

✅ Exactly confirmed.

⚠️ And I had built on it for a week without running it. The positional weights, the presentation: "all" change, the refusal to apply the assignment when the byte sizes did not fit — all of it rests on that reframing, and the verification cost one ffprobe against a file I have had all along. I checked the byte sizes scrupulously because they were the identifier I could test, and never checked the sentence the identifier was serving.

📌 That is a different failure from the ones this file catalogues. Not an unexercised rule, not a correction that never landed, not a control easier than the measurement: a premise so foundational that everything downstream got audited and the premise itself did not. The scrutiny went to the parts that moved.

What is still authored rather than measured

Four values, and the file says so at each:

value state
flow.screens.main_menu.on_cancel authored — likely but UNPROVEN; Ⓑ returning to the title is stated in HANDOFF with no capture behind it
ptbtn01.after_video authored; the game goes into Mission 1, which MISSION §7 scopes out, so "return to the title" is a chosen end state
flow.navigation.input_during_transition authored, not measured — nobody has watched a press mid-fade; ignoring invents least
authored/rendering.json's withheld leaves two leaf records deliberately not drawn, each with its reason

Everything else in authored/ now carries kind: measured — the BGM bank and its loop window, the plate's pulse period, the keyframe unit, the black hold, the navigation wrap, the cue bindings, the voice streams and their positional weights.

⚠️ The black hold is measured but sits at the top of its range (~6.5–9.2 units, authored 9), and that is recorded at the value rather than in a footnote.

Identifying their submenu capture: edges where intensity could not

They reached and captured a submenu but could not identify it. Their diagnosis is the useful part: correlation cannot discriminate when the candidate renders are near-blank, and near-blank is exactly what the .tbm hypothesis predicts — all 19 GP_SAVE_LOAD builds scored −0.004…−0.010, a ranking with no information in it. The instrument is disabled by the thing it was brought in to detect.

That diagnosis implies its own fix. Their capture is 99.999 % non-black — a full-screen background our renderer omits — and an additive background swamps an intensity correlation. It does not survive an edge map: a smooth ground has no edges, and the UI does.

The control first, because a ranking is worthless without one

Edge correlation against my own title capture, over seven GP_TITLE builds whose answer I know:

build r
4 — the right answer +0.2792
6 (extras, its nearest sibling) +0.1936
everything else ≤ +0.037

✅ Right answer on top, 1.4× over second and 7.6× over third. Modest absolute r, and a clear ranking — so the method discriminates on this corpus.

The result

Their capture against all 22 candidate builds:

build r
GP_TUTORIAL build 0 +0.4962
GP_TUTORIAL build 1 +0.3137
best GP_SAVE_LOAD (17) +0.0713
worst −0.0331

🟢 The submenu is a GP_TUTORIAL build. The winning r is higher than the control's, its margin over second is better (1.58× against 1.4×), and both TUTORIAL builds sit 4–7× above every GP_SAVE_LOAD build — the archive separation is far stronger than the within-archive one.

✅ It is independently plausible: authored/flow.json has ptbtn03 = TUTORIAL → TUTORIAL_MENU, noted as "the lesson list is not a GP_TITLE build". An Ⓐ on a menu whose focus was TUTORIAL lands exactly there, and HANDOFF Q5 measured initial focus as unstable boot to boot.

⚠️ What this does and does not settle. The archive is identified with a large margin. Which build within it is not: 1.58× is the same order as my control's 1.4×, and the two TUTORIAL builds are variants of one screen — so I would call build 0 the better fit and not a determination.

⚠️ And the method inherits a limit worth stating: an edge map is insensitive to what the background is, which is the point, but it is also insensitive to a missing element that has no edges. It answers "which screen", not "is our render complete".

Refutation attempt: "screen render omits every .tbm background, but none of your screens has one"

Their branch, HEAD d92a962. The first half is theirs to prove and they proved it against a capture. The half that decides whether my regression baseline is sound is the second, and it is a claim about my tree — so I tested it.

screen info --all, grepped for .tbm, across all 16 builds in my manifest: zero references. ✅ Their claim holds, and holds wider than they stated — they said "none of your five screens", it is none of sixteen.

Both controls fired, and this is the whole reason the result means anything. A "none found" from an instrument never shown to find one is the failure this corpus keeps repeating — my first attempt at this check printed nothing at all from its control and I nearly read that as agreement:

.tbm mentions
positive — GP_TUTORIAL build 0 1 (pubase.tbm, the element they named)
negative — GP_TITLE build 5, main_menu 0

The guard, and why a passing check still needed one

So tools/port/verify-screen cannot be misled today. ⚠️ That is a fact about today's manifest, not a property of the script, and the failure it would cause is the expensive kind rather than a silent one: the port draws a background the reference omits, the row reads DIFFERS, and this script's own header sends the reader off to find out which renderer moved. Neither did. It would be a real disagreement with a known cause on the reference side and nothing on screen saying so.

The row now says so. It does not change the verdict or the bar — tuning until things match is what that header warns against; it attaches provenance to the one row that would otherwise mislead.

🔴 The guard cannot fire on any screen I ship, which is how a guard goes quietly dead. Its expression is therefore controlled directly, both directions: GP_TUTORIAL build 0 → 1, GP_TITLE build 5 → 0.

✅ Regression unchanged after the edit: title max 6 / over3 790, main_menu max 4 / over3 0 — the committed baseline exactly.

Their identification and mine agree, from unshared assumptions

They identified the screen by reading the word TUTORIAL off the framebuffer. My edge correlation, run before that message arrived and without access to the text, ranked GP_TUTORIAL build 0 first. Two methods with no assumption in common, one answer.

📌 Worth keeping their methodological note over the result: their high-passed matcher scored 1.28×, and they declined to identify with it — the number was never used because it had been controlled. My 1.58× is barely better and I said the same thing about the build-within-archive question. The margin that mattered was the archive one (4–7×), and the answer that settled it was reading the label. Build a matcher only after checking whether the artefact already states the answer.

on_cancel: one half measured, and a MEASURED stamp removed from the other

The Decoder measured Ⓑ on the main menu → the title (their 86a8ce7, docs/re/data/b-on-main-menu.txt): delivery-confirmed, 73.5 % of pixels changed, both captures naming themselves, ≤ 0.4 s, and no loading screen on the path despite the disc carrying four.

✅ authored/flow.json main_menu/on_cancel moves from "likely but UNPROVEN" to MEASURED. What makes it conclusive is the latency, not the destination — my own why had named the confound: the title also returns on its own after ~8–10 s idle, so an observer could not tell a response from a timeout. ≤ 0.4 s is twenty times faster than the idle return, and that is what separates them.

🔴 The other half: my tree stamped MEASURED on a claim with no evidence

title/on_cancel_why read "MEASURED, HANDOFF Q5: Ⓑ on the title does nothing." The Decoder now says that is unevidenced — their 2026-08-30 run cannot be counted, because the second Ⓑ landed during the title's build-in, so the glyph 0 → 154 that followed is the build-in completing, not a response.

I did not invent the stamp, and that is the point worth recording. HANDOFF Q5 (9ca1eb5) prefixes its entire row **measured** and then lists six clauses. In the source it links, that clause's evidence cell reads none, with a yellow marker. The summary flattened six claims of differing strength into one word, and my authored tree copied the word.

⚠️ The value does not change — null either way. Doing nothing is the safe reading whether or not it is measured, so this correction moves no pixel. It removes a false provenance, which is the thing that would have been believed later.

The same row has a second empty cell, which nobody flagged

Auditing the rest of Q5 rather than only the clause I was handed: the up / down row — "one item per press, no auto-repeat at the durations tried" — also has an empty evidence cell, and my navigation block cites that same row.

✅ It splits cleanly, and only one half is exposed:

  • one item per press is evidenced indirectly and well — the wrap montage's count only comes out if each press moves one (4 presses from EXTRAS landing on OPTIONS). Keep it.
  • no auto-repeat has nothing behind it, and the source's own "at the durations tried" hedges it.

🔴 Worse, the port already behaved this way without stating it: boot.gd's _input is edge-triggered, so holding a direction moves one item — an unexamined consequence of how the handler was written, not a claim anyone could check. navigation.auto_repeat: false is now explicit, marked a choice: a repeat we did not implement cannot run a menu past the item the player wanted; inventing one could.

Audit of every MEASURED stamp in authored/

34 stamps. Six cite a HANDOFF row and nothing else — the laundering path above. The other 26 that my crude grep flagged are fragments of multi-part why arrays whose citation sits in a sibling field, so that heuristic over-reports and I am not going to pretend otherwise. Of the six, one (Q5's Ⓑ) was actually wrong and is fixed; the rest cite rows whose sources carry evidence.

📌 The generalisation, and it is the Decoder's own shape turned on a document: a summary that labels a row is not a citation for every clause in it. A bundled **measured** is exactly as strong as its weakest cell.

BLOCKED.md's five "blocking" rows were all answered, some days ago

The standing instruction says this file rots, and it had. Rows 1 and 2 are labelled "(P3, blocking)" while P3 through P7 have all shipped — a contradiction on the file's own face, and one that misleads in the worse direction: it under-reports progress and would send a reader to answer questions already answered.

Audited every row against HANDOFF 9ca1eb5, and — the part that makes this more than bookkeeping — checked whether the port actually acted on each answer:

row answer did the port act?
1 splash predicate ❔ no content rule exists; take the entry index ✅ addressed by entry index; publisher_logo 10/13 now exported
2 fade-out (a), play the group to its end ✅ and see below — the prescribed constant was deleted
3 focus over vs instead ✅ my choice was fine; the miss was the ring ✅ ptbtneff01 exported and drawn
4 rotation human's call; pivot anchor measured ✅ drawn about pos + pivot
5 gamma captures are not gamma-neutral, RMSE has a floor ✅ in verify-capture's header

🔴 HANDOFF ask 2's prescribed action is stale, and following it would double-count

Ask 2 says: "write one authored constant (~0.4 s / ~24 units) and play the group to its end." Under the corrected record layout (formats-pin-2026-08-29c) every pose is timed, so the unknown that constant stood in for does not exist — exit_ramp_units was already deleted for that reason.

Measuring what the file actually carries confirms the mechanism ask 2 describes and contradicts its number. On main_menu, the final alpha ramps are:

  • pteff00 — the black quad — 0 → 255 over 10 units (0.17 s)
  • ptmsg, pteff10, pteff12 — 255 → 0 over 6–8 units

✅ "the quad goes a=255 while the buttons, ptmsg and the glows go a=0" is in the file, exactly as described. ⚠️ But the ramp is 10 units, not 24. Authoring 24 on top of a group that already ramps 10 would have played the fade nearly two and a half times too long.

A decomposition that fits both numbers — offered as a hypothesis, not a finding

HANDOFF Q7 measures two quantities off the game: the fade-out ~0.4 s and the black-hold plateau 0.17–0.23 s. The file gives the ramp as 10 units (0.17 s).

in-file ramp 10 units  +  measured hold 10–14 units  =  20–24 units = 0.33–0.40 s

🟡 The measured ~0.4 s sits at the top of that range. So the ~0.4 s may be ramp + hold, not the ramp alone — in which case both parts are already known separately and no authored constant is needed at all. This is arithmetic that fits, not a measurement, and it is the Decoder's to confirm or kill: the two readings differ in whether a screen is still drawing during the last 0.2 s.

🔴 And it exposes a disagreement in my own tree

authored/timing.json holds black_hold_units: 9 = 0.15 s, measured in the draw stream. HANDOFF's plateau is 0.17–0.23 s, measured off the game. Mine sits below their floor, by 1–5 units.

I am not changing it. Two instruments disagree and the rule is to say which is wrong rather than tune until they match — and here the game measurement should win over the draw-stream one on principle, but the gap is small enough that it could equally be where each puts the boundary between ramp and hold. It goes to BLOCKED.md as an ask, at the value it was measured at.

The plate came back in the game and not in the port

The Decoder's Ⓑ run answered both my asks and threw in a third finding: after Ⓑ from the menu the PRESS Ⓐ plate is re-drawn — pressed 351.2 s, pulse back 358.5 s (daf8f47).

🔴 The port did not do that. Ⓑ landed on a bare title. _menu_arrive() calls _drop_overlay() — correct, the plate goes with the screen it was measured on — but nothing ever put it back: _overlay_spec is cleared the instant the overlay is raised, and only the boot sequence ever set it. Confirmed by running it, not by reading: the drawn list was the ten title elements with no ptbtn00.

✅ Fixed. _rearm_overlay_for(name) looks the declaration up in authored/flow.json's boot step for that screen rather than naming press_start, so the plate returns by the same code path and the same shared clock as on boot, and a screen that gains an overlay later gets it on both paths with no edit here. No new constant — the delay is not authored, it is whatever the boot already does.

Controlled both ways: Ⓑ → overlay press_start raised, drawing ptbtn00, ptbtn00f; entering EXTRAS, which declares no overlay, raises nothing.

An independent agreement I did not tune for

The script log had no press timestamp, so the port's own latency could only be guessed from surrounding lines. Added one. With it:
Ⓑ pressed 1.01 s
title arrives, overlay armed 1.37 s
port's press → title 0.36 s
their measured Ⓑ latency ≤ 0.4 s

✅ That agreement is worth something because nothing here was fitted to it — the port's transition timing comes from the screens' own fade keyframes, and this is the first time the two numbers have been put beside each other.

🟡 The plate's return time does not agree, and I am not adjusting it

The plate is raised on arrival and its own group takes it opaque at t=238 (3.97 s), so the port's press → plate visible ≈ 4.33 s. Theirs is 7.3 s to the pulse. The pulse has a 120-unit (2 s) period, so pulse detection can lag first paint by up to 2 s — which closes it to ~6.3 s at most and leaves roughly a second unexplained.

⚠️ It would be easy to author a delay that makes 4.33 into 7.3. That is exactly the tuning this corpus keeps warning about, and the previous authored delay in this very block (after_settle_seconds: 2.13) was already refuted once by arithmetic. Left alone; recorded as an ask.

Two stamps upgraded, both now measured for real

  • navigation.auto_repeat — a 2.0 s held ⬇ moves the cursor once, their counter passing its control first. Was a consequence of edge-triggered _input; now a measurement.
  • title/on_cancel — Ⓑ on a settled title does nothing, twenty seconds confirmed. This cell has now been MEASURED (wrongly), AUTHORED (honestly), and MEASURED (truly), with the value null the whole way through.

🔴 verify-screen was nondeterministic, and it looked fine most of the time

Running the full set after the plate fix, two rows had moved off the committed baseline. One of them was not a regression at all — it was the harness.

press_start returned over3 5021, 8919, 5021 on three identical runs. The plate's looping focus record takes its phase from time_units, which free-runs, so the captured frame lands wherever the grab happened to fall — while the reference renderer cannot pulse at all. A detector that answers differently each run is worse than one that fails: it teaches its reader to ignore it.

⚠️ The port is not the thing that was wrong. A thing that pulses does not stop because the screen has arrived, and the pulse is measured. What was wrong was comparing a moving frame against a static one and calling the difference a regression. So ScreenView.loop_phase_units pins the phase, negative means free-running, that stays the default everywhere, and only the harness passes --loop-phase=0.

✅ Controlled, and the control is what makes the fix trustworthy:
pinned, 3 runs identical md5
free-running, 4 runs 3 identical, 1 different

🟡 That 3-of-4 is the finding worth keeping. It is usually stable, which is exactly why it survived — a flake that fires one run in four reads as a real regression that "went away", and a --loop-phase that changed nothing would have been indistinguishable from a fix without that negative control.

✅ With the phase pinned, press_start reads max 1 / over3 0 OK — the recorded baseline exactly, not some new number. Fifteen of sixteen rows now match the committed baseline.

The sixteenth: title_jp has genuinely drifted, and I cannot say which side

max over3
committed baseline 155 20 498
now 233 61 208

What is established:

  • ✅ deterministic — 233 / 61 208 twice, so not the phase.
  • ✅ not the reference — the Decoder reports screen render is byte-identical across the stale and rebuilt binaries (max per-channel 0), so the reference is stable and the movement is on the Godot side.
  • ✅ localized — the differing region is a single 350×396 block at (405, 74), the logo stack. title is untouched at max 6 / over3 790, which rules out anything shared by both title screens (the forced-backdrop rule among them).
  • The port draws ptlogo_jp, ptlogo3a/b/c and the five ptlogo_back2eff* layers here that are transparent at rest on the English title.

🔴 What I cannot do is say which renderer is right. There is no capture of the Japanese title in the corpus, and this script's own header is explicit that agreement with the reference is not correctness and a DIFFERS is not automatically the port's fault. Guessing a direction here is precisely the move the mission forbids. Asked, not resolved.

🔴 WITHDRAWN — the JP capture does NOT go against the port; I scored the wrong frame

*(This heading read: "The JP title capture adjudicates title_jp — and it goes

against the port." Withdrawn in full below. I scored verify-screen's

--pose=rest frame, which the port does not ship; posed as it runs, the port

beats the reference +0.9994 to +0.8727. The heading asserted the opposite of

the finding for as long as it stood.)*

The Decoder captured the Japanese title at rest (310bf86) and deliberately did not compare it to either renderer, so that my diff and theirs stay independent. This is the oracle for the block I could not adjudicate.

Aligning it, because the last capture's geometry did not transfer

Their submenu capture had the game surface at y=45 in a 1280×720 frame. I did not assume that here — I recovered the alignment by row/column profile correlation, with the English pair as a control:

dy dx
control — English capture (1279×675) vs port 0 (r 0.994) 0 (r 0.977)
JP capture (1280×720) vs port −45 (r 0.927) −1

✅ The control lands on (0,0) as it must, and the JP offset comes out at their stated 45 as a measurement rather than an inheritance. My first look at the frame said "no letterbox, content spans all 720 rows" — true, and irrelevant: the surface is offset inside content that extends past it.

The instrument is fair, and then the verdict

Comparing the capture against both renderers in the disputed 350×396 block at (405,74), and against a control strip where the two renderers agree:

region vs port vs reference closer
control strip r +0.9751 r +0.9756 tie — ✅ instrument is fair
disputed block r +0.7462 r +0.8727 REFERENCE

🔴 The port moved, and it moved away from the game. The verdict is stable under gamma compensation at both measured title gammas (raw / 1.34 / 1.49 → reference every time), so it is not an artefact of the known capture gamma floor. The port puts light on 25.6 % of the block that the capture does not have, against the reference's 15.9 % — it is drawing too much, not too little.

⚠️ This is the opposite of what I expected. The Decoder's description — a crystalline burst behind the wordmark, the ptlogo3a/b/c + ptlogo_back2eff* stack that English holds transparent at rest — reads as confirmation that the port's extra layers are right. They are not: the burst is there, and the port draws more of it than the game does. A qualitative match on "is the effect present" was about to stand in for a measurement of how much.

What is not settled: which change did it

Both renderers draw this screen at rest, t=10 units, so the settle-window logic is not in play — the two decoders disagree about the rest pose of the JP effect stack itself. Four commits this session touched that path (the forced-backdrop rule, per-instant coverage, the looping record, the sweep/hold work) and I have not bisected them. Naming one now would be a guess dressed as a cause.

📌 What this does settle: title_jp's DIFFERS is the port's, not the reference's. That reverses this script's usual presumption, and it is the first row in the baseline whose direction has ever been established against a capture.

🔴 CORRECTION: the port did not move away from the game — I scored the wrong frame

The previous entry concluded, from the JP title capture, that "the port moved, and it moved away from the game". That conclusion is withdrawn. It is wrong, and the way it was wrong is worth more than the answer.

I scored verify-screen's title_jp frame against the oracle. That frame is posed --pose=rest, which this port does not ship. Posed as it actually runs:

disputed block whole surface
port, --pose=rest (the frame I scored) +0.7462 —
port, as shipped +0.9994 +0.9652
reference +0.8727 +0.9200

✅ Holds under gamma compensation (+0.9928 at γ=1.34) and ✅ on the English control, same method: port +0.9946 against the reference's +0.9560. The port is closer to the game than the reference on both title screens.

Why rest produces a frame the game never shows

ptlogo_back2eff1 on the JP title is (t, alpha) = (0,0) (98,0) (100,255) (102,255) (104,0) — a 4-unit sparkle, and its rest.t is 100: the peak of its own flash. Six of these stagger across the logo. Posing at rest fires every sparkle simultaneously at full brightness, which is exactly the "port puts light on 25.6 % of the block the capture does not have" I reported as a defect. The excess light was real; it was in a frame nobody sees.

⚠️ verify-screen is not at fault — it poses rest deliberately, because both renderers read rest through one decoder and that is what makes it a consistency check. Its header said so. I used a consistency-check frame to answer a correctness question, and the tool now says in its own header that its frames must never be scored against a capture.

A second, smaller thing in that entry was also wrong

It said the port draws layers "that are transparent at rest on the English title". Both screens draw them under --pose=rest. I had compared a --menu run's log (timeline pose) against a verify-screen log (rest pose) and read the difference as a property of the screens rather than of the two modes.

What actually stands from that entry

The alignment work survives intact — the measured dy=−45 with the English control at (0,0), and the observation that the instrument is fair on a control strip. So does the arithmetic. What failed was choosing which frame to feed it, and no amount of control on the comparison could have caught that: every control I ran was a control on the metric, and the error was upstream in the input.

📌 The generalisation: a control proves the instrument, not the sample. Both of my last two iterations' errors were of that shape — a live reader pointed at the wrong field name, and a fair metric pointed at the wrong frame.

Wired so it cannot recur

tools/port/verify-capture takes a fifth per-row field, a capture crop, because this capture is a full 1280×720 display frame with the surface at +0+45 while every other capture in that directory is pre-cropped to 1279×675 — comparing it whole would score the port against a 45 px shift. With it, title_jp reads RMSE 20.91, differing region 1.04 %, beside title's 14.16 / 0.21 %.

⚠️ The row prints no capture until the Decoder's branch merges. Their capture is theirs to commit; it was staged locally to test the row and removed.

The rest() flash defect reaches four screens I ship — and the port already survives it

The Decoder censused it from the file side while I was looking at one instance: of 13 991 elements with ≥2 keyframes, 2 305 have no plateau so the dwell fallback decides, and 1 697 (74 %) of those get a visible pose. In GP_TITLE, 5 fires and 4 are visible — all four on the splash screens this port ships.

✅ Confirmed in my own export, and it is exactly the JP-title shape on different screens:

element keyframes rest
palogo_sqex_eff 0:a0 15:a255 30:a212 45:a0 t=30, a=212
palogo_anima_eff 0:a0 15:a255 30:a212 45:a0 t=30, a=212
palogo_gamearts_eff 0:a0 15:a255 **30:a255** 45:a0 t=15, a=255
palogo_seta_eff 0:a0 15:a255 **30:a255** 45:a0 t=15, a=255

📌 A refinement to their description, which named the 212 shape: two of the four hold 255 through t=30, so their fallback lands on the flash's peak rather than its decay. Same defect, worse pose — full brightness, not four-fifths. The logos themselves (palogo_sqex holds 255 from t=30 to t=235) have a real plateau and are unaffected.

The port ships the right frame, and now there is a number for it

Both poses of the publisher splash against the committed oracle capture:

pose RMSE differing
timeline — what the port ships 2.17 0.01 %
--pose=rest — the harness frame 9.05 0.75 %

🔴 75× the differing area on a screen this port ships. So the rule I wrote into verify-screen's header after getting it wrong on title_jp is not a special case — it generalises, and here it is demonstrated against an oracle rather than argued.

✅ The port's settled pose evaluates pose_at(hold), not rest, so it skips the flashes and agrees with the capture at 0.01 %. The defect is confined to the harness pose. Nothing shipped is wrong; nothing needed fixing in the render.

What did need fixing: the port said "at rest" about a pose it never looked at

ScreenView logged "%s (transparent at rest)" for every skipped element, whatever instant it had posed. On the timeline path the pose is pose_at(time_units) — so it reported palogo_sqex_eff (transparent at rest) about an element whose resting alpha is 212.

⚠️ That is not cosmetic. The rest-versus-posed-instant confusion is precisely what made me score a --pose=rest frame against a capture and write up a drift that did not exist. A log line that erases the distinction is that error pre-printed, waiting to be believed. It now names the instant: transparent at t=6.

Controlled both ways on one screen: timeline → transparent at t=6 and the flash skipped; --pose=rest → still at rest, and the flash drawn.

Correction: those two are the sound path, which makes the rule stronger

The Decoder refuted my refinement, and it is a correction I would rather have than the credit. I wrote that palogo_gamearts_eff / palogo_seta_eff show "the same defect, worse pose — their fallback lands on the flash's peak". Wrong on the mechanism. They hold a=255 at identical x, y and scale from t=15 to t=30 — a genuine plateau at pair index 1, which rest_plateau() handles, and t=15 is the correct answer for that path. They are not among their census's four.

🔴 And the consequence runs the other way from a retraction. My rest pose for them really is the flash's peak, reached by the sound path. So "a rest render is not a frame to score against a capture" does not depend on the fallback being unsound: a plateau can itself be the held peak of a transient. The 2 305 / 1 697 census understates the exposure rather than bounding it.

Censusing my own tree — and the first answer was wrong

I asked how many elements I ship whose rest is visible but whose visibility is transient. First pass keyed "transient" on the element's own visible span, and returned 28 across 12 of 16 screens — a plausible-looking number.

🔴 It was wrong, and what caught it was the check the Decoder and I just agreed on: say what the number means physically. The list included ptmsg — the main menu's own ⊙ Select Ⓐ OK footer — as "visible 2 of 64 units", and ptbtn00, the PRESS Ⓐ plate. Those are on screen the whole time the game sits there. The story collapses on contact.

The cause: ptmsg is [0:a0 44:a0 56:a255 58:a255 64:a0], and that final zero is the screen's exit ramp, which every element has. I had counted the exit as the end of visibility, so every normal element looked like a flash. No control would have caught this — the arithmetic was right.

✅ Re-keyed on the screen's span rather than the element's: a transient is gone while the screen is still up.
elements whose rest shows what the settled screen does not 31
screens affected 8 of 16

Every entry now has a coherent story — *eff* and *loop* sparkles, plus the two loading screens — and ptmsg/ptbtn00 fall out on their own, which is the check passing rather than being applied by hand.

📌 My exposure is twice what the splash finding suggested. Not four screens, eight — both titles, both splashes and their region twins, and both loading screens. ✅ None of it reaches shipped output: the port poses pose_at(hold) and agrees with every capture it has. The number bounds what would break the day anything scored a rest frame against an oracle.

The two loading screens are no longer black, and it was the paint order

verify-screen's header has carried, since P1, that build_12 and build_15 "render as pure black in BOTH renderers, mean 0 and max 0", with an open question: "whether that is the port's bug or the decoders' reading of rest".

✅ Both halves are now settled, and the answer is neither. Measured today:

max mean
port 214.5 1.949
reference 214.5 1.918

Not blank, on either side, and the two agree — the rows read OK on a real comparison rather than on nothing-against-nothing.

🔴 It was the paint order, not rest. My own earlier measurement had already answered it and I had not connected the two: removing the forced-backdrop pass makes these screens' first element pgloading_loop5, "and the black screen returns". pgloading_eff00 is the full-frame opaque untextured quad, and it carries layer: null, layer_source: none — the only elements in the export with neither a read nor an implied key. Its position rests entirely on the occlusion constraint. The rule that fixed it is the one the Decoder supplied and I implemented this session.

⚠️ The guard stays and the stale paragraph stays with it, marked as history. It was correct when written — two of sixteen rows were reporting this script's strongest verdict for comparing nothing against nothing — and a guard that stops firing is exactly the kind that rots out of a tool. A reader who hits a blank pair tomorrow needs the reasoning, not just the verdict.

Refutation attempt: does the Decoder's census miss my title screens?

Their GP_TITLE census is "5 fires, 4 visible, all four on the splash screens". My own census found six transient ptlogo_back2eff* elements on title and seven on title_jp — also GP_TITLE builds. If those were fallback fires, their count of four would be wrong.

✅ Their claim survives. All six reach rest by the plateau path — alpha 255→255 with identical pos and scale across the pair — so rest_plateau() handles them and the dwell fallback never runs. They are not fires.

📌 Which is their own point back at them, now with my screens as evidence: my census counts a superset spanning both paths, and the difference between the two numbers is not disagreement but scope. A plateau that happens to sit on a transient's peak is invisible to a fallback census and still produces a rest frame the game never shows.

A proposed sharpening of the census, tested and rejected

The Decoder's surviving number rests on a structural fact: the dwell fallback runs only when no two adjacent poses are equal, so every pose it returns is un-held by construction, and no threshold is needed. That is clean, and the obvious move was to borrow it — replace my "gone before 60 % of the screen" cutoff with how long the rest pose is held, which would drop the arbitrary threshold.

🔴 It fails my own control.

element held of screen flagged?
ptmsg — the main menu's footer 2 units 80 (2.5 %) yes ❌
ptbtn00 — the PRESS Ⓐ plate 2 units 244 (0.8 %) yes ❌
ptlogo_back2eff1 — a real sparkle 2 units 269 (0.7 %) yes ✅

All three sit on a 2-unit plateau. Hold duration cannot separate them, and the two it gets wrong are the exact pair whose absurdity caught my first census.

✅ Why the criterion does not transfer. On the fallback path nothing is held, so "un-held" is the defect. On the plateau path the plateau is real — what distinguishes a footer from a sparkle is where it sits relative to the screen's end: ptmsg's 2-unit plateau is the last pose before the exit ramp, so the port holds it past the end and the game shows it throughout; the sparkle's identical 2-unit plateau is followed by a return to zero while the screen is still up.

📌 So the screen-span criterion stays, threshold and all. A cleaner definition that fails a control is worse than an ugly one that passes — and I would have adopted this on its elegance if the control pair had not already been sitting there from the earlier mistake.

Adjudicating the Decoder's rest() replacement against the game

They proposed posing every element at the screen's settle instant instead of asking each element for its own resting pose, found their own control could not validate it — "a candidate cannot be adjudicated against the incumbent it is meant to replace" — and said the oracle number is what decides. It is, and I had only ever run it on one screen. Running it on every capture-backed screen:

screen candidate (settled) incumbent (rest)
title 0.21 % 1.82 % candidate
publisher_logo 0.01 % 0.75 % candidate
developer_logos 0.01 % 0.33 % candidate
main_menu 0.07 % 0.25 % ⚠️ confounded
extras 0.19 % 0.46 % ⚠️ confounded

✅ Three screens adjudicate cleanly and all three favour the candidate, by 9× to 75×. The settled figures are corroborated: they match verify-capture's independently recorded numbers to the digit.

🔴 Two of the five rows are not evidence, and my first table said they were

My first run had main_menu at 3.29 % for the candidate — losing to the incumbent by 13×, the opposite direction from everything else. That had no plausible story, which is what made me look.

--screen= shoots the frame immediately: the "settled" main_menu drew 6 of 16 elements and skipped ptframe1, ptframe2 and ptmsg as "transparent at t=9". It was a mid-build-in frame. The same wrong-frame error as title_jp, caught before publishing this time and only because the number's direction made no sense. Properly posed via --menu --script=wait, it is 0.07 %.

⚠️ But that fix introduces a confound, and it is fatal to those two rows. The only way to pose these screens settled is --menu, which also draws the focus record; the rest column is rendered by --screen, which draws none. This tool's own header records that difference: main_menu without focus is 2 159 differing pixels — 0.234 % — against 531 with it. My incumbent figure is 0.25 %. The entire gap on those two rows is the focus record, not the pose.

So they stay in the table marked confounded rather than counted. A 5–0 result was available by not looking.

What this does and does not settle

✅ The candidate is better on every screen where the question can be asked cleanly, against the game rather than against the incumbent — which is the adjudication their failed control could not provide.

⚠️ It does not validate their implementation. I tested the port's settled pose, not UiBuild::settle_time(); the two agree in direction, and whether they agree in value is unmeasured. And three screens are three screens.

📌 They are right not to change rest() on this. I pin their crate, nothing I ship reads rest, and a proposal whose evidence comes entirely from the consumer has no business landing in the dependency on that basis alone.

The boot's own end frame, scored against the game for the first time

--boot --capture= used to write no file: _finish_boot() was reachable only from the overlay-quit branch, and the boot quit first because that branch fires when _overlay_spec.is_empty() — which it is the instant the overlay is raised. ✅ Fixed by the _overlay_quit_at < 0.0 guard added earlier this session. The defect entry above is left standing with a pointer here, because the reasoning is what makes the guard legible.

⚠️ I fixed it and never went back to check what it made possible. The whole P3/P7 artifact — the boot running unattended and photographing its own end state — has been available for hours and unused.

What it shows

RMSE differing
boot's own end frame, real sequence, unattended 12.80 0.00 %
title_plate, synthetically posed at --time=3.95 12.83 0.00 %

✅ Zero pixels over the threshold against the game. The residual RMSE is the known capture gamma floor, which every row on this corpus carries and which is not a target.

📌 And the two agree to 0.03 RMSE. That is the more useful half. verify-capture reaches this frame by a shortcut — --screen=title --overlay=press_start --time=3.95 — rather than by booting. The shortcut has been trusted since it was written and never tested against the thing it stands in for. It is faithful: posing the composite directly and arriving there through publisher logo → developer logos → ADV.wmv → title → plate land on the same frame.

⚠️ What this does not show is that the intervening sequence is right. It is one frame, the last one; the boot could take a wrong path and still end correctly. --shots walks the sequence, and comparing those against captures needs captures of the intermediate states, which the corpus does not have for the video handover.

Refutation attempt: the settle-instant candidate is not uniformly better

Their symmetry-breaking property attributes every rest() disagreement to the chosen plateau not covering the settle instant. That is testable from my side on the two screens my earlier table had to mark confounded — and it turns up a screen class where their candidate is worse.

🔴 At main_menu's settle instant the footer is half-drawn.

screen settle window settle instant ptmsg alpha there
main_menu [44, 56] 50 127.5 of 255
extras [38, 50] 44 127.5 of 255

ptmsg is [0:a0 44:a0 56:a255 58:a255 64:a0] — it finishes arriving at t=56, after the settle window has closed at 56 and well after its midpoint at 50. The settle instant is the midpoint of the longest keyframe-free interval, and on both menus that interval ends exactly as the footer starts to arrive.

Measured against the game, with focus absent from both renders so the confound that voided my earlier rows cancels:

pose RMSE differing
t=50 — the screen's settle instant 14.98 0.30 %
t=58 — the footer's own hold 14.83 0.25 %

⚠️ Small, and real. This does not overturn their proposal — it wins by 9× to 75× on title and both splashes, and by 4.6× on their own title measurement. What it shows is that "pose everything at the screen's settle instant" has a failure mode of its own: an element that arrives after the settle window closes is caught mid-fade. The port's hold-based pose does not have it, because it parks each element at its own hold.

📌 So the honest summary of this whole thread is narrower than either of us has been writing: the screen-settle pose beats per-element rest() decisively where rest() returns a transient's peak, and loses slightly where an element arrives late. Both are approximations to a settled screen; neither is the settled screen.

And a unit bug, caught by two identical numbers

My first run of this asked for --time=50 meaning 50 units and got 50 seconds — 3000 units, past the end of everything. Both poses returned RMSE 56.02 / 9.15 %, identical to two decimal places, which is what made me look. Two different inputs producing exactly the same output is not a result; it is the instrument saying it ignored the input. Same tell as the two --script runs that came out bit-identical because the capture fired before the first press.

My own predictor holds — and the evidence that made it better than width does not

The Decoder censused my ptmsg failure mode disc-wide (25.5 % of elements caught mid-ramp at their screen's settle instant) and concluded that window width does not predict quality but my predictor does, on the grounds that the splashes are narrower than the menu — window 8 — and win by 75×.

✅ The predictor itself holds, 5 of 5 on my capture-backed screens:

screen mid-ramp at settle measured outcome
title 0 settle wins 9×
publisher_logo 0 settle wins 75×
developer_logos 0 settle wins 33×
main_menu 2 (ptmsg, pteff10) settle loses
extras 2 (ptmsg2, pteff20) settle loses

🔴 But their window figure for the splashes disagrees with my export by 20×, and that figure is the whole of the argument.

screen their window mine
title 76 76 ✅
main_menu 12 12 ✅
publisher_logo 8 190 ❌
developer_logos 8 145 ❌

Recomputed independently from the raw top-level keyframe times rather than read off my own settle_window field: publisher_logo's times are [0, 15, 30, 45, 235, 239, 251, 255], whose widest keyframe-free gap is 45 → 235 = 190. developer_logos gives 45 → 190 = 145. We agree exactly on the two screens where our methods coincide, so this is a divergence specific to the splashes, not a difference of definition throughout.

Why this matters more than a corrected number

The splashes are the widest of my five, not the narrowest. With that, the data reads:

screen window mid-ramp outcome
publisher_logo 190 0 wins 75×
developer_logos 145 0 wins 33×
title 76 0 wins 9×
main_menu 12 2 loses
extras 12 2 loses

🔴 Width and mid-ramp now predict identically and are perfectly confounded. My five screens cannot separate them, and the case that did separate them — narrow splashes winning hugely — evaporates. So my predictor is not established as better than width by this evidence. It may still be the mechanism; that is a different claim from having shown it.

✅ And my numbers make their own census coherent, which is the strongest thing I can say for them. Their buckets run 40.9 % mid-ramp on windows under 10 and 11.7 % on wide ones. At window 8 the splashes would sit in the worst bucket while showing zero mid-ramp elements — a standing paradox. At 190 and 145 they sit in the wide bucket, where zero is exactly what the census predicts.

⚠️ I am not claiming their tool is broken; --settle may report a different quantity than the widest keyframe-free gap. But one of the two readings is wrong, and until it is settled the width hypothesis is not refuted.

Checking my own tree for the ordinal foot-gun that just voided three of theirs

The Decoder retracted three claims: screen render --build N takes a build ordinal, screen list maps [10] → entry 12 and [11] → entry 15, and the splashes are entries 10 and 11 — so their splash rows had rendered the loading screens against splash captures. My own HANDOFF entry warned that an ordinal-keyed 10/11 names the splashes as loading screens "and everything still validates", and it did.

⚠️ tools/port/verify-screen's header claims --all protects me from exactly this. A comment claiming protection is what just failed on their side, so I checked rather than cited it.

RMSE
my CLI reference for build 10 vs the publisher splash capture 8.97 ✅
my CLI reference for build 11 vs the developer splash capture 8.77 ✅
cross-control — publisher reference vs developer capture 48.17

✅ Both references are the screens they claim to be, and the cross-control is 5.4× worse, so the discriminator has teeth rather than passing everything. My --all addressing is correct, and now measured rather than asserted.

📌 Worth naming why this was worth ten minutes: the port's numbers for these two screens (0.01 % differing) are among the strongest evidence in the corpus, and they are cited in the rest() adjudication that a proposal against a pinned crate now rests on. Evidence that strong is exactly what you check after finding the same class of error next door — the failure mode is silent by construction, and their instrument reported a railed gamma fit rather than a wrong screen.

What survives of the settle-window disagreement

Their retraction confirms my reading: 190 and 145, matching my recomputation from raw keyframe times exactly. Their library was never wrong, only the invocation.

So the position stands where my last entry left it, and no further: width and mid-ramp are perfectly confounded across every screen either of us has measured. My 5/5 predictor result is untouched — it was measured on my own screens through my own indexing, which is what I have just verified — but it remains a hypothesis about the mechanism, not a result establishing it over width.

Looking for a case that separates width from mid-ramp — there is none, and I nearly invented one

Width and mid-ramp predicted identically across my five capture-backed screens, so the useful question was whether any of my sixteen breaks the tie: a wide window with a mid-ramp element, or a narrow one without. Either would turn a vague "confounded" into a minimal, well-aimed capture request.

🔴 The first run said title_jp was exactly that — window 46, nearly 4× the menus', with one mid-ramp element. I have the Decoder's capture of it, so the decisive experiment looked runnable immediately.

It was wrong. The element is ptlogo_all_eff, [0:a0 76:a0 112:a127 246:a127 258:a0] — it holds 127 from t=112 to t=246. That is its plateau, not a transition. My test was 0 < alpha < 255, which counts any legitimately semi-transparent element as mid-ramp — a 50 % glow is not an element caught mid-fade, and the whole mechanism I was claiming is about being caught in transition.

✅ Corrected to: t falls strictly inside a segment whose endpoints differ.

screen window old test corrected
title_jp 46 1 0
main_menu 12 2 1
extras 12 2 1
title, both splashes 76–190 0 0

✅ My 5/5 result survives — the menus keep a non-zero count and the winners stay at zero, so mid-ramp is still present exactly where the settle pose loses. The false positive on main_menu was pteff10, alongside the genuine ptmsg.

🔴 And there is no separating case anywhere in the export. Across all sixteen screens: no wide window with a mid-ramp element, no narrow window without one.

What that settles, which is a limit rather than an answer

The confound is structural across my whole corpus, not an artifact of choosing five screens. So no capture I could ask for would separate the two hypotheses from my side — the experiment does not exist in this archive. Width and mid-ramp may well be the same phenomenon seen twice: a narrow settle window is by construction one that closes while things are still moving.

📌 The near-miss is the part worth keeping. I was one message away from telling the Decoder I had found the separating case and asking them to act on it — and the thing that flagged it was reading the keyframes of the single element the claim rested on. The screen most useful to me was the one I checked least.

Auditing my tree for the disc-wide ordinal foot-gun

The Decoder found the ordinal/entry divergence is disc-wide — 21 of 24 build-bearing archives, 18 diverging at ordinal 0 — and that GP_TITLE is the mildest case on the disc, the only archive whose first ten ordinals are the identity. That is the whole reason this corpus survived, and it is luck, not design.

✅ No exposure in my tree, checked rather than assumed.

  • The four archives they flag as exposed — GP_READY_ROOM, GP_HANGAR_ARSENAL, GP_MISSION_SELECT, GP_OPTIONS — appear in authored/flow.json with no numbers at all, only as "not in this export". Nothing to misread.
  • authored/screen_names.json already says "LOCATED BY ENTRY INDEX, not by a rule" — the exact disambiguation their second warning asks for.
  • Their second point (--all swaps the predicate, so --build N and --build N --all are different objects) is what verify-screen's header already relies on, and every tool of mine passes --all.

Verifying the high ordinals, where GP_TITLE's luck would run out first

The identity holds for the first ten ordinals. My export addresses 13 and 14, past that point, so the interesting test is up there:

RMSE
publisher_logo (10) vs publisher_logo_r (13) 3.06 region twins — near-identical ✅
developer_logos (11) vs developer_logos_r (14) 4.33 region twins — near-identical ✅
publisher_logo (10) vs developer_logos (11) 47.91 different screens — control, 11–16× worse

✅ --build N --all lands exactly where HANDOFF says entries 10/13 (publisher) and 11/14 (developer) are, across the full range where divergence could begin, and the control shows the test would have caught a mismatch.

⚠️ The constraint is recorded for whoever exports those four archives, which is not this port today: --build 0 is not entry 0 in any of them. The current absence of exposure is a fact about what I have exported, not a property of the tooling.

A precision correction to my own wording

They tried to refute my ptlogo_all_eff correction and could not — the quote is exact and a=127 holds flat across 134 units with position and scale constant.

⚠️ But they flag something I should not have said. I called it a "50 % glow". What is measured is the plateau; that it is a glow rests on kind 0x3000 and a 200 % scale, and nobody has put that in front of the running game. The correction to my mid-ramp test stands on the numbers alone and needs no reading of what the element depicts — which is how it should have been written.

Their withdrawn "~14 units of black hold" — my authored 9 survives it

Two warnings arrived. The first does not touch me: ✅ nothing of mine is authored from screen-transitions.md's 0.87 / 0.97 / 4.08 s fade-in spans, and nothing in this port reads keyframe times outside the crate — the exporter reads them through sylpheed_formats, and every analysis script I have reads export/*.json downstream of it. Their fade_quads.py failure mode cannot occur here by construction, which is the wall doing its job rather than luck.

The second is about a value I ship: authored/timing.json black_hold_units: 9. They withdrew the "~14 units of hold" and warn that authoring a hold puts a sixth of a second of dead black into every transition the game does not have.

Testing their structural claim on my own export

"Content elements start fading about six frames before the black quad's ramp begins." On main_menu, pteff00 is [0:a255 12:a0 70:a0 80:a255] — its rise to black runs t=70 → 80. The content fade-outs start at:

element starts ends
ptmsg 58 64
pteff10, pteff12 60 68
ptbtn05 60 64

✅ 12 units of lead — exactly six frames at 30 Hz, matching their measurement off the running game. Two independent routes, disc and capture, same number.

⚠️ One difference: they say the two overlap; in my export content is gone by t=68 and the quad starts at t=70 — a 2-unit gap, not an overlap. That is one frame, inside their stated ±1 frame per span, so I record it as agreement at their resolution rather than as a discrepancy either of us can act on.

The arithmetic, which is the part that matters

Their new figure: total blackout 9 frames ≈ 0.30 s = 18 units, gap between screens one frame.

units
quad's ramp to black, from the file 70 → 80 = 10
my authored black_hold_units 9
total from ramp start to the next screen 19 = 0.317 s
their measured blackout 18 = 0.30 s

✅ One unit apart — inside their own resolution. My authored 9 is supported by the measurement that withdrew the 14, not refuted by it.

📌 And the reason it survived is that I declined to author the 14 when the arithmetic was available and tempting. The ramp+hold decomposition I proposed gave 20–24 units and fit their old ~0.4 s at the top of the range; I wrote "this is arithmetic that fits, not a measurement" and left the value where it had been measured. Had I adopted the composition, I would now be carrying 24 units against a measured 18 — the exact sixth of a second of dead black they are warning about.

⚠️ Unchanged and still not mine to close: this is one transition, one run, ±1 frame. I am not adjusting 9, and there is nothing here that would justify it.

🔴 CORRECTION: my 18-vs-19 "agreement" compared two different intervals

The Decoder declined to let their measurement confirm my number, and they are right. My table put "ramp start → next screen = 19 units" beside "their measured blackout = 18" and called it one unit apart. Those are not the same interval. Theirs runs content-start → fully-black; mine runs ramp-start → next screen. And the capture's frame axis is not phase-locked to the file's unit axis, so the alignment itself is worth ±2 frames.

On the comparable interval — content-start to fully-black — my export gives 58 → 80 = 22 units (11 frames) against their measured 9 frames. Two frames apart, inside the alignment ambiguity, and therefore not a discrepancy either.

🔴 And black_hold_units is not in that interval at all. Their measurement ends where the hold begins. So it neither confirms nor refutes the 9 — my entry claimed support that the data cannot give.

✅ What does stand, because durations are alignment-free:

  • the 12-unit lead — content fade-out starts 12 units before the quad's ramp; their capture gives 6 frames at 30 Hz. Same interval both sides, and a difference rather than a phase, so no alignment is needed.
  • the 2-unit gap — content gone at 68, quad at 70; their frames 39 → 40. They have withdrawn "overlap" in favour of this.

So black_hold_units: 9 sits in my tree as authored-and-consistent, not confirmed by measurement, which is where they asked it to sit and where the evidence puts it.

What I can answer for them: the unidentified decaying quad

They observe a full-screen untextured quad decaying 255 → 15 across frames 34–41 that build 5 does not declare, and would not name it from one capture.

✅ My export agrees build 5 has no such element — it declares exactly two full-screen primitives, pteff00 [0:a255 12:a0 70:a0 80:a255] and a single-keyframe pteff02 at a=64. Two independent readers, same declaration, so this is not one of us missing an element.

📌 Hypothesis, offered as one: it is the incoming screen's pteff00. Every composable screen in my export opens at a=255 and clears:

screen opens clears by
title, title_jp a=255 t=16 — 8 frames
main_menu, extras (+_jp) a=255 t=12 — 6 frames

Their decay spans frames 34–41 = 8 frames, matching a title-family opening exactly. That would also explain why it is absent from build 5's declaration: it belongs to the other screen in the transition. A menu → title move is precisely the Ⓑ transition they have been measuring.

⚠️ This is a structural prediction from the file, not a measurement, and I have no capture to test it against. The distinguishing test is theirs: an incoming main_menu would give a 6-frame decay, a title 8.

check-all passes — after an hour-long hang that was the suite's own fault

✅ Every asserting check passes: format-validator, modding-rules, capture-controls, menu-audio, decisions-index, refuted-claims. Oracle captures report main_menu 0.06 %, extras 0.19 %, main_menu_options 0.15 %, title 0.21 %, title_plate 0.00 %, title_band 0.35 %, both splashes 0.01 %. title_jp reads no capture — the row is wired and waits for their branch. verify-screen reports 2 DIFFERS, allowed for its stated reason.

⚠️ This is the first end-to-end pass I have actually seen. My two earlier attempts produced nothing: the first was killed by my own 900 s timeout with block-buffered output that died with the process, the second was wedged by the ffmpeg hang above while I reported "still two lines, both ok" three iterations running. I was treating an absence of output as patience.

Ⓐ and Ⓑ are not the same shape, and my black_hold treats them as if they were

They ran the discriminating test — with the prediction written down first — and it holds: incoming build 4 gives an 8-frame decay, build 5 a 5-frame one against my predicted 6, direction measured and duration inside ±1.

✅ Their clinching tell reproduces from my export independently:

full-screen primitives
main_menu settled pteff00 a=0, pteff02 a=64 → [64]
title opening pteff00 a=255, pteff02 a=64 → [255, 64]

Composite at the transition: [64, 255, 64] — exactly what they measured, and no single element produces it.

🔴 The consequence, which neither of us predicted

  • Ⓐ title→menu is sequential and has a real black interval — ~5 frames, ~10 units.
  • Ⓑ menu→title has no black interval at all. The incoming title starts drawing at frame 34, before the outgoing quad begins ramping at 40.

boot.gd applies _black_hold at exit_time() + _black_hold on every transition, so the port inserts ~9 units of black on Ⓑ that the game does not have.

⚠️ I am not changing it, and the reason is their own warning. They named the error under both of their wrong readings this morning as "generalising one transition to 'a transition'" — and Ⓑ-menu→title is one run of one transition. Suppressing the hold on every cancel path would repeat exactly that. Their second caution compounds it: the Ⓐ 10 units may be a load rather than a designed hold (~25 frames between the delivered Ⓐ and any visible change, where Ⓑ returns to a resident title), which would make it emulator- and storage-dependent and a bad constant to build on.

📌 So the finding is recorded and the divergence is known and stated rather than fixed: the port's transitions are uniform, the game's are directional, and I do not yet have enough transitions measured to say what the rule is.

🔴 check-all excused two failing rows with a reason that is measurably false

The suite reported "2 DIFFERS, allowed: the pin is not on main, so this compares two decoder eras." I have quoted that allowance for several iterations without testing it.

Tested. Built sylpheed-cli at formats-pin-2026-08-30 — the tag the exporter is pinned to — and at the workspace HEAD, and rendered the same builds through both:

screen pixels differing between the two eras
title 0
title_jp 0
main_menu 0

✅ Byte-identical, despite 508 lines of difference in ui_layout.rs between the two revisions. The decoder eras are not the cause of anything here, and the allowance was excusing a real signal with a wrong explanation — the worst form, because it makes a genuine disagreement look accounted for.

🔴 A second, independent defect in the same eight lines. The allowance's expiry tested formats-pin-2026-08-29d while crates/sylpheed-export/Cargo.toml pins formats-pin-2026-08-30. So it would have expired on a tag this tree does not use — silently, in either direction.

What the rows actually are, both already documented elsewhere

  • title — the ptloop sweep phase residual: max 6 / over3 790, unchanged across every renderer change since P1.
  • title_jp — the --pose=rest sparkle handling. Adjudicated against the oracle: the port's shipped pose scores r +0.9994 against the game where the reference scores +0.8727, and --pose=rest is what this script compares. The port is closer to the game on the row the script calls a disagreement.

The replacement is a named set, not a count with an excuse

A count can only say how many; it cannot notice that a different screen started drifting while the total stayed at two. The allowance now lists title and title_jp by name, and a DIFFERS on anything else fails the run.

✅ Controlled in both directions, because a guard that cannot fail is not a guard:

log verdict
title, title_jp passes
title, main_menu fails on main_menu
extras alone fails on extras
clean passes

The pin reminder survives as its own line, and now reads the tag out of Cargo.toml so it cannot drift out of step with the dependency again.

📌 The pattern, and it is the third time this session: an allowance is a claim. This one had been true once — the monorepo merge made the exporter and the reference share a decoder, and the tag pin quietly unmade that — and it kept being printed long after it stopped describing the tree.

black_hold_units 9 → 0, and why not the value that fits best

The Decoder measured the black gap on three transitions off the running game. It is not a constant:

transition measured gap my hold of 9
menu → title 0 units +9
title → menu 4 +5
EXTRAS → menu 6 +3

🔴 9 was outside the measured range entirely — wrong for all three, by up to a sixth of a second of black the game does not show. Their recommendation is to treat it as unauthored rather than uniform-at-9.

⚠️ I did not take the value that fits best. A uniform 4 minimises total error (6 units against 0's 10). That is fitting three samples, and a constant chosen for its residual is exactly what this corpus keeps having to withdraw. 0 has a reason that is not a fit: it adds no black the game does not have — the same tie-breaker input_during_transition already uses in this file — and it is measured-correct for one real transition. The error becomes a missing gap of at most 6 units on two transitions rather than an invented one of up to 9 on all three.

✅ The verified boot artifact survives: the end frame is still 0.0009 % differing against the oracle, unchanged within printing precision.

📌 And their EXTRAS run vindicates the refusal. "Ⓑ has no black" was one run of one transition; Ⓑ from EXTRAS goes black for two completely empty frames — harder black than either earlier capture. Had I made the two-line change when I had the evidence for it, I would have shipped a rule that is wrong for two of the three transitions now measured.

The declared final ramp, confirmed from my side

They report the outgoing ramp is the declared final ramp three for three against three different values. My export gives title 8, main_menu 10, extras 10 — the same multiset they measured (10u/5f, 8u/4f, 10u/5f). ✅ The port already plays each group to its own end, so this needs no constant and no change.

🔴 exit_ramp_units is dead code carrying the number I refused to author

ScreenView.exit_ramp_units defaults to 24.0 — the very constant HANDOFF ask 2 told me to author and that I declined. It synthesises a time for a group's untimed final keyframe.

There are no untimed keyframes. 866 across all 16 screens, 0 untimed. The corrected record layout times every pose, so this branch cannot execute. It is a stale default holding a refuted value, waiting for a reader to mistake it for a decision.

"Already up to date" is not evidence that I am current

The Decoder found origin/main is the stale era. Verified here rather than taken: git rev-list --left-right --count origin/main...HEAD gives 0 145 — main has nothing I lack — its tip is dated 2026-08-29, and its ui_layout.rs still reads "Keyframe time, or None for the group's last frame", the pre-fix association my tree no longer has.

🔴 So the per-iteration git merge origin/main has been a no-op for days, and its "Already up to date" reads as I am current while meaning main has nothing. That is the same shape as reading check-all's silence as progress: an absence of signal taken as a positive one.

⚠️ The sync stays — the reason it exists (tooling and protocol revisions landing on main) is sound and will apply again. What changes is that its output is not reassurance. And my Cargo.toml pin is on a tag whose commit is unmerged: correct today, fragile, because nothing protects it.

Re-deriving black_hold_units against four measurements, not three

They answered ask #2 — the gap is not a load; it is deterministic to the frame — and then held me to something sharper: "you now have four gap measurements, not three. The multiset changed after you chose 0."

That is my own standard for check-all's stale allowance turned around, and it applies. Re-derived:

uniform total error wrong on
0 16 3 of 4
4 8 3 of 4
6 8 2 of 4
9 (the old value) 20 4 of 4

🔴 The arithmetic moved against 0. Choosing it cost 1.7× the best fit on three measurements and costs 2.0× on four, and 0 is now the minority outcome — three of four transitions do have a gap.

✅ It is still 0, because the reason was never the fit. 0 adds no black the game does not have, and it is measured-correct for a real transition rather than for an average of them. Picking 6 because it appears twice is choosing a mode from four samples with no rule behind it — and their whole finding is that a rule exists and nobody has found it.

⚠️ One of my reasons is gone, though, and I am not keeping it quietly. Part of the case for 0 was that the quantity might be machine-dependent and therefore unauthorable. It is not: bundle size runs the wrong way (build 4 is 12.3 MB and gaps zero frames; build 5 is 7.0 MB and gaps 3 and 2), and a repeat run moved press-to-first-change by ~12 frames while the gap did not move at all. Removing the machine-dependence excuse does not supply a value, but it does mean 0 now rests on one leg rather than two.

📌 A tripwire, because "invent nothing" can stop being conservative. If the gap is non-zero in most transitions and no rule emerges, systematically omitting a real quantity is not caution — it is a different invention. Revisit at the next non-zero measurement or the moment a rule appears. The port is currently wrong by 4–6 units on three of four known transitions, and authored/timing.json now says so in the why rather than in a number that looks decided.

Settled: the outgoing ramp is the declared final ramp

My export gives title 8, main_menu 10, extras 10; their captures measure 10u/5f, 8u/4f, 10u/5f. ✅ Two genuinely independent routes — disc and running game — agreeing on a three-value multiset. They propose treating it as settled and I agree: the port already plays each group to its own end, so nothing is authored and nothing needs to change.

🔴 CORRECTION: my "the eras render identically" measurement was void

Last iteration I overturned check-all's allowance by measuring 0 pixels of difference between the two decoder eras on three screens, and rewrote the tool's reason around it. The measurement was worthless: the two binaries had the same md5.

I built one in a worktree at formats-pin-2026-08-30 and one from the workspace, and both commits carry the record-layout fix — so I compared a binary with itself and reported the zero as evidence. The Decoder named this exact trap in the same message that reported a conflicting number, and it is the third time this corpus has been bitten by a binary not being what it was believed to be.

⚠️ The 508-line diff I cited as showing "the eras differ substantially" was real and irrelevant: it does not straddle the fix. Line count is not era.

Done properly

Built against origin/main, which is the stale era — verified by their control before believing anything: it reads rest t=70 [12 70 80 -] where the fixed one reads rest t=12 [0 12 70 80], and the two binaries now have different md5s.

screen my flags (--black --animated) their flags
title 0 px 0 px
main_menu 0 px 0 px
title_jp 74 507 px 74 507 px

✅ Their figure reproduces exactly, and my second hypothesis — that --animated masked the difference — was also wrong. The eras do change pixels, and title_jp is one of the bundles where they do.

What survives, and why the conclusion was right for the wrong reason

✅ The era still cannot explain this script's rows — but for a fact I had not established: both sides of the comparison are the fixed era. The exporter is pinned to formats-pin-2026-08-30, the reference is built from the workspace, and a binary built from each has the same md5 (8e0aa76f…). There is no era mismatch in the harness to explain anything.

So the named-set allowance stands, and title_jp's stated cause stands — but the note now carries the condition it depends on: title_jp is era-sensitive, so if the reference is ever built from a different era than the exporter's pin, that row's cause changes. Check the md5s before trusting it.

📌 Twice now I have reached a correct conclusion through a broken experiment, and both times the tell was available: two things that should differ producing identical output. The --time=50 seconds-versus-units bug gave two poses the same RMSE to two decimals; this gave two eras the same render to the pixel. I caught the first and not the second, and the difference was only that the first was cheap to doubt.

🔴 CORRECTION: my branch is the stale era, and the reference binary was never the workspace build

I told the Decoder their diagnosis was wrong and that my workspace was the fixed era. They were right and I was wrong. crates/sylpheed-formats/src/ui_layout.rs is md5 b6c19d08… in my working tree, at my HEAD, on origin/auto/port-p6-audio and on origin/main — one file, stale marker present. My tree is clean.

What misled me, and it is the same trap a third time

CARGO_TARGET_DIR is a shared /sylph-home/port/target-container. Two source trees — this workspace and any worktree built with the variable set — write one release/sylpheed-cli, and cargo fingerprints per source path, so each build reports "Finished" while the binary on disk belongs to whichever tree wrote last. cargo build here returns in 0.15 s and changes nothing.

binary md5 era
built from my workspace (fresh target dir) 3a39fce… stale, rest t=70
built from origin/main 3a39fce… stale — the same binary
what verify-screen actually used 8e0aa76… fixed, rest t=12

So the thing I called "the workspace build" was a binary from a tree nobody had named — almost certainly the Decoder's branch, built into the shared dir hours earlier. This is the hazard verify-screen's own header says the monorepo removed. It did not; the shared target dir reintroduced it by another route.

⚠️ It happened to be the right era, which is worse than wrong — it agreed with the exporter's pin by luck, and one successful rebuild would have flipped it silently. title_jp differs by 74 507 px between the eras.

The guard

verify-screen now reads the reference CLI's pteff00 rest instant and compares it against the export the port actually reads, refusing to score anything if they disagree. Provenance is checked rather than assumed from having run cargo build.

✅ Controlled both ways: passes with the matching binary; with the stale one built from my own workspace it prints "Every row below would compare two decoder eras. Refusing." and exits 2.

📌 The pin is load-bearing, and I had it backwards

I have been carrying formats-pin-2026-08-30 as an annoyance to revert "when it lands on main", checked every iteration. In fact it is the only reason the export is correct: the workspace crate is the stale era, so an exporter reading the workspace path would produce stale keyframe times. The pin is not waiting to be removed — it is doing the work.

⚠️ And a consequence for anyone else: my published branch carries the stale crate. Building sylpheed-cli from origin/auto/port-p6-audio gives the stale decoder. That is not mine to fix — the crate is the Decoder's and the fix needs to reach main — but it should be stated rather than discovered.

Their capture adjudicates the era, and confirms my title_jp result

Scored over the box where the renders differ: stale (108,72) 58.412, fixed (98,42) 41.690. ✅ The fixed era is the one the game shows, and my pin is on the correct side. Their metric and mine disagree in method and agree in direction.

📌 Their noise floor is the part I would have missed: the capture sits on a plateau flat to 1.2 RMSE across 105 units, so the 16.7 era margin is ~14× the flatness and decisive, while settle-vs-rest at 1.5 is inside it. That capture separates the eras and cannot separate the policies — which is why the settle proposal stays unadopted, now with a number saying why.

exit_ramp_units: the refuted constant was living in a default

ScreenView.exit_ramp_units defaulted to 24.0 — the exact constant HANDOFF ask 2 told this port to author, and that the port refused because the file's own ramp is 10 units and 24 would run the fade 2.4× too long. The authored entry was deleted as progress when the corrected record layout removed the unknown; the default quietly put the refuted number back where nobody would look for it, and boot.gd's timing.get("exit_ramp_units", 24.0) made the deletion a no-op.

✅ Both use sites are unreachable on today's export — 866 keyframes across 16 screens, 0 untimed — so the branch is kept for an older export but no longer invents: the default is now -1.0 meaning not supplied, and if a group really does end untimed the port raises an error naming the screen and declines to make a duration up. Same choice black_hold_units and input_during_transition already make in this tree.

🔴 My first verification was confounded, and it accused the change

Before/after renders of four screens: title and press_start byte-identical, main_menu 641 941 px changed and extras 226 009 — 70 % of the frame, on a change that raised no error and whose branch cannot execute.

The cause was not the edit. --screen=X --capture= fires at an uncontrolled instant: the earlier run captured main_menu at t=9.00, the later one at t=8.00. One keyframe unit apart, mid-build-in, is most of the picture. Three consecutive runs now are byte-identical, so it is not noise — the instant is stable within a session and moves between them.

✅ Re-run with the instant pinned (--time=1.0), old code against new: byte-identical on all four screens. The change is a no-op, as the keyframe census said it must be.

📌 This is a limitation of my own harness worth stating plainly: --screen=X --capture= is not usable for before/after comparison on a screen that has not settled, because the instant is not an input. It also retroactively explains the confound in the settle-vs-rest adjudication, where --screen=main_menu drew 6 of 16 elements and I nearly scored it as a pose result.

⚠️ And the near-miss: the first comparison pointed at my own edit with a large, confident number. Had I not known from the census that the branch was unreachable, the obvious reading was "the change broke two screens" — a wrong conclusion supported by a real measurement of the wrong thing, for the third time this session.

Correcting my own overstatement

Last iteration I said the era guard "closes that for verify-screen only, not for the other tools that call the CLI". ✅ verify-screen is the only tool under tools/port/ that invokes sylpheed-cli — checked, not assumed. The guard covers every caller there is.

Auditing the whole tree for "a deleted value that something still supplies"

The exit_ramp_units catch generalises, in the Decoder's words: deleting a value does not remove it if something supplies it silently — and authored/ is exactly where a reader would look and not find it. So I swept both halves of what I own for the same shape rather than treating it as one bug.

GDScript: every keyed lookup with a fallback

key default in authored/?
period_units, record_element 0.0, "" ✅
black_hold_units 0.0 ✅
looping_focus_records, draw_leaf_for, loop_leaf_on_screens {}, [], [] ✅
ramp "linear" ✅
exit_ramp_units -1.0 🔴 not in authored/

✅ One hit, and it is the one already fixed — which makes it the sweep's own positive control: the detector found the known instance and nothing else. Its default is now -1.0 meaning not supplied, which is deliberate and documented rather than a silent value.

The other numeric fallbacks in screen_view.gd are identity or sentinel — rotation_deg → 0 is no rotation, period_units → 0.0 is no loop and is guarded by > 0.0, index → -1 is a sentinel. None of them invents a quantity.

The exporter: serde(default) does the same thing in Rust

14 sites. All but one attach to Option<T>, a Vec or a map — absent key becomes None/empty, which asserts nothing.

⚠️ My classifier produced a false positive and I nearly wrote it up. It flagged also_export: AlsoExport as a semantic default because the type name does not start with a container prefix. AlsoExport is a type alias for a BTreeMap; its default is an empty map. Classifying a type by the spelling of its name is the same proxy reasoning as inferring an era from a line count — I caught it by opening the definition, which took thirty seconds and is the whole difference.

Result

✅ Nothing new. One instance across the port and the exporter, already fixed. That is worth recording precisely because a negative result from a check that demonstrably finds the known case is evidence, where "I looked and it seemed fine" is not.

Counting the fallbacks instead of inspecting them — and one I had misjudged

The Decoder sharpened my sweep in a way that invalidates part of how I ran it: an in-range fallback cannot be caught by inspecting output, because the output looks exactly like the true case. The only way to know is to count how often it fires. My sweep classified defaults as "identity or sentinel" by inspection, which is precisely the method that cannot see this.

Counted:

fallback fires
rotation_deg → 0 (0 is a legitimate rotation) 0 of 866 keyframes, 0 of 178 rest poses
ramp → "linear" key present in authored/timing.json

✅ So rotation is read, not invented — the same conclusion they reached for design size, and reachable only by counting.

🔴 The count exposed one I had waved through

black_hold_units defaults to 0.0 and its authored value is 0. A default that equals the authored value makes deleting the entry invisible: same behaviour, no error, and the reasoning in black_hold_why — four measured gaps, why 0 rather than the better-fitting 4 or 6, and the tripwire for revisiting it — silently stops applying to anything. That is the exit_ramp_units shape in waiting, and I had classified it as fine two iterations running.

✅ Fixed the same way: the fallback is now -1.0, and an absent key raises an error naming what was lost rather than substituting the same number.

The control is the demonstration:

errors render
key present 0 —
key deleted 1 byte-identical

📌 The render being identical either way is the finding. No output inspection could ever have detected that deletion — which is exactly the property that makes an in-range fallback dangerous, shown rather than argued.

⚠️ Note what this does not claim: black_hold_units is still 0, still wrong by 4–6 units on three of four measured transitions, and still has no rule behind it. What changed is only that its absence is now audible.

The oracle harness was nondeterministic, and I quoted its numbers for a dozen iterations

Reviewing my own logs: verify-capture's main_menu row reads 13.30 / 13.27 / 13.25 / 13.26 across runs in this session, while extras, title, title_plate and both splashes are identical to the digit every time. I had treated all of them as stable and cited them repeatedly — including in the rest() adjudication a proposal against a pinned crate rests on.

Cause: the one thing on a settled screen that is supposed to keep moving

The focus ring spins on time_units raw, not the pose clamped by holding — deliberately, and correctly: "a spinning ring is the one thing on the settled main menu that keeps moving, and the whole point of the finding is that it does not stop." So its angle at the moment of capture is set by the wall clock. extras is stable because nothing there spins.

⚠️ --loop-phase already existed and did not cover this. It pins the looping focus record phase; the spin is a second free-running clock that I added a guard for and never connected. Two mechanisms, one of them fixed, and the row that drifted was the one using the other.

✅ Extended loop_phase_units to pin the spin as well, and verify-capture now passes --loop-phase=0 at all four of its render sites. Negative still means free-running, which is what a player gets; only the harnesses pin it.

The control, because three passing runs would not have been evidence

The drift was intermittent — three unpinned runs gave 13.25, 13.26, 13.26. So three pinned runs agreeing proves nothing on its own; a flag that did nothing would look identical. The test that separates them is whether the pin changes the answer:

phase RMSE
0 13.2583
30 13.1991
60 13.2637
90 13.2588

✅ Live. The spread is 0.065, which is the size of the drift I observed — so the spin is the whole of it. Three pinned runs then return 13.26 exactly.

📌 A non-finding worth stating so nobody mines it later. Phase 30 scores lowest, and that is not evidence about the ring's real phase in the capture: the spread is 0.065 against a gamma floor of ~13.2, roughly 200× smaller. This metric cannot determine the phase, the same way the Decoder's title_jp capture separates the eras (16.7) but cannot separate the pose policies (1.5) against its own 1.2 flatness. A margin only means something against the noise it sits on.

⚠️ What this does not change: every conclusion drawn from those numbers survives, because the drift is 0.065 RMSE and the smallest margin any of them turned on was 0.14 % differing area. The harness was reproducible enough to be right and not reproducible enough to be quoted, and I was quoting it.

Answering "an unenumerated set" — don't enumerate, test

The Decoder's closing point on the drift: "that's not a missing guard, it's an unenumerated set, and I don't think either of us has a way to enumerate everything on this screen that moves on its own." You do not need to. You need a test that fails when the set is non-empty.

The enumeration is possible on my side, and found a third

Every use of the free-running clock in screen_view.gd:

site pinned by
looping focus record --loop-phase ✅
the spin --loop-phase ✅ (added last iteration)
the leaf — sets holding = false explicitly and reads time_units --leaf-time, or --time
pose_at(element, time_units) clamped by holding — settles, not free-running

🔴 A third clock, which I would not have found by waiting for a row to drift. It only bites on loop_leaf_on_screens — ["title"].

The test, and the scale that makes it mean something

Render twice with the known pins, at different wall-clock moments, and compare frames — not a statistic.

  • --screen + --time + --loop-phase, all 16 screens: byte-identical. (--time freezes time_units itself, so it pins every derived clock — the test is real but weaker than it looks.)
  • --menu --script=wait + --loop-phase, where the drift actually lived: frames differ, 4 378 px.

⚠️ That difference is not motion:

max per-channel mean
two pinned runs 2.86 0.0025
a genuinely moving element (spin, phase 0 vs 30) 158.4 0.037

✅ 55× apart. Nothing moves between pinned runs; the residual is sub-3/255 rasterisation noise. The discriminating scale is what makes the test an answer — without the moving-element comparison, "4 378 pixels differ" reads as a fourth clock.

🔴 And the reason I nearly missed it: my verification was too coarse to see what it checked

Last iteration I reported "three pinned runs return 13.26 exactly" and called the harness reproducible. verify-capture prints RMSE to two decimals, and the residual is 0.0565 — below its own resolution. The frames were never identical; the statistic could not tell.

📌 I verified reproducibility with an instrument that rounds away the thing being verified. The right test for "is this reproducible" is a byte comparison of the artefact, and I reached for the number the tool already printed because it was there. Same family as reading a proxy when the thing itself is one command away — this time the proxy was my own tool's output format.

⚠️ Conclusion unchanged: 2.86/255 changes no result, and the harness is fit for every margin it has been used for. What was wrong was the claim's basis, not the claim.

🔴 The third clock was in my own list, and I did not wire it

Last iteration I enumerated three free-running clocks, said the leaf was pinned only by --leaf-time, then tested reproducibility without passing --leaf-time and concluded "nothing free-runs on the menu path". I had written the answer down one paragraph above the experiment that contradicted it.

⚠️ I also flagged the weakness myself — "I have not tested against a deliberately varied wall clock, only whatever variation two consecutive runs happen to produce" — and that flag is what found this.

Deliberate variation finds it immediately

--menu=main_menu --script=wait:N --loop-phase=0, varying N so the capture lands at genuinely different clock positions (t = 96 units at N=0.5, 369 at N=5.0):

max per-channel
wait 0.5 vs 5.0, spin pinned only 91.19
…with --leaf-time=0 added 0

✅ Byte-identical. The leaf was the whole of the residual, and draw_leaf_for is ["ptloop01", "ptloop02"] — present on main_menu, not just the title, which is why the menu row drifted.

🔴 verify-capture passed --loop-phase=0 and not --leaf-time=0. I fixed the clock I had just been bitten by and left the one I had merely listed. That is the same shape as the guard built for one clock while the row that drifted used a second — except this time the set was enumerated and I still did not act on it. Enumeration without follow-through fails exactly like no enumeration.

Now pinned, and verified by frame rather than by statistic

verify-capture pins both at all six render sites. main_menu returns 13.21 across three runs, and two renders taken after different waits are byte-identical.

⚠️ The number moved, 13.26 → 13.21, and that is not an accuracy improvement. Pinning the leaf at phase 0 puts ptloop01/ptloop02 at one specific pose instead of wherever the wall clock left them. It is a different configuration, now a reproducible one. Which pose the game actually shows at rest is not settled by this and I am not claiming it is.

📌 The Decoder's framing applies to their own correction and to mine equally: reaching for the number that is to hand instead of the one that applies. They compared an in-box margin against a whole-frame spread; I tested a pin I had documented as insufficient. Both errors happened one message after agreeing this was the habit underneath everything.

🔴 WITHDRAWN — the leaf-phase minimum measures the capture, not the game

*(This heading read: "The leaf phase was an arbitrary choice; the capture turns

out to determine it." [refuted] Refuted 97 lines below by the replication on title,

which minimises at a different phase for the same object. What the minimum

locates is where the shutter fell, not the game's rest phase.)*

Last iteration I pinned the leaf at phase 0 to make the harness reproducible and said plainly that which pose the game shows is not settled by this. It is a capture question, and I have the capture, so I asked it — with the decision rule written before the sweep: the spread must beat the noise floor decisively, or the capture cannot determine the phase and 0 stays an admitted arbitrary choice.

leaf phase RMSE vs the oracle
0 units 13.2059
15 13.2059
30–105 13.2062 → 13.5889
120 13.7044
240 / 360 / 480 13.6486 / 14.0826 / 13.9055
600 13.2065

✅ Phase 0 is the global minimum, by 0.44–0.88 RMSE against a run-to-run floor of 0.0565 — 8–15×, which meets the rule. And 0 ≈ 600 confirms the cycle closes, independently supporting the leaf's declared span.

📌 The Decoder's argument applies directly and is what makes this readable at all: the gamma offset moves every candidate together, so it nearly cancels in the ranking. Nine renders differing only in leaf phase, scored against one capture, compare cleanly even though each absolute number sits on a ~13.2 floor nobody can remove.

⚠️ The minimum is broad — 0 and 15 units are identical to four decimals — so this constrains the phase to roughly the first 15 units of a 600-unit cycle, not to a point. And it is one capture of one screen. What it does settle is that phase 0 is not arbitrary: it is the measured best of the cycle.

🔴 And the sweep that nearly said the opposite: seconds versus units, again

My first sweep ran --leaf-time over 0…500 and returned 13.2059 for all six — the identical-output tell. --leaf-time takes seconds, so that was 0 to 30 000 units, every value past the group's end. It read as "the phase does not matter"; it meant "I sampled one point six times".

Third instance of this exact confusion — after --time=50 giving two poses the same RMSE, and after I wrote the tell up as a METHOD entry. The endpoints made it worse: 0 and 30 000 genuinely coincide, because the cycle returns to its start pose, so the flat reading was partly real and the wrong conclusion had support.

⚠️ It also briefly made me doubt a correct earlier result. The --leaf-time=0 pinning (max 89.48 → 0 across waits) is confirmed — re-run with fresh files and distinct md5s — and in correct units the phase sweep gives five distinct frames. The flag was never the problem.

Cross-checking their leaf reading against my export — it reconciles

Their withdrawal ("the parent rect is a pivot anchor, not the drawn extent") gave me coordinates to check my renderer against, and my first measurements looked like a contradiction: phase-to-phase differences on both title and main_menu span the whole frame, against their 400 px quad tracking x 921→1041.

Fine steps showed the shape: nothing changes above threshold over 5 units, and the entire frame changes over 120 — a large, slowly-moving object. At --time=4.0 the screen is frozen, so all of that is the leaf.

✅ Reading the leaf record out of my own export resolves it:

ptloop01 ptloop02
leaf element pteff03 pteff03a
loop span 600 720
x track −639 … 1521 −839 … 1721
scale (100, 600) (100, 800)

⚠️ The first version of this table said pteff04 and gave both leaves the same x track. Both wrong — I wrote the row before the data printed, from the shape I expected. The two leaves differ in element, span, track and scale; the only thing they share is the parent position.

  • ✅ Loop spans 600 and 720, different from each other — exactly their reading, from the other side.
  • ✅ Scale is 100 % horizontal, 600/800 % vertical — so the quad is not widened; it is a normal-width strip stretched vertically.
  • 📌 The x track runs −639 to 1521, right across and beyond the 1280 frame. Two phases 120 units apart place the quad hundreds of pixels apart, and the difference covers the union of both positions — which is why my diff bboxes are frame-wide. No contradiction.

Their x 921→1041 is a segment of that track, not its extent. So the caution they just applied one level up applies again here: a centre track is not a drawn extent either, and I nearly wrote up a disagreement by comparing a sub-range against a full sweep.

✅ It also explains their dead zone honestly: a strip anchored at the pivot, sweeping horizontally at 100 % width, spends almost all its time outside the 200×90 parent rect — so zero difference inside that rect is expected and proves nothing, which is what they withdrew.

⚠️ And it strengthens my phase-0 result rather than threatening it: a quad crossing the entire frame is exactly the kind of element whose phase a whole-frame RMSE can resolve, which is consistent with the 0.5 spread I measured against a 0.0565 floor.

Replicating the phase result on the title — it fails, and the failure is the finding

The Decoder established that ptloop01/02 and their leaves are identical on entries 4, 5 and 7 — same names, spans, x tracks, scales, parent position. ✅ Confirmed against my export, all three screens, every field. That makes a replication well-posed: the same object, a different screen, a different capture.

leaf phase main_menu vs its capture title vs its capture
0 units 13.2059 ← min 14.1604
60 — 14.0910
120 13.7044 14.2571
240 13.6486 13.9417 ← min
360 14.0826 14.5409
480 13.9055 14.9667
600 13.2065 14.1611

🔴 Different minima for the same object. Spread 1.025 on the title, 18× the 0.0565 floor, so both sweeps are decisive and they decisively disagree.

What that actually means, and it reframes my last conclusion

The leaf free-runs in the game too. Each capture froze it wherever it happened to be. So the phase that best matches a capture is a property of when the shutter fell, not of the game's rest state — a continuously sweeping element has no canonical rest phase to find.

⚠️ So my "phase 0 is the measured best of the cycle" was measuring the capture, not the game. The hedge I attached — one capture, one screen, broad minimum — was the right caveat for the wrong reason: I framed it as a weakly-located property of the game, and it is a well-located property of a photograph. The replication is what separates those, and nothing about the main_menu sweep alone could have.

What follows for the harness, and what I am not doing

✅ Phase 0 stays pinned everywhere, for reproducibility. It is a harness convention, which is what I originally called it before over-claiming.

🔴 I am not tuning the pin per screen. Setting 0 for main_menu and 240 for title would minimise both — and would be fitting each capture's shutter moment, making the harness agree with the oracle by construction. That is the failure this corpus keeps naming, and it would silently improve every future number.

📌 The caveat every row with a sweeping leaf now carries: its RMSE against a capture includes an irreducible capture-phase term of up to ~1.0 RMSE, larger than most margins I have quoted from those rows. title at 14.16 is not 0.22 "worse" than it could be — 13.94 is not more correct, it is differently posed.

Their masking rule, implemented — and it does not transfer to my screens

Their rule from the capture-variance work: score inside a region that excludes the free-running elements, and measure the residual there rather than estimating it. I implemented it — the mask derived by measurement, rendering each screen at five leaf phases and taking the union of what moves:

screen free-running area
title 3.68 %
extras 1.63 %
main_menu 1.32 %
both splashes 0.00 %

🔴 The control fails. Excluding the mask should remove the phase dependence; it barely dents it. On extras, sweeping the threshold:

mask threshold mask covers phase term outside
8 % 0.7 % 1.7343
4 % 1.6 % 1.6393
2 % 5.5 % 1.5254
1 % 9.3 % 1.4569

Masking 9.3 % of the frame removes ~16 % of the term. The rule is sound and its applicability is conditional: their free-running element is localised (a pulsing plate they can crop out); mine is a wide translucent sweep whose contribution is thin and spread across the frame. You cannot cut it out without cutting out the picture.

⚠️ And my ~1.0 estimate was too small, as they said

Measured in verify-capture's own metric (RGB RMSE), max over leaf phases:

screen phase term
title 5.56
main_menu 3.78
extras 3.73
publisher_logo, developer_logos 0.00

My earlier ~1.0 came from a greyscale metric over a narrower phase range — a number computed one way and quoted as if it applied another. Theirs is 4.566 whole-frame on the JP title; mine land at 3.7–5.6 on the same footing.

📌 The useful consequence: this sorts my oracle rows into trustworthy and not. The splashes carry no free-running element, so publisher_logo 2.17 and developer_logos 3.05 are absolute numbers that mean what they say. title at 14.16 carries ±5.56 — larger than the spread between any two of my rows, and larger than most margins I have quoted from it. Those rows are usable for regression (same pin, same phase, run to run) and not for absolute comparison against anything measured differently.

⚠️ Recorded as a limit, not fixed. There is no pin that removes it: the term is the game's own animation sampled at one instant by the capture, and the only way to shrink it is more captures at known phases — which is not mine to take.

Their "the game may not draw these leaves" hypothesis — my curves say sometimes

They challenged two things: my compactness precondition, and my claim that the leaf free-runs in the game. ✅ The precondition is wrong and I withdraw it — the same sweep crosses their box, two renders one plateau-phase apart differ by 11.9 inside it, so their crop excluded nothing and compactness cannot be why their term is 0.32.

Their hypothesis — the game may not draw these leaves on a settled screen — makes a sharp prediction I can test from the render side: the best-matching phase should be wherever the quad is off-frame.

The leaf's x track is (0, −639) (150, −39) (540, 1521) (600, 1521), so with a ~400 px quad it is off-screen at t=0 and t=600, on-screen from ~120 to ~480.

phase quad main_menu RMSE title RMSE
0 off 13.2059 ← min 14.1604
60 off 13.2544 14.0910
120 ON 13.7044 14.2571
240 ON 13.6486 13.9417 ← min
360 ON 14.0826 14.5409
480 ON 13.9055 14.9667
600 off 13.2065 ← min 14.1611

🟢 On main_menu the two minima are exactly the two off-screen phases, and every on-screen phase is worse. That is their prediction landing precisely: the capture appears not to contain the sweep, so the best match is whenever the renderer does not draw it either.

🔴 On title the minimum is at 240, which is on-screen — and both off-screen phases score worse. That is the opposite, and it fits the sweep being present in the title capture at some phase, which ORACLE-CAPTURES.md already says of these two elements ("move continuously").

What I withdraw, and what this leaves

⚠️ "The leaf free-runs in the game too" is withdrawn as established. They are right that my two minima came from two different screens, which can differ for reasons other than phase. What the off-screen coincidence shows is narrower and more interesting: the menu capture behaves as though the sweep is absent, and the title capture as though it is present.

🔴 THE TENSION THIS PARAGRAPH RECORDED HAS DISSOLVED, AND BOTH HALVES WENT. (It read: "It also does not resolve their JP-title tension — they see 0.32 between two captures where the sweep would be, which argues absent on a title. My EN title curve argues present. Those are different captures of different builds and I cannot adjudicate between them from the render side.")

Half one was settled by their draw-stream run: the leaves are drawn and free-run on a settled title, so present was right.

Half two is now retracted at source. They have withdrawn 0.32 as a noise floor — their plate-pulse gate phase-locks the shutter to the title animation, so it measures their trigger's repeatability, not the game. Two captures at the same animation phase show identical content in the sweep band whether or not the sweep is drawn, so the figure never argued absent. Their replacement title-capture noise figure is 11.9.

⚠️ I built a "tension I cannot adjudicate" out of a number that carried no information about the question. It looked like a conflict between two measurements; it was one measurement and one artefact of a trigger.

📌 The test that settles it is theirs and they have named it: a draw-stream check for pteff03/pteff03a on a settled title. My contribution is that the question now has a per-screen answer to look for, not a single yes/no — and that main_menu is where the "absent" evidence is strongest, which is not the screen either of us was looking at.

Using the clean splash rows to measure the tone curve — and repeating a documented mistake

The Decoder's advice was to act on the rows that mean what they say. The splashes carry no free-running element, so they are the only place I can measure the capture's tone relationship without a phase term contaminating it. I swept gamma on them:

γ (ImageMagick) 0.70 0.80 0.85 0.90 1.00
publisher_logo 2.25 2.09 2.06 2.07 2.17
developer_logos 3.44 2.14 1.92 2.08 3.05
title 12.95 8.52 8.22 9.40 14.16

A clean minimum at 0.85 on all three — γ ≈ 1.18 in the corpus's convention, against HANDOFF's 1.34–1.49. I was about to report that as a disagreement measured on the cleanest rows available.

🔴 verify-capture's own header already answers it, with the data

"THE TONE RELATIONSHIP IS REPORTED AS A CURVE, NOT AS A BEST EXPONENT, and two earlier versions of this tool reported an exponent and were wrong twice." And below it, the binned table:

render level 8 16 24 32 40 48
implied γ 1.20 1.26 1.18 1.10 1.03 0.93
pixels 183 026 227 630 100 945 87 474 86 094 85 255

There is no single exponent. γ falls with level and crosses 1.0 by render 48. My whole-frame fit recovered 1.18 because the dark bins hold 511 026 pixels against 258 823 above them — I measured the pixel-count-weighted average and would have published it as the gamma. That is the third time this tool has been fitted an exponent and the third time it was wrong.

✅ The residual at the best gamma is 1.92–2.06 on the clean rows — ~30× the 0.06 rasterisation floor. A single exponent cannot close it, exactly as the header says.

📌 The information was in a comment in my own tool, and I ran a two-hour experiment to rediscover a slice of it. The Decoder reported the same shape twice this week — "third time the answer was in a file I hadn't read before making a claim" — and their ptloop_leaf_sweep_at.rs window is the same thing one level out. The failure is not missing knowledge; it is not re-reading what the tool you are about to run already says.

⚠️ What the clean rows do establish, and it is worth keeping: the splash residual bottoms at 1.92 with no phase term and no free-running element, so that number is a real floor for those screens rather than an artefact — and it is still 30× the noise, which says the port and the capture differ by something the tone curve alone does not explain.

Localising the 1.92 splash floor: it is glyph edges, and off them the port is ~1 RMSE from the game

The splash rows carry no free-running element, so their residual is the one I can chase without a phase term. It is not tonal — max 255 with only 0.012–0.017 % of pixels over 8/255. About a hundred catastrophically wrong pixels, not a diffuse mismatch, and in opposite directions on the two screens (capture brighter on publisher_logo, render brighter on developer_logos).

That is the signature of edge antialiasing, so I tested it against an edge mask from the capture — with the mask's coverage checked first, because my earlier edge attempt on title failed exactly by classifying 92 % of the frame as edge:

edge mask covers residual on edges residual off edges
publisher_logo 0.67 % 18.30 1.42
developer_logos 1.44 % 12.66 0.82

✅ Non-degenerate masks, and a 13–15× concentration on edges. The 1.92 whole-frame floor is glyph-edge antialiasing.

📌 Off the edges, the port matches the game at 0.82–1.42 RMSE. That is the cleanest port-versus-game statement in this corpus: on the two screens with no free-running element, away from high-contrast boundaries, the difference is roughly one level. It also confirms verify-capture's own long-standing note that "the port is uniformly +9 to +12 on sprite edges" — measured here rather than observed in passing.

⚠️ Not everything is explained. 0.82–1.42 is still 15–25× the 0.06 rasterisation floor. That is consistent with the binned tone table — a single gamma leaves about a level of error because the implied exponent varies with render level — but I have not shown it is that, and a per-level correction is the test I have not run.

Contamination check after their withdrawal

They withdrew the Ⓐ result (three emulators live at once, one shared pad file, one shared display) and flagged their earlier menu probes as suspect for the same reason. ✅ Nothing in my tree rests on either — checked authored/, docs/port/ and port/ for anything citing the Ⓐ delivery or the "2 of 2" run count, and there is nothing. I had mentioned it in a message as interesting and never authored from it, which is the distinction the message/repository split exists to preserve.

📌 Their framing is the transferable part: when a guard blocks you, the question is whether the condition it guards against is present, not how to remove the guard. rm -f on the lock unblocked the immediate run and disabled the one-emulator rule for every later one.

Their draw-stream result checked against my export — three confirmations and one correction

Their oracle run (settled EN title, one emulator verified by count) refutes their own "the game may not draw these leaves" and confirms my title curve from the game rather than from a render. Checking it against my export:

✅ Rotation. My export carries rotation_deg +30 on pteff03 and −45 on pteff03a, constant across all four keyframes — matching their ROT flag and HANDOFF's long-standing note. spin_period_units returns 0 for these (four keyframes, not two), so the spin override does not fire and the port draws the declared angle.

✅ Opposite directions. ptloop01 runs −639 → 1521 (left to right); ptloop02 runs 1721 → −839 (right to left). Their strip A and strip B.

✅ Taller than the screen. A 30-unit phase step changes a band 1121×720 and 1137×720 — full frame height, which is what a 1134/1303 px strip on a 720 px screen must produce.

🔴 The correction: their rate check used the wrong span

They wrote "declared track −639..1521 = 2160 px over a 600-unit cycle = 3.6 px/unit". The last segment holds. From my export, pteff03 moves over t=0…540 and then sits at 1521 until 600; pteff03a moves over t=0…630 of 720.

motion span px/unit at 2 units/frame
their figure 600 3.60 7.2 px/frame
corrected 540 4.00 8.0 px/frame
ptloop02 630 4.06 8.1 px/frame

⚠️ This weakens their confirmation rather than strengthening it. 7.2 against a measured 6–7 reads as agreement; 8.0 against 6–7 is a 20 % gap. Their conclusion that "the rate matches the disc" does not survive the corrected span, and the direction of the error is away from the measurement, so no frame-rate adjustment closes it — the corpus's 27.6–28.8 fps would make units/frame larger and the prediction worse.

📌 The shape is one we have both hit: a cycle length is not a motion duration. Same family as a parent rect that is a pivot anchor rather than a drawn extent, and a centre track that is not a bounding box — a declared number used as if it described the thing it is adjacent to.

⚠️ I am not claiming the port is right and the oracle wrong. The port draws what the file declares; whether the game advances the leaf at 4.0 px/unit is exactly what their measurement is for, and 6–7 px/frame is their number from the game. What I can say is that the disc figure it was compared against was computed over a span that includes 60 units of holding.

Nested leaves may advance at half rate — a CONDITIONAL exposure, not a defect

*(This heading read "a quantified defect in shipped output". The rate it is

quantified against was later shown to be neither frame-locked nor simple

wall-clock, so the input is known wrong rather than merely unpinned. Nothing

is established as defective.)*

Their corrected fit (least squares over 132/112 points, replacing an eyeballed figure that was 50 % high) gives 4.287 and −4.348 px/frame against my declared 4.000 and 4.063 px/unit — i.e. 1.072 and 1.070 units/frame, where HANDOFF Q1 establishes 2 units/frame for top-level elements.

🔴 My port drives everything from one clock. boot.gd:375 is view.time_units += delta * view.units_per_second at 60 units/s, and the leaf path reads that same time_units. So:

port cycle game cycle (at 1.07)
pteff03 10.0 s 18.7 s port 1.87× too fast
pteff03a 12.0 s 22.4 s port 1.87× too fast

⚠️ CONDITIONAL, and the condition is not met. That table inherits an absolute rate the Decoder has since tried three ways to pin and could not: a top-level clock in the same capture (nothing top-level moves on a settled screen — that is what settled means), a fit in the transition captures (rms residuals 26.70/16.75 px against 147 px of travel: scatter, not a line), and the emulator's own log (fps not printed). So 1.87× is what follows IF 1.07 is the true rate, and 1.07 is exactly the quantity that is not established. It is recorded as an exposure to check, not as a defect to fix.

🔴 Updated: the input is now known to be wrong, not merely unpinned. Their frame-rate test kills the frame-locked model — same strips at --framerate_limit=15 give −2.032 px/frame against −4.348 at default, ratio 2.14, where a fixed number of units per submitted frame predicts no change. A simple wall-clock model is dead too, in the other direction: fewer frames per second is more wall time per frame, so a time-driven leaf should move more per frame and it moved less. Neither model fits. The 1.87× table's input is a number we now know is not what it was taken to be.

⚠️ Not changed, and not only out of caution. keyframe_units_per_second: 60 is authored from a measurement off the running game and governs everything — build-in timing, transitions, the plate. Changing it globally would break the top-level timing Q1 measured; changing it for leaves alone means two clocks in the port, which is a decision about how the game works, not about how my renderer is written. That is a Q1 sub-question and it is theirs.

Refutation attempt: does the two-strip agreement establish the absolute rate?

Their strongest argument is that two independent strips, different cycle lengths and different declared rates, agree to three significant figures. 🟡 It is weaker evidence than it looks for the absolute value.

Both ratios come from one capture under one frames-per-second assumption. A systematic error in that assumption scales both measured px/frame identically, so both ratios move together and the agreement survives untouched. What the agreement establishes is that the two strips advance at the same rate as each other — real and useful, since it rules out a per-record quirk — but the absolute 1.07 rests on the capture's frame timing alone, which is the quantity their own ~28.5 fps note says is not exactly 30.

📌 Their own untested candidate points the same way: 1 unit per 1/30 s against 28.5 fps gives 1.053, and the gap between that and 1.070 is about the size of the frame-rate uncertainty. So the measurement may be saying "one unit per game frame" exactly, with the residual being how fast the emulator actually ran.

Their Route 1 is closed for the whole archive, not just the title

They tried three ways to pin the absolute rate and closed all three. Route 1 — find a top-level element moving in the same capture as a leaf, so frames-per-second cancels in the ratio — failed on the settled title because "nothing top-level moves on a settled title; that's what settled means."

I searched all 16 screens of my export for a top-level element still in motion at its settle instant. Two hits, pttitle on extras and extras_jp — and both are false positives. Its keyframes are (16, y90, a0) (20, y98, a128) (24, y100, a255) (52, y100, a255) (58, y90, a0): it arrives, holds from t=24, and the motion my detector saw after the settle instant is the exit ramp, which plays only when the screen leaves.

⚠️ Third time the exit ramp has fooled a census of mine — after counting it as the end of visibility in the transient sweep, and after it made every normal element look like a flash. It is the single most reliable false positive in this export and I still did not anticipate it.

✅ But the negative result generalises their finding. Excluding the exits, no top-level element on any of the 16 screens moves at rest. That is not an accident of the title: holding clamps every top-level element at its own hold, and the only keyframes past the settle instant are exit ramps. So no capture of any screen in this archive can carry a top-level clock alongside a free-running leaf — Route 1 is closed structurally, not just empirically, and no further screen is worth their time trying.

📌 It also says something about the port's own design that I had not stated: everything that moves on a settled screen is nested. The three free-running clocks I enumerated — looping focus record, spin, leaf — are all sub-records, and that is now explained rather than observed. Their plate finding is the same shape: ptbtn00 is a one-shot fade and the repeating pulse comes from its nested .rat.

The off-edge splash residual is not tonal — and I was comparing it to the wrong floor

I said the remaining 0.82–1.42 off-edge residual was "consistent with the binned tone table leaving about a level of error" and that a per-level correction was the test I had not run. Ran it, deriving the curve on one splash and applying it to the other, because fitting and scoring on the same pixels succeeds by construction:

developer_logos, off-edge RMSE
uncorrected 2.7512
single gamma 0.85 0.9040
per-level curve from publisher_logo 1.3795

🔴 The per-level curve is worse than a single exponent, cross-applied. And the control that settles it:

publisher_logo, off-edge RMSE
single gamma 0.85 1.4440
its own fitted curve 1.4209

A tone curve fitted on those very pixels improves them by 1.6 %. If the residual were a tone-mapping error, fitting the tone mapping on its own training data should collapse it. It does not, so the residual is not tonal — my hypothesis is refuted by the strongest test available to it.

⚠️ And the residual is smaller than I made it sound

I called 0.82–1.42 "15–25× the 0.06 rasterisation floor". That is the wrong comparison: 0.06 is render-to-render reproducibility, which is the floor for asking does my renderer repeat itself. For render-versus-capture the floor includes 8-bit quantisation on both sides — uniform rounding error has RMSE 1/√12 ≈ 0.289 per image, so a difference of two independently quantised images sits at ≈ 0.41 before anything is wrong at all.

Against that floor, 0.90 is ~2.2×, not 25×. It is roughly one level in 255.

📌 So the honest statement of the splash rows is stronger than what I had: off-edge, after a single gamma, the port differs from the game by about twice the irreducible quantisation floor, and the shape of what remains is not tonal. I quoted the same number twice this week against a floor chosen for a different question — the same error as comparing an in-box margin to a whole-frame spread, which I flagged in someone else's work two days ago.

⚠️ What is still unexplained is now a much smaller thing: ~0.5 RMSE above quantisation, off-edge, non-tonal, on screens with no free-running element. I have no candidate for it and I am not going to invent one.

Their linearity gate, applied to my side of the ratio — and an inversion

Their gate is right and I had not applied it: a slope is only a rate if its residual is random. It bears on the ratio they and I built together, so I checked the half I supply.

✅ The disc side has no residual at all. pteff03 is declared piecewise linear with identical segment rates:

segment movement rate
t 0…150 +600 px / 150 u +4.0000 px/unit
t 150…540 +1560 px / 390 u +4.0000 px/unit
t 540…600 0 hold

pteff03a gives −4.0667 then −4.0625 — a 0.1 % step, so very nearly but not exactly uniform. These are declarations, not fits: there is nothing to check a residual against on my side of the ratio.

🔴 The inversion worth their attention

Their gate failed on the strips of height 1134, which is pteff03 (scale 600) — the one whose declared track is perfectly linear. It passed on height 1303, pteff03a, whose declaration is the slightly non-uniform one.

So the curvature they measured is not in the source data, and it is in the strip where the source data is exactly straight. That localises it to the measurement or to how the game advances the record — not to the disc — which is a narrowing neither of us had.

An observation on the frame-rate result, offered as a question about the instrument

Their ratio implies a large difference in on-screen speed:

px/frame × fps px/wall-second
default 4.348 28 121.7
limit 15 2.032 15 30.5

~4× slower on screen at the lower limit. If their samples are guest frames, that says the animation itself runs four times slower, which no model of a fixed declared rate produces. If the samples are taken at a fixed wall-clock rate while the limiter slows guest time — their own boot slowdown of 3.58× says guest time did slow — then movement per sample falls with guest speed, which is the direction they measured and would revive the wall-clock model rather than kill it.

⚠️ I am not asserting that; it is a question about what a "frame" is in their capture, which is theirs to answer. But their boot-slowdown figure (3.58×) and their sweep ratio (2.14) are two measures of the same slowdown and they disagree, which is checkable without another emulator run.

The leaf thread, closed — one export value verified against the game, one self-check abandoned

✅ My sampling alternative is refuted, cleanly. Every capture reports done: … over 150 frames spanning frames 1..149, so their capture is indexed by guest VdSwap submissions, not wall-clock. The wall-clock revival I proposed does not survive, and I would rather have it closed than left as a plausible story.

✅ rotation_deg is confirmed from the running game. Their AABB check predicts, from the declared scale plus my exported angles: pteff03 400×1080 at +30° → 1135.3 against 1134 observed (0.12 %); pteff03a 400×1440 at −45° → 1301.1 against 1303 (0.15 %). Two angles, two scales, both under 0.2 %.

📌 That is the first time this session an export value of mine has been checked against the game rather than against the other decoder. Everything else has been disc→exporter→export verified against disc→their-reader, which shares the source. This one runs disc→exporter→export→oracle, and it holds.

The renderer self-check I started and am not finishing

Their geometry gave me a bounded way to check my renderer rather than my export: at leaf phase 0→30 only pteff03a should be on screen, so I predicted a changed band at x 949…1280, full height. Measured: 1177×70 at the top of the frame, max difference 5.29.

⚠️ The prediction is mine and it is wrong. The leaf pivot is [200, 90] — the centre of the 400×180 source — but under a 800 % vertical scale the mapping from pos to the drawn quad's extent is not the simple centre-offset I assumed. So this is my arithmetic, not a demonstrated renderer fault, and separating those properly costs more than the answer is worth.

🔴 Stopping here deliberately. The Decoder classified the leaf clock as undecodable with reach after four models tried and refuted, and said the thread has "cost us both a lot for a quantity nothing currently ships on." That is correct — the port's sweep speed is unverifiable, unfixable without their answer, and invisible in every artefact any gate depends on. Recording an inconclusive self-check as inconclusive is the end state, not a step toward another attempt.

⚠️ Still open and now parked: whether the port's leaf advance is wrong at all. Four models refuted means the input to my 1.87× table is known to be not frame-locked and not simple wall-clock, and nothing more.

Delivering the phase term where the numbers are, not where I found them

Their point closing the leaf thread — it lived in messages and docs/re/, which by our own rule means it wasn't delivered — applies to my side, and I had the same gap. The capture-phase term was written up in DECISIONS.md. But verify-capture is what prints the numbers it qualifies, and it said nothing: a reader saw title 14.16 / 0.21 % with no indication that ±5.56 of it is inherited from where the shutter fell.

✅ Now printed per row, in the tool's own metric:

main_menu   13.21  0.06%  rendered with authored initial focus; +/-3.78 capture-phase term
title       14.16  0.21%  settle t=198; +/-5.56 capture-phase term -- regression only
publisher_logo 2.17 0.01% no free-running element -- absolute, means what it says
developer_logos 3.05 0.01% no free-running element -- absolute, means what it says

Plus a header block recording that --leaf-time=0 is a convention, not the game's phase, and that these rows are usable for regression at a fixed pin and not as absolutes against anything measured differently.

⚠️ A gap in the delivery rule that their own update exposes

They landed the leaf facts in HANDOFF, which is right — it is the contract, and the standing instruction has me read it every iteration. It is not in my checkout. Their work is on auto/build-ordinal-audit; origin/main is 145 commits behind and still the stale era. So:

  • docs/port/HANDOFF.md as I read it contains none of it — no "the leaves are drawn and free-run", no "undecodable with reach".
  • The facts reach me only through messages, which is exactly the channel the rule says does not count as delivery.

📌 "Write it in the contract" is necessary and not sufficient when the contract lives on an unmerged branch. Nothing is wrong with what either of us did; the gap is structural and belongs to the merge, which is a human's. What I can do is name it, and keep the facts locally where my own work reads them — BLOCKED.md and DECISIONS.md carry the leaf-clock status and the phase term, sourced to their sha, so my tree does not depend on a HANDOFF I cannot see.

⚠️ This is the second structural consequence of main being stale, after the Cargo.toml pin being load-bearing. Both are recorded rather than worked around.

The boot verified as a sequence, not just at its endpoint

I have twice written that the boot's 0.00 % agreement is "one frame, the last one — the boot could take a wrong path and still land correctly." Closing that, and it needed no new capture and no new feature.

⚠️ --boot --shots= writes nothing. _shots is wired to the --script path only, so the boot can be photographed at its end and not stepwise. I was about to build that; the trace and verify-dwell already answer the question, so I did not.

The path

The boot logs its own transitions. Trace against authored/flow.json's declared sequence:

declared observed
1. publisher_logo start, settles t=30
2. developer_logos → at 4.26 s
3. video ADV → at 7.78 s (+ voice ADV)
4. title + overlay press_start → at 152.54 s, overlay raised same instant
boot ends 156.48 s

✅ Four declared steps, four observed, in order, with the overlay raised on the step that declares it.

The timings, and they are not authored

verify-dwell against the Decoder's three cold boots:

screen port oracle (3 boots)
publisher wordmark 4.28 s 4.297 / 4.604 / 4.370 agrees
developer logos 3.58 s 3.508 / 3.503 / 3.366 agrees

📌 authored/flow.json's dwell is empty by design — "NOT SET, because the dwell is DECLARED and the port already plays it" — so these intervals come from each screen's own keyframe group. Disc-derived timings agreeing with three cold boots of the real game, with no authored constant in between.

So the shipped artefact is verified on three axes

Path from the trace, timing from verify-dwell against the oracle, final frame at 0.00 % differing against live-title-press-a.png. That is a stronger statement than any of the three alone, and it is the P3/P7 gate met as a sequence rather than as an endpoint.

⚠️ Still not verified: the intermediate frames. The path says it visited developer_logos; it does not say the screen looked right while it was there — that rests on verify-capture's per-screen rows, which are taken by a different route. And the 144.76 s video is unexamined beyond playing.

📌 I found the empty-dwell rationale by reading the key, which documents that it "has now been wrong in two opposite directions". That is at least the fourth time this session the answer was already written down — but this time reading it cost one command, because I looked before concluding rather than after.

Refuting the "8.5 % systematic" in the splash dwells — it is the span, not the clock

They challenged my dwell agreement: declared spans 240 u and 195 u at Q1's 60 u/s give 4.000 s and 3.250 s, against six cold-boot measurements whose ratios all exceed 1 (mean 1.085), implying 54–56 units/s rather than 60. And pointedly: "240 units at exactly 60 should give you 4.000 and you're reporting 4.28."

🔴 The port does not play 240 units. Their 240 is the visible span — the logo element's 15→255. The port plays the whole group from t=0, and my export gives the full spans as 255 and 210 units, i.e. 4.250 s and 3.500 s. My observed 4.28 and 3.58 are those plus a frame or two of transition overhead, not an 8.5 % overshoot of anything.

Recomputed against the interval the port actually plays:

their ratios (vs 240/195) recomputed (vs 255/210)
publisher 1.074, 1.151, 1.093 1.011, 1.083, 1.028
developer 1.079, 1.078, 1.036 1.002, 1.001, 0.962
mean 1.085 1.0145
below unity 0 of 6 1 of 6

✅ The systematic largely dissolves. A mean deviation of 1.5 % with one measurement below unity is not a clock running at 54 u/s; it is six numbers scattered around a declared duration.

⚠️ And the practical consequence they drew does not follow. "A port playing 240 units at 60 u/s shows the publisher splash 0.42 s less than the game." The port plays 255 units, so the gap is 0.174 s — and on developer_logos the port is 0.041 s longer than the oracle mean, the opposite sign. There is no direction to correct in.

📌 Same family as the three we have already catalogued — a pivot anchor read as a drawn extent, a centre track read as a bounding box, a cycle length read as a motion duration. Here: a visible span read as a played span. Fourth instance, and the first where the misread number was mine to supply and I had not stated which span my port plays.

🟡 What survives, and I would not want it lost in the refutation. Against the full group the publisher screen still runs long in two of three boots (1.011, 1.083, 1.028) while the developer screen sits at 1.002, 1.001, 0.962. That is a much weaker signal than 8.5 % and it is not nothing. Three boots per screen is thin — their own caveat — and it does not support a change to keyframe_units_per_second, which stays where Q1 put it.

The fifth member of the family is mine: "drawn" is not "visible"

✅ Their revision confirmed from my export, exactly. palogo_sqex_eff ramps 0 → 255 over t=0…15 while palogo_sqex is still at alpha 0 until t=15 — so the screen is lit before the logo appears, its visible span is the full group, and their withdrawal of the systematic stands on my data as well as theirs.

🔴 And checking it exposed my own version of the same error. When I computed the "visible span" earlier I got 0..251 for this screen — and I got it by counting any element with alpha > 0, which includes palogo_eff0:
role full-screen primitive, no sprite
keyframes single, t=0
fade_argb 0xff000000 — opaque black

It is drawn from t=0 and shows nothing. My answer happened to be right because the _eff element really is lit early; had it not been, my method would have reported the screen visible from t=0 while it was a black frame. I published "visible 0..251" in the same message that corrected their span, without noticing my own definition was wrong.

📌 So the family has a fifth member and it is mine: "visible" read as "drawn", alongside pivot-anchor-as-extent, centre-track-as-bounding-box, cycle-length-as-motion-duration, and one-element's-span-as-the-screen's.

Accepting their correction on the framing

I wrote that this was "the first where the misread number was mine to supply". ⚠️ They are right that it is not. They supplied the 240, in a document arguing that numbers get misread; I supplied 4.28 s across two messages without ever saying what it spanned. The under-specification was mutual and simultaneous, and claiming the error more completely than I earned it is its own small distortion of the record.

✅ Nothing about the conclusion moves: the port plays the full group, 255 and 210 units; the recomputed ratios are 1.011/1.083/1.028 and 1.002/1.001/0.962, mean 1.0146; Q1 stands unqualified and keyframe_units_per_second does not move.

Auditing --black, and a rule that falls out of it

Their dividend — that screen render --black's premise is declared on the splash builds rather than assumed — is checkable across my whole export, and verify-screen passes --black to all sixteen screens on exactly that premise.

Audited by asking: does the screen declare a full-screen untextured primitive at t=0 with fade_argb 0xff000000?
declared — 12 screens pteff00 (both titles, both menus, both extras), palogo_eff0 (all four splashes), pgloading_eff00 (build_12, build_15)
not declared — 4 screens press_start, press_start_jp, build_00, build_01

🔴 All four exceptions are composited, not standalone. press_start is one element — the plate — and its own name_why records that it is "composited over the title"; the game never shows it on black. build_00/build_01 carry the pgloading_* set without the pgloading_eff00 backdrop that build_12/15 declare.

✅ Harmless where it is used, and worth stating why rather than assuming: verify-screen gives --black to both renderers, so the assumption cancels in a consistency check. It would not cancel in an oracle comparison — and verify-capture already avoids it, scoring the plate as --screen=title --overlay=press_start, over the title. The exposure was real and the tooling had already routed around it, which I could only establish by looking.

📌 The rule that falls out is the useful part: a declared opaque-black backdrop distinguishes a standalone screen from a composited one, and it is derivable from the file rather than from a name. The corpus wanted exactly this shape of predicate for splash recognition and was told none existed for that question; this is a different question with an answer. 12 standalone, 4 composited, no name-matching involved.

⚠️ It is a sufficient condition as observed, not a proven necessary one — four exceptions is a thin basis, and a standalone screen that simply omits its backdrop would be misclassified. Recorded as a rule with its evidence, not as a decoded fact.

🔴 CORRECTION: my backdrop predicate is exact in GP_TITLE and its reading was wrong

I offered "a declared opaque-black backdrop distinguishes a standalone screen from a composited one" and asked for it to be tested against archives I do not have. It was, and the result splits cleanly in two.

✅ The split reproduces exactly. Derived independently from the disc, GP_TITLE gives 12 with, 4 without, and the four are entries 0, 1, 2, 3 — my build_00, build_01, press_start, press_start_jp. Element names match too. Two paths, one answer, and this time genuinely different paths: my export against their disc reader.

🔴 The reading does not survive. Disc-wide the predicate is rare — 76 of 965 builds, 7.9 % — and GP_HANGAR_ARSENAL is 0 of 390, GP_OPTIONS 0/14, GP_PAUSE_MENU 0/6, GP_READY_ROOM 0/60, GP_GAMEOVER 0/10. A pause menu and an options screen are things a player plainly sees as screens. Read as "composited", my rule makes 92 % of the game composited, which the archives do not support.

🟡 What survives is narrower and still worth having: it separates screens that begin from black from everything else. Their sharpening is the part I would not have reached — the negative class is heterogeneous. A pause menu over gameplay, a hangar over a 3D scene and a plate over a title all lack a backdrop without being the same kind of thing, and a two-way rule cannot express that.

What I got right, and what that is worth

📌 My caveat was "sufficient as observed, not proven necessary — four exceptions is a thin basis, and I'd want it tested against an archive I don't have." That was the correct hedge and it named the exact test that refuted the reading. ⚠️ But I still put the refuted interpretation into a tool header — verify-screen carried "standalone versus composited" as a stated fact while the hedge lived in DECISIONS.md. Corrected there now, with the 7.9 % figure and an explicit "do not carry this into the four unexported archives".

Hedging in the write-up does not protect the claim I ship in the tool. That is the same delivery gap as the capture-phase term, and I repeated it four iterations after fixing it once.

✅ Within GP_TITLE the rule is exact, and --black for those twelve screens is now justified from the file rather than assumed — which was the original point and is unaffected.

Sweeping my own --help and headers, after theirs

Their audit found one defect in sixteen commands in about ten minutes, and their framing of why doing one and stopping is the wrong move — "a rule written down is not a rule applied" — applies to me: I had fixed verify-screen and verify-capture and gone no further. Swept the rest.

Hit 1 — verify-dwell compared the port against the game's gap

The tool built its target as oracle span + the game's black gap (0.114–0.190 s) and scored the port against it. That was right while the port inserted that gap. 🔴 It does not: black_hold_units went to 0 three iterations ago.

So the port should run short by the gap, and on publisher_logo it does — 0.131 s below the unslacked target, absorbed into an "agrees" by the 0.15 s wall-clock slack, which is larger than the omission it was hiding. A verdict that passes because the slack exceeds a known defect is not a verdict. The hold is now read from authored/timing.json so it cannot drift, and the game's gap is printed as its own term with the slack comparison stated.

Hit 2 — a rate that is right, with its population missing

verify-dwell carried "4 presented frames at 2.284 units/frame = 9.1 units". ✅ The number is correct. ⚠️ It is the disc used as its own clock on one capture, which ran at 13.1 fps against ~28 elsewhere. Stated bare in a tool, it reads as a general rate — and it would then contradict HANDOFF Q1's 2 units per rendered frame, which is a different quantity at normal speed. The derivation was in DECISIONS.md; the tool inherited the number without it.

📌 Exactly their defect: the doc states its population precisely, the tool inherits the value alone. Their fix generalises without modification — print the population beside the number — and I did not have to invent anything either.

What the sweep did not find

The percentages in check-capture all name what they are percentages of (frames in a named capture, with the control rows beside them). check-claims, check-modding, index-decisions and strip-padding assert no measured quantities. So: two hits across the tool set, both in one tool, both of the two types now catalogued.

⚠️ And their warning is one I cannot fully clear: any figure computed before the record-layout fix may have a population that moved, not just a value. My export is post-fix (verified: [0,12,70,80], rest t=12) and my censuses were run on it, so my own counts are sound. Figures of theirs that I have quoted are not something I can audit from here.

black_hold_units: my own tripwire has tripped, and I am not resolving it alone

I set the value to 0 with an explicit condition: "if the gap is non-zero in most transitions and no rule emerges, systematically omitting a real quantity is no longer the cautious choice — it is a different invention. Revisit at the next measurement that is not 0, or the moment a rule appears."

Both halves of the first clause now hold. Five measurements:

transition gap
menu → title 0
title → menu 4
EXTRAS → menu 6
their fourth 6
publisher → developer (from my own verify-dwell shortfall) ~7.9

Four of five non-zero, mean 6.0 units. The fifth is mine and arrived by a different route — the port running 0.131 s short of the oracle's span on a real boot transition, which verify-dwell's slack had been absorbing.

The rule attempt, which failed

If a rule existed, changing the value would be principled rather than fitted. The candidate: does the incoming screen's opening black-clear absorb part of a fixed black period?

transition gap incoming clear sum
main_menu → title 0 16 16
title → main_menu 4 12 16
extras → main_menu 6 12 18
publisher → developer 7.9 0 (never clears) 7.9

🟡 Suggestive on the three menu/title transitions — 16, 16, 18, consistent with a constant given ±1 frame of measurement. 🔴 It fails on the splash pair, whose backdrop is a single keyframe at alpha 255 and never clears at all. Three points fitting a constant with one outlier is not a rule; it is a fit with an exception, which is the error this corpus has spent the week cataloguing. Not adopted.

Why I am escalating rather than choosing

⚠️ My justification for 0 has failed on its own terms. "It adds no black the game does not have" was true when 1 of 3 measurements was zero. With 4 of 5 non-zero, 0 omits a real quantity on most transitions — which my own tripwire called a different invention.

⚠️ And the alternative is a fit. A uniform 4 or 6 halves the total error (8 against 16) and is chosen for its residual on five samples with no mechanism.

Both options now invent something, and the mission's rule is that I do not adopt on my own authority — so this goes to BLOCKED.md with the numbers rather than being settled by whichever error I find more comfortable. ✅ The value stays at 0 pending that, and verify-dwell now reports the resulting shortfall explicitly instead of hiding it in slack, so the cost of leaving it is visible in the tool rather than only here.

Their sharpened tell, applied to my tree: two descriptions the code below had already refuted

Their sweep cleared all three of my quoted figures — the splash dwell spans were corrected today, and the 0.114–0.190 s gap and the three cold-boot intervals are capture-derived, which the record-layout fix cannot reach.

📌 Their sharpening is what made a sweep of my side possible: the tell is not that a number changed, it is that a page hedges a quantity it should not need to — a hedge around something the corrected reader states exactly. In my tree the marker is the word untimed, because there are 0 untimed keyframes in 866. Two hits, and both are worse than a hedge: they are descriptions their own code had already refuted.

Hit A — a doc comment contradicting its own function

spin_period_units' documentation stated the rule as "the first timed and the second untimed. The period is the first keyframe's declared t." That is the pre-fix rule. The body directly beneath it carries a 🔴 block explaining that this rule "SILENTLY STOPPED THE RING" — because under the corrected layout every pose is timed, so the test always fails and the period returns 0 — and implements the span-based replacement.

A function and its documentation disagreeing, with the documentation stating the refuted version. Anyone reading the comment to understand the rule would learn the one that was removed for being wrong.

Hit B — I made the correction and left the claim on top

exit_ramp_units' documentation opened: "Authored (authored/timing.json): the disc has no time slot on that keyframe, so this is the one unknown duration per screen." Both halves are false — the authored entry was deleted as progress, and the corrected layout times every pose.

⚠️ And I wrote the correction myself, immediately below it. Two iterations ago I replaced the default with a sentinel and added a block explaining why; I never looked up at the two sentences above. The corrected text and the refuted text have been sitting adjacent ever since.

The pattern, which is narrower than "docs go stale"

Both hits are fixed code under an unfixed description, and in both the fix and the falsehood are in the same file within twenty lines of each other. That is not drift — it is editing at the point of failure and not re-reading the frame around it. ✅ Their practice of quoting the original sentence in the correction is adopted here, so the change is visible rather than silently overwritten.

📌 And their reading of my verify-dwell hit is sharper than mine was: a verdict passing because 0.15 s of slack exceeded the 0.131 s defect it hid is not a weak check but an inverted one — the tolerance was doing the work the measurement was supposed to.

The grep found two more — and the reason is my correction habit, not my attention

Their generalisation of my untimed marker is the cheap version and it works: search for the vocabulary the dead rule needed. A description that survived a fix still speaks the dead rule's language, which makes it findable without reading anything. Swept my tree for the nouns of every rule refuted this session — shifted, no time slot, first-declared, two decoder eras, standalone/composited.

Most hits were already-quoted corrections (check.rs, check-all) or the live guard message in verify-screen. Two were real:
verify-screen:57 still asserted "all four are COMPOSITED rather than standalone" — the reading I withdrew a few iterations ago after they tested it disc-wide at 7.9 %
boot.gd:197 opened "the one unknown duration per screen … the disc has no time slot there", then retracted it in the next sentence

🔴 The diagnosis is a habit, not a lapse

This is the third and fourth instance, after spin_period_units and exit_ramp_units. In every one of the four, the correction sits below the false claim in the same comment block, and I wrote both.

My corrections are additive. I append a 🔴 CORRECTION block and leave the original sentence standing above it, which is right for a record — the change should be visible, and their practice of quoting the original is exactly that — but it is wrong for a statement. A reader takes the first assertion; the retraction three lines later has already lost. That is why "having been bitten four times" produced four instances rather than fewer: the habit that creates them is the same habit I adopted to make corrections honest.

✅ The fix is to keep quoting the original but demote it grammatically — lead with "what this used to say", so the false sentence can never be read as the live one. Both hits rewritten that way.

✅ Verified as a comment-only edit by artifact rather than by reading, which is their practice: the main_menu render is byte-identical before and after, and verify-screen parses.

📌 So the toolkit now has two mechanical searches: their hedge around a quantity the current reader states exactly for prose, and the vocabulary the old rule needed for code. Neither requires understanding what you are looking at, which is the point — five instances of this class survived people who understood the material perfectly well.

On their caution about my failed rule

⚠️ They flag that gap + incoming clear = 16/16/18 failing on the splash pair "may be the honest signal rather than an exception to carve out" — three transitions supporting a constant and one structurally different case breaking it is the shape of a rule fitted to its own sample. ✅ Agreed, and worth stating plainly: I did not carve out the exception. The rule was rejected, not narrowed to menu transitions, and black_hold_units remains escalated rather than set from it.

Auditing headings — and my own index was amplifying the withdrawn ones

Their third mechanical search — audit headings first, because they assert with maximum reach and minimum context and a reader scanning them never reaches the retraction — lands harder on my tree than theirs, for a reason neither of us anticipated: tools/port/index-decisions builds a table of contents from the headings. A withdrawn claim was not merely sitting above its correction; it was being republished at the top of the file as a live finding.

Three hits:

heading status
"The JP title capture adjudicates title_jp — and it goes against the port" [refuted] asserted the opposite of the finding. I scored --pose=rest, which the port does not ship; posed as it runs the port beats the reference +0.9994 to +0.8727
"The leaf phase was an arbitrary choice; the capture turns out to determine it" [refuted] refuted 97 lines below by the replication on title
"Nested leaves may advance at half rate — a quantified defect in shipped output" not a defect — the rate it is quantified against is known wrong

✅ All three now lead with the correction, with the original quoted and demoted beneath — my own fix from last iteration, applied to the class where it matters most.

⚠️ Scope, stated because the number is unflattering

I audited the ~30 headings from this session, plus one older one I happened to remember. There are 211. So roughly 180 are unaudited — and older headings are likelier to be stale, not less, because they have had more chances to be overturned. This is a sample, not a sweep, and calling it an audit without the denominator would be the exact failure this whole thread is about.

📌 The generalisation their refinement earns: an index is an amplifier. Any mechanism that republishes headings — a table of contents, a summary, a --help listing — multiplies the reach of whatever the heading asserts, including the things it asserts wrongly. My index was built to make decisions findable and it was making three withdrawn claims findable first.

⚠️ Their point about why the additive habit fails is the one I would keep over my own framing: "record" and "statement" want opposite orders, and a single block cannot be both without deciding which one leads. That is more precise than calling the habit wrong — it isn't wrong, it is under-specified about ordering.

Ranking instructions above descriptions — swept, and the worst class is clean

Their sharpening: a stale instruction manufactures a false confirmation, which is strictly worse than a stale description that merely misleads. Their example is a doc naming an environment variable removed with the record-layout fix — a reader sets something inert, gets default behaviour, and concludes the two readings agree. So: rank instructions above descriptions when sweeping.

Applied to my tree, the instruction surface is the documented invocations in the tool and script headers. Fifteen distinct flags appear across them.

✅ All fifteen are parsed — no silently ignored flag, so nothing in my headers can produce their failure mode by being inert.

⚠️ But "parsed" is a proxy and I know its gap: --shots parses and does nothing on the --boot path, which I found two iterations ago. Parsing is not working. So I ran two documented examples end to end rather than trusting the grep — --screen=main_menu --pose=rest --capture and --screen=title --overlay=press_start --time=4 — and both produce a 1280×720 frame. (--boot --shots is not a documented combination, which is why the gap has not bitten a reader.)

Two hits, both of the loud kind
11 references to tools/verify-capture / tools/verify-screen those paths do not exist; the tools are under tools/port/. Fixed in 4 files.
check-all: "There are eleven tools under tools/port/" there are fourteen. Now states both, so the sentence dates itself.

📌 The distinction worth recording: mine fail loudly, theirs failed silently. A wrong path errors out and announces itself; an inert environment variable returns a clean, wrong result. Both are stale instructions and only one manufactures evidence. That is the ranking their sharpening earns, and it means my two hits — while real — are the cheap kind.

⚠️ And the honest limit on this sweep: I tested the flag surface, plus two examples end to end. I did not run all thirteen documented invocations. The --boot ones take 156 s each and I judged the flag-parse check plus two spot runs sufficient; that is a judgement about cost, not a claim of coverage.

Live-but-undocumented flags — and I wrote a dead instruction while fixing dead instructions

Their newest class is one step past a stale instruction: the instruction is dead and the working one is undocumented. That inverts the sweep I ran last iteration — I checked documented → parsed; the reverse is parsed → documented, and like their env vars it enumerates, so it completes rather than samples.

Eighteen flags parsed, fifteen documented, three live and undocumented:

flag
--film-interval used by verify-dwell, in no usage example
--skip-at same
--no-hold plays a screen past its rest instead of clamping each element at its hold — documented in DECISIONS.md and absent from the header a reader consults

📌 --no-hold is the one that matters: a capability that exists only in an 11 000-line record is, to anyone reading the interface, a capability that does not exist.

🔴 And then I documented it wrong, in the same command

I wrote the example as --screen=title --no-hold --time=6 and tested it. The two renders are byte-identical — the flag no-ops. --time sets frozen, and pose_at tests holding and not frozen, so an explicit instant makes --no-hold inert. Without --time the same pair differs by max 253.

I wrote a dead instruction inside the commit that fixes dead instructions, and the only reason it did not ship is that I ran the example instead of trusting that a parsed flag works — the exact gap I had named one iteration earlier and then walked into. The corrected line now carries the interaction and the measurement that establishes it.

⚠️ This is the strongest evidence yet for their ranking. A description I get wrong costs a reader's belief; an instruction I get wrong hands them a null result that looks like a finding — here, "--no-hold changes nothing", which is false and would have been reproducible.

Their XPR_* lead traced and closed — and their class found in my own lane

They flagged five XPR_* texture-decode toggles as relevant "since you consume textures", and my off-edge splash residual — non-tonal, ~0.5 RMSE above quantisation, no candidate — has exactly the shape a subtle decode difference would produce. So it was worth tracing rather than filing.

🔴 Closed: they cannot reach my sprites. The toggles live in texture.rs::decode_surface, documented as "shared by from_xpr2 and cube_faces_from_xpr2". My exporter calls neither — sprites come from t8ad::parse, a different module. And t8ad.rs reads no environment variables at all in its 202 lines, so the sprite path has no hidden degrees of freedom either. The candidate is eliminated and no replacement takes its place; the residual keeps its status as named-without-explanation.

And a live undocumented remedy in my own lane, which I had called clean

Enumerating what my exporter can reach turned up SYLPHEED_KF_TIME_SHIFT — the variable they reported as "removed with the record-layout fix, appears nowhere in crates/". ⚠️ True on their branch, false on mine: my ui_layout.rs is the stale era, and the knob is live at line 497. Not a contradiction — a branch difference, and my Cargo.toml:66 already records it.

✅ The pinned tag has 0 occurrences of it (and 2 of SYLPHEED_KF_TIME_LEGACY), so it cannot perturb export/. But verify-screen builds its reference from the workspace, which can be perturbed.

Tested both directions rather than reasoned:

reference reports era guard
SYLPHEED_KF_TIME_SHIFT=1 rest t=12 — the corrected reading passes, eras agree
unset rest t=70 — stale refuses

📌 So the knob is not a debug curiosity: it is the working remedy that makes a workspace-built reference usable, and it appeared in no tool, no help text and no instruction anywhere in my tree. My guard said a mismatch exists and never said here is how to clear it — their exact class, in the lane I had just told them was clean. The refusal message now carries the remedy and the measurement that establishes it.

✅ Incidental: the era guard covers an env-var route it was not designed for, verified in both directions.

Branches that announce themselves — their lesson, applied where it already bit me

Their salvaged iteration produced the rule I most needed: have each branch announce itself in the log, so a run that took the wrong path says so before its numbers are read. Their patch silently failed a branch condition and produced a well-formed capture of the wrong transition; what caught it was the log lacking lines the intended branch prints, not anything wrong with the data.

"Assertions catch the edit; log lines catch the execution."

I have been bitten by this twice, both times in ways an announcing branch would have caught immediately:

  • --no-hold under --time — I wrote it as a documented example, and the renders were byte-identical because --time sets frozen and pose_at tests holding and not frozen. A request silently overridden reads exactly like one that worked.
  • the leaf clock — I enumerated three free-running clocks, wired two, and a run that pinned two of three looked identical to one that pinned all three.

✅ Both now announce:

--no-hold: INERT -- --time sets `frozen`, which overrides holding
t = 360.00 units (6.000 s), pose = timeline [frozen, loop-phase=free, leaf=free]

--no-hold: playing past the rest, not clamping at each hold
t = 9.15 units (0.153 s), pose = timeline [running, loop-phase=0.0, leaf=free]

📌 The second line is the more useful of the two: every run now states the effective configuration of all three clocks, not the requested one. The failure it prevents is precisely the one I shipped — pinning a subset and reading the result as pinned.

✅ Verified the harnesses are unaffected: nothing under tools/port/ parses that line, and verify-screen and verify-capture return their usual rows.

Their scope correction, accepted

⚠️ "'Appears nowhere in crates/' is a claim about a tree, and I stated it without one." Exactly right, and it generalises the noun lesson: a claim about code needs its ref attached, the same way a number needs what it is a number of. With main 145 commits behind and both of us on topic branches, "the code contains X" is underspecified by default here — which is how both of us were correct about SYLPHEED_KF_TIME_SHIFT simultaneously.

Every documented invocation verified — and one runs forever without saying so

I flagged the --boot family as unverified three iterations running, each time deferring on cost (156 s per run). Done, and the deferral hid something.

invocation result
--boot ✅ terminates at 156 s on title + plate
--boot --skip-at=1 ✅ title at 7.80 s against 152.54 s — the skip is real and quantified
--boot --film=… --film-interval=0.5 ✅ 375 frames written
--boot --play ✅ hands over — "menu on title" at 7.77 s, then stays live by design

🔴 --boot --film= never terminates, and the doc did not say

The boot-quit branch is gated on _film == "" (line ~499), and a second quit path on the same condition. A filming run keeps capturing past the title forever. Measured: title at 7.8 s, still filming at 300 s, 375 frames.

⚠️ verify-dwell wraps it in timeout, so the behaviour was known to whoever wrote that tool — me. But the documented example is bare, and a reader following it gets a process that looks hung.

📌 That is the failure boot.gd's own header warns about, committed in its own usage block: "it does not fail, it waits, and a job that waits forever reads as a job still working." The warning and the violation are in the same file, twelve lines apart. Fixed — the example now states it runs until killed, with the measurement.

The deferral was the mechanism. Three times I judged the cost too high and recorded the judgement honestly, which felt like the careful call each time. What it actually did was keep a non-terminating documented instruction alive for three iterations. "Too expensive to verify" and "unverified" are the same state, and only one of them sounds like a decision.

Their correction, which strengthens my position rather than weakening it

They withdrew "the outgoing screen determines the gap" in favour of an ordering: the menu has two values, 0 leaving for the title and 1 for EXTRAS. And a third — menu → a pak outside GP_TITLE — also gives 1, so leaving the archive costs no extra black, a confound they named in advance and measured absent.

✅ For black_hold_units this makes "not modelled" more robust, not less: even a per-outgoing-screen key would not be single-valued, since the menu alone spans {0, 1}. The data forbade a constant; it now also forbids the obvious keyed replacement.

🔴 WITHDRAWN — and the refutation was in my own tree. (This paragraph read: "they note EXTRAS is stuck at n=1 with no second destination in this archive — a structural limit, not an unrun experiment. Worth recording as such: that row cannot be strengthened by anyone.") [refuted]

export/ lists three buttons for extras — ptbtn11, ptbtn12, ptbtn13 — and authored/flow.json, which I wrote, records ptbtn11 → GP_MISSION_SELECT: a destination outside GP_TITLE, which is precisely the exit they have now measured at gap 3. See the correction below.

🔴 I promoted an unverified claim of theirs to a fact, against data I had authored

They withdrew "EXTRAS's sole exit is Ⓑ to the menu, so n=1 is structural" after one screen info showed build 6 declares three buttons. ⚠️ I had recorded that claim in this file as a limit "that row cannot be strengthened by anyone" — and the refutation was sitting in two files of mine:
export/screens/title/extras.json buttons: ["ptbtn11", "ptbtn12", "ptbtn13"]
authored/flow.json — written by me ptbtn11 → "The stage list is GP_MISSION_SELECT, not in this export"

ptbtn11 leaves GP_TITLE. That is exactly the second destination they said did not exist, and exactly the one they have now measured. I did not need their emulator or a new run — I needed to read a file I authored.

📌 This is a failure mode distinct from the rest of the session's. Not "my claim outran its evidence" but "I promoted someone else's unverified claim to an established fact in my own record, while holding the data that refuted it." A message carries no evidence; the protocol says so explicitly, and I copied a sentence out of one into DECISIONS.md as a finding.

✅ Their METHOD entry — "structural" and "impossible" are the two words most worth distrusting in your own notes, because they retire a question rather than answering it — is right, and I would add the corollary this instance shows: they are worth distrusting hardest when someone else writes them, because then they arrive without the doubt the author would have had.

What the second measurement does to the result

outgoing gaps n
menu 0, 1, 1 3
EXTRAS 2, 3 2
title 3, 3, 3 3

🔴 The ordering is weaker than what I recorded last iteration. EXTRAS {2,3} and title {3,3,3} overlap at 3, so "menu < EXTRAS < title" no longer separates them. What survives: the outgoing screen constrains the gap to a ~2-wide band, bands not disjoint.

✅ One thing got stronger — a pairwise control holding the destination class constant: menu → another archive gives 1, EXTRAS → another archive gives 3. Same kind of destination, different gap, so the destination is not the variable.

✅ black_hold_units stays 0 = not modelled, and is now better supported: a uniform value was already excluded, and the obvious keyed replacement is excluded too, since neither the menu {0,1} nor EXTRAS {2,3} is single-valued.

The half-guard they named, tested — and it found a real gap on first use

They flagged that my pose line "reports [frozen, loop-phase, leaf] from the variables in force, never checked against a pin that's set but doesn't reach the view" — the case --no-hold-under---time turned out to be. I had recorded the same doubt and not acted on it.

The case exists and I could name it exactly: the overlay is a second ScreenView with its own pins, and the announcement read view.* only. The plate carries a looping focus record — the very clock in question — and draws from overlay.*.

✅ Extended the line to report the overlay's pins. 🔴 Its first use found a real gap:

[frozen, loop-phase=0.0, leaf=0.0, overlay(loop-phase=0.0, leaf=free)]

overlay.loop_phase_units was wired; overlay.leaf_time_units was not. A run requesting both pins had one reach the overlay and one not — and the pre-fix announcement would have printed leaf=0.0 from the main view while the overlay drew free-running. That is their half-guard precisely: an announcement reporting a value it cannot resolve for the case in question.

⚠️ Currently inert, and worth saying so rather than claiming a save. press_start carries no leaf (draw_leaf_for is ptloop01/ptloop02), so the render is byte-identical before and after. The gap was real, live for any overlay that carries a leaf, and cost nothing today.

📌 This is the fourth instance of their one remedy — put the qualifier in the text rather than in the reader's memory: state what the number is a number of → write the index space into the token (e10) → write the source into the claim → state each view's effective pins rather than inferring them from the request. Each has now caught something the corresponding discipline did not, and this one caught it within a minute of existing.

✅ And their asymmetry is the argument for the exchange itself: "I'd never have caught your --no-hold no-op, and you'd never have caught my 'sole exit'." Neither of us is the right auditor of our own retiring words. I had written the doubt about this guard into my own file and left it there; it took someone else repeating it back for me to run the test.

The ordered pair determines the gap — and nothing declared predicts it

Their latest run gives five replicates with no variation — title→menu 3,3,3 and EXTRAS→menu 2,2 — while every differing value comes from a different ordered pair. The same origin gives different values to different destinations (menu 0 vs 1, EXTRAS 2 vs 3). The origin constrains; the ordered pair determines, reproducibly.

🔴 That excludes a second model for black_hold_units. A constant was already out; keying on the outgoing screen is now out too. Only an ordered-pair key survives, needing a measured value per pair — six known, two replicated.

My independent check: no declared quantity predicts it

They said nothing declared predicts the values. Checked from my export rather than taken:

pair gap out.close in.clear out.span in.span
title → menu 3 15 12 269 80
EXTRAS → menu 2 10 12 74 80
menu → title 0 10 16 80 269
menu → EXTRAS 1 10 12 80 74

✅ Each column has two rows sharing a value with different gaps — out.close 10 gives 2, 0 and 1; in.clear 12 gives 3, 2 and 1; out.span 80 gives 0 and 1; in.span 80 gives 3 and 2. No single declared quantity determines the gap, independently from my side.

⚠️ And I did not search combinations of them, deliberately. Four intra-archive pairs against many candidate two-screen functions fits by construction — the error this corpus has catalogued five times, most recently my own 16/16/18. A formula found here would be indistinguishable from one found in noise, and I would have no way to tell the difference with the data that exists.

📌 So the position is now: black_hold_units = 0, meaning not modelled, with two candidate models positively excluded rather than one, and the surviving shape harder than when I escalated the decision. Their advice stands and I agree: don't key it.

The overlay leaf-pin fix, verified live with a negative control

I recorded that fix as "currently inert — press_start carries no leaf, so nothing verifies it in a live case." That was honest and it left the fix unverified, which is a state I have learned this session not to leave alone.

title carries the leaves, so raising it as an overlay exercises the path:

overlay pins reported renders at leaf-time 0 vs 4
pre-fix (line reverted) — identical — the pin does not reach
post-fix overlay(leaf=0.0) → overlay(leaf=240.0) differ, max 105.86

✅ A proper before/after: the negative control shows the failure the fix removes, rather than only showing the fixed state working. Pre-fix the overlay's leaf read the frozen time_units in both runs, so the two were identical — which is exactly why the gap was invisible until the announcement exposed it.

⚠️ The configuration is synthetic. --overlay=title over main_menu is something the game never does. What it tests is the wiring — whether a requested pin reaches a second ScreenView — which is screen-independent, so the result transfers even though the picture does not.

A process failure worth keeping

I reverted the fix with a text patch to run the control, and the restore script half-failed: it removed the line and then threw on the way to putting it back. The tree was left without the fix.

🔴 What caught it was two independent checks disagreeing. grep -c reported the fix absent while the render comparison reported the output matching the fixed run. Both cannot be true. Had I printed only the render check — the one I actually cared about — I would have concluded the restore worked and carried on with a silently reverted file.

✅ Restored with git checkout rather than re-patching, and confirmed clean: tree clean, fix present, and the verification re-run gives the same 105.86.

📌 Reverting a committed change by editing text is choosing the fragile path when the robust one is one command away. Same shape as reading a proxy when the thing is one command away — and the same remedy: use the mechanism that cannot be half-right.

Their incoming-primitive observation, checked — and a sharpening they can use

They offered, with its counter-example attached rather than fitted, that the incoming screen's full-screen primitive is [255] where the gap is 0 and [127] where it is 1 — a screen beginning from opaque black needing no blank frame. And that it fails on menu → EXTRAS, which declares a black backdrop and still gives 1.

⚠️ My first check got it wrong and would have dissolved their counter-example. I took the first full-screen primitive in element order and reported extras arriving at alpha 64, which would have made it not a [255] incoming at all. extras has two such primitives; I read one and called it the screen's.

✅ Corrected — and all three GP_TITLE screens are identical in this respect:

screen primitives at t=0
title pteff00=255 (paints 24th, last), pteff02=64 (paints 5th)
main_menu pteff00=255 (paints 16th, last), pteff02=64
extras pteff00=255 (paints 18th, last), pteff02=64

Every one opens with an opaque black quad painted on top, clearing over 12–16 units. So extras does arrive at 255 and their counter-example stands.

📌 The sharpening: within GP_TITLE this quantity is constant, so it cannot explain any variation among the four intra-archive pairs. It could only ever separate GP_TITLE screens from the outside ones (255 against 127) — which is a much narrower claim than "begins from black ⇒ no blank frame", and it is already contradicted by menu → EXTRAS = 1 against menu → other-2 = 0, both arriving at an opaque incoming.

✅ And their new pair kills the origin story outright from my side too: the menu now gives {0, 1, 1, 0} across four destinations — both extremes from one origin — while the two repeated pairs stay internally identical. black_hold_units unaffected: constant excluded, origin-keyed excluded, pair-keyed surviving with seven pairs known and two replicated.

⚠️ I am not pursuing the incoming-primitive idea either, and for their reason rather than a new one: nine transitions against many candidate two-screen functions is the construction we have both now declined once each. The difference between declining and not-having-looked is only visible if someone says so, which is why they said so and why I am repeating it.

PORT-MISSION.md had two stale blockers — the file I am told to read every iteration

Their finding was that MISSION.md carried three stale headings while they had audited headings, instructions, env vars and fallbacks everywhere else. Their diagnosis is the transferable part: a document read only for instructions is never read for review, and the more central it is the more often it is consulted and the less often checked.

The brief names five documents to read every iteration. I have audited BLOCKED.md (struck five rows) and never PORT-MISSION.md or MODDING.md.

🔴 Two stale blockers, in the table I am instructed to consult to find the lowest unfinished milestone:

said actually
P2 "Blocked on HANDOFF Q1 (the time unit). Do not invent it" Q1 is ✅ answered — ramp linear, 2 units/frame, 1 unit = 1/60 s settled. P2 shipped long ago
P6 "Looping is blocked on HANDOFF Q10" Q10 is ✅ answered — two stems played together. The P6 gate is recorded as verified

A reader following the instruction would look at P2, read "do not invent it", and treat an answered question as open. That is worse than a stale heading in a record: it is a stale instruction in a document whose purpose is instruction — the class we ranked highest.

Scope, because this file is not mine

⚠️ PROTOCOL.md: "The mission files are the only authority, and only the human changes a mission." So I corrected the factual status clause and nothing else — every gate, every requirement and every ask is untouched, and the original text is struck through rather than deleted so the change is visible and trivially reversible. If a human reads this as a mission change rather than maintenance, revert the two table cells; nothing else moved.

📌 Their own line for it is the right one: keeping it true is maintenance; changing what it asks would be overstepping.

⚠️ MODDING.md is still unaudited. I am naming that rather than quietly finishing one of two.

MODDING.md — audited, clean, and mechanically so

Finished the second half rather than leaving it named. MODDING.md carries no status markers at all — no 🔴, no "not yet", no "planned" — so there is nothing of the stale-blocker shape in it. But their finding was about claims, not markers, so the real question is whether its assertions still hold.

✅ It states five rules, and tools/port/check-modding asserts all five by name — one section per rule — and passes in check-all. So those claims are not merely unstaled, they are mechanically verified on every suite run, which is a stronger result than reading them and finding nothing wrong.

📌 So of the five documents the brief names, three are mine to audit: BLOCKED.md (five rows struck, earlier), PORT-MISSION.md (two stale blockers, corrected above), MODDING.md (clean, checker-backed). PROTOCOL.md and HANDOFF.md are not mine to correct — and HANDOFF.md as I read it is the stale main copy, which is its own recorded problem.

Their "ranked list always has a winner" — checked against my own matching

They tried to identify the ninth pair's destination and rejected their own result: best fits 43.30 (margin 5.88) and 45.74 (margin 2.28) against a calibration putting a true match at ~18–20 with margin ~10. The general form is worth keeping: a ranked list always has a winner, and nothing in the ranking says whether the winner is good enough — any nearest-match report needs a known-good score beside it or it will name something every time it is asked.

✅ Checked my own instance. When I identified their submenu capture as GP_TUTORIAL by edge correlation, I ran the control first: my own title capture over seven builds with a known answer, picking build 4 at +0.2792, 1.4× over second. The submenu then scored +0.4962 with a 1.58× margin — above the calibrated true-match score, not merely top of a list. That identification carries its known-good; I have no other nearest-match report in the tree.

Their REFUTED.md gap, in my tree — where I already had the mechanism and fed it nothing

Their finding: eight claims died this session and none reached REFUTED.md, the file their brief says to grep before proposing anything. Their split is the transferable part — the pages are where a refutation is argued; the index is where it is found — and only the second saves anyone.

🔴 Mine is the same gap and worse in one respect. I have tools/port/check-claims: a register that fails the run if a refuted claim is quoted without its [refuted] token, and it is in check-all. So an entry there does not merely publish a death — it enforces it. It held 7 rows, all from earlier work, and I added none while withdrawing ~8 claims this session. Their index would have been consulted; mine would have been enforced, and I fed it nothing.

What happened when I fed it

Registered four of this session's withdrawals. The checker immediately flagged three still asserted unmarked — and every one was inside a correction:

where
"and it goes against the port" [refuted] my own headings-audit table, in the row explaining it asserted the opposite of the finding
"the capture turns out to determine it" the next row of the same table
"a structural limit, not an unrun experiment" inside the withdrawal block that retracts it

📌 That is the token doing what phrasing cannot. All three read as corrections to a human — they are corrections, written by me, saying so explicitly — and the marker fired anyway, because it tests for a token an author must place rather than for language that sounds retracted. The header's claim that "its absence means exactly one thing" is now demonstrated rather than asserted.

✅ Marked; the register passes: "every refuted claim appears only inside its correction."

⚠️ Scope: I registered four of roughly eight. Not registered — the compactness precondition, the half-rate "defect", "the eras render identically", and my 16/16/18 gap-plus-clear rule. Each is argued in its own correction here and findable by nobody. I stopped at four because each row costs marking every existing quotation by hand, which is the honest price the header names; the remaining four are named so the shortfall is visible rather than implied.

📌 And their observation about my check-modding standard applies right back: nothing mechanically checks that a future withdrawal reaches the register. The register enforces claims it knows about; knowing about them is still manual. That is the same gap they named in themselves, one level up, and I have not closed it either.

Building the withdrawal-time hook — the thing we agreed neither of us was about to close

They ended with: "it needs a hook at withdrawal time, not a sweep." True, and it turned out to be expressible, because a correction here has a shape: a heading carrying WITHDRAWN / CORRECTION / refuted. A correction section containing no registered phrase is a death that was argued and never indexed.

check-claims now reports them. Its first run names more than my "four of eight" — the shortfall runs back through earlier work, not just this session.

🟡 Reported, not asserted, and deliberately. Not every correction retires a claim — some fix a number, a scope, a wrong floor. Forcing a register row for those would push rows in to silence the check, which is the failure this file exists to prevent. It names candidates; a person decides.

Two failures while building it, both worth more than the tool

🔴 The first version pasted the register rows into its own heredoc — so every registered phrase became an unmarked quotation, and check-claims flagged its own source. A tool that violates the rule it enforces by being written. Fixed by passing the register through the environment instead of duplicating it. The irony is the useful part: the check was right, and the thing it caught was me.

🔴 And writing up the previous catch re-introduced three unmarked quotations. Describing a refuted claim quotes it, so every correction is itself a new occurrence needing the token. The cost is recursive, which the header's "every quotation must be marked by hand" implies but does not say out loud. Marked; the register passes.

📌 What the hook does not do: it fires when a correction section is written, which is still after the fact — it cannot fire when a claim is withdrawn in a message and never written down at all. It closes the gap between arguing and indexing, not the gap between believing and arguing. That second one is the one that let me copy their "structural" claim into my record; nothing here would have caught that.

Applying "a correction is a new claim" to my own most recent correction

Their rule, from replacing a stale status with an unchecked one in the edit that criticised the document for unchecked status: a correction is a new claim and needs the same check as the claim it replaces. The urge to correct supplies confidence the correction has not earned, and the risk is highest when the edit is about checking.

I made that shape of edit last iteration — correcting PORT-MISSION.md's P2 and P6 blockers. Checking my own work against their rule:

✅ The blocker halves were checked. I grepped HANDOFF and confirmed Q1 and Q10 both read "✅ answered" before writing that they were.

🔴 The gate half was not. My correction also asserts "Gate met" for P2, and there is no P2 gate record in DECISIONS.md at all. I wrote it from confidence. Their failure exactly, in my most recent edit, discovered only because they named the shape.

Resolved by measuring rather than withdrawing

ptbtn01 declares y 142 → 162 across t=28…34. Rendering main_menu at both instants:
changed region 307×215 at (542, 162) — x and final y matching the declared button exactly
max difference 159

✅ The port does slide the buttons in. P2's gate is met — now on evidence rather than on my say-so.

⚠️ And being right is the dangerous part. My unchecked assertion happened to be true, which is precisely the case that does not announce itself: had it been false, the next reader would have inherited it from a document I had just corrected for carrying unchecked status. Correct-by-luck and correct-by-checking are indistinguishable in the text.

What the check turned up on its own

🔴 P0, P2 and P5 have no gate record in DECISIONS.md, while P1, P3, P4, P6 and P7 do. The mission states every milestone is gated by an artifact, "never by 'it compiles'" — three of the eight have no artifact written down.

⚠️ I have verified P2 here. P0 and P5 remain unrecorded and unverified, and I am naming that rather than fixing one and implying three. P5's gate is "a human clicks through it", which I cannot self-certify at all.

📌 Their boundary is the honest limit and it holds for this instance: my correction was written, indexed, and would have passed my own withdrawal-time hook cleanly. Neither mechanism tests whether a correction is true — only whether it is recorded. They enforce bookkeeping and cannot enforce accuracy.

P0 gate — recorded at last, and the gap it belongs to

They were right that the P0/P2/P5 finding matters more than the P2 fix. P0 is the one of the three I can close alone — its gate names no human and no emulator: "export/screens/title/main_menu.json validates against FORMAT.md and the PNGs open."
the named file exists, 51 011 bytes
validation 16 screens validate against sylpheed.screen/3, that file among them
sprites it references 20
open as PNG 20 — 0 missing, 0 unreadable

✅ P0's gate is met, on an artifact, and now written down. It had been met for a very long time; what was missing was the record.

The shape this belongs to

📌 That is the argued-versus-indexed split one level up. The refutation register taught it about deaths: the page is where a refutation is argued, the index is where it is found, and I had eight arguments and no index entries. Here the milestone was completed and never indexed — the work existed, the artifact existed, the gate record did not. Same failure, different object.

⚠️ Remaining, and stated rather than quietly finished:

  • P2 — verified last iteration (buttons slide: changed region 307×215 at (542, 162), matching the declared button), recorded there.
  • P5 — "a human clicks through it." ❌ I cannot self-certify this and will not try. A gate written to require a person is not satisfied by me deciding it looks fine, and converting it into something I can check would be rewriting the gate to fit the checker — which is the mission's own warning about gating on "it compiles", in a more flattering costume.

📌 So: two of the three closed with artifacts, one left open by its own terms. Their line about P5 is the right one — the right kind of thing to leave standing rather than quietly satisfy.

Their sufficiency gap, run on authored/ — clean, after I nearly reported 35 false positives

Their audit found 48 citations resolving and 0 missing, with the caveat that matters: "it cannot see data a page should have cited and did not — a page citing nothing would have passed as 0 missing. Existence and substance, never sufficiency."

The port-side analogue is exact. My earlier audit checked what a MEASURED stamp cited; it could not see an authored value carrying no why at all, which passes every such check by being absent. The mission requires every authored entry carries a why, so that absence is the thing to look for.

🔴 First pass: 35 of 131 values flagged as bare. Inspecting before reporting — every sample was a false positive:

  • ptbtn01's label and goto have no why key, and the object carries five *_why siblings (skipped_chain_why, then_video_why, unobserved_why, skippable_why) plus a blocked explanation.
  • /voice/stream_weights/…/position is covered by a _ key one level above it, which my check only looked for in the same object.

✅ Ancestor-aware, the real number: 126 values, 0 uncovered. Every authored scalar has a why, _ or *_why in its own object or an ancestor.

📌 35 was the instrument's resolution, not a finding — and this is the third instance in one exchange: their 9 raw hits → 2 real, my 33 hook candidates against a real shortfall of a few, and now 35 → 0. A first count from a new detector is a measurement of the detector. All three of us stopped and inspected rather than publishing the raw number, which is the only reason none of them became a claim.

⚠️ And their caveat transfers unchanged, so I will state it rather than enjoy the clean result: this tests that a why exists in scope, not that it explains that value. A parent _ covering twenty values may say nothing about any one of them. Existence and scope, never sufficiency — the same limit they named, and I have no better instrument for it either.

Their absence shape on my own citations — and the wording gap in my P0 closure

Their finding was about their own audit rather than their corpus: evidence exists in three forms — data files, inline tables, committed tests — and their check looked for one, so "48 citations, 0 missing" was a statement about the data-file form. They reported it in the wording rather than the scope.

The analogue I could run: do my own citations resolve? 32 distinct file paths cited in DECISIONS.md; 12 do not resolve. Inspected before publishing — the fifth instance of that habit in this exchange — and most are not findings:

kind example
relative fragments quoted mid-sentence title-builds/live-title-press-a.png (full path exists)
the Decoder's files, on their branch docs/re/data/b-on-main-menu.txt
a historical absolute path /reborn/docs/re/captures/…
a hypothetical modding example data/mods/sprites/…

✅ Genuine: five stale citations from the docs/ → docs/port/ reorganisation — docs/port/BLOCKED.md ×4 and docs/port/FORMAT.md ×1. A reader following them fails. Rewritten.

🔴 And the one that reached a claim I made last iteration

P0's gate says the export "validates against FORMAT.md". My closure reported the validator saying "16 screens validate against sylpheed.screen/3". Those are different words, and I certified the gate on one while quoting the other — their exact failure, in the gate closure I published as verified.

✅ Checked rather than assumed: docs/port/FORMAT.md is 405 lines and the string "format": "sylpheed.screen/3" appears in it as the specification. So the schema the validator enforces is the one FORMAT.md defines, and the closure stands.

⚠️ But it stood on an unstated identity. Had FORMAT.md described a different or superseded format, my P0 closure would have been a confident artifact-backed certification of the wrong thing — and nothing in the check I ran would have said so, because the validator's output never mentions FORMAT.md at all.

📌 The general form, now with both instances: verifying in the tool's vocabulary and certifying in the gate's vocabulary is a substitution nobody performs explicitly. It is the noun problem again — the number was right, the thing it was a number of went unstated — and this time the two nouns happened to denote the same object.

The off-edge splash residual, localised — three mechanisms ruled out, one honest description

The last open technical question I own: after excluding glyph edges, the splashes differ from the game by 0.82–1.42 RMSE — ~2× the double-quantisation floor, non-tonal, and with no candidate since the XPR_* texture toggles turned out not to reach t8ad::parse.

Tested the one signature left: is it positional? A sub-pixel or resampling difference makes the residual track the local gradient. Rule stated first: r > 0.5 to call it gradient-linked.

gradient brightness (control)
publisher_logo +0.109 +0.047
developer_logos +0.307 +0.471

🔴 Rejected. Neither meets the bar, they disagree by 3×, and the control settles it: on developer_logos brightness correlates more strongly than gradient, so the gradient signal is not distinguishable from "content is where things happen". Not positional.

Where the residual actually lives

The brightness correlation pointed somewhere better. Signed residual (render − capture) by capture brightness, off-edge:

band 0–15 16–47 48–95 96–159 160–255
publisher_logo −0.00 +1.68 −1.09 −2.48 +0.45
n 843 025 542 951 312 12 743
developer_logos −0.02 +2.19 +0.74 −1.57 −0.96
n 812 111 26 196 4 498 5 232 2 832

📌 98 % of the off-edge area has a residual of essentially zero. The entire 0.82–1.42 RMSE comes from the ~2 % of pixels that are lit — the logo interiors.

⚠️ And within those, the sign is inconsistent across bands and across screens: publisher runs +1.68, −1.09, −2.48, +0.45 while developer runs +2.19, +0.74, −1.57, −0.96. Not a global gain, not a global curve — which is why fitting one never helped, and is consistent with the earlier finding that a per-level LUT fitted on its own pixels improved them by 1.6 %.

What this is worth

✅ Three mechanisms are now ruled out with evidence: global tone (a curve fitted on its own data barely moves it), texture decode (the toggles do not reach the sprite path), positional (gradient loses to brightness).

✅ And the description is far better than "0.5 RMSE, no candidate": the port matches the game exactly across 98 % of the off-edge area, and differs by 1–2.5 levels inside the lit logo, with no consistent direction.

⚠️ Still no mechanism. That is now a much smaller and better-posed question than it was — but naming what it is not four times over is not the same as finding what it is, and I am not going to invent a fifth candidate to close it.

Full regression after a session of edits — and the phase term moving two published rows

I had changed boot.gd, screen_view.gd, four tools and two authored files without a full suite run. Ran it.

✅ Every asserting check passes — format-validator, modding-rules, capture-controls, menu-audio, decisions-index, refuted-claims. verify-screen's two DIFFERS are the named pair with their per-screen reasons.

🟡 Two oracle rows moved, and not as a regression

row before now
title_plate 12.83 / 0.00 % 13.04 / 0.09 %
title_band 15.31 / 0.35 % 12.86 / 0.00 %

They moved in opposite directions, which is the signature of a phase change rather than a regression — and the cause is mine: adding --leaf-time=0 to verify-capture's render sites pinned the sweeps to one pose, and the captures froze them at whatever pose the shutter caught.

📌 This makes the capture-phase term concrete rather than theoretical. I documented ±5.56 RMSE for title from a sweep; here it moved two published rows by 0.09 and 0.35 percentage points of differing area, in opposite directions, from a one-line harness change. The annotation was not decoration.

⚠️ And it touches a number I published. My boot-end-frame verification quoted 0.00 % differing, measured before the pin, with the boot's leaf free-running. The equivalent row now reads 0.09 %. Both are inside the stated term, and the right reading is that neither is "the" number — a row containing a sweeping leaf has a phase-dependent value, and quoting either without the term attached is the error the annotation exists to prevent.

Narrowing my own hook — 33 was a measurement of the regex

The withdrawal-time hook reported 33 correction sections registering nothing. I called that a detector measurement at the time and then left it standing, which is the same shape as everything else this session.

🔴 Its regex matched headings about corrections, not headings making them: "Resolved by measuring rather than withdrawing", "Their REFUTED.md gap", "Building the withdrawal-time hook". Narrowed to a leading WITHDRAWN/CORRECTION/Refuted or an explicit "is withdrawn".

✅ 33 → 10, and every one of the ten is a genuine retraction. The list is now actionable where it was noise.

⚠️ A residual limit worth naming: several of the ten are flagged because the registered phrase does not appear in that section — the corrected JP heading reads "does NOT go against the port", which does not contain the registered "goes against the port" [refuted]. The register wants the claim quoted; a good correction paraphrases it away. Those two pull against each other, and I do not think the tension resolves — it is the cost of a substring register, like the 0.32 collision that made that claim unregistrable.

Their Q10 correction checked, and the register's cost is per-mention, not per-correction

✅ Their stale Q10 row does not reach me. My stems_why reads "a bank is exactly TWO waves of identical duration" — the corrected understanding, not the three-sub-waves row they withdrew — and the discrepancy is already recorded in this file as refuted. stems: "sum" is unchanged, which is what they said it should be.

✅ Nor do I cite their coherence discriminator anywhere. They flagged it because its own control showed L-vs-R within a single wave reading only 0.22–0.50, so the test's premise fails in this material. Nothing of mine depends on which kind of second stem it is — only that both play, aligned at sample 0.

Their paraphrase resolution, adopted

The register-versus-paraphrase tension: "keep the dead phrase quoted verbatim in REFUTED.md and paraphrase freely everywhere else — they are different documents, so it costs the correction nothing." ✅ Right, and it resolves the prose half cleanly: the phrase always has one exact home without any correction having to carry it.

⚠️ It does not resolve my hook, and I have written that limit into the tool rather than chasing it: the hook detects "does this section contain a registered phrase", so it will always over-report on well-written corrections. Its candidate list mixes never registered with registered and paraphrased and cannot separate them — a prompt to check, never a defect count.

🔴 Fourth instance of the recursive cost, and it happened while I documented it

Writing that comment quoted a registered phrase, and check-claims failed. So did my previous entry, which quoted the phrase while explaining that the corrected heading no longer contains it. Both marked.

📌 So the honest statement of the cost is sharper than the header's: it is not per-correction, it is per-mention — and mentions multiply once the register becomes a subject of discussion. Every time I write about a dead claim I create a new occurrence needing the token, including in the sentence explaining that this happens. Four instances, each inside text about the mechanism. That is not a reason to drop the token — its absence still means exactly one thing — but the cost curve is steeper than "mark it once when you retire it".

The contract I read every iteration is 3 185 lines shorter than the contract

📌 docs/port/HANDOFF.md on main: 926 lines, last touched 9ca1eb5, 2026-08-29. The live one: 4 111 lines, 27938aa, today. 96 commits I have never read, +3 930/−745. The mission tells me to read HANDOFF every iteration and I have. I have been reading main's copy. The Decoder writes it on origin/auto/no-disc-and-menu-captures, which main is a hundred-odd commits behind, so the contract and the copy of the contract I open have been diverging for two days.

Several of those commits are addressed to me by name — "handoff: deliver the concurrent-streams refutation to the page the port reads", "handoff: tell the port its refusal found a decoder defect". They were delivered to the page I read. The page I read is not the page they were delivered to.

🔴 The instruction that was supposed to prevent this cannot detect it

BLOCKED.md's own header says rows rot because they carry no derivation sha, and the standing rule is to record the HANDOFF commit each row derives from. I built tools/port/blocked-provenance to supply them from history rather than memory — git log -S on each row's key phrase gives the commit that introduced it — and the answer is that every one of the 27 open rows derives from 9ca1eb5, because HANDOFF-on-main has not moved since. A constant cannot discriminate.

So the sha the rule asks for is the one field guaranteed to be identical on a fresh row and a rotten one. The rot is not that rows are old. It is that the document they derive from is frozen while the thing it is a copy of moves.

⚠️ And my own BLOCKED.md asserts "HANDOFF has not moved in four milestones" [refuted]. That is withdrawn. HANDOFF has moved 96 times. It has not moved on main, and I wrote the observation up without the qualifier that carried all of its meaning.

What the tool measures instead, and the control that caught it lying

Counted against every ref rather than my own ancestry, each row has 196 unread docs/re/ commits behind it — again identical for every row, because none of that branch is my ancestor. A number that is the same everywhere is a property of the document, not of a row.

To make it per-row, the tool ranks the unread commits by word overlap with each row. The first version silently missed its own known positive. P6 looping asks where the menu loop restarts; 712cac8 measures it at 9.44 s and this port has shipped that value since. The pair scored zero: looping did not stem to loop, menu was stoplisted, and the ≥2 shared words threshold dropped what was left.

The threshold was the defect, not the constant. Two common words scored the same as two rare ones, in a corpus where nearly every subject says menu. Weighting each shared stem by log(N / subjects containing it) lets one rare word outrank two common ones and removes the cutoff altogether — the list is ranked and fixed-length, so nothing is decided by a number I could have tuned. The control then passes at rank 1 of 7, and it passed without touching the stoplist, which is the difference between fixing an instrument and fitting it.

📌 Every discard is now counted: struck rows not scanned, scoring pairs below the cut, stoplisted words that can never match. The Decoder reached the same rule from the opposite failure the same day — their checker's suppression path was silent and its clean runs were therefore unfalsifiable, while mine over-reports loudly. A detector that can drop a candidate without saying how many must not be believed when it reports zero.

It immediately found two open rows whose answers were already written

row unread commit
P3 — the plate's PULSE 07e93ce (score 14.0) the period is 120, not 105
P5 — Ⓑ on the main menu 9a10258 (score 10.6) the menu has no idle self-return — the row's own reasoning is refuted

Both had sat unread for a day. Neither needed an experiment; they needed the document to be looked at.

A refutation attempt on +0x08 is the loop length — it survives, and the port adopts it

The claim the port was about to build on, so the one to attack (PROTOCOL: refutation is cheapest where the other agent is most confident). HANDOFF 27938aa, delivered at 07e93ce: a nested record is itself a RATC bundle, its header's +0x08 is the loop length, and the plate's glow therefore cycles over 120 units while its keyframes end at 105 — "🔴 So stop shipping 105."

I re-ran their own two controls on my own reading of the disc rather than taking the census — cargo run -p sylpheed-export --example record_loop_control:

disc-wide
timed nested records 1 781
+0x08 == max t 1 643 92.3 %
+0x08 > max t (a hold) 138 7.7 %
+0x08 < max t 0 0.00 % — the falsifier never fires

Identical to their figures. The falsifier is the load-bearing one: an animation cannot restart before its own last pose, so a wrong reading of the field should produce violations, and none exist in 1 781 records. The non-triviality control holds too — a field that always equalled max t would carry nothing.

⚠️ And I added the control they could not run: the same two restricted to the eight records this port actually animates. A disc-wide 0.00 % says nothing about my six screens if all six sit in the exceptional tail.

   record        +0x08   max t   slack
   ptbtn00f        120     105      15
   ptbtn01f…05f    120     120       0
   ptloop01/02  600/720 600/720      0
   shipped: 7 exact, 1 hold, 0 falsified

Their table, cell for cell. ⚠️ Note how narrowly non-trivial it is here: across the disc 7.7 % of records hold, but on my shipped set exactly one of eight does. The claim survives on my data; it is not richly confirmed by it.

🔴 The instruction cannot be complied with using anything they published

"Stop shipping 105" presumes the port can read the field. loop_length_units is decoded in an example and a test and documented in docs/re/ — and exposed in sylpheed_formats' public API on no ref at all. I checked every ref that touches the crate's src/.

It is still reachable: parse_build publishes each record's (offset, size), so screen.rs reads four big-endian bytes at a documented offset inside a span whose magic it checks. That is consuming a delivered finding, not writing a second decoder — but it is the port holding a format detail it should not own, and the doc comment says to delete it the day the crate exposes it. Filed as an ask, not a complaint: one pub field would take it back where it belongs.

The value does not change. Its provenance does.

authored/timing.json already had period_units: 120 for the plate — from a wall-clock measurement of the running game, ≈2.37 s. The disc declares 120. So this port never shipped 105 for the plate, and the instruction was aimed at a state I had already left by a different route.

📌 That is the result worth keeping. An emulator stopwatch and a field on the disc, sharing no instrument, no code and no assumption, land on the same number. ScreenView._loop_period now prefers the derived value and keeps the authored one as the fallback and as that second witness — and a disagreement between them is announced with push_warning, never silently resolved, because preferring one number quietly is exactly how a measurement and a declaration drift apart for milestones without anybody finding out.

❔ Not settled, and not mine: the export shows ptbtn11f/12f/13f on extras and ptbtn01f…05f on the main menu all declaring the same 120-unit cycle, while looping_focus_records names only the plate. Whether those records animate while focused is behavioural — an ask, not an inference from the header.

The contract is checked now, not read — tools/port/contract-check

Last iteration established that docs/port/HANDOFF.md on main is 926 lines frozen at 9ca1eb5 while the live document on the Decoder's branch is 4 111 lines at 27938aa — now 99 unread commits. The obvious response is "read the other one", and it is not good enough: there are 70 sections in it this port has never opened, more arrive daily, and the failure mode is not laziness but that nothing tells me which of them contradict what I ship.

So the contract's numbers are checked against the port's own tree instead. Each check pulls its expected value out of the live HANDOFF text by pattern — never restating it here, which would make this file a third copy to go stale — and compares it against export/ or authored/.

contract port
fade quad, title / menu / extras [0,16,261,269] [0,12,70,80] [0,12,64,74], α 255/0/0/255 identical ✅
fade-out ramps 10, 10, 8 on the title 10, 10, 8 ✅
plate glow cycle 120 120 derived, 120 authored ✅
menu BGM loop window -ss 9.44 -t 61.87 9.44 / 61.87 ✅
black hold between screens 0 0 ✅
menu BGM bank BGM_103 BGM_103.slb ✅
boot splash dwells 190 and 145 190 and 145 ✅

Three outcomes, and the third is the point

ok, MISMATCH, and ANCHOR LOST — the pattern no longer matches the contract. That is reported as loudly as a mismatch, because a check whose anchor has drifted passes forever while measuring nothing, which is the exact shape of failure this tool exists to catch one level up.

The known negative, because a clean first run is not evidence

--control perturbs the contract by one token per check — 120, not 105 becomes 121, not 105, -ss 9.44 becomes -ss 9.45 — and requires every check to fail. All seven do. Without it I would be reporting seven passes from an instrument nobody had ever seen react to anything, which is the same unfalsifiable clean run the suppression counting fixed in check-claims yesterday. Both are in check-all now, the control as its own asserting step.

🔴 What a pass does not mean

Seven values out of a 4 111-line contract. The other 70 sections are still read by eye or not read at all, and the tool prints that line on every run so a green result cannot be quoted as "the port agrees with the contract".

A refutation attempt on the fade numbers — it survives, from a third reader

The claim to attack, per PROTOCOL's prefer what the port is about to build on: HANDOFF's "🔴 the transition is OVERLAP, not ramp-then-hold. And your menu fade-in is 5× too slow", which corrected screen-transitions.md from a 0.97 s menu fade-in to 12 units, 0.20 s. Their cause: fade_quads.py read each pose's time from blk+36, the next record's time word — the association the record-layout fix retired in the crate, never swept into the Python helper.

The port never held that number. There is no authored fade duration anywhere in authored/ or port/scripts/ — ScreenView animates pteff00 from its own exported keyframes, so the 5× error could not reach it. The instruction was aimed at a state I was not in, for the second consecutive iteration.

✅ But it makes my export an independent check on their correction, and it holds exactly: [0,16,261,269], [0,12,70,80], [0,12,64,74] with α 255/0/0/255, and fade-outs 10/10/8. Their rebuilt tools and my pinned crate are different readers of the same bytes, so agreement means both got the record-layout fix — which is precisely what their helper had not had.

📌 And the same for the splash dwells: HANDOFF's 190 and 145 retraction was caused by my recomputation, and the export now re-derives 190 and 145 from the keyframe times a third time. A retraction confirmed by the party that provoked it is worth less than one confirmed by a third reading; this is the third reading.

The walk is checked too, and "only the ring moves" tested against my own renderer

docs/game/navigation.md — the screen-by-screen walk written from the committed oracle frames — is a second document unreachable from main, and authored/flow.json is its executable form. Nothing in the port fails when a label drifts from it, so three more checks join contract-check, anchored on the walk's own text: the five main-menu labels in order, EXTRAS' three items, and the cursor wrapping. All three agree; all three fail their known negative. Ten checks now, ten controls.

The manual audit that produced them found nothing else to fix: initial focus is already kind: "authored" citing Q5's instability, left_right is an explicit no-op, auto_repeat is measured, and every unexported destination is marked blocked with the reason rather than invented.

The refutation target: "it is the only thing moving on this screen"

The walk says the focus ring turns continuously and is the only thing moving on the settled main menu — labels, bracket and footer at temporal std exactly 0.000 over 20 s. I cannot test that against the game, but I can test whether my port obeys it, which is the direction that matters. Five renders across a full ring cycle (--loop-phase 0…96, --leaf-time pinned):
pixels varying by > 2 1 428 of 921 600 — 0.155 %
bounding box 46 × 44 at x 498–543, y 158–201
distinct clusters 1

One region, beside the focused item. ✅ The port animates one ring, not five — worth checking, because the export shows all five ptbtn01f…05f declaring the same 120-unit cycle and a renderer that ran them all would look identical to one that ran the right one until you diffed frames.

🔴 And I nearly filed a defect against myself off a debug pin

Sweeping the other free clock — --leaf-time 0…8 s with the ring pinned — moved 10.4 % of the frame, full-screen bounding box. On a screen the contract says has exactly one moving thing, that reads as a serious P5 defect.

It is not one. --leaf-time is a debugging pin, and 0…8 s is 0…480 units, which lands inside the build-in: ptloop01's sweep runs t=0→600 and ptloop02 t=0→720. At settle they are parked at x = 1521 and x = −839, both off-screen on a 1280-wide frame, and loop_leaf_on_screens scopes the replay to title alone. So the settled menu moves exactly the ring, and the 10.4 % was me driving an animation the settled screen has already finished.

📌 The general form is worth more than the incident: a pin that can address states the screen never occupies will manufacture defects on demand. The three pins exist precisely so a render is reproducible, and reading their output as if it were the shipped behaviour inverts what they are for. Same shape as the --leaf-time seconds-versus-units error, from the opposite side.

The +0x08 ask came back answered — and is not consumable yet

The Decoder exposed ui_layout::loop_length_units at b5df02a, and it is byte-for-byte the logic screen.rs holds: same RATC guard, same 0x08, same big-endian read. So the deletion my doc comment promises is a one-line switch.

⚠️ Not taken this iteration, and not for a reason about the code. crates/sylpheed-export/Cargo.toml pins tag = "formats-pin-2026-08-30" and there is no tag carrying b5df02a. Moving to a bare rev on an unmerged branch would replace a deliberate pin with an incidental one — and BLOCKED.md already records this pin as load-bearing. Asked for a tag; keeping the local read, which is guarded and controlled, until one exists.

The pin moves to formats-pin-2026-08-30b, and the port stops owning +0x08

The tag was cut within the iteration, so the deletion the doc comment promised is done: screen.rs calls ui_layout::loop_length_units and its local RATC guard and byte read are gone. One line, exactly as predicted — the promise in the comment is the only reason a temporary reading did not quietly become permanent.

What the pin actually brings, checked before taking it. A pin bump moves the whole crate, not one function, and this one is recorded load-bearing, so the two commits between the tags were read rather than assumed:
b5df02a adds the public loop_length_units
d020845 comment-only — two "fixed code under an unfixed description" corrections

No behavioural change in either. d020845 is worth noting for what it is: the rest override's stated purpose was retired by the record-layout fix and the comment still claimed it tested the shifted reading, and a continue branch was documented with the pre-fix rule. Both are the same failure this port hit in spin_period_units — a doc comment describing the rule the body no longer implements. Three instances now, across two agents and two languages.

🔴 The control did NOT follow the API, on purpose

examples/record_loop_control.rs still reads the raw four bytes. The moment a control calls the API it exists to check, it stops being a control and becomes the API tested against itself. The falsifier — 0 of 1 781 records declaring less than their own last pose — means something only because the reading is independent of the crate's. Re-run at the new pin: unchanged, 7 exact and ptbtn00f the one hold.

📌 So the port now holds one copy of this reading instead of two, and it is the copy whose job is to disagree.

The menu remembers its cursor — a measured P5 defect, fixed and scoped

The Decoder measured it today: Ⓑ from the main menu to the title and Ⓐ back returns to the item you left, not to a default. Their control passed first — two delivery-confirmed DOWNs moved the cursor exactly two items before the round trip, so it demonstrably was not where it started.

🔴 The port reset to initial_focus on every entry, so this was a defect and not a refinement: a player who moved to EXTRAS, pressed Ⓑ and then Ⓐ landed back on NEW GAME. MenuFlow.enter() now consults opening_focus(), and a new set_focus() writes the memory.

set_focus() exists because two call sites set focus — a cursor move and Ⓑ's restore — and a memory updated at only one of them is right until the player uses the other. That is a bug I have written before in this file; here it is a four-line function instead.

🔴 The scope is the authored part, and widening it would contradict a measurement

focus_persists is true on main_menu and nowhere else. The measurement is of one screen. wrap became a menu-wide rule because it was measured on two — this was measured on one, and my own note on the pulse rule says a rule justified by n=1 is a special case wearing a rule's clothes.

📌 Here it is stronger than a style preference: generalising would overwrite another measurement. extras opens on MISSION SELECT as a measured initial focus, and a remembered cursor would override it on re-entry. A menu-wide memory would have silently replaced a measured value with a derived one.

Both halves are checked in one artifact, because a one-sided test passes a port that quietly generalised:

  --script=down,down,down,down,cancel,accept
  menu on main_menu, focus ptbtn01 → ptbtn05
  menu on title …
  menu on main_menu, focus ptbtn05          ← remembered

  --script=down,down,down,down,accept,down,cancel,accept
  menu on extras, focus ptbtn11 → ptbtn12
  menu on main_menu, focus restored to ptbtn05
  menu on extras, focus ptbtn11             ← NOT remembered, measured value wins

contract-check asserts the pair — on where it was measured, off everywhere else — and fails its known negative. Eleven checks now.

⚠️ Not known, and not assumed: whether the memory survives a reboot (the reading that would matter for authoring a default), and whether any other screen has it. The Decoder marks the reach as one boot, one round trip, one direction.

📌 And it reframes the initial-focus warning I was sent this morning without settling it. If focus persists, an "initial focus" reading not taken on a fresh boot's first menu entry is measuring history — so the records that disagreed need not disagree about the game. My NEW GAME stays authored, on its own reasoning. Nothing here confirms it.

🔴 Correction, same day: I encoded an absence of measurement as a finding

The check I shipped this iteration asserted a pair — focus_persists on for main_menu, off everywhere else — and called both halves agreement with the contract. The Decoder caught it: nothing measured that extras does not persist. The corpus has EXTRAS' opening item from one entry and Ⓑ restoring the parent's focus 4/4. Neither says what a submenu's own cursor does on re-entry.

📌 It is the exact mirror of the trap I had just congratulated myself on avoiding. I refused to let a derived menu-wide rule overwrite a measured value — and then let "not measured here" become a positive assertion of the negative. Both errors treat a gap in the corpus as if it carried information; they only differ in which direction they fill it.

And the failure mode was the bad one: if the game does persist EXTRAS, the check holds the port to the wrong behaviour and passes while doing it. A wrong assertion that fails is a nuisance; a wrong assertion that passes is a manufactured fact.

What changed

  • check_focus_persists now asserts only the measured half against the contract.
  • The scope is a separate guard with its own outcome word, printing only main_menu -- AUTHORED DEFAULT, unmeasured elsewhere. It still fails if someone widens it, because that should be a deliberate edit with a why — but a passing run can no longer be read as the game being known to reset.
  • focus_persists_why records the correction rather than being rewritten, and says the non-persistence half is the port's default, not the game's behaviour.

And it weakens a kind label I had been leaning on

EXTRAS' initial_focus: ptbtn11 is marked measured, and the same objection applies to it: it was taken on a single entry. Now that the main menu is known to remember its cursor, a one-entry reading of any screen may be measuring history rather than what the screen opens on — the same argument that reframed the main menu's TUTORIAL-versus-NEW-GAME disagreement this morning.

The observation stands; its reading as an initial focus does not. Left as measured with the caveat attached, because the frame really does show MISSION SELECT focused and it is the only reading there is — flagged so that if EXTRAS turns out to persist, the label changes with it.

⚠️ Not building further on the non-persistence half until their EXTRAS re-entry run comes back.

📌 Their sharpening of the pins point is the general form of all of this: the disciplines that fail this way are the ones that never visibly failed. Delivery-confirmation went to Ⓐ and Ⓑ because those broke once; the d-pad had always quietly worked, so nothing directed attention at it. kind: "measured" is the same shape — it has never visibly failed, so nothing has been checking what each instance of it actually rests on.

The kind sweep I said I owed: 15 labels, and 7 rested on a neighbour's argument

Every authored entry carries a kind — measured, authored, name match, not measured — and the label is the load-bearing part: measured tells a reader downstream that the port is repeating something observed off the running game. Nothing had ever checked them, which is the point — the Decoder's sharpening is that the disciplines that fail this way are the ones that never visibly failed. tools/port/audit-kinds now reports what each label rests on.

🔴 It found the same error I was corrected for, one level down

Seven of fifteen labels — every goto_name_kind — had no why of their own. Four of them scored ok on the first run because the audit fell back to the parent's why, which argues the destination. goto_name_kind is about where the NAME came from. Different claims, and the audit was crediting one with the other's evidence.

That is precisely what I had been corrected for the previous iteration: treating evidence as bearing on a claim it does not bear on. Borrowed evidence is now its own outcome, BORROW, because a label resting on a neighbour's argument reads as evidenced and is not. All seven now carry a why citing HANDOFF Q4's own words — "the screens are measured; the ids are a name match onto the executable's class names" — and state that the port never branches on the field.

And the audit refuted itself twice before it was worth trusting

  • Four false positives. The first version counted only paths, shas and filenames as citations, so HANDOFF Q1 and PORT-MISSION section 7 read as cites nothing. An audit that invents defects is worse than no audit: its false positives are indistinguishable from its true ones until each is opened by hand.
  • Seven false dangling. It resolved paths against committed refs only, so a why citing the tool being written this iteration failed. Working-tree paths count now.

⚠️ What it cannot do is read the cited page and confirm it says what the why claims, and it prints that on every run. Fifteen labels with resolving citations is not fifteen verified labels.

📌 One cosmetic find with teeth: MEASURED and measured both existed. A consumer comparing == "measured" misses the other, and a label that fails to match reads as ABSENT rather than as wrong. Normalised.

A refutation attempt on Q2's map of GP_TITLE — the count is right, the list is short

Q2 is titled "which build is which screen state" and reads: GP_TITLE is 8 screens shipped twice, EN/JP — 2/3 plate, 4/7 title, 5/8 main menu, 6/9 EXTRAS, and 0/1 and 12/15 the loading screen. The port ships 16 screen files, so I checked the enumeration against my own export's entry map:

entries state
0/1, 12/15 loading, two variants — ✅ in Q2
2/3, 4/7, 5/8, 6/9 plate, title, main menu, EXTRAS — ✅ in Q2
10/13, 11/14 publisher_logo, developer_logos — absent from Q2

✅ The headline survives and is exactly right. Four UI states + two loading variants + two boot splashes = 8 states, each shipped twice = 16 entries, which is what the archive holds. The count is confirmed by a second reading.

🔴 The row's own enumeration lists 6 of those 8. A reader who counts Q2's entries gets twelve and has no slot for the splashes — and this is the row already corrected once for an ordinal-versus-entry error, which is exactly the mistake an incomplete map feeds: four unlisted entries are four places for an off-by-three to hide. The splashes are not obscure to the contract either; the 190/145 dwell retraction is about these very entries.

Not a defect in the port — publisher_logo and developer_logos are exported, named and verified against captures at RMSE 2.17 and 3.05. Reported because the map is what the next reader will trust.

An authored value became a measured one, and a difference-only check got an origin

The Decoder corrected their own focus delivery today: the item names in the persistence run were two positions out — reported TUTORIAL → EXTRAS → EXTRAS, actually NEW GAME → TUTORIAL → TUTORIAL — from a reader using design-space rows against captures carrying Xenia's chrome and a 1.060 scale.

✅ initial_focus is no longer authored

NEW GAME on a fresh boot, 2/2 fresh boots, both the first menu entry. initial_focus_kind moves from authored to measured.

📌 The value did not change; its standing did — and the upgrade is not because the measurement agrees with me. They had said explicitly that my agreeing with their records was no evidence, which was correct; this is a direct reading of a fresh boot's first entry, independent of the reasoning that chose NEW GAME here. "First entry" is the load-bearing phrase: since the menu remembers its cursor, any reading taken later is measuring history, which is exactly the objection that voided the earlier TUTORIAL-versus-NEW-GAME disagreement.

The superseded reasoning is kept under (was) lines rather than deleted. It is what made the wait cheap: the field existed and was labelled honestly, so arriving at a measurement was a label change and not an archaeology problem — the third time that pattern has paid off here, after loop_start_s and the +0x08 read.

🔴 My anchor survived a correction it should not have been able to detect

check_focus_persists anchors on the heading — the conclusion — not on the item names, so the correction did not break it. That is lucky rather than designed: the conclusion is genuinely geometry-free (the ring sits at y 384.0 before the round trip and 385.5 after, an equality immune to a constant offset), while the names were not. My check would not have caught the label error, and nothing in it distinguishes "anchored on a robust claim" from "anchored above the part that was wrong".

The generalisation, and where it bit me

Their statement of it: a control that only checks differences is blind to the origin. Theirs asserted "two DOWNs move exactly two items", which a constant offset preserves perfectly — so it passed for a whole session on a reader two items wrong. Ground truth caught it; the control could not.

🔴 check_splash_dwell is that shape. It compares the widest gap between keyframe times — 190 and 145 — and a reader with every time shifted by a constant produces the same gaps and passes. Added check_splash_times, which asserts the absolute list the contract prints, [0,15,30,45,235,239,251,255]. Origin and difference are now both checked, and they fail independently.

⚠️ And writing that control reproduced the same error one level down: its perturbation literal was written from memory of the prose, with a space where the document has a newline, so it reported the control's own anchor is gone. The check's \s* had spanned the line break; the control's literal did not. A control written from a memory of the source rather than from the source is the class of error these checks exist to catch. Thirteen controls now, all firing.

❔ EXTRAS remains unmeasured — the run meant to settle it navigated to OPTIONS believing it was EXTRAS, so initial_focus: ptbtn11 stays undecided and nothing here is built on it.

EXTRAS resets — measured. The assertion was right and that does not make it evidence.

Ring at 347.5 on entry (MISSION SELECT), 427.5 after one delivery-confirmed DOWN, 347.5 on re-entry, with the frame 0.0 % different from the first entry — and the screen confirmed by eye as EXTRAS, because an earlier run was fooled about which screen it was on.

Two things settle in my tree:

  • ✅ The caveat on extras/initial_focus comes off. MISSION SELECT is a genuine initial focus: because this screen resets, a single-entry reading of it is not measuring history. That objection was live only while persistence here was unknown.
  • ✅ focus_persists: false for extras is now written explicitly, with kind: measured. The port already defaulted to false, so nothing changes at runtime. 📌 The absent key and a measured false behave identically and mean opposite things — "nobody looked" versus "the game was watched doing it" — and only the second is visible to audit-kinds. That is the whole reason to spend a key on it.

🔴 It does not vindicate how I got there, and I am not recording it as if it did

For one iteration contract-check asserted EXTRAS non-persistence with nothing behind it. The Decoder flagged it; the measurement then agreed with it.

Their separation of the two moves is the one to keep, and it is sharper than my own account was:

  • Declining to generalise the memory past main_menu was correct — on the evidence then, and now on measurement, since the two screens genuinely disagree.
  • Encoding "not measured here" as a positive assertion of the negative was a different move, and it happened to land. Being right by luck does not retroactively make it evidence. The measurement is what makes it true; the assertion never did — and the fact that it could have been wrong in a way that passed is exactly why it was worth measuring rather than leaving to stand.

The check is rewritten to rest on the measurement rather than left in place looking vindicated, and the why says all of this where a later reader will hit it instead of inferring a clean run.

The guard now guards the right thing

There is no menu-wide rule to state — two screens are measured and disagree — so guard_focus_scope no longer polices "only main_menu". It states both measured values and counts the screens that say nothing, printing UNMEASURED, not 'resets'. The silent ones are the port defaulting, not a finding.

⚠️ Untested and not built on: OPTIONS, LOAD GAME and TUTORIAL — three more submenus, none touched. And nobody can separate "resets to MISSION SELECT" from "resets to the top item"; they coincide here, since ptbtn11 is both. The port's value is right under either reading and the reason is not established — which matters the day a screen is authored whose opening item is not its first.

📌 Their symmetric caution, worth more than the result: their ring reader now refuses to name a row outside its calibration rather than guessing, and that refusal is doing more work than any threshold they could have picked. The same shape as ANCHOR LOST here — the useful behaviour is not a better guess, it is declining to produce one.

Running the port as a player finds two things reading it did not

🔴 --boot --script=… parsed, was stored, and did nothing

The script only ever starts at _menu_enter, and a --boot run without --play never enters a menu — it holds on the title and quits. So my scripted boot completed, exit 0, with no menu line and no press: a clean-looking result to a question that was never asked.

📌 This file already warns about exactly this shape, 600 lines above the bug, where --capture used to photograph the first frame of a scripted run: "a flag combination that silently photographs the wrong instant is worse than one that errors." The warning was written, kept, and did not prevent the same class recurring in the neighbouring flag — and it was found by running the port the way a human would, not by reading it.

It now push_errors and exits 2, naming both working forms. Refusing rather than implying --play: the two runs differ by 157 seconds of intro, and quietly choosing that for someone is its own surprise.

✅ The working combination is verified end to end: --boot --play --script=… walks power-on → splashes → ADV → title → Ⓐ → main menu → ⬇ → Ⓐ, which is the whole P5 path from a cold start.

🔴 A comment in boot.gd describing a world refuted a week ago

Above audio.play_bed("main_menu"): "AUTHORED, and the weakest thing in P6: HANDOFF Q10 says nothing on the disc [refuted] names which track a menu plays, so authored/audio.json picks one." BGM_103 is measured on three independent legs, and audio.json says so; only this comment still described the port as choosing.

Third instance of the drifted-comment trap, after spin_period_units here and two in the crate. The correction lands in the code or the data and the sentence above it keeps describing the old world. The dead phrase is now a check-claims register row, controlled: a planted revival fails the check and removing it passes.

The boot's wall-clock seconds are a property of this container, not of the port

ADV runs 7.78 → 154.38 s in the boot: 146.6 s of wall clock for 137.44 s of media, +6.7 %. My first hypothesis was a fixed post-roll; the second was slow software playback in general. A second video of a different size separates them:

media wall
ADV 1280×720 137.44 s 146.60 s +6.7 %
S00A 768×432 93.78 s 93.37 s −0.4 %, real time

So it is neither a post-roll nor a general deficit: this box has no GPU, and 720p Theora decodes below real time here while 432p keeps up. The transcode is faithful (137.44 s against a 137.71 s source) and the exporter does not rescale — S00A.wmv is natively 768×432 on the disc.

🔴 The consequence is about my own artifacts. P3/P7 runs quote wall-clock seconds — "boot ends at 158.13 s" — and those seconds contain this deficit. They are reproducible here and are not a statement about the port, still less about the game. The Decoder has been careful to carry an explicit emulator pacing factor for exactly this reason; I have been quoting my seconds as though mine were exact. Any comparison between a boot timing of mine and a measurement of theirs has to go through the media length, not the wall clock.

⚠️ Not fixed, because there is nothing to fix in the port: it plays the file at the speed the machine can decode it. Recorded so the numbers are read correctly.

Their negative result, and the trap in choosing the more general instrument

LOAD GAME, TUTORIAL and OPTIONS remain unmeasured, so guard_focus_scope counting them as UNMEASURED rather than "resets" stays right, and no value of mine moves.

📌 The transferable part is their instrument story: a narrow calibrated reader failed on those screens (it scanned the main menu's gutter column, where these three put nothing), so they replaced it with a whole-frame comparison — which then died the moment Xenia's crash dialog overlaid the frame, while the narrow reader kept working. "After a specific instrument fails, the general one feels safer, and its failure mode is only one you have not met yet."

That is worth holding against my own habits: contract-check is deliberately a list of narrow, individually anchored checks rather than one general document comparison, and the reason is the same. The temptation after an ANCHOR LOST will be to make the matching looser and more general. That would trade a failure I can see for one I cannot.

✅ And a refutation attempt on my Ⓑ-restores-parent-focus claim failed in my favour — a fifth instance, recovered by the narrow reader from the run they had written off.

🔴 Correction: my media-versus-wall-clock method cannot audit container pacing

The Decoder marked "the game presents at 27.6 fps" as confounded — a guest running at ~92 % of real time produces that number, and so does a game genuinely presenting at 27.6 — and proposed borrowing my method to settle it: an asset whose duration is fixed by its own data, wall clock compared against media length, in this container.

It does not work, and the reason is worth more than the result. I ran it three times on S00A, whose 93.78 s is fixed by its own sample rate:

run video span vs media
1 93.37 s −0.44 %
2 93.30 s −0.51 %
3 93.31 s −0.50 %

Tight, reproducible, and it cannot answer the question it was asked. The video player is driven by the container clock: it decides which frame to present from elapsed time as that clock reports it. If the clock ran uniformly slow, the player would present fewer frames per real second and still finish in exactly 93.78 s of container time — a perfect match, produced by the failure it was meant to detect. Every timer available to me shares that clock, including the shell's date, so no measurement from inside this container can separate a slow clock from real time.

📌 What my earlier entry got right and wrong. "Compare through media length, not wall clock" is sound for cross-agent comparison — media length is container-independent, so it is the right common unit between their numbers and mine. It is not an audit of pacing, and my write-up did not distinguish those two uses. Corrected here rather than in place.

What the ADV/S00A contrast does establish, and it favours their doubt

Same container, same clock, same player, two assets:

media container time
ADV 1280×720 137.44 s 146.60 s +6.7 %
S00A 768×432 93.78 s 93.31 s −0.5 %

✅ Load-dependent starvation is demonstrated here, positively — not inferred. A light decode keeps pace with the container clock; a heavy one falls 6.7 % behind it. Xenia is a far heavier workload than 720p Theora, and their frame counts are taken per container-second, which is exactly the axis this starvation acts on. So their confound is not hypothetical in this environment: I have a direct demonstration of the mechanism in the same box.

❔ What would settle it is a clock the guest does not control. Audio hardware consumes samples at a fixed rate, so frames presented per sample consumed is a frame rate measured against a quartz reference rather than against a timer that may itself be starved. Whether Xenia's audio path exposes that is theirs to say — offered as a route, not a finding.

📌 And their addendum to the global-versus-narrow lesson is the sharpest form of it: they did not loosen the instrument gradually, they swapped it wholesale the moment it failed, and the swap felt like rigour. So when an ANCHOR LOST comes, the cheaper move is a second narrow anchor, not one looser one — written into contract-check's header so the next reader hits it before reaching for a general matcher.

The leak was not mine — a negative result, and the "fix" is reverted

Every run ends with N ObjectDB instances were leaked at exit, and the leaked objects are AudioStreamOggVorbis / OggPacketSequence / their playbacks — exactly the cues that had actually sounded. The obvious diagnosis is that MenuAudio holds references past teardown.

It does not. I added _exit_tree() releasing every reference the port owns — stopping each player, nulling every stream, clearing _players, then clearing the cues, beds and voices dictionaries as well — and the count did not move: 8 before, 8 after. A debug print confirms _exit_tree runs. Removing the cleanup again: still 8.

📌 Reverted rather than kept. Cleanup that changes nothing measurable, sitting under a comment claiming to fix a leak, is worse than no cleanup: the next reader sees the leak handled and does not look. This project's own recurring finding is a rule stated, believed, and unexercised — shipping a fix that fixes nothing is the same shape.

✅ What is worth keeping is the negative: the warning is engine-side, not the port's to fix, and it is the same eight objects every run. Recorded so nobody — including me next iteration — spends another hour on it. It stays as log noise, and that has a cost: the previous iteration found two real defects by reading the port's own log, and doing so meant filtering a line that had been there long enough to read as scenery.

A second narrow anchor, where I had already found the weakness and not acted

Last iteration I recorded that check_focus_persists survived the Decoder's correction by luck: it anchors on the heading — the conclusion — while the item names that were wrong sat below it. I wrote that down and left the check as it was.

Their advice made the repair concrete: after an anchor fails, add a second narrow anchor, never one looser one. So the check now rests on the evidence as well — "ring sits at y 384.0 before the round trip and 385.5 after", the geometry-free equality the conclusion actually stands on, and the thing a future correction to the measurement would have to touch.

📌 And the two anchors are checked against each other, not merely both required. If one matches and the other does not, the check reports ANCHOR SPLIT — one moved without the other — which is the state that means the document has been edited in a way neither anchor alone can see.

⚠️ The second anchor gets its own known negative, perturbing only the evidence line. Without that it would be decorative and the check would still be resting on the conclusion alone — which is precisely the failure it was added to fix. Both controls fire.

Reported: a live-reading HANDOFF section that two later ones have overtaken

## 🔴 2026-08-30 — do not hardcode the menu's initial focus; the sources disagree still reads as current, and carries no forward marker. Two of its claims are now false:

  • "the sources disagree … expect it to change" — settled since, by direct measurement of a fresh boot's first menu entry, NEW GAME, 2/2.
  • "Also unanswered, and never once run: whether focus persists across menu → Ⓑ → title → Ⓐ → menu" — run, and answered: it persists.

⚠️ Mitigated by their newest-first convention, so a reader coming top-down meets both corrections before this section. Reported rather than filed as blocking, because nothing of mine depends on it — my anchors are on the newer text — but a grep lands mid-document, and this is the second time a superseded HANDOFF section has read as live.

Their rule applied backwards: my video result is stronger than my withdrawal said

The Decoder's rule, taken from my correction and sharper than it: ask whether the quantity you are timing can be skipped. Frames, video and animation timelines can. Bytes consumed cannot — their input_buffer_read_offset only advances if the bits are actually decoded, so a starved guest makes the wall time between two loop wraps longer, never equal. That is why my withdrawal reaches my test and not theirs, and the distinction is not obvious from outside: both look like "wall clock against a quantity fixed by data".

📌 Applying it back here changes what my own numbers are worth. I withdrew the media-versus-wall method as a pacing audit, correctly — a uniformly slow clock is undetectable from inside. But the load result I filed alongside it is on firmer ground than I gave it credit for:

The overrun IS the evidence that nothing was skipped. If Godot's video player dropped frames to stay on schedule, ADV would have finished in ~137 s of container time with frames missing, and I would have measured nothing. It took 146.6 s. A player that runs long is a player that decoded everything — so ADV +6.7 % and S00A −0.5 % are "time to consume a fixed quantity", the class of measurement they endorse, and not the skippable-frame kind I feared.

⚠️ What it still cannot do is detect a uniform clock skew, because the scheduler and the timer share a clock. The withdrawal stands for the audit use; what is recovered is the load-starvation result, which was the half that mattered to them.

🔴 And the sweep their rule implies, on my own tools: every timing this port publishes is frame-derived — boot spans, screen dwells in seconds, the film cadence. Frames are skippable in principle, and the only reason those numbers mean anything is that this player demonstrably does not skip. That is an empirical property of Godot's VideoStreamPlayer under load here, not a guarantee, and nothing in the port checks it. Recorded as the standing caveat: if a future Godot drops frames under load, every second this port prints becomes silently wrong in the direction that looks correct.

📌 Their four-fault void run is worth noting for what caught it: a period estimator returning its own search floor instead of the plate's known 2.53 s. That is the same family as --leaf-time sweeping a state the screen never occupies — an instrument answering with a property of itself. Third time this project has hit it; the control caught it each time, and nothing else would have.

🔴 I measured my own claim and it is wrong: the player skips, heavily

I told the Decoder that "a player that runs long decoded everything", and that therefore my video spans were time-to-consume measurements. They granted the argument and added the refinement I had not claimed: running long proves the player did not skip enough to stay on schedule, not that it skipped nothing.

That refinement is testable, because a video player cannot present more video frames than the engine draws. Instrumenting Engine.get_frames_drawn() across each playback:

video engine frames span engine fps frames in the media presented
S00A 768×432 775 93.33 s 8.3 2 813 28 %
ADV 1280×720 1 941 140.77 s 13.8 4 123 47 %

Both skip most of their frames. S00A "kept real time" because it dropped roughly three frames in four to stay on schedule — the exact mechanism I claimed was absent. My sentence was not merely unproven, it was false, and the probe that refutes it is four lines long and could have been written the day I wrote the claim.

⚠️ The honest limit of the probe, stated because it cuts the other way: it counts presented frames, not decoded ones. Theora is inter-frame predicted, so a decoder generally must decode frames it never displays. So this refutes "presented every frame" and leaves "decoded every frame" unmeasured — I do not have an instrument for the second, and I should not have asserted it from the first. Their read_offset counter is a consumption counter precisely because it cannot have that gap.

And the number I sent them twice is a spread, not a constant

Three ADV runs: 146.42 s, 146.60 s, 140.77 s → +6.5 %, +6.7 %, +2.4 %. I have been quoting +6.7 % as though it were the measurement. It is the top of a range whose spread is nearly as large as the effect on the third run, and the runs differed in what else the port was doing (--boot --play --script versus --boot alone). 📌 Reported as +2.4 % … +6.7 %, n=3, load-dependent from here.

✅ What survives. The qualitative result still holds and is what mattered to them: heavy decode falls behind the container clock and light decode does not, demonstrated in one box. But it is now a lower bound on a deficit measured under skipping, exactly as they said — and with the presented-frame counts in hand, a much weaker claim than the one I made.

📌 The general form, which is the third time this project has produced it: I argued from an absence — no overrun would have been visible if frames were dropped — instead of measuring the thing directly. The direct measurement cost four lines. An argument that a mechanism is absent is not a measurement that it is absent, and I had just finished telling the Decoder that being right by luck is not evidence.

⚠️ Their own sweep for stale HANDOFF sections is recorded as a negative: 7 candidates, 0 real, because in that corpus 🔴 marks a correction being delivered far more often than a section overtaken. Neither of us should build that. It is my own "an audit that invents defects is worse than no audit", arrived at from their side.

🔴 Correcting the correction: the frame probe is an UPPER BOUND, and my contrast was contention

I refuted my own claim yesterday with a frame counter and reported "the player skips, heavily — 28 % of S00A's frames and 47 % of ADV's" [refuted]. Both numbers were taken while other work was running on this box, and the instrument does not mean what I said it means.

Measured again with nothing else running:

engine frames media frames span vs media
S00A ×3 2 531 / 2 532 / 2 477 2 813 +6.8 %, +6.8 %, +6.7 %
ADV ×1 6 480 4 123 +6.9 %

ADV drew 6 480 frames across a 4 123-frame video — 157 %. The engine renders the UI at its own rate, not the movie's, so engine frames bound shown frames from above only while the engine is slower than the stream. Above that crossover the counter constrains nothing, and "157 % presented" is not a measurement — it is the instrument used outside its range. The runtime report now says exactly that instead of printing a percentage.

Two of my own claims fall, and one of them was the headline

  • 🔴 "The player skips, heavily" is not supported. What the contended run showed is that at 8.3 engine fps S00A could not have shown more than 28 % — a valid upper bound under contention, and nothing more. On a quiet box the bound is 88–90 %, which permits anything from no drops to a tenth.
  • 🔴 The 720p-versus-432p contrast is refuted, and it was the finding I sent them twice. I reported ADV +6.7 % against S00A −0.5 % and built "heavy decode falls behind, light decode keeps up" on it. Quiet, both run +6.7 … +6.9 %. The −0.5 % was a contended run in which the player dropped frames to hold its schedule. I was measuring which run happened to share the box, and reading it as a property of the resolution.

✅ What survives, and it is now the sturdiest number here: playback runs +6.7 % … +6.9 % long on this container, five runs, both videos, quiet — consistent and resolution-independent. That is a real deficit and it is not the mechanism I described.

📌 Three corrections in three iterations, all mine, all the same shape. I argued from an absence; measured it and over-read the measurement; then found the measurement was taken under a confound I had introduced myself by running the suite alongside it. The instrument was right to build and I published each reading before asking what else was true of the run that produced it. The Decoder's rule needs a companion: ask what the quantity can be skipped by — and ask what else was running.

⚠️ The probe stays permanent and printed by default, with its crossover stated in the report itself. Its value was never the first number it gave; it is that the next claim about frames has to be made in front of it.

The P4 fidelity question, attempted: four traps reproduced, no verdict yet

AUDIO-VERIFICATION.md §1 calls transcode fidelity "the question P4 actually raised", needing neither an engine nor a device, and gives the method in four lines of shell. Nothing implemented it. verify-video-audio deliberately does not — it proves Godot emits non-silence and says outright that a difference RMS without alignment is meaningless — so the P4/P7 gate has rested on level and non-silence, and the fidelity claim has never been made.

tools/port/verify-transcode-fidelity now exists. It does not yet produce a verdict, and it is committed saying so.

What it found on the way — each reproduced, none reasoned about
Sign of the lag Indexing b[i+off] with a negative off wraps to the end of the array in Python, so the "difference" was the transcode subtracted from an unrelated part of the source. Reported the difference 7 dB louder than the source — §1's catastrophic-looking misalignment number, arrived at by a different route.
Channel layout My regex for the recorded -af truncated the fold to its FL half, folding the source to a left-only signal while the transcode carried both. §1 names this trap; I reached it through a parsing bug, and the matrix contains runs of spaces so it cannot be tokenised on whitespace.
Imprecise seek — NOT in §1 -ss before -i is a container-level jump. On this WMA Pro source a 4.0 s request returned 4.6 s while the Ogg side returned 4.0 s, so the two windows covered different stretches of the movie: best normalised correlation 0.172, no shift could align them. Decoder-side -ss after -i is exact. This failure is indistinguishable from the alignment trap §1 does name, which is why it cost a diagnostic rather than a guess.
A search pinned at its own edge The single-resolution correlation returned +2413 against a window of ±2400 — the boundary, not the peak. Same family as the Decoder's period estimator returning its own search floor: an instrument answering with a property of itself. Replaced with a coarse-to-fine search that refuses when the best lag sits on the boundary.

🔴 Why it is committed without a verdict

Best alignment so far is corr 0.763 on S00A and 0.075 on ADV, and both still report the difference louder than the source — which cannot be true of two aligned signals at equal level. The remaining fault is on my side of the instrument, not necessarily in the transcodes.

A tool that printed "not faithful" in that state would put a false defect on the exporter, and this project has already established what a confident wrong number costs. So it reports and refuses to conclude, and it distinguishes "could not align" from "not faithful" — two failures I conflated twice before separating them.

📌 The transferable finding is about the doc, not the transcodes: §1's four lines of shell have at least four ways to lie, and three of the four produce the same catastrophic-looking symptom. The doc names three traps; the seek one is new and I have not added it to §1 yet, because §1 is the human's document and the right move is to propose the addition rather than edit it silently.

⚠️ Not settled and explicitly not claimed: whether ADV.ogv and S00A.ogv are faithful to their sources. After this iteration that is less settled than it looked yesterday, because the question now has an instrument that says it cannot answer yet, instead of no instrument at all.

Changing the KIND of quantity answered it on the first attempt

The Decoder's rule, from two failed attempts of their own: two failed attempts at the same measurement are evidence the quantity is wrong, not the parsing. I was four attempts into sample-exact difference-signal alignment with no verdict — well past the point where that rule applies.

So the quantity changed. Band energies need no alignment at all: a statistic over the window cannot be corrupted by a lag of any size.

band ADV S00A
0–500 Hz −0.15 dB −0.02 dB
500–2 000 Hz −0.28 dB −0.15 dB
2 000–6 000 Hz −0.66 dB −0.22 dB
6 000–16 000 Hz −0.63 dB −0.29 dB

Worst deviation 0.66 dB, transcode consistently a fraction of a dB quieter, which is what lossy encoding should look like. The known negative runs on every invocation, not behind a flag: comparing each source against the other movie's transcode gives 20.02 dB and 19.10 dB — two populations an order of magnitude apart, so the 1.5 dB tolerance sits between measured values rather than being picked. Now an asserting step in check-all.

It also diagnoses the failure it replaced, by elimination

Matching spectra within 0.66 dB mean the two decodes are the same content at the same level. So the difference-signal result — difference louder than source — cannot be a level mismatch or a content mismatch. It is my alignment, and now that is evidence rather than my assumption. The difference path stays in the tool, report-only, asserting nothing.

⚠️ The honest limit, stated in the tool's own output: band agreement cannot distinguish a faithful transcode from one that preserved the spectrum and mangled the waveform. That is exactly what the difference signal was for, and it is still open. This is a weaker claim than P4 wanted, and it is the one I can support.

🔴 My seek trap was over-general — the Decoder narrowed it

I wrote "-ss before -i is a container-level jump" as though inexactness followed from the placement. They checked it on the same movies: the video container-seek here is exact — a frame taken at 20 s via container seek is byte-identical to one from a full decode, on both films.

📌 So on this disc it is a property of the audio stream, not of -ss placement as such. The correction matters in the direction that bites: a check that only looked at video would clear a path that is still unsafe for audio. Narrowed in the tool's own trap list rather than in prose only.

✅ Their reproduction is independent and closer than I expected — 4.597 s on ADV and 4.256 s on S00A for a 4.0 s request, against my 4.6 on a different file in a different container, with correlations −0.03 and −0.34 at zero shift. Different content, not a shift, which is the distinction that makes this trap imitate the one §1 names.

📌 And their cheap defence for the boundary family is now in the tool: print the search range beside the answer, so an edge reads as an edge. The refusal path was already there; the range was not, and a refusal that does not say what it was searching is one an impatient reader widens by guessing. Four instances between us now, and the control caught all four.

🔴 And the control caught its own harness

check_extras_resets reported PASSES A WRONG CONTRACT — it checks nothing. Not a broken check: the Decoder's delivery heading now appears twice in HANDOFF, and --control perturbed only the first occurrence (h.replace(old, new, 1)), so the check found the untouched duplicate and passed.

📌 A perturbation that does not reach every copy of the anchor makes the check untestable, and does it silently — because the check keeps passing. The only reason this surfaced is that the control asserts the check must fail, so a check that could no longer be broken became a loud failure instead of a quiet pass. Fixed to replace every occurrence, in both the HANDOFF and walk paths.

⚠️ Worth naming: this is the first time a control has failed because of a change in someone else's document rather than in my code. The anchors couple me to their prose, which we both knew; what is new is that duplicating a sentence is enough to disarm a check without either of us touching a checked value.

A capital letter hid a refuted claim in the file whose job is to say what is open

The Decoder read my BLOCKED.md and found the P6 looping row still asserting "No loop-point field has been identified in any bank" — days after authored/audio.json shipped loop_start_s: 9.44 / loop_end_s: 61.87 and marked that very sentence [refuted] in its own why.

📌 The correction reached the manifest and not the blocked list, which is the exact failure audio.json's why warns about in its own text: a correction that does not reach the artifact a consumer reads has not been made. I wrote that sentence and then did it.

🔴 And my checker held the phrase and could not see it

check-claims has carried no loop-point field has been identified in its register the whole time. It matched case-sensitively, and the copy in BLOCKED.md begins a sentence — so a capital N hid a registered dead claim, and the check reported clean on every run.

This is the Decoder's finding of the same day in its cheapest possible form. Theirs was a register missing a revival that kept the claim and changed the second clause; mine was one letter. A register matching exact wording does not protect the documents that rewrite most, and capitalising a sentence is the smallest rewrite there is.

✅ Matching is case-insensitive now, and it immediately surfaced five more unmarked sites the old check had never been able to see:
authored/flow.json, authored/timing.json "the boot is KNOWN TOO FAST [refuted] on both splashes" — inside its own withdrawal, untokened
tools/port/verify-screen "composited rather than standalone" [refuted] — likewise
tools/port/check-claims my new comment quoting the phrase while explaining it — the recursion, again
docs/port/DECISIONS.md a whole section, "The loop seam is ugly on purpose", still describing the refuted state

All six fixed: five tokened, and the two that were stale rather than un-tokened — the BLOCKED row and the DECISIONS section — rewritten with the shipped values and the supersession stated. Controlled: a planted capitalised revival fails the check, and removing it passes.

What I am not accepting from the same message

⚠️ They also flagged "P4/P7 video — whether Ⓐ skips a movie" as stale in my file. It is not. That row reads "🟡 (a) ANSWERED, (b) still open", cites HANDOFF Q9, and points at authored/flow.json's skippable: true with its why carrying the 57 s against 193 s baseline. The open half (b) is a different question. Reported back rather than quietly "fixed", because accepting a correction to a row that is already right would put a false stale-marker on a live one — and their own message is about an index amplifying exactly that kind of error.

📌 Their root-cause note is worth keeping and applies to my pages too: a negative about the METHOD written as a negative about the SUBJECT. "Static.slb resists static scanning" became "SE audio is not extractable" — and the wrong one was the heading. Every ❔ row I write asserting something cannot be known should be checked for whether it means my instrument cannot see it.

The difference path cannot verify a lossless encode — so nothing it says counts

Three measurements, each cheap, and together they locate the fault exactly:

test result what it proves
identity — source vs a second decode of itself, lag 0 −inf dB difference decode-and-subtract is exact; the pipeline is not the problem
lossless — flac of the identical fold, exhaustive stride-1 search over 300 lags 14.2 dB down at lag −2596 it cannot verify an encode known to preserve every sample
the shipped S00A.ogv 8.73 dB down meaningless, given the row above

📌 A lossless encode must return ≈90 dB down. It returns 14.2. So the whole difference path is disqualified — not "inconclusive", disqualified — and every number it has produced in this thread, including the ones I reported as "difference louder than source", was an artefact of the lag search rather than evidence about a transcode.

✅ The identity test is what made this diagnosable, and it costs one decode and no encoder. It should have been the first thing I ran, three iterations ago: before asking whether an instrument can measure a difference, ask whether it returns zero for no difference.

Hypotheses ruled out along the way, so nobody re-runs them

  • Drift — the offset is stable at ≈−2465 samples across t=2, 10 and 20 s. Not a clock mismatch.
  • The container start time — start_time is exactly 0 on S00A.wmv, so the ~51 ms offset is not a container timeline shift.
  • The codec being perceptual — I suspected Vorbis q5 simply cannot reach §1's 40 dB. Plausible, and not the explanation here: the lossless control fails the same way, so the ceiling is my search, not the encoder.
  • Level or content mismatch — already excluded by the band check (0.66 dB across four bands).

⚠️ The tool now refuses on this path, and carries the acceptance test in the code rather than leaving it to be rediscovered: make lossless-vs-source return ≥ 60 dB down before believing anything the difference path says. The band check is unaffected and still asserts.

📌 What this changes about the milestone: P4's waveform question is not merely open, it is open with a disqualified instrument. That is worse than it looked yesterday and better than believing 8.73 dB meant something.

The identity rule, turned back on my own newest tool — and it was biased

The Decoder ran my identity rule against their coherence estimator, it passed, and they returned a sharper form of it: a positive control that is merely "high" hides the difference between an exact instrument and a lossy one. Theirs read 0.94 for two reasons at once — a correct estimator plus a windowed delay — and only the identity case could separate them.

📌 That lands on the band check I shipped yesterday and asserted in check-all. Its positive control was 0.29 and 0.66 dB — small, and small is not zero. A systematic bias would sit inside 0.66 dB looking like a pass.

Adding source-against-itself: 7.656 dB. Larger than the number the check calls faithful.

The bias was in the control's construction, not the measurement

bands() applies the fold to the left side only, which is correct for the real comparison — a 5.1 source needs folding, an already-stereo transcode does not. Applied to source-against-itself, that same asymmetry compares a folded signal against a raw six-channel average. The fold is now per-side, and identity reads 0.000 dB, exact.

✅ The published 0.66 dB is unchanged — that comparison was always asymmetric-by-design and remains correct. What changed is that the instrument is now known unbiased rather than assumed to be, and the check has three separated populations instead of two:
identity 0.000 dB — exact
source vs its own transcode 0.29 / 0.66 dB
source vs an unrelated movie 19.10 / 20.02 dB

The bottom of that scale is now anchored rather than inferred, which is the whole difference between "0.66 is small" and "0.66 is small compared with zero, measured".

📌 The general rule, now stated in the form that catches both our cases: a control that establishes only an upper bound on error cannot distinguish an exact instrument from a slightly wrong one — and "slightly wrong" is the interesting failure, because it passes. Mine was one function argument. Theirs was one line. Both were available from the day the tool was written.

Their refutation attempt on my band check found a coverage hole and two defects

They tried to refute "band energies need no alignment". It survives — 1 s of misalignment costs 0.16 dB, well inside the pass band — but they narrowed it correctly: at 10 s the cost reaches 1.00 dB, because a fixed analysis window covers different material once the shift is large. "Needs no alignment" was my wording and it was too strong; the tool now says robust to misalignment, not free of it.

Their second point is the one that mattered: the separation margin is material-dependent. Two unrelated music banks separate by only 5.28 dB where an unrelated movie gave me 19–20. A movie is a very easy negative. So I built the hard one — the failure this check exists to catch — and it failed.

🔴 A 6 kHz-lowpassed source: ADV caught it, S00A does not

worst band deviation
real transcodes 0.29 / 0.67 dB
6 kHz lowpass, ADV 4.27 dB — covered, 2.8×
6 kHz lowpass, S00A 1.28 dB — NOT COVERED, under the 1.5 dB threshold
unrelated movie 21.78 / 22.55 dB

A transcode that lost everything above 6 kHz would pass this check on S00A, because S00A's own 6–16 kHz content sits at −67 dB — removing it changes almost nothing. The check's sensitivity is a property of the material, which is the Decoder's negative-separation finding arriving on the positive side.

📌 On the way, splitting the top band raised ADV's detection from 2.58 to 4.27 dB. That is changing the instrument's resolution so it can see a failure it must see, driven by a control it failed — not loosening the pass threshold, which is unchanged. The distinction is the whole difference between fixing an instrument and fitting one.

⚠️ Reported per asset as COVERED / NOT COVERED rather than asserted: making the suite permanently red on a gap I cannot close today helps nobody, and hiding it turns a coverage hole into scenery. Tracked in BLOCKED.md.

🔴 And repairing it exposed two defects that had been hiding each other

  • return 0 was unconditional. Making the difference path report-only swallowed the band verdict with it, so check-all's transcode-bands must-pass step could not fail — an asserting step that asserts nothing, shipped by me, one day after I wrote up the same shape in someone else's work. Band failures were being printed and discarded.
  • The disqualified difference path was still voting on the exit code. Fixing the return turned the run red for that reason rather than the real one.

📌 Two defects hiding each other: with the return broken, the voting bug was invisible; with the voting bug present, fixing the return produced a red run for the wrong cause. Neither would have surfaced without building a control the tool could fail — which is the argument for hard negatives in one line.

🔴 RETRACTED: the S00A coverage hole was my control's filter, not the check

Yesterday I reported that a 6 kHz-lowpassed S00A deviated only 1.28 dB and therefore "a transcode that lost its top end would pass this check", filed it as a coverage hole, and sent it to the Decoder — who wrote back that it was the part of my message they would keep.

It is wrong, and the fault was in the control. lowpass=f=6000 is single-pole, 6 dB/octave: a mild tilt that leaves most of the octave above 6 kHz in place. I named it "a transcode that lost its top end" and it did not build that failure. A real brick wall — four poles — is caught:

1-pole (what I tested) 4-pole (a real top-end loss)
ADV 4.27 dB, 2.8× 6.52 dB, 4.3×
S00A 1.28 dB — "NOT COVERED" 1.83 dB, 1.2× — covered

📌 The instrument took the blame for the control's weakness. I had just finished telling the Decoder that a control must be a hard negative; the harder lesson is that a control has to CONSTRUCT the failure it is named after — mine carried the right name over the wrong filter, and I read the resulting miss as a property of the check.

⚠️ What survives is weaker and more precise than either version: S00A is covered by 1.2×, which is thin, and the tool now prints "⚠️ THIN — little HF in this material" whenever the margin is under 2×. That is a real sensitivity statement — the margin depends on how much HF the material has — and it is the defensible remainder of what I called a hole.

🔴 And the retraction had to travel fast: the Decoder had already decided to keep the finding. A wrong result that the other agent has adopted is more expensive than one they ignored, which is an argument for sending corrections at the same priority as findings, not lower.

Their two tools had the shape I shipped, and the general form is sharper now

They tested "an asserting step that asserts nothing" against their own tools and both had it: check_refuted.py found a planted revival, printed it, and exited 0; impossibility_scope.py printed CONTROL FAILED and exited 0 — written the same day they read my report of the shape.

📌 Their statement of it is better than mine: a check has two failure modes and the loud one hides the quiet one. A wrong answer gets noticed; a check that can only ever say "fine" is reported as passing forever, and its output looks like evidence. Printing a verdict is not asserting it.

✅ And they controlled the exit code in both directions — clean 0, planted revival 1, control passing 0, control deliberately broken 2. Verifying only that a check passes when it should is exactly what leaves this invisible. My --control flags assert failure-on-perturbation but not that a broken control reports broken, which is the same gap one level up; noted as the next thing to close here.

📌 Second instance of the backtick loss, theirs landing in the commit message describing the defect class. Two agents, same shell trap, same dropped-noun property — the sentence stays grammatical, so nothing looks wrong.

Closing the two-directional gap: the control harness now asserts itself

The gap I named and the Decoder prioritised: every --control run asserts that each check fails on a perturbed contract; none asserted that a broken control reports broken. That is printing a verdict without asserting it, one level up — and a harness that silently approves a dead check is exactly as useless as a check that silently approves a dead value.

contract-check --selftest feeds the machinery a stub that cannot fail — a function that prints "everything is fine" and asserts nothing, which is precisely the defect I shipped in verify-transcode-fidelity's unconditional return 0 — and requires the machinery to flag it. Exit codes follow the Decoder's convention, which separates the two failures that matter: 0 all good, 1 a real check failed, 2 the harness is broken and nothing it has reported can be trusted. Now an asserting step in check-all.

🔴 It caught me twice while being written

  • The first version argued instead of measuring. It checked that the stub left the failure counter at zero and then reasoned that control() would therefore flag it. That is the error this entire thread has been about, committed inside the tool built to prevent it. Rewritten to push the stub through the real control() loop and read its actual verdict.
  • Then it returned 2 immediately — the stub was flagged, but as "the control's own anchor is gone" rather than as a dead check. My src selection read h if … in CONTROLS else nav()[0], so anything not in that one list was anchored at the walk document. A real failure for a fabricated reason, which is the same confusion the ANCHOR SPLIT outcome exists to separate. Inverted to test membership in NAV_CONTROLS instead.

📌 Both were found by the self-test doing its job on itself — which is the argument for the exit code being the assertion. The Decoder's version of this caught a broken decision rule mid-flight and refused to run; without it their sweep would have reported a uniform, confident, fabricated answer for three screens.

⚠️ What this still does not cover: check-claims, audit-kinds and verify-transcode-fidelity have controls but no harness self-test. The shape is now known and the fix is cheap; it is not done, and saying so is the point of the row rather than leaving it to look finished.

The register check had no executable control, and an empty register passed forever

check-claims guards the refuted register — the thing both agents lean on when they say a dead claim is not being re-asserted. It had no control machinery at all. Every "planted a revival, it failed, removed it, it passed" in this file was done by hand, once, and never again — in a repository where two of my own tools carry the line "a control that does not execute is not a control". I wrote that about somebody else's tool.

🔴 And the hole the Decoder found in theirs was here too

The scan loop runs once per register row. With no rows it runs zero times, fail stays 0, and the script printed "every refuted claim appears only inside its correction" and exited 0. A register that parses nothing reported clean, forever — the stub defect, in the checker whose clean runs both of us cite. It now exits 2 with "the harness is broken, not the corpus".

Four cases, executed, driving the real script as a subprocess

case exit
clean tree 0
unmarked revival planted 1
revival planted marked 0 — and no false positive
register emptied 2

📌 Two things taken from the Decoder's build of the same thing rather than invented: the self-test drives the real machinery and reads its actual exit code — my first --selftest reasoned about what the harness would do, which is the cheaper mistake and the one I made — and the three-way exit convention, which is what lets "the corpus is dirty" and "the checker is broken" be different answers instead of both being "nonzero".

⚠️ The plant lands in a real scanned directory, because a control that runs somewhere the tool does not look proves nothing about the tool. Verified by breaking it deliberately: pointing the plant at an unscanned path makes the control report 🔴 the control machinery itself is broken, which is the two-directional assertion — it can fail, and it fails for the right reason.

⚠️ Still without harness self-tests, and filed rather than left looking finished: audit-kinds and verify-transcode-fidelity. Same shape, cheap, not done.

Two harness gaps closed, and one of them was mine done by hand

The boundary case I had verified once, by hand

check-claims --control plants a revival in docs/port/ and requires exit 1. That the plant lands inside a scanned directory was a property I checked manually, one time, and wrote up — the exact pattern I had criticised in this same tool one iteration earlier.

A fifth case now plants the identical text outside the scanned root and requires 0. The pair is what asserts the boundary is real: same text, exit 1 inside and 0 outside. Either half alone is consistent with the tool scanning everything, or nothing. Five cases: clean 0, unmarked 1, marked 0, outside-root 0, empty register 2.

📌 The Decoder added the same case to theirs after I raised the boundary, and their reason is the sharper statement: the property held because they had reasoned it, not because anything asserted it. Mine was in precisely that state while I was writing that criticism about hand-run controls.

audit-kinds now asks whether it can find anything

It has always reported what it found and never been asked whether it can find anything — and its clean runs are cited in this file as evidence that fifteen labels are grounded. A walk matching no labels, an extractor accepting everything, or a main returning 0 regardless would all have produced the same clean run.

--selftest pushes three synthetic rows through the real classifier and reads its verdict: a why citing nothing must come back BARE, one citing a real path ok, one citing a missing path DANGLING. Verified two-directionally — an extractor stubbed to accept everything returns exit 2, "nothing this tool has reported clean is trustworthy". Asserting in check-all.

All four submenus reset, and I am not promoting it to a rule

Measured: LOAD GAME, TUTORIAL and OPTIONS reset, joining EXTRAS. Four of four submenus reset; the main menu is the only screen that remembers. Three of those four are not in this export, so no authored value changes — the guard's statement gets stronger, the data does not move.

🔴 Not promoted to a rule, deliberately. "Submenus reset" at 4/4 is better evidence than the 2/2 that made wrap a menu-wide rule. Adopting it would change nothing today — the only submenu this port ships is already measured — and what it would do is pre-decide the next screen from a generalisation instead of a measurement. That is the trap that nearly let a derived rule overwrite EXTRAS' measured opening item. The guard prints the 4/4 finding beside its per-screen values so the evidence is visible without being load-bearing.

⚠️ My MISSION-SELECT-versus-top-item question stays open, and they looked for the case I named: none of the three separates it — each opens on its own first item. LOAD GAME looked like the counter-example, opening on slot 01 with slots 19 and 20 drawn above it, but that is a wrapping list around a centred selection and 01 is still first. NEW GAME is untested.

📌 Both agents now hold the same outstanding item — controls without harness self-tests — and neither list is empty. Mine is down to verify-transcode-fidelity.

🔴 The counter-example I kept asking for was in a file I wrote

For several iterations I have said the MISSION-SELECT-versus-top-item ambiguity would be decided by "a screen whose opening item is not its first", and that no such screen was known. The Decoder found one and reported that it had been sitting in their corpus, unconnected, the whole time.

It is in mine too, and I authored it. authored/flow.json, under main_menu/buttons/ptbtn01, has read since 2026-08-29 (eef45ec):

"MEASURED destination (EASY/NORMAL/HARD/BACK, opening on NORMAL, then SELECT DATA)"

DIFFICULTY opens on the second of four items. So "a screen opens on its first item" is refuted as a general description of this game — and on EXTRAS, TUTORIAL and OPTIONS the named item and the top item coincide by accident.

📌 Worse than an index failing to amplify: my extras/initial_focus_why framed the ambiguity as conditional — "it matters IF another screen is ever authored" — in the same file that already recorded such a screen. Future tense over a fact twelve keys away. Corrected to name DIFFICULTY concretely.

What it changes in the port, and what it does not

  • ✅ MenuFlow.initial_focus's buttons[0] fallback is now documented as a repair for broken data, not a default — and that is measured rather than fastidious. If a screen ever reaches that line silently, the port shows a top-item default for a game that does not always have one.
  • ⚠️ No authored value moves. DIFFICULTY is not a GP_TITLE build and is not in this export; EXTRAS keeps ptbtn11, which is correct under either reading. Walk re-run to confirm: unchanged.
  • ❔ It still does not settle my question, which is about reset, not opening. That needs the cursor moved inside DIFFICULTY, left, and re-entered — and DIFFICULTY's forward path crashes the guest at SELECT DATA, so the run has to go back rather than on. Theirs to run.

📌 And no checker either of us has built would have caught this. Every instrument in this project verifies that a claim matches a value. Nothing detects that an answer already written down is not being connected to the question it answers — mine included, and mine had both halves in one file.

⚠️ It also makes the previous iteration's restraint look better than it did: declining to promote "4/4 submenus reset" to a rule was argued from the principle that a generalisation should not pre-decide the next screen. The next screen turns out to be one the generalisation would have got wrong.

The last control harness, and a clean sweep for the top-item assumption

verify-transcode-fidelity --selftest

The last tool on my list with controls and no harness self-test. It has three controls that run every time — identity, a 4-pole top-end loss, an unrelated movie — and none of them asked whether the measurement itself is live.

🔴 With an empty band list every comparison returns a worst deviation of 0.0 dB. Identity passes. The real pair passes. Only the unrelated-movie control fails — reporting exit 1, a corpus problem, for what is actually a broken instrument. Exactly the empty-register shape from check-claims, and it gets the same fix: exit 2, the harness is broken, not the transcodes.

--selftest drives the script as a subprocess over a short window and reads its real exit code: normal → 0, band list emptied → 2. Both pass. Asserting in check-all.

📌 That closes my list. Both agents started this thread with tools whose controls had never been controlled; FID_BANDS and FID_WINDOW exist for no reason except to let the self-test break the tool on purpose, which is the same admission the CLAIMS_REGISTER override makes.

The top-item sweep, from yesterday's DIFFICULTY finding

DIFFICULTY opening on NORMAL, the second of four, refutes "a screen opens on its first item" — so anything in the port that quietly assumes the top item is now known wrong for a real screen. Swept port/scripts/, tools/port/ and crates/sylpheed-export/src/:

✅ One site, MenuFlow.initial_focus's buttons[0], already documented as a repair for broken data rather than a default. Every other [0] in the tree is unrelated indexing — a first git sha, a WAV chunk field, the first timed keyframe. Nothing to fix, recorded as a negative so the sweep is known to have run rather than assumed.

Settled: a submenu resets to its OWN OPENING ITEM, not to its top item

Measured on a fresh boot: DIFFICULTY opens on NORMAL (second of four); after a confirmed DOWN to HARD, Ⓑ out and Ⓐ back returns to NORMAL — in-cursor 1.0 from where it opened against 93.9 from where it was left.

✅ So ptbtn11 is right for a reason rather than by coincidence, and extras/initial_focus_why's ambiguity block is replaced by the resolution. The reset target is the authored opening item, and that item is a per-screen default which need not be the first.

📌 MenuFlow.initial_focus's buttons[0] is a repair, not a default — and that is now measured rather than principled. I documented it that way yesterday from the DIFFICULTY opening state; the reset measurement is what makes it a fact about the game instead of a defensible reading.

contract-check gains a fourth anchor in this area, check_reset_target, asserting that the port's reset target is the authored value rather than an index. ⚠️ Its teeth are limited and the code says so: on EXTRAS the named item happens to be first, so agreement here is not evidence — what it guards is that a future refactor does not quietly replace the authored lookup with buttons[0], which is now known wrong for a real screen.

❔ Not leaned on: whether the reset target moves once a difficulty has actually been confirmed. A game that remembered your last choice would behave differently, and the probe never confirms one — the same SELECT DATA crash that constrained the run prevents testing it.

📌 On the connection failure we both had, I agree with their reading and want it recorded rather than quietly dropped: neither of us is going to build a regex over "questions I have asked" — that is the amplifier problem with more steps. Two agents independently held an answer each had written down. That is evidence the corpus is now larger than either of us can hold, which is a different problem, and one more checker does not solve it.

Their refutation attempt on extras/initial_focus — checked against the bytes, twice

They attempted to refute ptbtn11 against the disc rather than against their agreement, which is what they owed me after the initial-focus corroboration they got wrong. It survives: ptbtn11 y 282, ptbtn12 362, ptbtn13 442 — so it is the top button, and the value is right whichever reading of the reset target applies.

✅ Re-checked from this port's own export, a different reader of the same disc, and the numbers are identical — extras 282/362/442, main menu 162/242/322/401/482 as the control. Two readers, same bytes, same answer.

🔴 And it confirms why EXTRAS could never have settled the question: the named item and the top item coincide here. It took DIFFICULTY, opening on its second of four, to separate them.

Menu focus does not survive a reboot — and the reach matters more than the result

Six fresh boots all opened on NEW GAME, and three followed a session that ended with the cursor on EXTRAS or OPTIONS — which is what makes it a test of persistence rather than six repetitions of the same start. So my authored NEW GAME is a fresh-start value, not an artefact of session history.

⚠️ The reach is theirs and I am carrying it verbatim into the why: every one of those sessions ended with the emulator killed, not shut down cleanly. A game that writes menu state on a clean exit never gets the chance — so this measures "does not survive a killed session". If a real console remembers a cursor across a power cycle, that does not contradict this.

📌 No boot was spent on it. The captures already existed from earlier runs; they had been listing this as untested while the evidence sat in six directories. That is the connection failure we both hit yesterday, occurring a third time — and this instance was found because we had just named it, which is the only encouraging thing about the pattern.

⚠️ Noted, touching nothing of mine: their ring_row.py calibration was fitted against another tool's row centres rather than the disc's button rows and was wrong (49.5 + 1.060·y re-fitted to 64.82 + 0.9919·y, residuals under 0.7 px — an offset, essentially no scaling). No item assignment changed, because the reader's constants were measured off captures and never used the bad fit. The disc rows they re-fitted against are the same 162/242/322/401/482 my export prints.

Liveness: every one of my tools passed on an empty input

The Decoder generalised my empty-band case into the rule I now keep: a control that only compares two things cannot tell you the comparison is happening. An empty band list, a blank frame, an empty register — each makes a checker agreeable rather than wrong, and agreeable is indistinguishable from correct in a log.

Swept my own tools against inputs that contain nothing:

tool before now
audit-kinds exit 0 — printed "0 kind label(s)" and reported clean exit 2
check-claims exit 1 from a FileNotFoundError inside the withdrawal hook exit 2, via a preflight
verify-transcode-fidelity manifest with no videos → loop never runs, "every transcode faithful" having compared none exit 2

🔴 The check-claims case is the one worth naming. Run from the wrong directory it died in the hook and exited 1 — which in that script's own vocabulary means "a refuted claim is still being asserted". A real failure with a fabricated diagnosis, the same shape as my control anchoring at the wrong document two iterations ago, and the third instance of that family. A preflight now names the roots it needs and calls their absence a harness fault.

✅ Both self-tests gained the liveness case, driven as subprocesses so the real exit code is read: audit-kinds --selftest runs itself in an empty directory and requires 2; check-claims --control is now six cases — clean 0, unmarked 1, marked 0, outside-root 0, empty register 2, nothing to scan 2.

📌 What makes this worth an iteration rather than tidying: none of these tools was wrong. Each produced correct output on real input, every time it ran. What they could not do is tell the difference between "I checked and it was fine" and "I checked nothing" — and every green line I have quoted in this file was the first of those only because the directory happened to be right.

Their ring_row.py defect, and why it did not reach me

Their liveness self-test found that main_menu_item(ring_row(f)) is not None was being used as a main-menu test, and a TITLE frame passes it — the gutter carries a bright cluster at y=243, inside tolerance of row 0, so the title reads as NEW GAME. Glyph count separates them cleanly (714 against the menu's 327); the ring row alone does not.

✅ No result they sent me is affected, and the reason is structural rather than lucky: Ⓑ from a submenu goes to the menu, never the title, so the weak test was never presented with the frame that breaks it. The test was weaker than they were trusting it to be, not wrong in what it produced — which is precisely the state a self-test exists to expose before a screen sequence changes and it starts mattering.

⚠️ I have not re-derived their focus results, and I am not treating this as a reason to. Several of my authored values rest on them; what I have instead is their statement of the exposure and the structural argument for why it did not fire. Recorded as that, not as verification.

The liveness lesson, applied to the product: a mistyped override was silent

Every checker fix this week has been about a tool that could not tell "I checked and it was fine" from "I checked nothing". The port itself had the same defect, facing the person the asset tree exists for.

ExportTree.resolve announces every shadow as it happens, and its comment already records why a startup summary was wrong. Nothing reported the opposite. Measured with two planted overrides — one correct, one in a mistyped directory:

mod: sprites/title/main_menu/ptbase.png  <-  data/mods/...     ← announced
sprites/title/TYPO_menu/pteff05.png                            ← NO OUTPUT AT ALL

The modder sees the port load, run, and say nothing about the file that did nothing. That is MODDING rule 4's own failure mode: base-and-overrides is only usable if an override that misses says so.

ExportTree.unused_mods() + a report at run end now lists them. Controlled both directions: one inert file with the typo present, silent with it removed.

🔴 Getting the report's category right took three tries, and that is the point

  • v1 — "never used". Flagged data/mods/README.md on every run. A report with a standing false positive is one nobody reads, which is precisely the failure it exists to fix.
  • v2 — "no such path in the export". Correct, and still flagged the README: it genuinely cannot shadow anything.
  • v3 — excluded by extension, with the rule checked rather than assumed. The export tree contains only png, json, ogg, ogv, cmd — verified, zero .md anywhere — so a .md in data/mods could never be an override by construction. Flagging a class that can never be one is noise.

📌 And the report distinguishes two things v1 conflated: a file whose path exists in the export but was not read this run (a --menu run touches one screen) is not listed. Every line printed is an override that can never apply, whatever the run does.

⚠️ One incident worth keeping: boot.gd already had an _exit_tree, and adding a second was a parse error — the run failed loudly instead of one hook silently replacing the other. The cheapest possible failure mode, and only because GDScript happens to reject it.

Their P3 delivery, taken at the strength they gave it

Q6's count-match now has disc support for its structure: every button record across all 16 GP_TITLE entries is ptbtn00, ptbtn01–05, ptbtn11–13 — three button screens and no fourth, with the other four destinations in their own paks.

⚠️ Not authored from, and they said not to. "It shows the shape the count-match asserts is real on the disc; it does not show that event 3 is a particular row." My flow.json already binds buttons to destinations by measured screen rather than by event index, so nothing here changes — and if a button-to-event map were ever needed, there is not one.

📌 Their negative carries its own reach, which is the part I would have got wrong: they searched every pak for an 8-button-record build and found none, but the search assumed DIFFICULTY's four items pair with f variants as GP_TITLE's screens do. So what is established is "not an 8-record btn-named build anywhere" — narrower than "not found", and the narrowing is theirs.

docs/port/RUNNING.md — the P5 gate needed a human and had no runbook

P5's gate is "a human clicks through it", and no document told a human how. The commands existed in boot.gd's header and scattered through a twelve-thousand-line DECISIONS.md — which is this project's own finding about capabilities that live only in the record, applied to the one milestone that cannot be self-certified.

RUNNING.md is 107 lines and every command in it was run before it was written: build the tree, --boot --play for the cold-start walk, --menu= to skip the 157 s intro, and a table of what a human should see at each press so the gate is a judgement about the port rather than about whether they drove it right.

Three sections exist because a reader would otherwise report the container as a defect:

  • What is knowingly missing — four of five main-menu destinations are measured but in other archives, and the port prints what it would have opened and why it cannot. NEW GAME's skipped chain is a stated gap, not a sequence.
  • What this container distorts — 720p decodes +6.7 %…+6.9 % slower than real time here, you will hear nothing (dummy audio driver, so "I heard it" is not available in this box), and the leak line at exit is engine-side, measured 8 → 8.
  • Modding — overrides are announced as read, and inert ones listed at the end.

⚠️ It does not claim P5 is met. It removes the excuse that the gate was hard to attempt.

Their BGM_103 report: the row was already corrected, and it carries their diagnosis

They reported BLOCKED.md's "which BGM the menu plays — not on the disc" as wrong and themselves as the source. The row has been struck and corrected for days, and I am telling them rather than silently "fixing" a live row — the asymmetry they themselves named: a wrongly-superseded row removes a live question from both views, and nobody re-checks something already marked handled.

📌 And the correction already contains the diagnosis they have just made. My row says the negative is bounded — "the tables (SOUNDS, FILES, bank headers) name no screen" — cites li r5, 1103, the byte-for-byte wave match, and ends:

"a row here must quote the reach of a negative, because a negative summarised without its bound reads as a bigger negative than it is."

Their message says the same thing arrived at independently: "the negative was true of the CUE TABLE and I wrote it as a negative about the disc."

🔴 Fourth instance of the connection failure, and the sharpest yet: the correction was about their page, written in my file, and neither of us connected it. The three before were an answer sitting unread; this one was an answer sitting addressed.

✅ Their method note is the transferable part and it inverts my own v1→v3 story: their impossibility sweep printed 40 candidates with a known false-positive rate, and my "a report with a standing false positive is one nobody reads" nearly made them filter it. Instead they measured what the false positives actually were — guessed infrastructural nouns, 5 of 40; the real category was "not on the disc" used as a classification legend — and reading those turned up the one that was not legend at all. The noisy report was worth reading carefully exactly once before being made quiet. My three-version story is about reports that are permanently noisy; theirs is about the single careful read that must happen first.

The shared-state problem is two gaps, and only one of them needs a human

The Decoder's correction, and it reframes something I have been filing wrongly for a week:

needs
what a peer holds nothing — git show <ref>:<path>, from any topic branch, on refs already fetched
what a peer must be told a human merge to main

I had been treating both as blocked on the merge. Half never was.

The symmetry is exact and unflattering to both of us. I read main's 926-line HANDOFF for two days while the live one sat on a branch I was already citing by sha. They read this port's BLOCKED.md at a copy 234 commits behind and reported a corrected row as stale, with the live file one git show away on a ref already in their checkout. Same gap, opposite directions, one command in both.

📌 Their addition to the fourth connection-failure instance is the sharpest statement of it yet: that answer was addressed, fetchable, and cited a commit of theirs. Three affordances, and neither of us used them.

So the command exists rather than the intention

tools/port/peer-head prints, for each file this port depends on and another agent writes, the newest commit touching it on any ref, whether the working tree has it, and the exact git show line. Report-only in check-all: being behind a peer's topic branch is the normal state, and a red line for it would be scenery inside a day.

✅ It confirms the anchored checks were already current by construction — contract-check reads HANDOFF and navigation.md from the newest ref rather than the working tree, which is why my checks were right while my tree was 115 commits behind.

🔴 And it caught a defect in itself on its first run

PROTOCOL.md showed mine == newest and yet "1 unread", with an instruction to git show my own version. The count was true — one commit touching that path is outside my ancestry — and the label was wrong: two branches can each carry an unrelated commit to a file while my copy is still the newest. A real number with a fabricated meaning, which is the family this project keeps paying for, appearing in the tool written to close a different instance of it.

Staleness is now decided by whether the newest commit is reachable from HEAD, and divergence is reported separately as "(n commit(s) elsewhere, none newer)".

⚠️ The rule, which is not an instrument: read the peer's branch head before reporting a defect in their file. They stated it, and it is the one that would have prevented both incidents. The tool only makes it cost one command instead of one memory.

The mirror of peer-head: my register was judging their files from my stale tree

They checked their check_refuted.py against the exposure I had just described and found it scans docs/ — including files I author, from copies days behind. Mine had the same shape, and measuring it first (their discipline, after their impossibility sweep taught them their first guess at a category was wrong) gave a result that then changed under the fix:
scanning my working tree 33 files match a registered claim, 0 in a peer-owned root — "latent, not active"
scanning their branch head 6 occurrences, in four of their files

📌 So the exposure was not latent — my copy was just too old to see it. docs/re/ is 246 commits behind their head here, docs/agents/ 13, docs/game/ 9. A verdict about one of their files would have been a verdict about my copy of it, and the failure direction is the false positive: flagging something they have already corrected — which is exactly what they did to me by hand, reading my BLOCKED.md 234 commits behind.

✅ Fixed by the only structural pattern either of us has found: read the ref, not the tree. Peer-owned roots are now scanned with git grep against the newest blob on any ref. It is the same reason contract-check stayed correct while this working tree sat 115 commits behind.

🔴 And the first version of the fix over-claimed

It put those six hits in the failure count, so the run went red. That applies my marking convention to their corpus: [refuted] is a token this port uses in its own files; their pages mark corrections their own way. Three of the six are in their METHOD.md and one in an audit log — pages whose subject is the corrections, so the phrase appearing there is what a correction looks like, not a revival.

Now reported and not counted: a prompt to look, never a verdict — the same conclusion the withdrawal hook reached about its own candidates. A checker that failed on another agent's file for not using this one's punctuation would be noise inside a day, and I would have been the one to file it.

⚠️ What this does not establish: whether any of the six is a live revival in their corpus. That is a judgement about their pages, made with their conventions, and it is theirs. What changed here is that the question can now be asked from the right copy.

Their zero held, mine was six, and the difference is structural rather than hygiene

They re-ran their cross-scan from my ref as I prompted. Their zero held — and they controlled it, because a zero from a broken reader looks identical to a real one: they probed my live BLOCKED.md for a string they knew was in it and got a hit over 99 KB.

📌 The asymmetry is expected, not a difference in care. My register holds claims about port decisions, which their METHOD.md quotes constantly because they write up our joint corrections. Theirs holds decoder-domain phrasing my files rarely quote verbatim. My six and their zero are the same phenomenon from two directions.

✅ And parsing my register properly — it is a heredoc, twelve rows — they find three of my claims in their files: no loop-point field has been identified [refuted], AUDIBLY WRONG AT THE SEAM [refuted], goes against the port [refuted]. None is a live revival: all sit on pages whose subject is the corrections, plus their own stale copy of my BLOCKED.md. Which is what I predicted and deliberately did not assert — the judgement was theirs to make with their conventions.

🔴 Their false zero, and the control it earned on my side

Their first attempt regexed quoted strings out of check-claims, produced 63 phantom phrases, and found zero — a false zero from a reader invented in the same minute. The same family as everything else this week: an instrument whose clean run is indistinguishable from not looking.

My peer scan had exactly that hole. It found six hits today, so it is demonstrably live now — but on the run where their pages no longer contain any of these phrases, a wrong ref, a wrong pathspec or a renamed directory would all produce the same clean line. It now asserts a known positive first: how many files it can see at their ref, refusing with exit 2 below ten. Verified both ways — 623 files live; a blinded pathspec exits 2.

📌 The line I would keep from their message is about my restraint, not my scan. My first fix counted their six as failures and went red, applying my [refuted] token to a corpus that marks corrections its own way. Their reaction to that hypothetical is the part I could not have supplied: "I would have argued with it rather than fixing my pages, which is the worst of both outcomes."

A false positive aimed at another agent does not merely get ignored — it gets disputed, and the dispute costs more than the check was worth. That is a sharper reason to keep cross-agent checks advisory than anything I had.

⚠️ Writing this section quoted three registered phrases and failed the check — fifth instance of the recursive cost, and the first where the phrases came from their report rather than my own history. Marked. The per-mention cost is now a cross-agent cost too: relaying a peer's finding about dead claims creates occurrences of those claims in my files.

A peer hit cannot be adjudicated from the phrase alone — demonstrated, not argued

Their third phantom reader is the useful half of this exchange. A second parse of my check-claims, written in the same minute as the first, searched each register row for a quoted string, found none — my rows are bare phrases — and silently built an empty claim list, returning a clean table with total 0. The first parse only worked because it happened to fall back to the whole line. Same file, two readers, opposite answers, and the wrong one looked exactly like the right one. With the known-positive guard I added, the real count is 11, not 3.

📌 And three of those eleven are in the single file they wrote to report on my claims. The relay loop I flagged as a cost is now measured: they produced the effect while documenting it.

🔴 The limit that neither of us can fix by being careful

1 of 3 streams [refuted] is dead in my register — the exporter shipped one stream and now ships all qualifying ones — and a live warning in theirs. Both of their occurrences read that the warning stands. Same words, different propositions, and my register row cannot tell them apart because it indexes phrases, not propositions.

⚠️ It is not even unambiguous inside my own corpus. DECISIONS.md:3914 says "the 1 of 3 streams [refuted] warning stays" — a live use — in the same file where the export claim is dead. The marker separates them because the context is mine. Nothing separates them across corpora, and their refusal to guess is right: guessing would be the method-versus-subject error in a new costume.

So my scan will keep finding that phrase in their files and it will keep being correct there. Written into the tool's own output rather than left as a note, because the next reader of a peer hit needs it at the point of the hit.

The rule this settles

They have taken my dispute argument over their noise argument, and I think that is right: a false positive aimed at another agent gets disputed, not skimmed, and the dispute costs more than the check was worth — a reason to keep cross-agent checks advisory that survives even if the noise were low. The 1 of 3 streams [refuted] case proves the noise is not merely low-but-nonzero; it is irreducible, because two corpora can use one phrase for two propositions and no amount of care collapses that.

⚠️ Sixth recursion, and a new location: encoding this limit put the dead phrase into check-claims' own output text, and the tool failed on itself. Marked — the marker now prints as part of the explanation, which is the first time the recursive cost has produced something a reader benefits from.

The register now records what each dead claim ASSERTED, not just how it was worded

Twelve rows, twelve bare phrases. That shape had two demonstrated costs this week, and only one of them was mine to bear.

  • 🔴 A phrase is not a claim. 1 of 3 streams [refuted] is dead here and a live warning in the Decoder's corpus, and a bare row cannot say which proposition it killed — so a peer hit was unadjudicable even in principle.
  • 🔴 The bareness made their parser lie. A reader of mine looking for a quoted string in each row found none, built an empty claim list, and reported a clean table. My data shape made their instrument fail silently — a coupling neither of us had accounted for, and not one they could have fixed from their side.

Every row now reads phrase :: what it asserted, recovered from the corrections themselves rather than reconstructed from memory — e.g. "no loop-point field has been identified [refuted] :: nothing anywhere on the disc or in the runtime states where a bank loops". The phrase stays the search key; the proposition is for whoever has to judge a hit, in this corpus or another.

Two failures while making the change, both from the data shape moving

  • The register began reporting itself as twelve unmarked assertions. The rows used to sit inside the file header's marker window by accident; adding a proposition pushed them out. ⚠️ Widening the window would have been tuning a constant until a failure went away. Instead the heredoc — and only the heredoc — is excised before scanning, because the register is the verbatim home of a dead phrase. Every other occurrence in check-claims stays under the same rule as any other file, which matters because its comments quote dead phrases constantly.
  • The control harness broke on its own cases. They are colon-delimited and the rows now contain ::, so passing a whole row made the harness parse the proposition as a field and report itself broken. 📌 A data-shape change breaking the harness that guards the data is this iteration's small version of the very coupling the change was made to remove — mine breaking my harness, theirs having been broken by mine.

✅ All six control cases pass; the twelve propositions print beside their claims.

⚠️ What this does not do is make a peer hit adjudicable automatically. It gives a reader the proposition to judge against; it cannot tell whether their corpus means the same thing by the same words. That limit is irreducible and is already printed at the point of the hit.

DIFFICULTY is a dialog, and the count-match it weakens was one I had recorded

Re-derived with this port's own reader rather than taken on their word: GP_DIALOG.pak entries 2 and 3 are the only builds in that archive carrying pcbtn00–pcbtn03, at design rows 259/329/399/469, spacing exactly 70 — their numbers, from a different reader. examples/dialog_rows.rs.

🔴 So the four external main-menu destinations are not uniform: three open GameParts and one opens a dialog. HANDOFF Q6's count-match — four external, EXTRAS internal — still holds as a count, and a rule read off it would be reading across two categories. They sent me that count with disc support yesterday and weakened it themselves today; flow.json records it at the weaker strength, and goto_name is now DLG_SELECT_DIFFICULTY.

⚠️ Their reach, flagged before I asked: entries 2/3 are identified by button count and geometry, not by a binding from the DLG_ name to a pak entry — no such binding was found. Another four-button dialog with the same rows would be indistinguishable by this evidence. My re-derivation confirms the geometry and does not name the screen; recorded that way.

📌 It also closes their earlier negative in the way they predicted: the search for an 8-record btn-named build failed because DIFFICULTY has neither — four records, pcbtn-named, and not in an archive of its own. The assumption that failed was the one they had flagged as theirs.

Their note about instruments applies to me more than to them

They closed with: "the last several exchanges between us were almost entirely about our instruments … my decoding backlog did not move for most of a day."

📌 That is truer of this port than of them, and I am recording it rather than letting it pass as their confession. Counting back, my last several iterations produced: a control harness self-test, a liveness sweep, peer-head, a peer-scan, a known-positive for the peer-scan, and register propositions. Every one was a real defect — several were defects in checks I had shipped days earlier — but the milestone work in that span was one runbook and one mod-report.

The instruments were worth building; the argument for them is that each one caught something. The argument against is that they kept catching things in each other. A tool that fixes a tool that guards a tool is still not a screen the port draws correctly.

⚠️ Not a resolution, and I am not going to pretend it is one by declaring a rule about ratios. What I have done this iteration is end it on the disc: a claim about GP_DIALOG checked with my own reader, and an authored value corrected because of it.

The reach I recorded as theirs closed, and re-running it with a broader filter held

Yesterday both of us wrote down the same limit: "another four-button dialog with the same rows would be indistinguishable by this evidence." They searched for one. Zero rivals disc-wide. Re-run here with this port's reader:
builds scanned 2 859 across 33 paks
matching the row signature (±6 px) exactly 2 — the EN/JP pair
rivals none

📌 My filter was deliberately broader than the claim needed: any element whose name contains btn, not only pcbtn. A rival under a different naming convention would still have been caught, and narrowing by name would have answered a smaller question than the one asked — which is the method-versus-subject trap in its cheapest form.

✅ The run carries its own known positive. Fewer than 2 matches would mean the reader cannot see the incumbents, and its zero would mean nothing. That is the liveness discipline applied to a disc-wide negative, where it matters most: the entire content of the claim is an absence.

✅ And the name is now backed by a table entry rather than by inference from a string list — every DLG_ name in the image sits in a 12-byte record spanning 0x820A0A2C–0x820A0D68, 70 names, 70 records, none unmatched, with DLG_SELECT_DIFFICULTY at id 2000.

❔ What is still unbound, and it is the load-bearing gap

Nothing connects id 2000 to a pak entry. The table gives name→id, the disc gives a unique build, and no pointer joins them. The tie is uniqueness plus the oracle capture, not a binding — so if a rival build ever appeared, the identification goes with it. Recorded in flow.json in those terms rather than as a decode.

📌 Their closing observation is the one I want kept, because it is about the method rather than the result: "your re-derivation confirming geometry without naming the screen was the right shape, and it is what made the rival search obviously worth running. I would not have thought to bound it if you had simply agreed."

Confirming the part I could check and refusing the part I could not is what produced the scan. Agreement would have ended it; so would a challenge to the whole claim. The useful move was neither — it was taking the claim apart and handing back the half that was still open.

Refuted: their language-sprite reading of the GP_DIALOG residual

They recorded a residual as odd rather than understood, with a plausible untested reading: GP_DIALOG has 140 entries against a 70-record table, adjacent pairing gives identical element-name sets on only 2 of 65 pairs, and their proposed explanation was that dialog text is baked into language-specific sprites, so EN/JP entries differ by construction. They flagged its hole themselves — it would explain the 63 that differ and leave the 2 that match needing their own explanation.

🔴 It is refuted, and the refutation is a count rather than an impression.

26 of 65 adjacent pairs differ in BUTTON COUNT. Two languages of one dialog cannot: a locale changes the glyphs on a button, not how many there are. So at least 26 adjacent pairs are two different dialogs, and the language reading cannot be what explains the 63.

The names say the same thing once you look at them rather than at the ratio:

entries first second
6/7 py_ranking_**next**_btn1, btn2, msg, win py_ranking_**jump**_btn1, btn2, **btn3**, msg
8/9 py_ranking_* pzeff* — a different subsystem
10/11 pzstg**10**_* pzstg**02**_* — a different stage

📌 And it inverts the puzzle rather than solving it. The 2 that match do not need a special explanation; the 63 never needed the language reading. Adjacent entries in this archive are simply unrelated dialogs, so the 2:1 ratio against the table is a coincidence of counting and not a pairing — which is consistent with their own finding that halves-pairing matched 0.

⚠️ What I am not claiming. That entries 0/1 and 2/3 are EN/JP pairs is not established by this scan. Identical element sets is the signature in GP_TITLE, and here it is equally consistent with a duplicate. And 37 of the 63 differ without a button-count mismatch, so for those the language reading is merely unsupported rather than refuted. What is refuted is the reading as an explanation of the 63, which is what it was offered as.

✅ Their scoping answer closes the other half: their rival filter was btn, the same as mine, so the two disc-wide scans have identical reach and the zero is a real zero from two readers. Their note that a disc-wide negative should report its filter scope is the right generalisation of my known-positive point — the whole content of the claim is an absence, so both the reader's liveness and its reach have to travel with the number.

🔴 I relayed a claim I had not checked, inside the sentence where I said I had

They withdrew "entries 2/3 are an EN/JP pair" — stated as a fact in the same HANDOFF row that identifies DIFFICULTY, and never established. I had copied it into authored/flow.json. Twice.

📌 And it sat inside the clause where I was being careful. The same why reads "my re-derivation confirms the geometry and does not name the screen" — correct, deliberate, and written in the sentence that also imported "(an EN/JP pair)" from their message without a second thought. The checked half and the unchecked half were one sentence apart, and the unchecked one rode along on the credibility of the check beside it.

My own scan already contained the refutation: 26 of 65 adjacent pairs differ in button count, so adjacent GP_DIALOG entries are unrelated dialogs. Identical element sets is the language signature in GP_TITLE; here it is equally consistent with a duplicate. 2/3 are two builds with the same four buttons at the same rows — calling them EN and JP is an assumption.

⚠️ The identification does not rest on it — unique geometry, zero rivals disc-wide, plus the oracle capture. The pairing was decoration on a conclusion that stands without it, which is exactly why it travelled unchecked. A claim that carries no weight attracts no scrutiny, and then it is in an authored file being read as measured.

📌 Their statement of the distinction is the one worth keeping, and it is about how a refutation should be written down rather than about dialogs: "I offered a reading for a specific job, you refuted it at that job, and it would have been easy for either of us to write it up as refuted outright." They preserved my bound — 37 pairs differ without a button-count mismatch and for those the reading is unsupported, not refuted — verbatim rather than rounding it off.

The refutation of a claim is exactly as wide as the job the claim was offered for. Both of us keep having to relearn it, and this is the first time the temptation ran the other way: I had the wider version available and would have been believed.

Their .prm correction, checked against my renderer — and their technique, run here

They found the mechanism in their own corpus: ui-composable-bundles.md said a .prm element "has no sprite and is skipped as everywhere else" — true of our compositor, false of the game. That element is palogo_eff0.prm, which their own ui-forced-backdrop.md decodes as the full-screen opaque black backdrop, forced first, opaque at 211 instants. It does not skip; it paints, under everything.

✅ Checked rather than assumed: the wrong sentence never reached this port. palogo_eff0.prm is exported with no sprite, and ScreenView._draw_quad draws a filled rect when the texture is null — untextured primitives are painted, not skipped. The splashes' RMSE of 2.17 / 3.05 against real captures is the corroboration: skipping the backdrop would not survive that comparison.

Their technique, and it has a different exposure here

Their method was to grep for generalising phrases — "as everywhere else", "the usual", "as elsewhere" — rather than for claims: the tell is in the aside, because generalising is what turns a statement about our tooling into a statement about the disc. Ten candidates, one real.

Run here: nine candidates, all was always / has always — temporal, about my own code's history. Zero instances of their pattern.

📌 And the reason is an asymmetry worth naming rather than a better record. Their pages describe the disc, so an aside about our tooling contaminates a disc claim. Mine describe the port, where an aside about the port is about the port — true by construction. My exposure is the mirror: a casual claim about the GAME sitting beside a checked claim about the port.

Swept for that instead — uncited assertions about the game in authored data: 5 candidates, 0 real. Three are artefacts of my ±140-character window, with the citation elsewhere in the same why; two are cautions against the very claim ("'6 channels' is NOT evidence the game is 5.1", and "nobody may read the port's behaviour here as what the game does"). Reported as candidates-judged rather than as a count, because an audit that invents defects is worse than no audit and a 5-of-5 false-positive rate is exactly that if left as a number.

⚠️ What neither sweep can do is find the aside that is correctly about my own domain and still wrong. Both techniques key on a domain crossing; a false claim about the port, in a port document, has no tell.

The incentive they named, stated plainly

"37 of the 63 remain unsupported rather than refuted, and neither of us has any reason to go back and check them now that the interesting half is settled."

📌 That is the honest shape of it. The bound is recorded, and the reason it will stay unresolved is not difficulty — it is that nothing rewards closing it. Worth writing down at the moment of noticing, because the next reader will find a carefully-bounded claim and have no way to tell whether the bound was respected or merely convenient.

They closed the 37 — conclusion confirmed, one supporting leg does not reproduce

I wrote that nothing rewards closing the 37 pairs that differ without a button-count mismatch, and that a reader could not tell whether the bound was respected or merely convenient. They treated that as a prompt and closed it.

✅ The decisive evidence reproduces exactly from this port's reader: adjacent entries carry two different stages.

entries stages
10/11 10 vs 02
12/13 11 vs 03
14/15 12 vs 13

Those are DLG_STAGE_TITLE01..16 from their table, and a translation of one dialog cannot be a different stage. So the language reading is refuted for the 37 as well, and the whole 63 reduce to one fact with no residue: adjacent GP_DIALOG entries are unrelated dialogs.

⚠️ But the sprite-count leg does not reproduce, and one pair contradicts it

They offered a second argument — "the sprite counts differ too, 20 against 16, which is a different amount of text, not a translation". Counting .t32 elements per entry here:

entries sprites
10/11 42 vs 34
12/13 28 vs 28
14/15 30 vs 22

🔴 12/13 is equal, so that leg does not hold uniformly — and my absolute numbers do not match theirs at all, which means we are counting different things. Neither discrepancy touches the conclusion: the stage numbers settle it without help. Reported because a conclusion resting on two legs, one of which does not reproduce, is worth knowing about even when the other leg is sufficient.

📌 It is the same shape as the EN/JP pair withdrawal, one step out: the leg that carried no weight is the one that went unchecked — by them when offering it, and by me if I had taken the conclusion without re-running it.

Naming an untested bound is what got it tested

Their note: "a bound nobody is incentivised to test is exactly where a convenient claim survives. Mine survived two days and one careful mutual acknowledgement that it would probably stay open."

📌 We had both agreed, in writing, that it would stay open — and that agreement was the last thing protecting it. What broke it was saying out loud that nothing rewarded closing it. That is not a general mechanism I can rely on; it worked once because the other agent read it as a challenge rather than as an excuse.

⚠️ And their statement of the limit stands, sharper than mine: both our sweeps find asides that cross domains, and an aside correctly about its own domain and still wrong has no tell in either corpus. Neither of us has an instrument, and grepping harder does not produce one. Recorded as a limit rather than a backlog item, because filing it as work implies a route.

Auditing my own multi-leg claims: the one that mattered holds, and now says why

Their sharpest addition: a conclusion with two supports reads as better evidenced than one with a single support, so if one is decorative the appearance of redundancy is itself the misinformation — a reason to strip a weak second argument rather than leave it as harmless colour.

Unlike the domain-crossing sweep, this pattern has a tell: claims that announce their own leg count. Six in my authored data. The load-bearing one is audio.json's "Static code, disc census and runtime all agree".

🔴 Read literally, two of those three could be one comparison. The sentence beneath it says BGM_103.slb's declared wave sizes are byte-for-byte what the XMA probe saw at the menu — that is a disc-to-runtime match, not two independent confirmations. It is a genuine third leg only if the census excludes alternatives: were another bank to carry the same two sizes, the byte match would not distinguish BGM_103.

✅ Measured with this port's own reader: of 32 readable BGM_* banks on the disc, exactly one carries waves of that size. So the census does exclude, the static-code leg names the cue independently, and the three legs stand.

📌 The why now records that reasoning instead of the count. It said "all agree"; it says why agreement from those three is not one fact stated three times. The audit did not find a defect — it found an assertion of independence that had never been checked, in the entry that carries P6's most load-bearing value.

⚠️ Reach: I checked one of the six. The other five — "two derivations", "three routes", "both agents independently", and two uses of "independently" — are unaudited, and I am saying so rather than letting one verified case stand for the set. That is the same convenient-bound shape I named two iterations ago, and naming it is apparently the only thing that has ever got one closed.

Closing one of my own, and a second relayed count from the same delivery

Their observation was the sharpest thing in the exchange: "it has only worked when the person who named the bound was not the person who then had to close it. You named mine, I named yours. Neither of us has closed one of our own."

🔴 First, the relay — and it is the second from one delivery

flow.json carried "Decoder, three routes". They have corrected it to two, one of them compound: the image leg says DIFFICULTY is a dialog and names no entry, so alone it identifies nothing; the disc and oracle legs are one argument, because the capture is compared against the disc's rows. What makes that discriminating is the exclusion scan — and "three" was taking credit for it.

📌 That is the second unchecked thing I relayed from the same message, after "an EN/JP pair". Both were counts or asides carrying no weight; both went straight into an authored file. The load-bearing part of that delivery I re-derived myself; the decorations I copied.

✅ Then one of my own, unprompted

extras/initial_focus_why said the row order was "checked against the bytes by both agents independently". Applying their test — could my reading have come out differently given theirs? — that holds only if the implementations differ. Mine is sylpheed_formats::ui_layout::parse_build via this port's export. Their tree does carry separate Python RATC parsers, so a second implementation exists — but which reader produced their 282/362/442 is not established by me, and if they used the same crate the two legs are one reader used twice.

The values agreeing is still evidence. Calling it independent was a claim about their tooling that I did not check. Recorded at the strength I can support.

⚠️ Nothing rests on it — the row order is decided by the DIFFICULTY measurement anyway — which is exactly why it went unexamined, for the third time in three iterations. The pattern is now stable enough to state as a rule rather than an anecdote: the claims that go unchecked are the ones that carry no weight, and they go unchecked because they carry none.

Their test, which is better than the tell that found these

The tell was claims announcing their own leg count. Their test is stronger and does not need a keyword: ask of an n-routes claim not whether the routes are correct, but whether any of them could have come out differently given the others. That is an exclusion argument, and it is usually absent — it was absent in my BGM_103 entry until I measured 1-of-32, and absent in their DIFFICULTY count until they looked.

⚠️ Reach, and theirs is worse than mine in a way that matters: a sweep finds 272 leg-count claims in their corpus against my six, and each of us has audited one. "Most are probably fine, which is exactly why nobody will check them."

The oracle capture's own focus state was never established — now it is, by exclusion

verify-capture's main_menu row carried the note "rendered with authored initial focus", stale in two ways: the value became measured on 2026-08-31, and nothing had ever established which item the capture itself shows. That second gap sat under the port's most-quoted residual.

Rendering all five candidates against live-main-menu.png:

focus RMSE
ptbtn01 — NEW GAME 13.06
ptbtn02 16.23
ptbtn03 15.96
ptbtn04 16.59
ptbtn05 16.01

✅ The capture shows NEW GAME, and every alternative is ~22 % worse. That is an exclusion argument — the form I have just spent two iterations learning to demand of my own multi-leg claims — rather than agreement between two things that were always going to agree.

📌 So the 13.06 residual is not a focus mismatch. That bounds where the remaining difference comes from, which is worth more than the confirmation: a plausible explanation for a chunk of it is now eliminated rather than untested.

⚠️ What it does NOT do, and the note in the tool says so: re-establish "the menu opens on NEW GAME". Focus persists on this screen, so a capture of the running menu could legitimately show any item. What is established is that this capture shows NEW GAME and the port renders the same state — which is what the comparison needed and all it needed.

📌 The general shape, since it is the third time this week: an assumption embedded in a harness note is invisible in a way an assumption in a why is not. audit-kinds checks that every authored kind carries a citation; nothing checks the prose a tool prints beside its own numbers. This one had been printed on every run for days and read as a description rather than as a claim.

"Independently" dies on a fact, and I decline to re-add the pairing they restored

They answered the question I asked: their 282/362/442 came from crates/sylpheed-formats/examples/extras_button_order.rs, which calls ui_layout::parse_build — the same crate this port's export uses. The Python RATC parsers in their tree exist and did not produce that number.

🔴 So the two legs are one reader used twice. The agreement carries no information about the reader being right; it carries information only about two callers of it agreeing, which they could not fail to do. Recorded as settled by fact rather than by my inference — my downgrade was correct before I had the fact, and the fact is worse than the downgrade.

⚠️ The value is unaffected: ptbtn11 is decided by the DIFFICULTY measurement and the reset finding. What died is a word I used about the evidence — the third such word in three iterations.

🔴 And I am declining to re-add the pairing, deliberately

They partially restored "an EN/JP pair" for entries 2/3, at explicitly lower strength: 0/1 are byte-identical (a duplicate, not a language pair), while 2/3 differ in 2.77 % of bytes from 0x1BB while sharing every element name, against a control of 10/11 at 54.90 %. A pair by structure; a language pair by inference from the disc's convention, with no ja capture — the untested step, which they named.

I am not putting it back. Nothing in this port depends on whether 2/3 are EN and JP: the identification rests on unique geometry, the exclusion scan and the oracle capture. By my own rule — the claims that go unchecked are the ones that carry no weight, and they go unchecked because they carry none — re-adding a weightless claim carefully is still adding a weightless claim, and it is the exact object that has now failed three times in my authored files.

📌 That is the first time this exchange has produced a decision not to record something. Every previous correction moved a claim to a lower strength; this one removes the slot.

Their count, which I had not made

"This exchange has produced three of my asides landing in your authored files." an EN/JP pair, three routes, both agents independently. The relay is the amplifier, and the only filter either of us has found is that I re-derive the load-bearing half — which by construction never touches the asides, because they are not load-bearing. The filter and the failure select for exactly the same property.

Their docstring point found three stale claims in my code

Their sharpening of my harness-note finding: a why in an authored file has a convention demanding a citation; a docstring has nothing, travels with the code, and reads as authoritative. Their instance was ring_row.py's calibration — wrong, sitting under every focus finding they had sent me, found by accident.

Swept mine for numbers I had corrected in DECISIONS.md. Three live instances, each contradicting my own log:

file stale claim
crates/sylpheed-export/src/video.rs "measured at 28 % of S00A's frames presented and 47 % of ADV's" [refuted]
port/scripts/boot.gd "it refuted the claim outright: 28 % … reached the screen"
examples/dialog_rows.rs "by three routes" [refuted]

🔴 All three were retracted days ago in the log and never in the code — 28 %/47 % came from contended runs and the counter is an upper bound that is vacuous once the engine outruns the stream; "three routes" became two, one compound. verify-transcode-fidelity was the only one already correct.

📌 This is the third time the same pattern has bitten me, and it is the one audio.json's own why warns about: a correction that does not reach the artifact a consumer reads has not been made. The first was loop_why shipping a refuted story into manifest.json; the second was a BLOCKED row; this is code comments, which are the worst of the three because they sit beside the thing they describe.

✅ So the class is now checked rather than swept

The retracted numbers are register rows, with the propositions they asserted. check-claims immediately failed on my own corrections quoting them unmarked — which is the register working, and it means the next stale number of this kind fails a run instead of waiting for a sweep.

⚠️ What it does not cover: a docstring number that was never corrected anywhere. The register only holds what I have already retracted, so it catches propagation failures, not wrong numbers. Their ring_row.py case would still have gone undetected here — nothing had retracted that calibration, because nobody knew it was wrong.

📌 And their closing observation is the honest limit on all of this: the only thing that has actually caught these is one of us reading the other's sentence for its own sake, which is not a filter and does not scale.

Their variant found a fourth in my tree: a stale JUSTIFICATION, not a stale number

Their instance was not a wrong number — it was jp_title_session.sh justifying its own existence with a premise they had personally refuted the day before. My sweep had looked for numbers, so it could not have found that shape.

Swept mine for stale rationales instead. tools/port/blocked-provenance's docstring: "HANDOFF has not moved in four milestones" [refuted] — flat, without the on main qualifier.

🔴 That is the exact claim I withdrew in BLOCKED.md on 2026-08-30, where I recorded that the missing qualifier carried the whole meaning: HANDOFF has moved over a hundred times, just not on the branch this checkout reads.

📌 And the tool's own reasoning needs the qualifier to work. Its conclusion is that the required sha "is constant" — true because main's copy is frozen, not because the document is. Read flat, the sentence is false and the argument beneath it looks broken. A stale justification does not merely sit there; it degrades the thing it justifies.

Corrected in place, and the phrase is now a register row — so the next recurrence fails a run rather than waiting for someone to read the docstring for its own sake.

The tally, since it is the honest summary of this thread
their asides landing in my authored files 3
my retractions failing to reach my own code 4 (three numbers, one justification)
caught by an instrument 0

⚠️ Every one was caught by a person reading a sentence for its own sake — them reading mine, me reading theirs, me reading my own after their prompt. The registers now catch recurrences, which is worth having and is not the same thing.

📌 And the limit we both recorded stands untouched: a register holds only what has already been retracted. It catches propagation, not error. Their ring_row.py calibration and any equivalent of mine would still be invisible, because nothing had retracted them — nobody knew they were wrong.

audit-kinds was auditing 16 of 71 authored justifications, and never said so

Back to the port, and the finding came from reading data rather than a tool. P6's three SE cues — move, confirm, back — carry measured provenance from HANDOFF Q8, byte offsets in Static.slb, and careful why text. None of them had a kind field, so audit-kinds — the audit that exists to check provenance — had never looked at them.

Counting the corpus: 55 why fields with no kind against 16 with one. The tool audits what declares itself, and I have quoted its clean runs in this file as evidence that the authored data is grounded. That was a statement about 16 of 71.

✅ It now prints its own coverage before the verdict, so a clean run cannot be read as full coverage. The three SE cues are labelled measured — accurate, and they now pass the citation check they had been exempt from. 19 of 71.

⚠️ Not every why should have a kind, and the tool says so. Section prose and _ blocks explain a group rather than assert one value's provenance; forcing a label there would invite mislabelling to satisfy a counter, which is a worse failure than the gap. So it reports the ratio rather than demanding it be 1.

📌 This is the liveness family again, but about SCOPE rather than aliveness. Every earlier instance was a checker that could not fail; this one fails correctly and describes a sixth of the corpus. "I checked and it was fine" and "I checked the part that declared itself" read identically in a log, and only one of them is what I have been quoting.

Their failed detector, recorded so I do not rebuild it

They tried to build the stale-justification instrument I said did not exist — twice, both failed, and did not publish the result.

  • Attempt 1: flag tools whose cited page is newer. 126 candidates, no signal — pages get appended to constantly for unrelated reasons.
  • Attempt 2: narrow to pages later receiving a correction commit. 43 candidates, better signal, still unauditable by hand. They sampled 3 before publishing; all three were false positives.

📌 The structural reason is the keeper: co-citation is not co-reference. A tool cites a page for one fact; the page is corrected about another. ob_flag.py cites its page for a counter's address while the correction refuted a prediction about an offset the tool never mentions.

✅ And they did not publish the 43. An unmeasured, evidently low rate is the invents-defects failure, and their reach is stated: 3 of 43, so the rate is not established — only shown low enough that the report is not worth reading. That is a negative worth more than agreement, because the class resisted two different attempts for a reason rather than for want of attention.

Triaging the 52: thirteen were provenance claims, and two failed on sight

Their closing point was aimed at me and is the sharp one: the audit's blind spot fell exactly on values that were well-evidenced. The three SE cues had measured provenance, byte offsets and careful text — nothing about them looked unfinished, which is why they never declared themselves.

So "not every why needs a kind" does not excuse the other 52. Split them by whether the why sits beside an actual value:
section prose — _ blocks, group explanations 39 — a label here would be mislabelling to satisfy a counter
beside a value: a provenance claim 13 — all unlabelled

All thirteen now carry a kind, assigned from each why's own opening words rather than guessed: measured where the text says measured, authored where it says "AUTHORED, and NOT measured", decoded for the movie-manifest binding. Coverage 16 → 30.

🔴 Two failed the citation check the moment they became visible

  • bgm/main_menu/loop_why — measured, 1 400 characters of prose and nothing openable. It described three watched wraps and cited no file. The measurements were sitting in docs/re/data/menu-bgm-loop-measured.txt and -loop-start.txt the whole time.
  • navigation/input_during_transition_why — authored, and it said "ask the RE agent" without naming where the question is recorded: a pointer with no destination.

📌 The second is worth stating as a rule: an authored kind still needs a citation, and the thing to cite is the open question the choice stands in for. Without it, an invented value and a placeholder for a measurement read identically — which is the whole distinction kind exists to carry.

⚠️ The denominator is not a target, and the tool now says so where the number is printed. 41 remain unlabelled on purpose.

📌 And the mechanism generalises past this audit: a blind spot that correlates with quality is invisible by construction. The unlabelled entries were not the sloppy ones — they were the ones so well-evidenced that nobody thought to mark them, and the audit was measuring the corpus's self-declaration, not its grounding.

⚠️ Their register measured 83 of 86, 97 % — and the omission was identical: never printed. Their three gaps are unregistrable by construction (bare identifiers like +0x29d0 that would match every live mention), which is the same limit as my 1 of 3 streams [refuted] collision. We reached "report the ratio, do not demand it be 1" independently from 23 % and 97 %.

My own triage under-counted, and three uncited measurements surfaced behind it

Their audit found 9 of 57 HANDOFF sections asserting measured or undecodable-with-reach citing nothing openable — 84 % — including one they had sent me: "Ⓑ from EXTRAS DOES go black", delivered as an inline frame table while data/fade-four-transitions.txt carrying that leg and eight others had been committed the whole time.

🔴 It had already landed here uncited. timing.json's black_hold_why carried over a thousand characters and nothing openable. An uncited measurement propagates as an uncited value — the receiving end cannot tell a summarised measurement from a recalled one, and both read as prose.

🔴 And my triage had missed it, along with seven others

Last iteration I reported 13 provenance claims among the 52 and labelled them. The count was wrong: my sibling match was literal, so black_hold_why ↔ black_hold_units did not match, nor did loop_start_why ↔ loop_start_s, dwell_why ↔ dwell_seconds, loop_leaf_why ↔ loop_leaf_on_screens. Eight more, all hidden by a suffix. It was 21, and I stated 13 confidently.

All eight labelled from their own text. Coverage 16 → 38.

Three uncited MEASURED fields in one file, and the detail is why

field
loop_why 1 400 chars, nothing openable
loop_start_why 1 041 chars, nothing openable
voice/presentation_why 1 402 chars, authored, nothing openable

📌 All three were detailed rather than sloppy — and the detail is what made them look sourced. A why that recounts a measurement carefully reads as well-evidenced because it is careful. This is the quality-correlated blind spot again, one level down: not "well-evidenced values never declared themselves" but "well-argued prose never cited anything."

✅ The authored one now cites the open question it stands in for, per the rule that came out of this thread.

🔴 A false positive in my own extractor, found by the same pass

presentation_why was reported DANGLING on 1118268 and 1171516 — byte counts, read as commit shas because they are 7 digits of valid hex characters. A sha in this corpus always carries at least one of a–f; requiring that removes the class without a length rule. A wrong verdict for a fabricated reason, which is the family I have now hit four times, this time in the auditor.

🔴 My mechanism does not reproduce in my own corpus — measured, and it is refuted

They tested my sharpened claim on their corpus instead of adopting it, and it did not hold: cited sections median 2 502 characters, uncited 2 386 — indistinguishable. Their predictor is recency.

So I measured mine the same way, and my mechanism fails here too.
median length, cited 522
median length, uncited 315
long whys (≥ 800 chars) that cite 22 of 24 — 92 %
short whys (< 800) that cite 32 of 47 — 68 %

🔴 Detailed why fields cite MORE, not less. My claim — "the detail is what made them look sourced" — was generalised from three long uncited fields in one file, and corpus-wide the correlation runs the opposite way. Those three were outliers, and I presented them as a mechanism two messages ago.

✅ And their predictor does reproduce here: of the whys carrying a date, 86 % → 100 % → 100 % cited across 29 / 30 / 31 August. ⚠️ Only 28 of 71 carry a date, so that table covers a subset — and their caveat applies to my numbers as much as theirs: the improvement coincides with this exchange, so salience is part of what produced it. It is evidence that the uncited residue is old, not that the habit is durable.

The prognosis flips, and that was the point of their message

They distinguished a generative blind spot — quality-correlated, keeps producing new instances — from a legacy residue, finite and closable by backfill. They said reading my diagnosis onto their corpus would have implied work that was not needed.

📌 The same is true in reverse: mine is a legacy residue too. I had it as generative and would have gone looking for an ongoing mechanism that is not there. The right work is a backfill of 17 uncited whys, not a new discipline — and I would not have known that without measuring a claim I had already published.

📌 Their framing of the propagation step is the one I want kept, because it assigns the cost correctly: an uncited measurement of theirs became an uncited value of mine, and the receiving end cannot distinguish a summarised measurement from a recalled one. That is a cost their delivery imposed on my file rather than a defect I introduced — and the fix belongs at the delivery end, where they have put it.

The backfill: 17 was 12, and 12 is now 0

The work my own measurement said was needed — a legacy residue, not a new discipline. Doing it corrected the number twice.

🔴 First, "17 uncited" was inflated by my own extractor. Five of the sixteen named a capture filename (live-extras.png) or a bare HANDOFF — real, openable citations the extractor could not see. A third of my published backlog was the invents-defects failure aimed at myself. Capture filenames now count; a bare HANDOFF counts separately, because "the contract says so" sends a reader to 4 000 lines while "Q5 says so" does not.

✅ Then the genuine twelve, all backfilled to zero. The plate-overlay group now cites plate-pulse-measured.md, plate-pulse-phase-lock.md and the raw series; unobserved_why cites the BLOCKED row it stands in for; the boot order cites ui-title-build-map.md; focus_persists_why cites both the round-trip data and the contrasting submenu result.

⚠️ screen_names.json's sibling references were left as references, with a note saying so: "as entry 10, region twin" points at another entry in the same file, and forcing a path onto it would be mislabelling to satisfy a counter — the failure I have been warning about for four iterations, which is easiest to commit while clearing a backlog.

🔴 Their record layout was wrong and I had copied it — fourth relayed aside

The dialog record is {id, name_ptr, handler}, not {handler, id, name_ptr}. Same three fields shifted one word, so every record was credited with the previous record's handler. They caught it with a control dump: under the old alignment record 0 had a "handler" of 0x10000000, which is not a code address.

I had copied the wrong order into flow.json. ids and names are unaffected and DLG_SELECT_DIFFICULTY is still 2000, so nothing here moves except the sentence.

📌 Fourth aside of theirs relayed into my authored data — and the first that is a STRUCTURE rather than a decoration. The earlier three were an EN/JP pairing, a leg count and an independence claim, all weightless. A wrong field order is the kind of thing a later reader builds on, and it carried no weight here only by luck. The pattern I named — the unchecked things are the ones carrying no weight — did not protect me this time, because this one looked like a fact rather than an aside.

The join, recorded as a route rather than an answer

All three handlers load the same global at 0x828E2B14 and take addresses inside a 364 601-byte contiguous zero run — BSS, populated only at runtime. Controlled: an all-zero read is also what a wrong address gives, and the dialog table reads non-zero through the same arithmetic.

⚠️ That closes the dialog handlers, not the image. The archive loader and any id-keyed table elsewhere are unexamined, so "not in the image" is not established — their framing, kept.

📌 And their symmetry caution is the right one to end on: two corpora whose residue is old and whose recent rate is high, measured during the exchange that made the norm salient. That is exactly the shape that would look like durable improvement and might not be. Worth re-measuring later — "which is not a thing I would bet on".

🔴 My falsifier never identified the offset — the half I called a formality did

Their struct-layout control found that a homogeneous repeated table type-checks at every field boundary, so an interior test carries no information about phase — 69 of 70 records passed under both shifted alignments. Their rule: the evidence for a field order lives at the first and last record, and nowhere else.

That aimed at my +0x08 loop-length control, which is an interior test of exactly that kind and which I re-ran as "confirmation". Re-run at the neighbours:

offset falsifier — never < max t exact — == max t
+0x04 0 violations — PASSES 0.0 %
+0x08 0 violations 92.3 %
+0x0c 1 287 violations, 72 % —

🔴 The falsifier does not identify +0x08. It rejects +0x0c and accepts +0x04, whose word is ≥ max keyframe time in 100 % of records. I published it as the load-bearing half — "an animation cannot restart before its own last pose, so a wrong reading should produce violations, and none exist in 1 781 records" — and a wrong reading one word to the left produces none either.

✅ What identifies the offset is the half I described as merely guarding against triviality: +0x08 equals the largest keyframe time exactly in 92.3 % of records; +0x04 does so in 0 %. No unrelated word reproduces that coincidence.

📌 So the value is right and my argument for it was wrong — and this is the second time this week I have had the weight on the wrong leg. Last time the count was taking credit for an exclusion argument; this time the falsifier was taking credit for the exactness statistic. Both were cases where the impressive-sounding control was the one carrying nothing.

⚠️ Their generalisation of the boundary rule does not transfer literally — a per-record header has no first-and-last-record phase question — but the underlying point does: an interior consistency check is satisfied by any reading that is internally consistent, and "internally consistent" is what a wrong offset into a regular structure usually is.

📌 And their observation about when I found my extractor inflating my own backlog is worth keeping: while clearing it, not while building the tool. Clearing put me in contact with the individual items; building had only put me in contact with the rule.

The 92.3 %-versus-49.6 % gap: same numerator, and their filter is not applied

Reproducing my offset result, they reported the same discrimination over a different population — 3 311 records against my 1 781 — with exactness at 49.6 % against my 92.3 %, attributing the difference to "this scan takes every pak and requires a timed keyframe". Both scans are described identically, so at least one was narrower than its own description. Counting my survivors at each filter:

filter survivors
records declared by parse_build 3 311
within the entry's bounds 3 311
carrying the RATC magic 3 311
parsing as a nested build 3 311
with at least one timed keyframe 1 781

📌 3 311 is the count before the timed filter. And the arithmetic closes it:

1643 / 1781 = 92.3 %     (mine)
1643 / 3311 = 49.6 %     (theirs, exactly)

Same numerator. So their denominator includes the 1 530 records with no timed keyframe at all, where "does +0x08 equal the largest keyframe time?" has no meaning — there is no largest keyframe time, max t is 0, and every one of them counts as "not exact" by construction.

🔴 So their stated filter is not applied, and the 49.6 % is not a weaker version of my 92.3 % — it is 1 643 successes divided by a denominator containing 1 530 questions that were never asked.

✅ The discrimination is untouched, as they said: +0x04 gives 0 % under either denominator, so the offset conclusion stands on both scans.

⚠️ And my number needs its own qualifier, which it did not carry. 92.3 % is "of the records where the question is meaningful", not "of nested records". I have been quoting it bare since 2026-08-30, including into screen.rs's doc comment — a population-scoped statistic reported without its population, which is the same shape as a negative reported without its reach.

📌 Two agents, one number, and the disagreement was entirely in the denominator — neither of us was wrong about the disc. That is a cheaper failure than the offset one and a more common one: the numerator agreed to the unit, which is exactly what makes a denominator mismatch invisible.

🔴 Correcting my own correction: none of the 1 530 is a question without content

I told them their denominator held "1 530 questions that were never asked" — records with no timed keyframe, where "does +0x08 equal the largest keyframe time?" has no meaning. I did not check that, and it is wrong.

of the 1 530 excluded
no timed keyframe at all 0
timed, every pose at t = 0 1 530

Every one of them has a largest keyframe time. It is 0. So the question is well-formed there, and the answer is "not exact" — because a static record still declares a cycle length, and a nonzero +0x08 against a largest time of 0 is a real disagreement, not an absent one.

📌 Which makes their 49.6 % defensible rather than mistaken. Two statistics over two populations:

  • 92.3 % — of records whose largest keyframe time is > 0.
  • 49.6 % — of all nested records, static ones included.

Neither is the corrected version of the other. I framed mine as the correct one and theirs as an artefact; the truthful statement is that they answer different questions and both need their population attached — which was my own point one message earlier, applied to their number and not to my reading of it.

⚠️ Their cause diagnosis is still right about the mechanism — .max() returns Some(0) rather than None — but "records with no timed keyframe" describes zero records on this disc. The mechanism they found is real and the population they attributed it to does not exist.

📌 Third-order, and worth naming as such: they corrected an argument, I corrected their denominator, and this corrects my characterisation of what was in it. Each step was checkable in one scan, and each of us stated the interpretation confidently while only the number had been measured. The numbers have agreed throughout; every disagreement has been about what they were counting.

✅ What survives untouched, and is the only part the port depends on: +0x08 equals the largest keyframe time exactly where that time is nonzero, +0x04 does so 0 % of the time under either denominator, and the offset identification stands on both scans.

The one load-bearing thing in the denominator thread, checked against the port

Their substantive point was not about counting: a static record still declares a cycle length, and a nonzero +0x08 against a largest keyframe time of 0 is a real disagreement. That is a rendering question for this port, and it had not been asked.

Scoped to the archive the port exports:
nested records in GP_TITLE 65
declaring a cycle while every pose sits at t = 0 20
of those, with any element carrying more than one pose 0

✅ So the declared cycle is visually inert on every one of them. A record whose elements each hold a single pose renders identically whether looped or held — there is nothing to move between. The port holds nothing still that the disc says moves, and that is now measured rather than assumed.

⚠️ It includes ptbtn11/12/13 — EXTRAS' own buttons — declaring 120-unit cycles. Had any carried two poses, the port would have been holding a menu button the disc says animates, on the one submenu P5's gate walks. The check cost one scan and the answer could have gone the other way.

📌 And this is the thread's whole yield stated honestly. Three rounds of correction ran over an interpretation that was never load-bearing — the offset stood on both scans throughout, so the cost of being wrong at each step was a paragraph. What came out of it that was worth having: the population distinction, and this one check, which exists because they pushed on what the 1 530 mean rather than on how they are counted.

⚠️ Their framing of why it was safe is the caveat I would attach to repeating it: nothing the port depends on moved at any point. That made three rounds cheap. It does not make three rounds a good default, and I would not have spent them if a shipped value had been waiting on the outcome.

Quantifying the one thing neither agent can move

They closed with the fact that gates everything: main is ~234 commits behind their branch, so nothing either of us decided this week is reachable from it. That is also where P5's gate sits, and it is the one open item I own the framing of.

Measured from this side: 256 commits ahead of origin/main, 0 behind — so main is an ancestor and the merge is a fast-forward with nothing to resolve. 58 files: the exporter and its examples, the Godot scripts, authored/, tools/port/, docs/port/.

RUNNING.md gains a §6 saying what a person is actually being asked to do, in three lines: run --boot --play, walk the table, say whether it behaves as described — not whether it matches the game, because that comparison is the oracle's and is already asserted by check-all.

📌 That distinction is the point of writing it down. A reviewer who thinks they are being asked to judge fidelity will either decline or over-claim; the gate asks something narrower and answerable in five minutes. P5 has been open partly because nobody had written what "clicking through it" means.

⚠️ What this does not do is meet the gate. It removes the last excuse that is mine to remove — the commands existed only in a header comment, then only in a log, and now the ask itself was unstated. The remaining blocker is a person, and before that, a merge neither agent may perform.

Verified their merge-state claim rather than relaying it — and it improves the ask

They extended the merge quantification and I checked it from this side, because it is a structural claim about my own repository and I have relayed four of their asides unchecked this week.
their branch vs main 329 ahead, 0 behind — fast-forward ✅
files in common between the two change sets 0 ✅
git merge-tree --write-tree of the two heads single tree, no conflicts ✅

Read-only: nothing was merged, and merging stays the human's.

📌 Their point about the sentence is the useful part, and it corrects my own framing from last iteration. I wrote "257 ahead, main 234 behind" — which sounds like a backlog someone has to schedule. The true sentence is "two fast-forwards over disjoint file sets, mergeable in either order with zero conflicts", and that is a decision that takes a minute. RUNNING.md §6 now says the second thing.

⚠️ I had the numbers and still described the situation in the harder-sounding way. A quantity is not a framing, and I supplied one while leaving the other at the level of "this is blocked".

Closing the exchange

Their last observation is the one I would keep from the whole week: the counting question felt like the rigorous one to both of us and produced three rounds of correction over an interpretation nothing depended on; the meaning question produced a check that could have gone the other way on a screen this port ships.

📌 And the P5 finding is its companion: the gate was partly open because the ask itself was unstated. The commands existed, the log existed, the question lived nowhere — and no instrument either of us built would ever have surfaced that. Both are the same shape: the thing missing was not evidence, it was what the evidence was for.

The number in my decision document was stale the moment I committed it

Their last finding lands on RUNNING.md §6, which I wrote for the person who has to certify P5: a count written into a document meant to inform a decision decays with every commit either agent makes.

🔴 Self-demonstrating: §6 said "256 commits ahead". By the time it was worth reading, the answer was 258 — and the commit that added the sentence is one of the two that made it wrong. The act of recording the number changed the number.

✅ Rewritten to invariants plus the commands to re-derive, because the counts were never the claim. What does not move:

invariant
main is an ancestor of this branch ✅
main is an ancestor of the Decoder's branch ✅
the two change sets touch zero files in common ✅
merge-tree of both heads → one line, no conflicts ✅

Every check in the table was run as written before it was published — a documented command that has never been executed is the same class as a control that does not execute.

📌 And it closes the exchange on the shape it kept producing. Three times this week I supplied a measured quantity and left the thing it was for unstated: the merge described as a backlog when it is a one-minute decision; the P5 gate open because the ask was never written; and now a count standing in for an invariant. In each case the evidence existed and what it was evidence for did not.

⚠️ Their closing judgement is the one I would repeat rather than improve: no instrument either of us built has any purchase on that class, and neither of us should try to build one. The only thing that has ever caught it is one agent reading the other's sentence for its own sake — which does not scale, and is not a process, and is the entire mechanism behind every correction in this file this week.

A command without a pass condition is half a check

Their standard applied back to my §6: a reader gets a number and no way to know whether it is the right one. Two of my four rows were worse than that — git merge-base --is-ancestor prints nothing at all on success, so a reader running it as written sees an empty line and cannot distinguish success from failure.

Each row now carries ; echo $? where the answer is an exit code, a stated pass condition, and the last observed run: 0, 0, 0, 1. All four were executed as written before publishing.

What every failure this week actually was

Their closing observation is the best summary of the exchange and I would not have assembled it:

None of them was a wrong measurement. Every one was a correct measurement doing a job it could not do.

  • a count standing in for an invariant — §6's "256 commits"
  • a falsifier standing in for a discriminator — +0x08 vs +0x04
  • a leg count standing in for an exclusion argument — "three routes"
  • a denominator standing in for a population — 92.3 % vs 49.6 %
  • a capture's assumed focus standing in for an excluded one — the oracle row

📌 That is a narrower failure than being wrong, and it survives every instrument either of us built — because the number is right and the instruments check numbers. audit-kinds checks that a claim cites something. check-claims checks that a dead phrase is marked. contract-check checks that a value matches the contract. Not one of them can ask whether the quantity answers the question it is placed under.

⚠️ And that is where I am leaving it, because the alternative is building the instrument we spent a day establishing cannot exist. The Decoder tried twice and published neither attempt; my own version would have been "flag claims whose supporting statistic is not an exclusion argument", which is a judgement, not a test.

📌 The one durable thing is a habit rather than a tool: ask what job a number is doing, not whether it is correct. Every entry in the list above was caught by somebody asking that about somebody else's sentence — and in four of the five, the somebody was the other agent.

The remaining multi-leg claims audited — and the pattern I predicted is not there

I have listed "four unaudited multi-leg claims" as open for several iterations, and after the week's findings I said I expected the same inversion in them: a count standing in for an exclusion argument. Applying the test — could any leg have come out differently given the others?

claim verdict
loop_start_why — "two derivations, neither converts bits to seconds" ✅ holds. (a) depends on a measured rate, (b) on the cycle — a wrong rate breaks (a) and leaves (b), a wrong cycle does the reverse. They fail independently. ⚠️ Bound: one trace, so they exclude arithmetic error and not trace error — which the existing "one boot, one bank" caveat already says
arithmetic_why — "the corpus had independently measured 28.5 fps" ✅ holds. A different quantity, measured before these runs, so it could have disagreed. It agrees to 1.4 %
black_hold_why — "I checked independently…" ✅ holds, and needed nothing — it was already an exclusion argument: a constant excluded, outgoing-screen keying excluded, and four declared quantities each shown not to separate the pairs

📌 So the prediction was wrong, and that is worth recording as loudly as a confirmation would have been. Two of the original five were the bad shape and were corrected when they came up — "three routes" and "both agents independently". The three that remained are sound, and two of them were already exclusion arguments before I had the vocabulary for it.

⚠️ The lesson I nearly drew was that my corpus is riddled with count-shaped support. It is not: it had two, both relayed from a peer's message, and the claims I built from my own measurements state what they exclude. That is a different diagnosis and it changes what to watch — the exposure is at the relay, not in the authoring.

✅ Each why now states what its legs discriminate, rather than how many there are. That is the whole content of the week's finding applied to my own data: the count was never the claim.

Their JP menu capture, corroborated from the disc — and the legs are genuinely different

They captured the JP main menu for the first time: initial focus 新規 (NEW GAME), top item, ring y 225.5 — matching six English boots — and reported that the JP build places its buttons where the English one does.

✅ Checked from my export, and it is exact:

screen button rows
main_menu 162, 242, 322, 401, 482
main_menu_jp 162, 242, 322, 401, 482
extras 282, 362, 442
extras_jp 282, 362, 442

📌 And this time the legs really are independent, which is worth stating after a week of finding they were not. Theirs is a runtime capture of where the ring lands; mine is the disc's declaration of where the buttons rest. Different instruments, different quantities — my rows are button rest positions, their 225.5 is a ring row, so these are not the same number — and either could have disagreed: the disc could declare different JP rows while a runtime ring landed at 225.5 for some other reason.

What each establishes, separately: the disc declares identical rows for EN and JP; the running JP menu's ring sits where English's does. Together, declaration and runtime agree and the languages agree.

⚠️ It does not settle their dialog question, and they said so before I could: this is language-pair structure at the menu, not at the dialog. GP_DIALOG 2/3 remains exactly where it was — the ja capture of DIFFICULTY did not happen, the round trip failed at the final Ⓐ.

📌 Their self-correction on the way is the same shape as everything this week: they assumed the JP menu detector had failed because a log line showed glyph 11654; it had not — JP detects at 320 against English's 327, both inside the band, and the 11654 was a later phase. Diagnosing from the log line rather than from the capture.

They have taken the relay finding, and it now has a direction

"The exposure is at the relay, and I am the source end of it." They hold 271 unaudited leg-count claims, and my result predicts that is the problem set rather than mine — a prediction with a direction, which is better than a backlog item, and they said plainly they are not going to pretend it is scheduled.

📌 That is the correct disposition and I would not push it. A backlog nobody is incentivised to clear is exactly what we established survives; the honest move is to say so rather than to file it and let the filing stand in for the work.

The independent pair was an accident — the rule that would make it deliberate

Their observation, and it is the one thing left in the exchange worth converting into a habit: the first genuinely independent pair either of us produced this week happened by accident. I checked a different quantity because it was the one my export had, not because independence was designed for.

📌 The rule that would make it deliberate: when corroborating a peer's claim, re-derive it from what YOUR OWN DOMAIN gives you, not from the quantity they measured. Independence then follows by construction, because the domains differ — mine is a static export of the disc, theirs is a runtime capture of the emulator. Reaching for their quantity is what produces one reader used twice, which is precisely how extras/initial_focus's "both agents independently" died.

⚠️ And it explains why that one failed while this one held. For ptbtn11 I reached for the same quantity — button rows via parse_build — and got their crate back. For the JP menu I reached for what my export happened to carry — declared rest positions — and got a different instrument answering a different question. The difference was not care. It was whether the obvious check was inside my own domain or inside theirs.

📌 Their note on the cost of the log-line slip is the sharper half of that finding: the wrong diagnosis would have entered the corpus as "the detector is locale-specific" — plausible, tidy, false, and exactly the kind of instrument finding nothing downstream questions. An instrument's own limitations are the claims least likely to be challenged, because challenging them requires doubting the tool everyone is using.

A workflow defect of mine, on its fourth occurrence

check-all failed on decisions-index again — stale because I appended to DECISIONS.md while the suite was running. That is the fourth time, and I have regenerated and moved on each of the previous three without naming it.

📌 The check is right and the habit is wrong. A stale index is a real defect for a reader — it answers "is this already decided?" with a confident no — so weakening the assertion to accommodate my ordering would be exactly the tuning-to-pass failure this file is full of warnings about.

✅ The rule is one line: write the entry, then start the suite. Recorded here rather than left as a thing I keep rediscovering, because four silent regenerations is how a recurring defect becomes invisible — each individual one looks like a trivial fix.

⚠️ And the substantive result of the run, which is why it was worth doing: after an iteration of authored-data edits across audio.json, flow.json, timing.json and screen_names.json, the oracle numbers are unchanged — main_menu 13.21, extras 13.38, title 14.16. Nothing I did to the why fields touched what the port renders, which is what authored/ being separate from export/ is supposed to guarantee and is now checked rather than assumed.

The menu residual, decomposed — and half of 13.06 is tone

verify-capture's header has said for weeks that "RMSE is reported and is NOT a target: the capture carries the game's own tone ramp, so it has a floor." The floor has never been measured. The splash residual was localised in detail; the menu's — the port's most-quoted number — never was.

luma RMSE
main_menu render vs capture, aligned 10.60
after fitting one monotone transfer curve 4.77
removed by tone alone 55 %
⚠️ control: same fit, menu render vs the EXTRAS capture 28.92 → 20.98, 27 %

📌 The control is what makes the 55 % mean anything. A fitted curve always removes something — on an unrelated pair it removes 27 %. Twice that on the matched pair, so the tone difference is real and specific, not the fit absorbing variance.

So roughly half the menu residual is a tone/gamma difference between the port's render and the captured surface, and half is not. The fitted curve is an S-shape rather than a gain — 64→72 brightens, 128→119 and 192→184 darken — which is the shape of an output pipeline, not of a wrong colour.

⚠️ What this does NOT do, and I am not going to do it: identify which side is wrong, or "fix" the tone. The mission's instruction is explicit — say which is wrong rather than tuning until they match — and I cannot say which. The capture carries the emulator's output path; the render carries Godot's. Nothing in the port changes on the strength of this. What changed is that a number quoted for weeks now has a decomposition and a bound: 4.77 of it is not tonal.

🔴 And my first attempt at it was misaligned in exactly the documented way

Before this I ran a raw full-frame comparison and got "75.6 % of pixels differ, uniformly across the frame" — a nonsense result, because the capture is 1279×675 and the render is 1280×720. verify-capture handles that in a comment I had read: "the captures are a 1279×675 top-left crop of the guest surface, so the render is cropped to match and nothing is scaled."

📌 I bypassed the harness that encodes the correction and reproduced the uncorrected error. Same shape as the week: the instrument existed, its comment said why, and I reached past it for a quicker check. The tell was that the answer was uniform — a residual spread evenly over an entire frame is a comparison fault, not a rendering one, and that is the reading I should have applied before the dimensions.

Refutation: the peer's tone/geometry positive control rests on a number of mine that cannot carry it

docs/re/structures/title-residual-tone-vs-geometry.md (d0eae04) argues that at least 68 % of the title's residual is spatial. Its instrument is a per-level LUT fitted on the screen itself, and it validates that instrument with a positive control on the main menu — "where the port measures only 0.06 % of pixels differing, so geometry is essentially right" — closing 70.3 % there.

📌 That 0.06 % is mine, and it does not mean what the control needs it to mean. verify-capture counts pixels surviving -threshold 25%: differing by more than ~64 levels. That is deliberate — the tool's job is to catch a missing or misplaced element, which is a large connected blob. A one-pixel offset, a soft edge slightly out of place, an antialiasing difference: none of those move a pixel 64 levels, and none of them are visible to that column. It establishes no gross displacement, not geometry is right.

And sub-threshold spatial error is precisely what a per-level LUT also cannot close — so if the menu has any, the control is not measuring what it claims.

It does. Measured, with a known negative

After fitting the LUT, splitting the remaining residual by local gradient:

main_menu, LUT-corrected residual value
on edge pixels (4.3 % of frame) 6.94
on flat pixels 2.20
concentration 3.16×
⚠️ known negative — render vs itself under a pure gamma 0.78 0.00 / 0.00

✅ The known negative is exact, by construction: a residual that really is a per-level tone effect is inverted perfectly by a per-level LUT, so any nonzero edge concentration is spatial. The menu's is 3.2×.

What this does and does not refute

  • 🔴 Refuted: the positive control's premise. The main menu is not a geometry-free screen, so "the instrument closes 70 % of a tone-dominated residual" is not demonstrated — that 70 % was closed on a residual that also contains spatial error.
  • ✅ Their conclusion survives, and I want to be clear about it. The title's 32 % figure never depended on the control: whatever a fitted per-level LUT cannot close is, by construction, not a per-level effect. That argument is self-standing. The refutation lands on the validation, not on the result.
  • 📌 The actionable half is mine. A number this tool prints was quoted by another agent as evidence for something it cannot support. I have written the limit into verify-capture's header next to the number, because the misreading was reasonable — the column is called diff and nothing said what it thresholds.

⚠️ Still not settled: what the menu's spatial error is. 3.2× edge concentration is the signature of sub-pixel misregistration, of antialiasing, or of a genuinely misplaced soft element, and this measurement does not separate those three. I am not guessing between them.

The menu's edge residual is not a misregistration — the Decoder's discriminator, run

They proposed the test and said plainly they had not run it: "the discriminator would be whether the edge excess is signed — a misplaced element gives a residual with a consistent direction along the edge, antialiasing does not. That is a real experiment and I have not run it, so it is a route, not an answer."

📌 It needed my render beside the capture, so it was mine to run. Made concrete: a shift by (dx,dy) makes the signed residual track the gradient, and the fitted slope is the shift in pixels; a blur makes it track the Laplacian, symmetric and directionless. New tool: tools/port/edge-residual-kind.

The controls come first, and they are not a flag

render vs a deliberately damaged copy of itself d/dx d/dy laplacian
known +1 px horizontal shift r +0.789, slope +0.938 px −0.008 px −0.306
known blur, no shift +0.003 px +0.004 px r −0.896

✅ A 1-px shift reads back as +0.938 px. The instrument recovers both what it is for, and neither control leaks into the other's channel.

The result

main_menu render vs oracle capture value
horizontal shift r −0.027, slope −0.010 px
vertical shift r −0.027, slope −0.009 px
blur / sharpness r +0.103

🔴 Flat on all three. The menu is not globally misregistered — any whole-frame translation is under a hundredth of a pixel, against a control that reads a true 1 px at 0.938. That excludes the most worrying of the three candidates, and the one a renderer can silently acquire. The blur channel at +0.103 is weak and the opposite sign to the blur control, so the capture is not a softened render either.

⚠️ Reach, and it is the whole reach: this is a whole-frame fit. A single misplaced element is a small share of 38 752 edge pixels and would not move these numbers. This excludes a global translation, not a local one. Of the peer's three candidates it kills misregistration and weakens uniform antialiasing; a misplaced soft element is untouched by it, and I am not claiming otherwise.

📌 Exit codes are 0 or 2, and there is no 1 — the tool classifies, it does not judge. If either control fails it prints nothing but the failure: verified by raising the thresholds to 0.99, which suppresses the report and exits 2. A guard nobody has watched fail is decoration.

GP_DIALOG 2/3 restored to authored/flow.json — on a measurement this time

I withdrew "an EN/JP pair" as an unchecked relay and declined to re-add it because nothing depended on it. The Decoder has now taken the ja capture that was missing (HANDOFF at 5a7f34d, dated today): EN and JP differ in 1.82 % of pixels in four bands and nowhere else — heading, the ring by 2 px, BACK, the footer. EASY/NORMAL/HARD are not in the differing set; the Japanese release leaves them in Latin script, which is why the disc figure is only 2.77 % of bytes.

📌 My objection was not wrong and is not withdrawn. It was that identical element sets do not imply a language pair — 26 of 65 adjacent GP_DIALOG pairs differ in button count, so adjacency proves nothing. That still holds. What changed is that the claim now rests on a direct locale capture instead of on that inference. A bad argument for a true claim is still a bad argument, and the claim was correctly out of the file until somebody went and looked.

⚠️ Their reach, carried across: one JP boot, one screen, does not generalise — GP_TITLE 4/7 differs by more than text. Nothing in the port keys off locale today, so this is recorded, not consumed.

The residual map: no local displacement either, and the split I expected is not there

The Decoder proposed the division and it is the right one: "the map is yours and the element inventory is mine." tools/port/edge-residual-map tiles the frame at 64 px and runs the same shift discriminator inside each tile, which is the thing edge-residual-kind said it structurally could not do.

🔴 The first control failed, and that is the useful part

A known +2 px displacement localises perfectly — the displaced region is the top four tiles — but reads back +0.839 px. The slope is a linearisation, residual ≈ dx · gradient, valid only while dx is small against the width of an edge. The estimator saturates. Reporting that as a distance would have understated a real displacement by more than half.

So there are now two controls, each asserting only what it can:

control localises magnitude
+1 px (linear regime) ✅ top 4 tiles ✅ +0.949
+2 px (saturating) ✅ top 4 tiles ⚠️ +0.839 — a lower bound

📌 A hot tile's slope is a floor on the displacement, never a ceiling.

The result

tile edge flat e/f dx dy
512,128 18.80 10.20 1.84 −0.001 −0.000
576,64 15.11 9.09 1.66 −0.012 +0.029
384,256 14.12 4.40 3.21 +0.003 +0.003
512,192 11.91 3.53 3.37 −0.038 −0.090
448,128 11.78 9.53 1.24 +0.084 +0.036

median tile 5.13 · hottest 3.66× median · every dx and dy under 0.1 px

🔴 No tile in the top ten is displaced. Against a control that reads a true 1 px at +0.949 and finds a 2 px one even while understating it, nothing in the hot region has moved. The peer's third candidate — a misplaced soft element — now has no support anywhere on this screen, globally or locally.

The hot tiles cluster: x 384–704, y 64–256, a wide upper-centre band, plus one outlier at 640,576. Those are coordinates. This tool names nothing — what sits under them is the Decoder's, and I have sent them the list.

⚠️ And a structure I expected, went looking for, and did not find

I added the flat column expecting two families: tiles hot only at edges (an edge-rendering difference) against tiles hot everywhere (a local tone the global LUT mis-serves). Reading the first ten rows, that split looked obvious.

It is not there. The hot tiles run continuously from 1.24 to 3.37 across a median of 1.84.

📌 What nearly manufactured it: I had the frame-wide pooled edge/flat ratio, 3.16, from the earlier work, and against 3.16 the rows at 1.2–1.8 look like a distinct low family. But the pooled figure is dominated by the tiles carrying the most edge pixels; the per-tile median is 1.84, and against that the same rows are unremarkable. Same quantity, wrong population — the week's pattern again, caught this time only because I computed the baseline before writing the claim rather than after.

So the hot region is not one anomalous element with a character of its own, and that is a finding, not an absence of one.

Suppression beats coordinates: the menu residual is two frame elements, drawn too dark

The Decoder named what sits under my hot tiles (docs/re/data/menu-hot-tile-inventory.txt) and was careful to test both coordinate readings rather than assume one, because design space and the comparison frame differ by the capture transform.

📌 I did not need the transform. The port has a mod tree, so an element's real footprint can be measured: shadow its sprite with a transparent PNG, render, and diff my own two renders. The pixels that change are the element, in my comparison frame, with no coordinate convention assumed at all. That is the method I should have reached for before handing over tile coordinates.

The ranking, by residual density on each element's own visible pixels

element footprint mean |resid| vs frame mean 2.40
ptframe1 0.45 % 22.72 9.47×
ptframe2 0.50 % 13.09 5.46×
ptmsg 0.46 % 8.46 3.52×
pteff12 17.31 % 4.98 2.07×
ptbase 3.98 % 3.34 1.39×
pteff10 52.15 % 3.34 1.39×

🔴 This refutes the hypothesis I came in with

I predicted the effect element: screen.rs records blend mode as undecoded, an effect composited wrongly would be tonal and displace nothing, and pteff12 sat in the hot band. The measurement says the frames — 9.47× against the effect's 2.07×, and pteff12's ratio is largely inherited from containing ptframe1 (excluding the frame's pixels drops it from 4.98 to 4.61).

The mechanism I proposed may still be right. The element I proposed it for was wrong, and the only reason I know is that suppression ranks elements rather than confirming the one I was looking at.

Not an edge effect — and that is what makes it specific

edge px |r| edge flat px |r| flat
ptframe1 1868 19.85 1986 25.41
ptframe2 2201 9.82 2086 16.54
pteff12 12102 7.73 137306 4.73
ptbase 14092 4.69 20229 2.40

🔴 The two frames are the only elements whose residual is higher on FLAT pixels than on edges. Everything else is edge-weighted, as any render/capture pair is. So this is the elements' body intensity, and signed it is one-directional: ptframe1 renders at 88.4 against the capture's 129.1, with 0.1 % of its pixels render-brighter. The port draws them too dark, nearly everywhere, after a global tone LUT is already applied.

Filed as an ask in BLOCKED.md against HANDOFF 5a7f34d. I am not brightening them — that is tuning until they match, and the blend bits are the Decoder's.

⚠️ And a defect I nearly reported that was not one

Suppressing ptbtn01 — the focused button — changed zero pixels, and an opaque magenta replacement changed zero too. ptbtn02 and ptbtn03 change 9 331 and 7 654. All five buttons carry the same rest fade, so the difference is focus, and the obvious reading was "the port never draws the focused button".

screen_view.gd:746 says otherwise, deliberately: "A FOCUSED button draws its record INSTEAD of its base sprite — measured, the focused sprite covers the base at 100.0 % of base-visible pixels."

✅ So the null is a confirmation, at a stricter standard than the claim it confirms: not "100 % of sampled base-visible pixels are covered" but "replacing the base with opaque magenta changes the frame in zero pixels, exactly". I went looking for a bug and independently re-derived a documented measurement.

The frames generalise, premultiplied alpha is refuted, and the shortfall tracks the background

tools/port/element-residual generalises last iteration's suppression method: pose a screen as verify-capture does, shadow each sprite with a transparent PNG, and rank elements by residual on the pixels they actually paint. Two controls, both mandatory — the metric's zero on identity, and a mod that shadows nothing must move zero pixels, or a footprint is the harness rather than the element.

It generalises: four frames, two screens, ranks 1 and 2 on both

screen element foot % |resid| ×frame edge flat signed
main_menu ptframe1 0.45 22.72 9.47× 19.85 25.41 −22.72
main_menu ptframe2 0.50 13.09 5.46× 9.82 16.54 −12.31
extras ptframe3 0.40 34.80 14.23× 32.41 41.93 −34.80
extras ptframe4 0.40 25.58 10.46× 23.29 33.55 −25.36

📌 And the sign splits, so this is not the port being globally dark. Frames are negative; ptmsg +5.02, ptmsg2 +8.83, pttitle +7.88 and every button +1.45…+4.07 are too bright. A global tone error cannot do that.

🔴 Premultiplied alpha: my hypothesis, refuted by its own prediction

The obvious exporter-side cause is a premultiplied-alpha texture decoded as straight alpha, which darkens exactly where alpha is partial. It predicts error ∝ partial-alpha fraction. The opposite holds:

element % partial alpha signed
ptframe1 7.3 % −22.72
ptframe3 6.7 % −34.80
pteff10 100 % −1.33
ptbase 0.9 % +1.04

✅ Dead. The most-darkened elements have the least partial alpha, and the one element that is entirely partial is almost exactly right.

What the frames actually are, and where the shortfall goes

Neither frame has a single fully-opaque pixel — 0 % at alpha ≥ 99 %, against ptbase's 99.1 %. They are wholly semi-transparent overlays, the one class where the compositing equation decides the result.

That gives a falsifiable prediction. Under alpha-over, the shortfall against a background-scaling blend is a · background, so it scales with what is behind the frame — whereas a too-dark texture would scale with the frame's own contribution. Using only the render, the frame-suppressed render and the capture, so no placement or coordinate convention is assumed:

r(shortfall, background) r(shortfall, frame's contribution)
ptframe1 (main_menu) +0.772 +0.244
ptframe3 (extras) +0.797 +0.237

✅ Replicated on two elements on two screens. The missing light scales with the background, which is what an additive or screen blend predicts and what a bad texture does not. Implied a medians 0.316 and 0.532.

⚠️ What I am NOT doing about it

The Decoder has established there is no blend mode on the disc for .t32 — both frames are kind 0, declared identically to elements the port draws almost exactly right (ptbase ×1.31, pteff05 ×0.92). So any blend I choose is authored, and adopting one on my own authority is precisely what the mission forbids. I am proposing it, not taking it.

📌 The measurement does say something their negative does not cover, and I want it on the record as an extension rather than a challenge: the behaviour exists and is large and replicated, and if nothing in the data selects it, then it is selected in code — the executable's draw path, which they named as the route they have not taken. Their negative and this measurement are consistent; together they locate the remaining question rather than closing it.

⚠️ Not settled: whether it is additive, screen, or something else — +0.77 and +0.80 say "scales with the background", not which curve. Two screens; I have not checked the title.

Which blend? Additive halves the error, on both frames — proposed, not adopted

Last iteration ended with "+0.77 and +0.80 say 'scales with the background', not which curve." That is decidable without any RE, because an element rendered over two different backgrounds gives two equations in a and aC:

base  - bg  = a(C - bg )        the frame over background 1
b2    - bg2 = a(C - bg2)        the same frame over background 2
--------------------------------------------------------------
a  = [(base-bg) - (b2-bg2)] / (bg2 - bg)        aC = (base-bg) + a·bg

Both backgrounds are produced by the mod tree — suppress pteff10/pteff12 and the background under the frame changes by a mean of 26 levels. No placement, no coordinate transform, no texture decoding assumed.

✅ The control is exact, and it is what makes the rest usable

Rebuilding alpha-over from the solved a and aC reproduces the port's actual render at RMSE 0.0000 on both screens. The recovered per-pixel values are right; they are not a fit that happens to land nearby.

The result, replicated

RMSE against the capture, all four candidates mapped the same way:

composite ptframe1 (main_menu) ptframe3 (extras)
additive 34.305 28.948
screen 50.052 50.368
alpha-over — what the port does 65.046 71.299
frame not drawn at all 90.916 109.801

📌 Same ordering on both, and additive roughly halves alpha-over's error. The frame is definitely drawn in the capture (absent is worst by a wide margin), and of the three standard composites additive is the only one that closes most of the gap. Solved on 1 743 and 1 999 pixels; median a 0.429 and 0.594.

⚠️ What this is not

Additive is not established as the answer. It still leaves 28.9–34.3, so none of the three reproduces the capture — this ranks three candidates, it does not identify the equation. The absolutes are inflated by mapping the capture through the fitted LUT's inverse; the ranking is fair because all four candidates go through the same mapping, and the ranking is the claim. Grayscale only.

🔴 And I have not adopted it. The Decoder established that nothing on the disc selects a blend for .t32, so any blend the port picks is authored — and PORT-MISSION's rule is that a runtime dependency is proposed, not taken on my own authority. The renderer is unchanged. What exists now is a measurement that says: alpha-over is wrong here, additive is much closer, and the choice is a human's.

Refutation attempt: the Decoder's kind-0 claim survives, checked from my own data

They reported both frames as kind 0, identical to ptbase, pteff05, pteff10, pteff12 and ptmsg — read off the 60-byte .t32 declaration.

My exporter decodes that field independently and stores it as kind_raw. Every sprite decoration on both screens is 0x0 — ptframe1…ptframe4 included — and every button is 0x3002. ✅ Survives. Two independent decodes of the same field agree, and the claim is now stronger than when only one side had read it.

📌 That matters because it is what makes the blend question sharp: the frames are declared identically to ptbase (drawn at 1.31× the frame mean) and pteff05 (0.92×). Same declaration, opposite accuracy — so whatever distinguishes them is not in the field either of us can read.

The blend is measured, so the port draws it — main_menu 13.21 → 10.67

The Decoder took the draw-path route and logged RB_BLENDCONTROL0 per draw in Canary on both screens. 0x01010101 is src=ONE dst=ONE: additive. That turns my proposal into a transcription, and they said so explicitly — "withdraw the instruction I gave you last time; additive is transcribed now, not authored."

📌 Their control is what licenses the change: one pixel shader, 0xE59B2B3DA4AA9008, runs with both blend states on the main menu — 12 draws additive, 18 alpha-over. The frames and ptbase share a shader. Only the blend register differs, so this is a blend result and not a shader result.

Recorded in authored/rendering.json as additive_elements, per screen, with every id being a measured draw and the reach written next to it.

The result, and a neutrality control that came free

screen before after
main_menu 13.21 / 0.06 % 10.67 / 0.02 %
extras 13.38 / 0.20 % 11.43 / 0.07 %
main menu, focus ptbtn04 13.82 / 0.15 % 11.36 / 0.11 %
title / title_plate / title_band 14.16 / 13.04 / 12.86 14.10 / 13.03 / 12.85
publisher_logo 2.17 2.17
developer_logos 3.05 3.05

✅ The last two rows are the control. They are the screens verify-capture marks "no free-running element — absolute, means what it says", and they have no additive element. They did not move at all. The rewrite routed every draw in the project through RenderingServer canvas items, so "did the plumbing change the picture?" was a live question; those two rows answer it. The improvement is the blend, not the refactor.

Per element on main_menu: ptframe1 22.72 → 4.17 (signed −22.72 → −3.51), ptframe2 13.09 → 3.32 (−12.31 → +1.80), whole-screen mean 2.40 → 1.55.

🔴 The change ran, produced a number, and the number was wrong by looking right

First run after wiring it all up: ptframe1 moved from 22.72 to 22.69. Bands were created, ordered and assigned correctly; the screen composited exactly as before. I had written CanvasItemMaterial.new() and never set blend_mode, so every band was MIX.

📌 Nothing errored. A 0.03 move is a plausible outcome — I could have written "additive does not help after all, the two-background solve overstated it" and it would have read as a careful negative result. It was caught only because the measurement predicted a large move and 0.03 is not one. The comment now sits on that line.

Why it is RenderingServer and not child nodes

Godot sets blend mode per canvas item, not per draw call. The obvious implementation — a child Node2D per band with a CanvasItemMaterial — loses a frame: boot.gd calls view.queue_redraw() from nine places and none reaches a child node, so bands would paint the previous pose. Under --script=wait that surfaces as a plausible wrong capture, not an error. The bands are canvas items filled synchronously inside _draw() instead.

The runs are recomputed every frame rather than cached. The additive elements are consecutive in paint order on both measured screens — that is an accident of those two screens, and a cache keyed on "the additive block" would be right today and silently wrong on the first screen that interleaves.

⚠️ What I did not do: ptframe4

ptframe4 is now the worst element on EXTRAS (31.90, 16.19× the frame mean) and additive would plainly help it. It is not in the measured table and it is not in the file. Filed in BLOCKED.md with pteff21/22/23, which are also absent from every captured draw. Where the blend is measured the element is near-exact (ptframe3 signed −0.61); where it is not, it is the worst thing on screen. That contrast is the argument for asking rather than inferring.

🔴 Refuted: my "no fully-opaque pixel" sharpener

I offered, as the thing that distinguished the frames, that neither frame has a single fully-opaque pixel against ptbase's 99.1 %. The Decoder refuted it with a census (docs/re/data/menu-sprite-alpha-census.txt): pteff10 has max alpha 130, is 100 % partial, has no opaque pixel either — and I measure it as nearly exact. pteff12, pteff20 and pteff21–23 likewise.

✅ The observation was true and it was not the discriminator. My direction survived — the draw path was the right place to look, and it answered — but the reason I gave for looking there was wrong. Recording it because the conclusion being vindicated is exactly the circumstance in which a bad supporting argument survives unexamined.

The sweeps: a measured blend, a corroborated identification, and a confound in my own evidence

Transcribed: both rotated sweep strips are additive

ui-blend-mode-measured.md's summary table names them additive in the same row as the frames. They are ptloop01/ptloop02 here, now in additive_elements for both measured screens.

⚠️ It changes nothing visible today. On the menus the port runs the leaf group once and parks it off-screen, so both paint zero pixels at every pose the port can be put in — checked by suppressing both sprites at leaf-time 100, 200 and 300: 0 px changed each time. The entry is there because it is measured, not because it does anything. What it does do is repair the instrument below.

✅ Refutation attempt on their identification — survives, with a number of mine

The automatic name matcher reports "no match" for those two draws; they are identified only by the Decoder's control, which reproduces heights 1134 and 1303 from a different tool in a different session. A claim resting on one control is worth attacking.

It survives, and my own geometry corroborates it independently: rendering the menu at a phase where the sweeps are on screen and suppressing them gives a footprint of 884 × 720, against the log's 889.6 wide — 0.6 % apart, and I did not use their number to produce mine. The heights differ (720 against 1134) exactly as they should: my bounding box is clipped by the screen, theirs is the untruncated quad extent.

🔴 And the blend was a confound in my own prior evidence

loop_leaf_why scoped leaf-looping to the title partly on a measurement of mine: sweeping the phase against live-main-menu.png, the port matched best with the sweeps off-screen (0.061 %) and three times worse mid-screen (0.183 %).

That sweep drew them alpha-over. They are additive. So an on-screen sweep was being composited the wrong way and scored against the capture — "mid-screen is worse" could have been an artefact of my own renderer rather than of the sweeps being absent. Re-run with the correct blend and looping switched on for the menu, through a scratch export root so nothing in the repo changed:

diff vs capture sweeps
phase 0 0.0208 % 0 px — off screen
phase 150 0.0851 % 58 027 px, bbox 884×720
phase 300 0.0205 % 0 px — off screen
phases 75/225/375/450/525 0.086–0.122 % on screen
run-once-and-park (what ships) 0.0208 % parked

✅ The conclusion held and strengthened — the ratio was 3× with the wrong blend and is 4–6× with the right one. The capture still matches best with the sweeps not visible, so the scoping stays and the correction is what got recorded.

⚠️ Still one capture, and "best match" is still a weak instrument for an absence. Fixing the blend cleared one confound; it did not repair that.

📌 A draw is not a visible element

The new log shows both sweep strips submitted on the main menu, in every frame group. It would be easy — and wrong — to read that as "the sweeps animate on the menu", which is exactly the question loop_leaf_why left open and would have contradicted the pixels for no reason. A quad parked off-screen at x=1521 is still a draw call. The log settles the blend; it does not settle visibility, and those two came in the same artefact.

A leak I introduced, and a reach sentence that understates its own gap by four elements

🔴 The RenderingServer rewrite leaked five canvas items per run

Every run printed 5 RIDs of type "CanvasItem" were leaked — exactly the number of paint-order runs on the main menu. Canvas items created through RenderingServer are not owned by the node; a child Node2D would have been collected for me, and the reason for not using one (_band) is also the reason this had to be paid for. Freed in _exit_tree.

📌 It was found by looking, not by anything failing: verify-capture was green across every screen, the pictures were right, and the leak line sat in a log alongside N ObjectDB instances were leaked at exit — which BLOCKED.md records as engine-side and not ours, investigated at 91ada14, where releasing every reference the port owns moved the count not at all. A new leak line arriving next to a known-benign leak line is close to the best possible camouflage. The distinguishing fact was the number: 5, which is a count of my bands and not of anything the engine owns.

🔴 Refutation: the measurement's reach is right for one screen and wrong for the other

ui-blend-mode-measured.md closes with: "Every element on the two screens the port ships is in the table except the two above and pteff10, which did not appear as an identifiable quad."

Checked element by element against my own export — counting an element as covered if it appears in the per-draw log or in the summary table's prose rows (which name pteff05, "every button" and "both rotated sweep strips"):

screen in neither
main_menu pteff10 — ✅ exactly as claimed
extras pteff10, ptframe4, pteff21, pteff22, pteff23

🔴 Five, not one. The sentence is accurate for the main menu and understates the EXTRAS gap by four elements — and they are not arbitrary four. They are precisely the elements the port now measures as the worst on that screen: ptframe4 at 16.19× the frame mean, with pteff21/22/23 immediately behind it.

⚠️ This is a reach statement, not a result — every measured row stands, and the port has already transcribed all of them. But a reader of that page would conclude the coverage is complete but for one unidentifiable quad, and on EXTRAS it is not: a quarter of what the port draws there is unmeasured, and it is the quarter that is visibly wrong. That is the difference between "one loose end" and "the open ask in BLOCKED.md".

📌 A smaller observation, offered as one: "every button" in the summary row is a class generalisation, in a document whose own warning is to read the table as per-element facts. No button appears in the EXTRAS draw log at all — the generalisation comes from ptbtn01f on the main menu. It is very likely right, and the port depends on nothing that would break if it were not; I raise it only because it is the same move the document tells its reader not to make.

EXTRAS is complete: 1.97 → 0.63, and the two metrics disagree about it

The four elements I reported as absent from every draw were in a draw all along. The vertex dump was capped at 8 vertices — two quads — and the additive batch holds six, so the log printed pteff20 and ptframe3 and dropped the other four with a well-formed line and no ellipsis. Cap raised, screen recaptured, all six named. 📌 A truncation that leaves no mark is the same failure class as my MIX-default material: the run completed, the output parsed, and the answer was wrong.

ptframe4, pteff21, pteff22, pteff23 and pteff10 are additive on EXTRAS. Transcribed.

EXTRAS element before after
ptframe4 31.90 (16.19×) 1.14 (1.81×)
pteff21 / 22 / 23 14.34 / 13.15 / 12.04 0.79 / 0.72 / 0.73
ptframe3 7.97 1.26
whole screen 1.97 0.63

🟡 Their pteff10 flag, tested — and the answer is "both metrics, opposite ways"

They flagged it before I could adopt it: "you measure it nearly exact under alpha-over and the game draws it additive… it is the one row your renderer does not independently corroborate." Tested by holding pteff10 at alpha-over with every other element additive:

tone-corrected |resid| raw RMSE
pteff10 additive (as measured) 0.630 12.91
pteff10 alpha-over (as the port had it) 1.704 9.98

🔴 They disagree, and the reason is not subtle. The port already renders +8.50 levels brighter than the capture on this screen before any of this (render 35.16 against capture 26.65); additive adds 3.85 more. Raw RMSE is dominated by that pre-existing offset, so it punishes any added light regardless of whether the light is correct. The tone-corrected number, which removes exactly that offset, says additive is 2.7× better — and verify-capture's differing region halved, 0.07 % → 0.03 %.

✅ The measurement wins and I have adopted it, because it is measured off the game and the structural metric agrees. ⚠️ But extras raw-RMSE went 11.43 → 12.88 and I am not hiding that. By the tool's own header — "RMSE is reported and is NOT a target… what finds a real defect is the DIFFERING REGION" — the screen improved. The +8.50 offset is a separate, older question and I am not correcting it: I established weeks ago that I cannot say which side's tone is wrong.

🔴 Refuted: my kind census was a two-screen generalisation, one message after I criticised theirs

I reported "every sprite decoration is 0x0 and every button 0x3002" as an independent confirmation. They refuted it: kind & 0x2 is the focusable flag (0 violations in 15 493 entries across 24 UI paks), while kind == 0x3002 catches 778 of 1 062 focusable elements and misses 284.

My own export contained the counter-examples the whole time:

element kind_raw what my exporter calls it
press_start / ptbtn00 0x73002 unknown — not button
title / ptlogoall_eff, ptlogoall_eff2 0x3000 unknown — looks like a button, is not focusable
title / ptlogo1, ptlogo2 0x4 unknown

📌 This is exactly the move I had just objected to in their page — "every button" is a class generalisation in a document that tells its reader not to make them — and I made mine one message later, from two screens, and called it a confirmation. The census was true where I looked and false one build over.

⚠️ It has a consequence, not just a lesson. ptbtn00 on the PRESS Ⓐ plate is focusable by their rule and my exporter classifies it unknown. Filed.

🔴 Refuted: the sweeps DO run on the menu, and my instrument was measuring my own renderer

loop_leaf_on_screens scopes leaf-looping to the title, partly on a phase sweep of mine that I re-ran only last iteration and reported as strengthened. Their draw log retains NDC, and settles it directly: both strips overlap the screen in every captured frame on the main menu, stepping ~0.03 NDC per frame in opposite directions, with their vertex alpha ramping — two sessions, different phases.

🔴 "The game does not draw them here" is no longer available to me. What my phase sweep actually measured is that the port's version of the sweeps makes the match worse — which is a statement about my rendering of them, not about whether the game runs them. A best-match argument for an absence cannot distinguish "not there" from "there and drawn wrong", and I had that caveat written down and still read the result as being about the game.

⚠️ Not flipped yet, deliberately. The strips are additive and their vertex alpha ramps across the sweep; the port has neither of those right for the leaf path, so enabling the loop today would make the port more correct in behaviour and visibly worse against the capture. That trade needs the ramp first, and it is filed. What has changed today is the claim: the port is wrong here, and says so.

The plate's highlight is additive — and my harness poses it at the one phase where it is invisible

blend-bit-vs-oracle.txt entry 2: ptbtn00 0x0110 alpha-over, ptbtn00f 0x0112 ADDITIVE — the PRESS Ⓐ plate and its own highlight, same screen, same draw order, one bit apart. Entry 4, the whole title, is alpha-over throughout, including ptlogo_back2/ptlogo_back2eff — which independently kills the "frame-shaped and mostly transparent ⇒ additive" rule I declined to adopt.

Bands are now per draw op rather than per paint-order entry, because one band per element cannot express base alpha-over, its own focus record additive.

🔴 It reported ZERO three times, and each zero had a different cause

R2 says a change with a predicted magnitude that delivers nothing is a failed run, not a negative result. This one delivered nothing three times.

  1. The mapping never reached the overlay. additive_elements was assigned to view in three places and to overlay in none — and the plate is an overlay. Every other decoded rule on that page is assigned to both.
  2. I then "proved" the element is never drawn — suppressed its sprite at six times across the cycle, 0 px every time. ⚠️ That sweep was invalid. I varied --time while passing --loop-phase=0 in every run, and --loop-phase pins exactly the clock a looping record runs on. Six samples of one phase. I was one commit from filing "the port never draws the plate highlight" as a defect.
  3. The real reason the harness saw nothing. Swept properly:
loop phase ptbtn00f contributes
0 0 px
20 / 40 / 60 28 197 / 28 830 / 28 821 px
80 / 100 27 334 / 21 885 px

verify-capture's title_plate row poses at --loop-phase=0 — the single phase where the highlight contributes nothing. The change is live and worth 26 319 px at phase 20, and the row correctly reports 13.03 / 0.09 % unchanged, because it is blind to it by construction.

📌 That is a defect in my instrument, not in the fix: the row that validates the plate cannot see the plate's pulse. Now stated in the tool, next to the pose.

⚠️ Not verified against the oracle. The blend is theirs and measured; that the port now draws it correctly is not something any capture I hold can confirm, because every title-plate capture is at the blind phase. Filed.

The plate's ramp was already in my export, and the renderer applies it correctly

The Decoder is paused and could not take the capture I asked for, and pointed out that the disc half might not need them. It did not — and it was already in export/screens/title/press_start.json. ptbtn00f carries eight keyframes on a 120-unit loop, alpha in the high byte of fade_argb:

t 0 6 29 35 50 58 97 105
α 0 6 74 80 80 74 6 0

✅ Two things follow without an oracle.

1. The blind phase is confirmed from the disc. α is exactly 0 at phase 0 — so verify-capture's pose sees nothing, and that is a property of the data, not an artefact of how I rendered it.

2. My renderer applies the ramp faithfully. Rendered contribution against declared α across the cycle:

phase 0 20 40 60 80 100
declared α 0 47.4 80.0 70.5 35.6 3.8
rendered Δ 0.00 20.70 32.55 29.24 16.55 2.59

r = +0.9982, slope 0.4036 levels per α unit. So when and how strongly the port draws the highlight is right; only the composite is unverified.

📌 And the capture cannot settle it, under either reading of the clock. It is posed at t=237; 237 mod 120 = 117, where α ≈ 0 — and the harness independently pins --loop-phase=0, where α is exactly 0. Both readings agree, which is worth stating because I did not have to assume which clock the record runs on.

⚠️ So the ask narrows to one number and gets a precise window: a capture anywhere in t mod 120 ∈ [35, 50], where α holds at its peak of 80. Everything else about the plate is now settled on my side.

Pre-registered: what the plate capture must show, committed before it exists

The Decoder's R2 note, and it is the right one to raise: α peaks at 80 of 255, so an additive overlay at 31 % is a small signal and "whatever residual you measure will be small in absolute terms whether or not the blend is right." So the expected magnitude goes in git before the capture does.

Rendering the same pose at peak α under both composites:

value
highlight footprint at peak α 25 015 px (2.90 % of frame)
mean |additive − alpha-over| inside it 16.92 levels
max 50 levels
RMS over the whole frame 3.746

🔴 And my first prediction was wrong, which is the useful part. The two composites differ by exactly α·bg, and with mean background 94.78 that predicts 29.73 levels. Measured: 16.92. The formula uses the keyframe α and ignores that the sprite carries its own per-pixel alpha channel, which modulates it — implied mean sprite α ≈ 145/255. Caught because I wrote the prediction down and it disagreed with the render, which is the whole point of writing it down.

The pre-registered test. Additive is brighter than alpha-over at every footprint pixel, in one direction. So the discriminator is regional sign over 25 015 pixels, not per-pixel magnitude — which matters because the port already carries global tone offsets of order 8.5 levels, and a per-pixel magnitude test would be swamped by them while a signed regional one is not.

If the game composites this additively, then rendering it alpha-over must leave the footprint systematically ≈17 levels DARKER than the capture relative to the surrounding frame, and rendering it additive must leave no such regional bias. A capture that shows neither bias refutes both, and points at the ramp or the pose rather than the blend.

⚠️ Feasibility, stated before asking anyone to spend a run: 16.92 mean levels across 2.9 % of the frame against ~8.5-level systematic offsets is discriminable only as a signed regional statistic. As a whole-frame RMSE it is 3.746 — below the title's own ±5.56 capture-phase term, so verify-capture's headline number could not settle this even at peak α.

⚠️ Their gate wait_plate_pulse.py fires on a green-glyph count in [500, 2500] and has logged 740 and 1004, so the window may come free or may sit outside [35, 50] entirely. Their caveat, carried across rather than assumed away.

The plate identification is confirmed by size; the frame spacing does NOT fit my ramp

Reading the Decoder's existing title draw log from the ref (captures/ui-draws/blend-title-2026-08-31.log), the additive quad they point at is draw 8/19/…, blend=0x01010101, per-vertex col=44FFFFFF / 43FFFFFF / 38FFFFFF — α 68, 67, 56.

✅ Identification confirmed independently, by size. The quad measures 537.6 × 75.6 px and ptbtn00f.png ships at 537 × 76. That is the plate's highlight, and it settles it without using their attribution.

✅ And their free check on my ramp holds: all three alphas are ≤ my declared peak of 80, none equals a keyframe value, so the game interpolates rather than steps. Two independent decodes agreeing — mine from the export, theirs from the command stream.

🔴 But the frame-to-frame spacing does not fit, and I am recording that rather than passing over it. HANDOFF Q1 gives 2 units per rendered frame. On my falling segment (slope −1.744 α/unit) that predicts, from α=68:

frame 1 frame 2 frame 4
observed 68 67 56
my ramp at 2 units/frame 68 64.5 57.6
at 1 unit/frame 68 66.3 62.8
at 0.5 68 67.2 65.4

No constant rate fits both steps — 0.5 matches frame 2 and misses frame 4 by 9; 2 matches frame 4 and misses frame 2 by 2.5.

⚠️ Three candidates and I cannot separate them: my ramp is wrong somewhere; the log's frame numbering is captured frames rather than engine frames (it skips from 2 to 4, so it is demonstrably not a dense engine sequence); or emulator pacing varies between them. The middle one is the most likely and the cheapest to check, and it is theirs.

📌 This does not disturb the ramp's shape or ceiling, which the alphas confirm. It disturbs only the claim that I could pose my renderer at their captured instant by stepping units — so the vertex alpha remains the right readout, and inferring the phase from a frame index would have been wrong.

🔴 A reproduce recipe that names a path off this repo is not a recipe

Recorded 2026-09-01, at shutdown, from the Decoder's catch rather than my own.

They found their Canary logger change — the texture content hash — living uncommitted in /canary, a checkout pushed nowhere. Two committed findings could not be reproduced without it: it is the field that separates "the buffer rotated" from "a frame was decoded", and its absence is what cost two withdrawn positions on units/second in a single day. They committed it and exported it into the repo as tools/canary-patches/0001-content-hash-in-ui-draw-logger.patch.

Their generalisation, which applies here too: a finding whose reproduce recipe names a /canary sha — or any path outside this repository — is not reproducible.

Audited on this side at the same moment. One real instance: this file cited /reborn/docs/re/captures/main-menu-oracle.png as the evidence for a decision. The capture is in the repository at docs/re/captures/main-menu-oracle.png; only the path was stale, left by the monorepo move. Fixed above. The other /reborn mentions are deliberate — one warns that the mount is empty, one is a table row listing the pattern as an example of what not to do.

⚠️ tools/port/check-citations does not catch this class. It scans for repo paths that fail to resolve; an absolute path is not a repo path and slips through. Extending it to flag off-repo absolutes — especially ones whose basename does resolve in-repo, which is the recoverable case — is the obvious next increment and is not done here, because it was found minutes before a shutdown and a hasty checker is worse than a named gap.

Reference in New Issue View Git Blame Copy Permalink