tools: repair launch_mission.sh; Stage 02 now reaches the briefing and stops there

Finding REMAINING OB in RAM means getting to the escort stage, and
launch_mission.sh exists for exactly that. It carried three of the dead patterns
this session has been clearing: six vgamepad calls (the command no longer exists,
so the entire scripted route pressed nothing), the XUID E0300000EFBEA3D4 which
has no profile behind it and therefore opens the sign-in dialog that swallows
every keystroke, and the emulator's stdout going to /dev/null. wait_flight.sh had
a fourth, in the tap that skips the launch cinematic.

Fixed, the route works far past where it used to stop: boot -> title -> LOAD GAME
-> slot 01 -> READY ROOM -> TAKE OFF -> the Stage 02 briefing map, with ACROPOLIS
labelled on it.

And it stops there: 384 dumps at PC 0x82307128 and no flight HUD within 300s. The
briefing is still animating (two shots a minute apart differ by RMSE 2986), so
the emulator is not frozen - flight simply never starts.

One discriminator worth recording: the TUTORIAL reaches flight and has run
completely crash-free, while this path crashes during the briefing, which is
where the stage content loads. That is consistent with the cache-flush shape the
crash has always had, and points at WHAT is being loaded rather than at how far
the navigation gets.

REMAINING OB is therefore still not found - the mission was never entered.

docs/re/autopilot-knowledge-sources.md

@@ -91,6 +91,36 @@ the pilot is making progress; and the four unused taught capabilities — radio
 orders, resupply, special moves, advanced maneuvers — are the levers it currently
 does not pull.
 
+## 🔴 The runtime counter needs Stage 02, and Stage 02 stops at the briefing
+
+`REMAINING OB` was measured in the escort stage, so finding it in RAM means
+getting there. `launch_mission.sh` exists for exactly that — "drive into the
+Stage 02 mission from save slot 01" — and it had **three** of the dead patterns
+this session has been clearing out:
+
+* six `vgamepad` calls (the command no longer exists, so the whole scripted route
+  pressed nothing);
+* `--logged_profile_slot_0_xuid=E0300000EFBEA3D4`, a XUID with no profile behind
+  it, which opens the sign-in dialog that swallows every keystroke;
+* the emulator's stdout to `/dev/null`.
+
+Plus one more in `wait_flight.sh`, which taps Ⓐ through the launch cinematic.
+
+With those fixed the route works far past where it used to stop: boot → title →
+LOAD GAME → slot 01 → READY ROOM → TAKE OFF → the **Stage 02 briefing map**, with
+ACROPOLIS labelled on it ([capture](captures/stage02-briefing-crash.png)).
+
+**And it stops there.** 384 dumps at `PC: 0x82307128`, and `wait_flight.sh` times
+out after 300 s without a flight HUD. The briefing keeps animating (two shots a
+minute apart differ, RMSE 2986), so the emulator is not frozen — flight simply
+never starts.
+
+Worth noting as a discriminator: the **tutorial** reaches flight and has run
+completely crash-free, while this path crashes during the briefing — which is
+where the stage content loads. That is consistent with the cache-flush shape the
+crash has always had, and it says the difference between the two paths is *what
+is being loaded*, not how far the navigation gets.
+
 ## Not settled
 
 * ❔ The button→action mapping. `tables.pak` has an `ID=Control` object but it is

tools/re-capture/launch_mission.sh

@@ -38,7 +38,11 @@ ensure_display(){
   fi
   xdpyinfo -display "$DISPLAY" >/dev/null 2>&1 || { echo "DISPLAY UNAVAILABLE"; exit 1; }
 }
-step(){ vgamepad dpad "$1"; sleep 0.25; vgamepad dpad center; sleep 0.7; }
+# pad.py, NOT `vgamepad`: that command no longer exists (the uinput pad was
+# replaced by the --hid=file driver) and every call here failed silently, so the
+# whole scripted route pressed nothing. See canary-scripted-input-traps.md.
+step(){ python3 "$SD/pad.py" dpad "$1" 0.08; sleep 0.9; }
+tap(){ python3 "$SD/pad.py" tap "$1" 0.3 || { echo "PAD PRESS FAILED"; exit 6; }; }
 shot(){ screenshot "$SHOTS/$1" >/dev/null 2>&1; }
 
 pkill -x xenia_canary 2>/dev/null; sleep 2
@@ -47,29 +51,36 @@ rm -f /dev/shm/xenia_memory_* /dev/shm/xenia_code_cache_* 2>/dev/null
 ensure_display
 
 cd /sylph-home/re
-nohup run-canary --apu=sdl --log_mask=13 \
-  --logged_profile_slot_0_xuid=E0300000EFBEA3D4 </dev/null >/dev/null 2>&1 &
+# Sign in a profile that EXISTS. A XUID with nothing behind it opens a sign-in
+# dialog and IsUIActive() then swallows every keystroke for the whole run — 8.4
+# million of them, measured. And KEEP the log: /dev/null is what hid that.
+XUID="${SYLPH_XUID:-$(ls "${XENIA_CONTENT:-$HOME/.local/share/Xenia/content}" 2>/dev/null | head -1)}"
+[ -n "$XUID" ] || { echo "NO PROFILE on disc"; exit 2; }
+LOG="${LAUNCH_MISSION_LOG:-$SHOTS/launch_mission-canary.stdout}"
+echo "signing in profile $XUID; emulator log: $LOG"
+nohup run-canary --apu=sdl --log_mask="${LOG_MASK:-13}" --log_level="${LOG_LEVEL:-2}" \
+  --logged_profile_slot_0_xuid="$XUID" </dev/null >"$LOG" 2>&1 &
 sleep 5
 "$SD/skip_intro.sh" 600 || { echo "BOOT FAILED (skip_intro exit $?)"; exit 1; }
 sleep 14                       # main menu is not input-ready before this
 
 step down                      # NEW GAME -> LOAD GAME
-vgamepad tap A 250; sleep 8    # save list, slot 01 preselected
-vgamepad tap A 250; sleep 4    # "Load game?" -- cursor starts on NO
+tap A; sleep 8    # save list, slot 01 preselected
+tap A; sleep 4    # "Load game?" -- cursor starts on NO
 step up
-vgamepad tap A 250
+tap A
 sleep 28                       # -> READY ROOM
 shot "lm-readyroom.png"
 
 if [ "$MODE" = "--hangar" ]; then
   step down; step down         # BRIEFINGS -> HANGAR
-  vgamepad tap A 250; sleep 12
+  tap A; sleep 12
   shot "lm-hangar.png"
   echo "STOPPED IN HANGAR"; exit 0
 fi
 
 step up                        # BRIEFINGS -> TAKE OFF
-vgamepad tap A 250
+tap A
 # The launch cinematic + stage load + objective card is NOT a fixed 75 s under
 # lavapipe; wait for the flight HUD itself.
 "$SD/wait_flight.sh" 300 || { echo "NEVER REACHED FLIGHT"; exit 1; }

tools/re-capture/wait_flight.sh

@@ -37,7 +37,7 @@ while [ $SECONDS -lt $DEADLINE ]; do
     exit 0
   fi
   if [ $(( SECONDS - last_tap )) -ge 6 ]; then
-    vgamepad tap A 250
+    python3 "$(dirname "${BASH_SOURCE[0]}")/pad.py" tap A 0.3
     last_tap=$SECONDS
   fi
   sleep 2