re: the freeze is independent of the mask poke -- control run settles it

challenge-mission-gate.md §5.6 attributes the 128 MB heap failure to a careless
cleared-stage mask poke, concludes that poking only real story ids does not blow
the heap, and ends by asking for the control: repeat without the poke.

Ran it.  nav_to_flight.sh gains SYLPH_NO_POKE=1, which skips the write; only
Stage 1 is selectable without it, so the control changes stage too, which makes
the agreement stronger rather than weaker.

    poked    0x0001FFFE   Stage 02   frozen, 128 MB request refused
    control  untouched    Stage 01   frozen, 128 MB request refused

Both logs carry not merely the same error but the same numbers:

    requested 134217728 bytes, parent free 28969/131072 pages

28969 in both, across two stages and two boots.  So the poke does not cause it
and neither does the stage; the guest reproducibly arrives at a 128 MB request
with ~113 MB free.  An identical free-page count across independent runs also
says the allocation pattern is deterministic -- not a race, not host pressure.

The control was verified three ways, because the first attempt was confounded:
two emulators were alive at once (the previous one survived a pkill).  The mask
was read back as 0x0 from the live mapping, the log was confirmed to be this
run's, and the liveness test was repeated after killing the stale process so
exactly one emulator was running -- three frames at rmse 0.00, and an 8 MB slab
of guest RAM with 0 bytes changed over 3 s.

tools/re-capture/nav_to_flight.sh

@@ -60,8 +60,15 @@ for i in $(seq 1 "$MENU_TIMEOUT"); do
 done
 [ "$MENU" = 1 ] || { say "TIMEOUT: no main menu"; shot 00-timeout; exit 1; }
 
-say "poking the cleared-stage mask so every story stage is selectable"
-poke w32 0x828F40C0 0x0001FFFE
+# SYLPH_NO_POKE=1 skips the mask poke, so a run can test whether the 128 MB
+# heap failure in mission-freeze-heap-exhaustion.md depends on it. Only Stage 1
+# is selectable without it.
+if [ "${SYLPH_NO_POKE:-0}" = "1" ]; then
+  say "SYLPH_NO_POKE=1 — NOT poking the cleared-stage mask (Stage 1 only)"
+else
+  say "poking the cleared-stage mask so every story stage is selectable"
+  poke w32 0x828F40C0 0x0001FFFE
+fi
 
 # main menu -> EXTRAS -> MISSION SELECT
 for _ in 1 2 3 4; do pad dpad down 0.06; sleep 0.35; done