915d6adbd9
With the emulator launched correctly and the boot verified by the progress counter first (counter > 0 = title reached; a flaky boot never leaves 0), nav_to_flight.sh ran the whole sequence -- main menu at 20 s, mask poke, stage select, briefing skip, ready room, take-off -- where every previous attempt stalled. The game is alive at the end of it: screen liveness 2.13% against 0.00% when frozen, guest churn 0.288-2.932% against 0.000%. An animating screen and a busy guest at the point that used to be stone dead. But no units. DEF_VTABLE (0x820AF844) has no hits on a direct byte search, with a working control in the same run: searching for the poked cleared-stage mask 0x0001FFFE finds it at 0x828F40C0, exactly where nav_to_flight wrote it. So the search is sound and the vtable is genuinely absent. Both vtable constants were also checked against sylpheed.db's vtables table and are real vtables, so they are not stale. Three minutes of waiting left DEF/INST at 0/0 with the counter static at 17. So the run reaches a live, animating state that is not a mission with spawned units -- most likely the launch cinematic or a post-take-off screen. The freeze is gone; what still separates this from unit spawn is the remaining work.