Long v05 stress control 2026-10-10 — Runtime-confirmed no sustained music speedup, short crunches observed; trace-confirmed recoverable native/host losses. 598 seconds anchored to first PIF reply (first VI missing due bounded ring wrap), 9,766 valid player PIF reads, 348 Down and 264 Up rising edges, intensive cross-box/combative activity user-reported; 18 unique native guest PCM failures (not 36 duplicate FULL logger reads), largest 5 over 0.266s, at least 59 SDL threshold drops retained (first 11,422 host events overwritten). Input/AI/RSP complete; VI/phase lost 12,668/2,877 earliest samples. After last pressed input t430.829, 167.38s of neutral input still include 10 guest rejects and 23 retained host drops. Three 38.5–44.8-second 368-frame plateaus each step AI_LEN 1344→1288; one 2,310-buffer plateau has zero pressed buttons. AI_LEN=1216 29 times and accepted 1,600B PCM 30 times without runaway. Retained VI each receives audio service, sample clock consistent; Grunt AI/RNG state unobserved, not disproven or implicated. Canonical owner.\n\nRMG v05 input-aware accelerated Inventory capture (2026-10-10): maintainer Runtime-observed speedup/clipping within ~one minute of Inventory use; trace confirms exact chronological PIF input / audio correlation, not initiating game cause. 1,594 PIF responses, 3,962 native complete audio services (no active-VI gaps), 86 guest PCM rejects over 5.734s following 73 Up/Down button presses in the 22.8s preceding rejection. Probable Inventory opening Z at t38.786s; first repeated navigation t39.711s; first AI_LEN=1,216 t62.093997 precedes nearest new Up response by 0.535ms, first 1,600B at t62.111, first FULL at t62.544. Promoted 1,472B DMA remains unfinished 4,056 Count beyond next service; prior v04 fast case was −4,126 Count. 86 failed vs 259 successful submissions between first/last rejections, +23.54% synthesized sample frames relative to target, zero SDL queue-threshold drops. Last PIF button release t63.395; failures persist until t68.278 with neutral input. Low AI_LEN 8B staircase descends about every 4.804s after Inventory activity; cause may be opening/menu versus cursor/audio work and remains Pending. All six trace rings complete, native sizing/clock 0 mismatches, no ROM identity embedded. Full canonical details in Inventory upstream investigation.\n\n2026-10-10 v04 deadline accounting — Trace-confirmed and statically consistent, production fix Pending. Normal 368-frame output at 551 Count/PCM-byte takes 811,072 Count, just 20 fewer than the observed 811,092 Count/VI; 352 and 384 neighboring frame sizes differ by ±35,000 Count. Two ~40s healthy 368-only stretches show AI END mean 811,077.40/811,077.75 while native services remain ~811,092, accounting for quantized AI_LEN drift. Slow case's next service is +35,580 Count after promoted 1,408B tail deadline (352-only + median 35,226 Count FIFO idle); fast case is −4,126 Count before 1,472B tail deadline (repeated rejected PCM). Rejected events were separated by successful services; no all-368 causal precursor established. Native producer pointers/parameters stable, earliest event timing perturbation still Pending. See canonical investigation.\n\n2026-10-10 native rich Inventory audio: three fresh RMG v04 captures — maintainer Runtime-confirmed clean, slowed/clipped, and sped-up/clipped sound; read-only host traces independently confirm 352-frame undersupply and 81-reject oversupply. Five streams each, all saved=total, overwritten=0. Clean 379.61s (5 guest rejects, no major audible symptom), slow 229.80s (5 isolated rejects; 2,303 consecutive 352-frame accepted outputs following one rejected service (2,304 accepted 352-frame buffers in the wider interval), −4.35% native synth frames/VI over last 38.4s, host queue median 504B), fast 277.60s (81 recurring guest FULL rejects (~one per four audio services; intervening accepted submissions) in 5.33s, producer sample time +23.8% over target, host queue median 16,600B). Slow loop arises after a DMA END 10 CP0 Count following first native FULL-status read. DAC/manager params and all AudioInfo/command/synth addresses stable at 52,316 phase snapshots; 52,313 synth sample-clock increments match expected sizes exactly; fixed code hashes stable in Fortress. The healthy run also has 39.77s all-368 output, refuting this as a sufficient acceleration indicator. No ROM identity embedded in traces; startup route and cursor trigger remain user report, not logged controller events. Neither original upstream operation nor release-ready fix identified. Canonical investigation.\n\nProduction rich Inventory (2026-10-09): cursor-sweep PCM failure Runtime-confirmed bounded; upstream trigger and root-cause correction Pending. Original environment is Bazaar-installed RMG Flatpak with ParaLLEl RDP + ParaLLEl RSP; exact versions/audio settings are not recovered. test_musicnormal.state has one cumulative failure; test_musicspeedup.state has 136. The first failure predates the healthy capture; the last is seven WESS ticks before accelerated capture. The accepted proof remains bounded success for a different composition. Audio and VI deltas match; upstream chronology is missing. The guarded data-only pre-filled Fortress ROM entered Inventory and completed the maintainer's full idle test (plus extra minute) without audible defects, then a separate cold-boot rapid cursor-sweep route reproduced tempo acceleration. Four zero-overwrite Trace (5) streams establish 80 paired native FIFO enqueue rejects between t=42.357..47.624, 80 reconstructed rejected 352-sample buffers (28,160 omitted frames), a self-terminating ~24% extra synthesized relative to accepted sample time, nominal VI/AI deadlines, and no host SDL drops. A subsequent 110-second ordinary-items-only test and 219-second full sweep did not reproduce acceleration. The ordinary test recorded zero AI FIFO failures or SDL drops; full sweep recorded four isolated guest FIFO rejections and 14 host queue-limit discards (14,920 bytes). Both host audio queues grew ~133 bytes/s during the pre-drop interval, consistent with 368×60 stereo samples/s produced versus 22,047Hz consumed. This supports a separate host-clipping mechanism and weakens deterministic cursor/portrait causation; actual per-item display validation, exact cursor operation and guest upstream trigger remain Pending. Trace (4) files are hash-identical to prior Trace (3), not independent evidence. No emulator automation or enqueue retry was performed. PR #156 stays draft/unmerged. See paired report and one bounded matched manual experiment.

Cross-feature reservation audit (2026-10-09), ROM-static and historical runtime evidence only; peak safety Pending. Exact clean/instrumented/prefilled ROM identities verified; raw file-1A transport fills but does not cross [0x801AF820,0x801B3420) with unchanged floor. Live false-zero stock action records stay byte-identical; GAME SETTINGS trailing bad store remains suppressed; rich HUD first-load size set correctly in the current generated layout. All named production fixed RDRAM suballocations are disjoint; draft #156 and diagnostic tail are separate proof-only owners. The old 16 KiB all-stage proof had 30,120 B peak headroom, while the later failing Fortress endpoint has 17,496 B immediate headroom; these are neither matched peaks nor direct evidence of allocator overflow. Other features and cross-composition faults remain in scope; no automatic feature removal or ROM correction.\n\nTrace (5)/(6) feedback reconstruction (2026-10-09), Static/trace-confirmed mechanism; upstream trigger Pending. At the first failure in Trace (5), the 1,472-byte queued tail finishes 4,222 Count after the next audio service; in Trace (6), the 1,408-byte queued tail finishes 30,628 Count before it. Both first failure services have nearly identical VI-relative Count offsets (7,592/7,596). The differing next FIFO occupancy flips feedback for an accepted 704-frame buffer: AI_LEN=0 under a queued tail in Trace (5) versus AI_LEN=2,808 when newly started as a head in Trace (6). All four Trace (6) failures recover through an empty FIFO at the next service. The Trace (5) sustained burst ultimately stops when a head ends 736 Count before service. DMA timer is 551 Count/byte and VI=811,092 Count, just 20 Count above nominal 368-frame DMA. No Inventory cursor/PI event or task-generation provenance is logged; this is not an Inventory-origin or universal backend defect claim. See upstream investigation.\n\nOpt-in RMG memory probe v02 (2026-10-09): implementation/static smoke only; RMG/ROM runtime Pending. Draft PR #160 extends #157, not #156, by sampling guest physical RDRAM without ROM changes or guest AI MMIO. Synthetic C read-only/idempotence checks passed and exact pinned v02 Flatpak artifact built/linked in Actions run 37899907006 from commit f6c67e5; guest runtime and opt-out parity remain Pending. The tool can report arena cursor > upper bound, a suspicious cached HUD pointer, and changes in selected fixed-code digests during a stable stage, but zero VI-sampled warnings cannot rule out transient between-frame corruption. Exact initial upstream writer or allocation defect remains Pending, and production is blocked.\n\nVI/audio service offset audit (2026-10-09), Trace-confirmed; no runtime correction: Across Traces 7–11, 59,484 native first AI_STATUS reads map uniquely to 59,484 active VI events, after 294/295 initial VI events before audio starts, plus one final unmatched VI callback in each recording; there are no gaps between active-service VIs. VI→first-status CP0 offset medians are 7,652–7,722 Count (range 7,294–9,490), versus normal 811,092 Count/VI, including Trace 10's 352 consecutive rejected submissions. This does not support missing or duplicate audio service calls or whole-frame scheduler starvation during the observed failures, but doesn't identify why AI DMA deadlines/queued-tail sizes become unfavorable. See canonical investigation.\n\nStronger event-only FIFO replay (2026-10-09) — trace/static-confirmed, correction Pending. On the five complete RMG captures, independently reconstructs 59,992/59,992 AI FIFO status reads, 59,489/59,489 AI_LEN reads, 58,971/58,971 written PCM sizes and 513/513 guest-native rejected decisions. Uses only previously observed audio service/start/completion timestamps plus native size formula as inputs; all FIFO contents, register values, accepted/rejected outcomes and sizes are calculated internally and checked against captures. Acknowledges the observed timing schedule is exogenous and diagnostic logger can change timing. No emulator/runtime correction, ROM patch or memory-safety proof is inferred. Reusable independent script staged in draft diagnostic PR #162; see full audit.\n\nFull five-capture native audio closed-loop audit (2026-10-09): Trace-confirmed exact feedback/size, upstream trigger Pending. Across sound-on Trace 7, clean vanilla Trace 8, entire-helper-off Trace 9, muted-helper Trace 10 and s0-preserved muted-helper Trace 11: all 59,489 AI_LEN reads exactly equal pinned RMG FIFO head/deadline/Count reconstruction; all 58,971 native accepted PCM buffer sizes exactly equal the prior AI_LEN size recurrence; all 513 native rejects calculate to 352 synthesized sample-frames. Severe burst first-reject queued tail is still active at next service (−3,784..−4,486 Count), while isolated full reads have already drained (+~30,500..31,700 Count). Trace 11's final rejection coincides with an emulated AI END 18 Count after the first FULL status read and before the second logger-only read, immediately changing the following AI_LEN to 1,464B and allowing recovery. End-to-end audio event accounting, not a runtime-validated production correction or proof of general guest-memory integrity. Diagnostic logger changes instruction timing. See focused full audit.\n\nSafe Stage Select helper active, SFX call OFF, s0-preserved Trace (11) — 2026-10-09; Runtime-confirmed transient accelerated music, trace-confirmed FIFO burst, no fix. Exact two-instruction register-only proof SHA 73d8e64b078ff6211b9e059e6f46bdb90f2bef9bd829c2a7e52f41392b77fc68 captured 247.770s zero-overwrite with 80 rejected native submissions: one isolated at t=162.671s, then 79 consecutive at t=240.087..245.288s, automatic recovery. No 40-second 368-only precursor (maximum 7). Stage-9 arena cursor/HUD/hash checks remain bounded/stable; separate 22 SDL drops total 19,312B. First attempt heard prolonged distortion, then RMG's normal Shutdown unexpectedly terminated the whole GUI without any trace export (observer dumps on process atexit; mechanism unknown). This disproves the s0 ABI encoding change as a sufficient cure; a distinct phase-dependent helper/core timing explanation remains hypothesis and production audio gate blocked. See Stage-Flow and canonical audio analysis.\n\nSafe Stage Select helper ON / SFX call NOP Trace (10), 2026-10-09 — Runtime-confirmed accelerated and clipped music; 352 consecutive FIFO failures. 65.657s clean four-stream RMG v02 capture from the static-verified Fortress proof SHA 7ef2ce16bddcc5716df8aa030c5eaf367363a3bbdf882f6b63ceee2ba73bb25e, whose only change from failing Trace (7) was removing JAL 0x80064C18 at helper ROM 0xE29C and CRC. The first native failure at t=42.207s was followed by one per native service until t=65.607s when the user quit; 352 rejected guest submissions, no host SDL queue drops. Accepted buffer sizes cycled 688/416/368 frames, without Trace (7)'s long 368-only precursor; arena/HUD/FNV memory samples unchanged. Thus the native movement SFX call is not required for prolonged acceleration under these conditions. A two-instruction callee-saved-register isolation proof (return-address holder s0→t9, SFX still off) was statically built for one bounded follow-up; actual register corruption not proven and runtime pending. See selector owner and audio report.\n\nSelector MOVE SFX-off Fortress Trace (9), 2026-10-09 — bounded Runtime-confirmed healthy audio, trace-confirmed disappearance of sustained FIFO/368-only regime. Exact prefilled Fortress Trace (7) ROM was changed only at ROM 0xDD70: JAL movement-helper → stock li a0,0x50 plus N64 CRC. A 251.722s cold-boot observer capture had no perceived acceleration, only two isolated guest FIFO-reject attempts, and a maximum 9 consecutive 368-sample buffers. Earlier SOUND-ON Trace (7) had 74 rejections including a 73-failure burst and 2,383 consecutive 368 buffers within 130.062s. RDRAM reset/base/cursor bounds, cached HUD pointer, and all three fixed-code hashes remained unchanged. The 22 separate host queue drops do not imply speed-up. This strongly implicates the selector helper/SFX path or the audio phase it changes, not a proved invalid memory cave; a single benign test is not causation. Narrow second proof retaining the helper but NOPing only JAL 0x80064C18 at 0xE29C was statically built; runtime Pending. Release gate remains BLOCKED pending repeated sound-call-vs-helper isolation and correction validation. Selector owner.\n\nVanilla MKMSZ Fortress negative control / Trace (8), 2026-10-09 — bounded Runtime-confirmed absence of audible acceleration; native FIFO FULL trace-confirmed. The clean USA Rev.0 ROM ran 321.460s from first VI and reached stock stage 9 at t=53.379s. Complete zero-overwrite observer streams show five actual guest FIFO FULL events (one before Fortress, three consecutive at 124.558..124.691s, one later) and 40 SDL drops totaling 30,944B, despite no perceived acceleration. Vanilla's third failure uses queued tail 1,408B and recovers; MKMSZR Trace (7) retains 1,472B and suffers 73 repeated failures. Vanilla longest 368-only run is 4 vs MKMSZR 2,369/2,383, though all use the same emulator 551 Count/byte. Stock guest-memory probes do not implement MKMSZR marker semantics. This is evidence for a shared audio timing vulnerability and a composition-specific sustained trigger; no single ROM fault, emulator-only resolution or production guard confirmed. See Trace (8) comparison.\n\nCross-capture AI clock analysis (2026-10-09), Trace-confirmed/Static-confirmed, production fix Pending. Two independent prefilled-Fortress recordings contain 2,369 (Trace 6) and 2,383 (Trace 7) consecutive 368-frame native submissions over nearly 40 seconds with head AI_LEN 1,344→1,280 before a FIFO FULL. Across four runs, all accepted emulated AI durations have exactly 551 Count/byte; pinned core's pre-multiply integer truncation is statically verified and predicts ~134B/s host SDL queue buildup, matching prior observed ~132–133B/s. However a fractional-duration control has not been runtime-validated and this clock discrepancy alone does not certify absence of unrelated memory corruption. Draft emulator-only PR #161 is Pending; no game ROM modification permitted by this result.\n\nRMG v02 opt-in memory trace (7), 2026-10-09 — Runtime-confirmed symptom, bounded memory negative. Four complete streams from prefilled Fortress record 7,798 VI+memory sample pairs, one native FIFO-full rejection at t=82.112s, then 73 between t=118.729 and 123.529s; host-side SDL drops 4 (2,832 bytes), no overwritten records. Arena cursor remained <=0x8028CD48 (15,432 B of sampled headroom), HUD pointer 0x801FEBA0 remained within current cursor, and all three observed rich-HUD/legend/materialized fixed-runtime checksums exactly match the prefilled-ROM source after initial load. The lasting cursor value 0x8028C538 and key-portrait cache were unchanged near the burst. A once-per-VI probe cannot certify absence of transient or unmonitored corruption. This confirms the new observer records the failure, not a production correction; root cause and gate Pending. See full reconstruction.\n\nNative Inventory legend (2026-10-06): Runtime-confirmed bounded. The maintainer manually accepted focused legend v01 and reported it works perfectly. The proof preserves the production in-Inventory switch path and native panel, adds dynamic BOX n OF 4, uses LEFT-RIGHT BOX / A USE / B COMBINE / R POWERS in Items mode, and the intentionally sparse L-R POWER / R ITEMS layout in Power Ups. This evidence is presentation-only and does not resolve the separately reproduced Inventory/loading hang.

In-Inventory four-box switching (2026-10-06): Runtime-confirmed bounded, full production composition. The maintainer reports production-composition v03 works perfectly. Items-mode Left/Right cycles all four authoritative boxes with wraparound without closing Inventory; empty-box traversal is healthy, selected-row state refreshes coherently, stage masking/SEALED behavior remains intact, and the existing gameplay box shortcut and Inventory HUD coexist. Power Ups retains stock horizontal navigation. Proof SHA-256 14feee5d6a0a79a20359781364eb6a9ef77ffffad3f2c0bee94760b9c2074f7e. This does not replace the final representative full-seed/lifecycle release gate.

Fire/Bridge four-box credential gates (2026-10-06): Runtime-confirmed bounded. Disposable v03 used the real production four-box switch/mask implementation and visible BOX n OF 4, with Fire IDs 0x17..0x19 and Bridge IDs 0x1D..0x1F distributed across separate authoritative boxes. The maintainer manually switched boxes and reported both stages working perfectly in paired positive/negative tests: all three owned across the 40-slot backing inventory succeeds; the otherwise-matched build with the third credential absent fails. Positive SHA-256 9952a2ceb4d3e64888bb1f2662560a703f15db0613fd07043906a8ca6539be25; negative SHA-256 f6521862d51ab2899184e41277e56e11c0d2f43630b732ff5e7996218236d812. For test speed, v03 placed the player from the actual Fire/Bridge use-zone trigger records and bypassed the unchanged native physical use-site gate; therefore the runtime-confirmed claim is specifically the corrected 40-slot ownership scan and box composition, not a revalidation of the stock trigger predicate.

Inventory HUD production wording regression (2026-10-05): Runtime-confirmed closed. A ROM generated through the deployed webapp after #146/#147 rendered the slash separators in the promoted REQUIRED POWERS X/Y / XX/85 strings as corrupted native-font glyphs; the maintainer reproduced the issue with Powers-as-pickups OFF and ON. PR #148 restored REQ. POWERS X-Y, CHKS XX-85, and Vanilla REQ. XP 5100, with matching runtime digit offsets. After deployment, the maintainer generated a new webapp ROM and reported that the corrected Inventory display looks good. This closure is bounded to that deployed production route and does not change Required-Powers semantics.

Inventory-HUD TEST LAB line (2026-10-05): v16/v18/v19 establish the preexisting Inventory hang and reject later pickup-manager/resource count as its owner. v20 Runtime-confirms the one-word first-load size correction removes that hang. v21 Runtime-confirms the completed nine-Power TEST LAB Inventory presentation and ordinary-row fifth-argument correction. The exact v21 artifact used slash-form status strings that are retained only as proof history; deployed production wording is now Runtime-confirmed after PR #148 as REQ. POWERS X-Y + CHKS XX-85. Final all-stage/full-seed production-composition coverage remains Pending. See detailed diagnosis and Native HUD and UI.

Earth hazard discriminator (2026-10-05): the photographed horizontal wall spikes in Earth were inactive at difficulty 2 and became active in an otherwise identical proof after changing only the difficulty halfword to 4 (Very Hard). This is Runtime-confirmed for that bounded 2→4 comparison; it is not a claim about every Earth hazard or every difficulty value.

Power Upgrade presentation update (2026-10-05): the original Ice Blue Herbs and three-pulse white Sub-Zero presentation remain Runtime-confirmed. Dense v21 placement exposed a rapid-pickup lock when the pulse loop slept inside the pickup callback. v22 direct-award control removed the failure. v23 Runtime-confirms the accepted nonblocking architecture: progression awards synchronously; one guarded child owns the same three 2-tick white pulses; rapid later Power pickups continue to award. Production preserves the existing flash allocation; final full-product composition runtime remains Pending.

Lifecycle update (2026-10-01): lifecycle v06 is Runtime-confirmed on the bounded manual route and promoted to production. The accepted build preserved damaged HP across Pause -> Quit -> re-entry, preserved lives/continues/XP/powers/four-box inventory, allowed repeated ordinary deaths below the former ×7 floor with full replacement-life HP, preserved run state across accepted Continue, and reset run progress on genuine final Game Over to Very Hard / 9 total lives / 5 continues / starter inventory while retaining all five GAME SETTINGS preferences. No music-speed corruption was reported on the accepted v06 route. v04 remains Rejected / unsafe composition.

Powers-as-pickups OFF earned-XP persistence (2026-10-06): Runtime-confirmed bounded. PR #154's focused all-stage proof MKMSZR_earned-xp-persistence_all-stages_proof_v01.z64 (SHA-256 05c579ad5473a3f357b4cae45b660dbcbdd5b5aa66389eff3395a8e47bf8a550) retained stock XP acquisition and used the OFF-only MKSV +0x44 snapshot/restore path. The maintainer manually ran the requested earned-XP/power re-entry validation and reported that it worked. Scope is the tested OFF lifecycle route; this does not replace the final representative full global-seed release gate.

Scope: This page is the canonical summary of runtime evidence scope by subsystem. It records the narrowest runtime-confirmed claim, the relevant static/implementation-confirmed scope, and what remains unestablished. Detailed mechanisms and proof chronology belong to the owning domain pages.

Rule: “Runtime-confirmed” is always bounded to the documented ROM/build, route, state, and lifecycle boundary. It does not mean exhaustive coverage.

Current project maturity and priorities are owned by Project status. Release requirements and final acceptance gates are owned by 1.0 requirements and roadmap.

| Key-checkpoint self-trace v06 | Runtime-confirmed bounded diagnostic | Prison first easy pickup carries full L1 identity. Native trace reported KA, live G4 S7 B1; visible CHECK POINT banner was absent with the three direct generic-key 0x80062D60 spawns suppressed. User death-tested afterward and confirmed checkpoint relocation still occurred. Establishes separate banner vs respawn effects; not yet a production/global fix. | | Key-checkpoint banner+respawn v07 | Partial Runtime-confirmed / progression regression | Keeps v06 banner suppression and applies player-only Prison selector 7 -> 0 at spawn lookup. After death trace became KAR, proving the respawn override fired while live state remained G4 S7 B1. Level-1 door did not open, so the combined proof is not production-safe and key/door progression has an unresolved dependency beyond the currently preserved award/selector/bit state. | | Prison L1 checkpoint v08 | Runtime-confirmed bounded proof | Full relocated L1 identity at first easy Prison pickup. Runtime showed TRACE KA, G4 S2 B1; no checkpoint banner, Level-1 door opened, and death returned to the natural stage-start/no-checkpoint spawn. Confirms that keeping acquired bit 0 while suppressing the three direct key-presentation spawns and only the L1 selector-7 write preserves the tested Prison progression while removing the unwanted checkpoint. Generalization beyond Prison L1 remains Pending. | | Fire key checkpoint v01 | Runtime-confirmed bounded family proof | Fire callback 0x802F0EBC keeps the stock award/progression path while v01 suppresses only the direct checkpoint-presentation JAL at ROM 0xE5C28 and pickup-created respawn-selector store at 0xE5C50. Runtime: no key-created checkpoint event, death returned to natural stage start, Fire remained completable through Fire God, and next-stage transition succeeded. A one-off crunchy-audio symptom from the first run is currently non-reproducible: stock-callback control v02, split controls v03a/v03b, and a later v01 retest all stayed clean. | | Wind key checkpoint v01 | Rejected / failed bounded design proof | Two-edit selector-assisted proof suppressed Wind pickup callback presentation + selector increment. After Circle + Triangle, deliberate death at the breaking bridge returned to the preceding non-key checkpoint while later key/progression state remained. On the retry route, the upper-room Monk fight near the slab/final-key path abruptly lost the room and dropped the player to the lower bridge area without a normal death/fade; earlier bridge geometry was present again. Static reconciliation shows Wind selector 0x802C18F8 is a nine-step live stage/checkpoint ladder, with stock key steps 3/5 interleaved among non-key 2/4/6/7/8/9 states. Do not generalize the two-NOP model to Water/Earth. | | Wind location/reward split v02 | Runtime-confirmed negative control / Rejected as-is | Circle reward was moved to a separate location while the stock Circle physical location retained its callback. After tornado activation, backtracking to that old Circle location caused its callback to increment the already-advanced selector into the still-unvisited Triangle checkpoint; death respawned there. Collecting Triangle then incremented again into the later door checkpoint. This confirms parameters 0/1 are order-sensitive relative selector += 1 transitions, not absolute location markers. | | Wind checkpoint guard v04 | Partial Runtime-confirmation; audio defect | Guarded Circle checkpoint ownership passed the late-backtrack case: relocated Circle award -> tornado checkpoint -> late old-Circle/Herbs collection produced no false checkpoint -> death returned to tornado. Triangle pickup then established the next checkpoint. Triangle use persisted the door-open progression state across a later death while respawn remained at Triangle pickup. Static trace confirms selector 6 belongs to a separate post-Three-Bars physical trigger, not Triangle USE. Both moved Circle and Herbs-at-Circle were silent; audio seam remains to fix before promotion. The attempted all-keys default-template control did not preload keys and is rejected as a control mechanism. | | Wind checkpoint guard v05 | Runtime-confirmed bounded audio + Circle-location guard proof | Both moved pickups play normal pickup sound. The old Circle physical location, now displaying/awarding Herbs, produced its checkpoint when reached in the expected early-stage predecessor state and death respawned there. Together with v04's late-backtrack no-op after tornado state 4, this Runtime-confirms both accept and reject sides of the Circle 2 -> 3 guard on bounded routes. | | Fortress five-import stress v01 | Runtime-confirmed bounded materializer proof | In Fortress, the first five stock Herbs locations were materialized as Potion, Urn of Vitality, Formula, Eye, and Shield using extension selectors and self-contained imported bundles; the sixth Herbs remained a byte-for-byte control. User validation confirmed Fortress entered normally, all five visuals and awards were correct, control Herbs remained normal, and no rendering/audio/stability/stage-progression regression was observed on the tested route. This closes the pending Fortress five-import destination-resource stress check, not arbitrary boss-reward materialization or production allocation. | | Fortress Kia -> Potion boss reward v01 | Runtime-confirmed bounded trigger/reward-split proof | Kia's boss-defeat reward record 0xC4834 retained the 0x8000 encounter-owned activation gate while its reward identity/resource became Potion. User validation confirmed no pre-defeat Potion spawn, correct post-Kia activation, Potion visual, Potion award instead of Crystal Kia, and healthy encounter/stage continuation. This establishes the tested Fortress boss-trigger/reward separation; Jataaka/Sareena and production allocation/generalization remain to be integrated rather than inferred as runtime-exhaustive. | | Materializer production-composition v02 | Runtime-confirmed bounded production-shaped composition | Corrected v02 uses the established shared file-0x1A bootstrap expansion transport and leaves pickup-manager resume on the known four-box path. User validation confirmed healthy stage entry plus the complete representative route: Fire -> Wind Circle visual/award, immediate foreign-key Glass masking, Wind reveal/native use/re-mask, and Kia -> Potion post-defeat reward activation/visual/award with healthy Fortress continuation. v01's extra file-0x19 stage-init load is Rejected. Shared browser/CLI materializer integration and exhaustive stage/item coverage remain Pending. | | Materializer shared-core v03 | Runtime-confirmed bounded co-resident integration candidate | After newer main added the Temple special-check module at 0x801B08E0..0x801B096F, PR #126 relocated the materializer helper to 0x801B0970..0x801B0A5F. The disposable v03 included both neighboring file-0x1A modules; the user reported all requested checks working as expected, closing the exact relocation/composition runtime gate. PR #126 is also CI-green. This does not establish exhaustive stage/item coverage or the future global generator/solver. |

Domain	Runtime-confirmed scope	Static / implementation-confirmed scope	Not yet established / limit
Stage flow and selector	A-button title route reaches all eight compact safe destinations. Post-legal logos are skipped, and selector entry suppresses only the immediate unwanted auto-save while later/manual saves remain intact. Safe-selector presentation v03a Runtime-confirms the title-blue nine-frame cursor and one title MOVE sound on valid Up/Down presses, with normal stage audio on the tested post-load route.	Selector table/range/mapper, selector-local 29-entry palette replacement, and movement-SFX helper/hook are guarded and implementation-confirmed. Exact sites belong to Address and patch-site registry; helper ownership belongs to Memory and allocation map.	A is the title route into the selector; stage choice inside the selector uses Start. Confirmation-SFX v02 is Rejected / failed and is not production: its A-edge sound did not commit a stage and delayed crunchy/choppy stage audio was observed. The exact corruption mechanism remains unresolved.
Core runtime / bootstrap	Production now reserves 0x801AF420..0x801B3420 (16 KiB). The established Runtime V2 code/state layout remains in the first 1 KiB and the remaining 15 KiB is a build-time expansion pool. A disposable exact allocator-profiler proof loaded all eight safe stages with this floor, peaked at 0x802893E8, and left 0x75A8 = 30,120 bytes = 29.41 KiB below the 0x80290990 bump boundary. The normal full-production build configured as seed TEST16KB, edition TEST 16KB, outfit rainbow was then manually exercised and the user reported no regressions on the tested route.	Both guarded arena-address constructions, file-table entry, bootstrap hook/stub bounds, Runtime V2 first-1-KiB contract, build-time expansion-pool allocator, allocator semantics, live cursor 0x80111ECC, and bump boundary 0x80290990 are Implementation/CI- or Static-confirmed as applicable. See Core runtime and address database.	The 29.41 KiB figure is a bounded proof-route minimum headroom measurement, not confirmed-free space or a worst-case guarantee. The profiler's per-stage labels are lifecycle-qualified because the current-stage field changes before some preload work completes. No production feature owns any expansion-pool subrange yet; future allocations still require guarded composition and their own runtime validation.
Ordinary-pickup persistence	At least one ordinary pickup in every main stage has been collected, persisted, reconstructed, and absent on revisit; multiple Fire records were also exercised.	All 84 ordinary records and persistence bit mappings are cataloged. See Persistence, inventory and lifecycle and Stage catalogs.	All 84 records have not been individually runtime-exhausted. Game Over/new-run reset remains pending.
Stage-local pickup randomization	Seed TEST153 made the first Fire ordinary location the predicted Shield and it rendered/awarded normally.	All 84 ordinary identities are implemented in the historical stage-local mode; deterministic namespaces and access-model tests are Implementation/CI-confirmed. See Pickups and item randomization.	No representative full seeded playthrough establishes broad arbitrary-layout runtime coverage; this interim stage-local model is not the 1.0 global model.
Pickup placement / Ice Blast cancel research	Runtime-confirmed bounded post-1.0 proof. The accepted placement probe printed live player raw fixed8 X/Y/Z; two Wind Herbs were hand-placed and visually iterated, yielding the accepted authoring convention Y = player Y + 0x1C00 (+28 world units). The separate Ice-Blast-cancel v01 proof was reported working perfectly: while standing on a pickup, normal ground Ice Blast can be interrupted into the stock Pickup transition.	Static proof guards identify normal Ice by controller +0x6F0 == 0x8004AB84 with mode 0x80111F98 == 0; the special lock 0x800BF308 is cleared only after stock pickup interaction/spatial gates pass. Reproducers are retained under tools/.	4Fun / Post-1.0 only. Directional/Air Ice, generalized action cancelling, production cave allocation, and exhaustive cancel-frame helper/projectile behavior are not established. See Pickup placement and Ice-Blast cancel proofs.
Cross-stage item materialization	Bounded proofs confirm foreign-resource conversion, multi-import stress, and destination-safe reward/state composition, including first-item-swap v04.	The shared materializer is connected to the pipeline; PR #137 supplies accepted global assignments with explicit appended resource ownership. Destination checkpoint/activation actions and Prison credential restoration remain separate from movable logical rewards.	These are bounded proofs, not exhaustive coverage of arbitrary assignments in all stages. Representative full-seed release validation remains Pending. See Global item materialization and solvability.
Temple scripted Map check	Runtime-confirmed full Temple-specific closure. v01 proved reward/progression separation. v02 visibly replaced Map art with native Temple Herbs, awarded Herbs, moved the elevator, preserved the exit-rope route, stayed collected with correct progression after title -> Temple re-entry, and completed Temple -> Wind normally.	Callback 0x802EEC54 keeps its stock location-owned progression. Dedicated MKSV header flag bit 0x0001 persists this special check outside the 84 ordinary bits; re-entry reconstructs 0x8026E9A4 and resumes 0x802EEE94. v02 SHA-256 d14380afe698d7daa9173a3295882e04f58e1bb747a88e33df33b32720118f66.	Temple-specific architecture is closed. PR #137 now supplies arbitrary assigned logical rewards through the validated Temple-specific seam and does not make this an ordinary fifth Temple record.
Global generation / solvability	Runtime-confirmed bounded loader seam and maintainer-reported working global-v2 gameplay; promotion approved. Temple relocation above 0x01000000 loaded normally with ordinary Herbs behavior. This is not exhaustive full-run evidence.	PR #137 generates/solves/materializes 85 checks in the shared browser/CLI path, supports All 85 available / Game beatable, and owns eight appended slots in 32 MiB output. GLOBAL85-V01, All-85 / pickup mode ON, is accepted at attempt 0.	Full-seed/all-tier release coverage remains Pending. OFF retains vanilla XP, needs no additional earned-XP solver accounting, and preserves the independent Required powers Fortress gate. Persistent FX-only crunch is unresolved, deferred, and not attributed to global generation. See Global item materialization and solvability.
Four-box inventory / lifecycle	Runtime-confirmed baseline + configurable production implementation. Exact v06 confirms Very Hard / 9 lives / 5 continues / HP persistence ON together with XP/powers/inventory, death, Continue and Game Over reset behavior.	The shared lifecycle patch now parameterizes difficulty, lives (1..10), continues (0..5), and HP persistence while retaining the same guarded control flow. Browser defaults are Very Hard / 5 / 3 / HP ON. HP OFF keeps the stock final full-HP store. Production XP/Mission Objective restoration remains unchanged.	Non-reference value combinations are Implementation/CI-confirmed pending representative runtime sampling; final full-seed composition validation remains pending.
GAME SETTINGS TURN controls	Runtime-confirmed production composition. The shared patch core exposes GAME SETTINGS -> TURN: TOGGLE / LOCK; fresh builds default to TOGGLE. LOCK reproduces the accepted v10 direction-facing/facing-lock behavior. The validated production build confirmed menu entry/exit, both modes, inventory-box switching, a stage transition, both former Temple hang routes, and first-Scorpion forced-facing fallback without changing the saved LOCK selection.	v06 keeps the stable decision helper and makes release/action hooks leaf-only. Forced-facing detection in those fragile hooks directly scans the stock controller list with a hard 64-node bound instead of making nested native calls. Durable TURN state uses bit 0x0200 in the MKMSZR four-box state word; the stock GAME SETTINGS editor uses 0xA01AF81C only as transient frontend storage.	Earth type 0x19 remains outside the TURN runtime claim because its custom boss path is not proven to use the generic +0x6BC & 0x0200 policy. The modern control suite is separately recorded in the Native HUD / UI row.
XP progression / power order	Diagnostic B behavior is Runtime-confirmed through normal XP 85 and 258 lifecycle routes. Power-order v02 Runtime-confirmed a Slide -> Ice Blast first-two reorder with synchronized native Power Ups presentation. Generalized v04 Runtime-confirmed the nine-gate/UI remap mechanism on the tested order Freeze on Contact -> Air Ice Blast -> Super Slide -> Ice Shatter -> Slide -> Ice Clone -> Directional Ice -> Ice Blast -> Polar Blast, including Super Slide before Slide and Ice Shatter after a freezing power.	Central XP award/restore behavior, all mapped power-tier gate sites, both native Power Ups presentation tables, deterministic constrained ordering, and the isolated RNG design are established. The v04 standalone 85-XP-at-stage-load symptom is statically isolated to its proof bootstrap executing the award callback and is not part of the production XP lifecycle. See XP and progression.	The shared browser/CLI integration and default-off web checkbox are implemented on the feature branch; repository CI/merge/deployment and final representative full nine-tier production-composition runtime validation remain pending. Final art and Game Over/new-run reset also remain pending.
Native HUD / UI	Five-setting frontend v09 and controls v10 are Runtime-confirmed for their tested routes. The user accepted corrected full-product controls/CI4 Toasty v02 with real progression: “Works perfectly!” The earlier CI4 candidate failed at 0 XP for Slide/Super Slide and is superseded.	The accepted v02 build (SHA-256 b12ed90201ab754aac542b7b89458735b5a756f480fffca89c129c0ed3173147, seed CONTROLSV10CI4, MKT Rev. 2 donor) remains the Runtime-confirmed baseline. Current builds intentionally differ only in the approved Toasty four-word TLUT purple polish; controls semantics and allocation are unchanged. Slide and Super Slide use stock recognizers 0x8003C9F8 and 0x8003CAF4; proof-only XP forcing is absent. Optional no-donor controls composition passes guarded build.	This is a bounded manual test report, not exhaustive stage, boss, input-combination, or all-tier coverage.
Presentation / branding	Legal/boot presentation and the earlier Candidate-B title route were Runtime-confirmed. The new vector/typeset title was user-confirmed through the production webapp on 2026-09-29.	The accepted title remains native 16-color CI8 file 0x5E in the stock slot with configurable <NAME> EDITION. Non-vanilla outfit modes now tint its palette; rainbow uses fixed word/edition bands. See Presentation and branding.	Color variants and fixed rainbow are Static/implementation-confirmed; exact in-game color acceptance is Pending. The rejected executable-wrapper composition remains rejected.
Palette / recoloring	Multiple static player outfit modes visibly recolor clothing. The 64-phase rainbow mechanism is Runtime-confirmed, and compact-tail v01 was manually validated on all eight safe stages with inventory use, movement, enemy kills, and doors. The v60 proof separately Runtime-confirms the first Scorpion/type 0x12 alternate palette as the intended yellow/gold Cyrax-style Sektor on its tested route.	Stock 64-entry TLUT structure, BGR555 transforms, native frame-setup binding, all 15 stock Sub-Zero load paths, the +0x2000 runtime tail, and dedicated 8 KiB bank transport are established. Stock file 0x87 remains in place; the old high-ROM duplicate is superseded. See Palette and recoloring.	Undead Scorpion/type 0x11 and arbitrary enemy palette behavior remain outside the confirmed scope.
Enemy randomization	Representative merged planner/materializer seed Runtime-confirmed. ENEMYPLAN05 v03 was built from current main and the user reported every requested stage test worked, including Water foreign 0x17, Prison FAST → GRUNT1 → FAST/fence → scripted capture → final PRIS, native shuffled Fire/Bridge/Fortress groups, and preservation of fixed special encounters.	Planner/materializer v1 are merged and CI-confirmed. v03 SHA-256 630a5302c30c216994df2ad265cadf374e2639257fb44357adeabbf9b49a586f; Prison phase modeling retains fixed 0x8F auxiliary ownership for capture.	This is one representative all-stage seed, not exhaustive coverage of every deterministic seed/profile combination. Unresolved MONK1/MONK3/MONK4 and GRUNT1/GRUNT2 foreign paths, arbitrary cross-family phase substitutions, and normal browser/CLI production integration remain Pending.
MKT / Sektor takeover	Bounded takeover and v62 combos are Runtime-confirmed proof only. Missile: v69 chest one-frame injection, v70 genuine travelling rocket, v72 mirrored (+5,+38) placement, v73 acceleration, v74 cadence folding, and v75 bounded velocity calibration are Runtime-confirmed on tested routes. v75 is the stable baseline. v65-v67, v71, v78 and v79 hard-hung; v76/v77 did not materially fix presentation/placement.	Clean MKT/target and v75 disassembly resolve separate parent, companion-actor helper, blue-tint helper, and projectile child ownership. The full donor-to-target operation map and limits are in MKT adapter primitives; full version chronology in Sektor takeover proof history.	v80–v84 manual results reconcile the frame schedule and selector ownership: v83 raw early bind is overwritten by parent stock advancement; v81/v82/v84 use selector zero, not the dynamically allocated Sektor source. v85 was built but never tested and its ordinary-route deferred insertion is statically unreachable. First fallback frame, Ice companions/tint, chest hold/close, donor audio/smoke/explosion, strike/reaction translation, palette release and production-safe allocations remain pending.
Toasty audio	v03 Runtime-confirms the donor voice; v46 confirms the isolated dedicated route while ordinary pickup audio remains stock; v47 Runtime-confirms that behavior in the full current production composition on the tested route.	Donor chain remains slot 0x1B / event 0x0160 / patch 65 / subpatch 111 / waveform 77. Host dedicated route is event 52 -> 68 -> 608 -> 533; pickup 524 -> 681 -> 524 -> 133 is preserved.	Runtime scope is the manually exercised v47 composition; Frosty/Crispy are not required.
Seeded Temple intro audio	Audio-2 donor replacement is Runtime-confirmed by the corrected Temple proof line; Audio-1 replacement is Runtime-confirmed by v05. Production carrier v06 is also Runtime-confirmed: seed TEMPLE-PROD-CARRIER selected Audio 1 / Friendship and the user observed “Friendship!” followed by the untouched stock Scorpion laugh. Proof SHA-256 9460d923b9c1cecf2d481e36719f7249231944eeecc7e2c300dd95a4809085c6.	Stock Temple mapping is 0x41/0x42 opening-line alternation plus 0x43 laugh. Approved donor pools and deterministic one-slot-at-build-time selection are implemented in PR #120. Production carrier 0x20A -> 0x1A6 -> 579 -> 422 -> 412 is statically isolated; only one selected sample is written to [0xF6BDF0,0xF6D810).	Runtime coverage is bounded: the production carrier/allocation was manually exercised with the Friendship Audio-1 selection, while the opposite Audio-2 seam had already been separately Runtime-confirmed. The full 11-clip pool and every seed/slot combination are not individually runtime-exhausted.
Toasty visual	v38/v40/v42/v44/v46/v47 established the image, compact execution, lower-right 3/16/8 presentation, successful-reaction trigger, dedicated audio, and earlier full composition. Accepted full-product controls/CI4 v02 was reported to work perfectly, and compact-source proof v01 was later reported “Worked perfectly.”	Production stores the same padded CI4 texture bytes with deterministic PackBits-style compression plus a 0x7C native decoder. The module is now 0x801B1000..0x801B2131 (0x1132 = 4,402 B). Proof SHA-256 is 2500b3100a3fa375252ca769c7b4e756cd07909469ddf26879e9318b9186611f; production retains 80/1000 (8%), while the proof used 1000/1000 only to accelerate validation.	Runtime confirmation remains bounded to the user-tested proof composition; it does not independently exhaust every stage/trigger permutation.
Browser / CLI patch core	No separate gameplay-runtime claim is inferred from the product surfaces themselves.	Browser and CLI use the shared patch core; supported-ROM validation, guarded writes, deterministic build logic, and CI composition checks are established. See Web patcher and product and Testing and CI.	CI/static success does not establish final gameplay behavior; final 1.0 runtime validation must exercise the normal production composition.
PS1 research	No new PS1 runtime claim is established by the current N64 consolidation.	Executable/resource/save/pickup/enemy mappings and bounded donor/reference findings are static research. See PS1 research and N64–PS1 comparison.	PS1 Fire substitution, UI hook, playable Scorpion moves, and any N64 transfer not separately demonstrated remain unestablished.

Runtime-confirmed bounded evidence: v10 stable empty TEST LAB; v21 three correctly rendered Herbs all collectible; v26 imported Prison L1 key renders in TEST LAB; v27 ten distinct key/crystal visuals enter successfully; v31 fifteen non-Earth pickups enter without Mission Objective corruption; v33 makes that 15-live set recognizable with coherent selected native static frames. v28-v30 are rejected corruption controls. Earth direct cross-stage rendering is now Runtime-confirmed in TEST LAB v38 using the corrected file-0x30 donor mapping; all three Earth visuals render correctly and the tested Earth key awards correctly. See TEST LAB proof history.

Historical N64 proof runs used BizHawk 2.11.1, Ares64, CPU emulation 1, and P1 controller 2 where explicitly recorded.

A runtime observation remains bound to the exact proof/production ROM identity, stage or frontend route, relevant save-state identity, and lifecycle boundary that were actually exercised. Later successful proofs can supersede an earlier status without retroactively widening its route coverage. The owning history pages retain proof hashes, build sizes, detailed routes, and rejected controls where those details are needed.

PS1 findings remain platform-specific unless transfer to N64 is separately demonstrated.

Production evidence applies to guarded code that is part of the normal browser/CLI composition for the supported ROM and has the relevant implementation/CI gates. Runtime-confirmed production additionally means that production composition was manually observed on the stated route.

A proof may intentionally use a one-off record edit, temporary resource placement, isolated patch, or allocation that is unsuitable for production. A proof can establish feasibility or a failure boundary without becoming a product feature.

Examples of the boundary:

• the cross-stage item planner is integrated with the 85-check global generator/solver in PR #137; bounded runtime evidence does not establish exhaustive full-seed coverage;
• the MKT/Sektor line has extensive Runtime-confirmed proof evidence, but the v62 standalone combo continuation still overlaps production bootstrap ownership and the v65-v74 missile helpers also use proof-only conflicting bootstrap space;
• Toasty audio and visual paths are Runtime-confirmed in bounded proofs, while their final trigger/allocation/composition are still pending.

Runtime success never converts an old proof cave or proof allocation into production-safe space by itself.

This page no longer owns version-by-version proof diaries.

• Sektor vNN proof/build chronology, including v52 allocation failure, v53-v59 takeover work, v60 alternate palette, v61/v62 combo strings, and the v63-v85 straight-missile diagnostics: Sektor takeover proof history. Slot mapping/current gaps remain in Sub-Zero to Sektor animation mapping; donor/adapter interpretation remains in MKT to MKMSZ compatibility layer.
• Sektor v60 alternate-palette proof chronology and proof-specific mechanics are canonical in Sektor takeover proof history. Palette and recoloring owns current production player-outfit recoloring behavior.
• Toasty audio donor identification, rejected candidates, and v01-v03 proof history: Toasty audio research. MKMSZ host mechanics remain in Audio system.
• Toasty visual diagnostics: Toasty visual research.
• XP proof and Diagnostic A/B history: XP and progression.

• Implementation/CI-confirmed: PR #129 implements the researched Wind/Water/Earth/Fire/Prison destination actions, generic Bridge/Fortress activation gates, portable Strength award separation, and Prison credential reconstruction after the stock reset. Current-main lifecycle v06 is unchanged. CI run #1583 passed.

• Static-built proof: MKMSZR_destination-wrappers_first-item-swap-proof_v04.z64, SHA-256 c7df1ca9798d6532783a80205b123a11e5c7655cda069342e6c60b4ab75547ee, CRC1/CRC2 59037DDA / 4BACE8C6.

• Allocation correction: the earlier high-tail materializer placement 0x801B2960..0x801B2EBF / 0x00F6B140..0x00F6B69F is Rejected after a real web build exposed overlap with fixed Toasty audio. Corrected helper runtime is 0x801B2310..0x801B28EF, ROM 0x00F6AAF0..0x00F6B0CF; lifecycle v06 remains 0x801B0A60..0x801B0FF3. Wrapper behavior was not changed by the relocation.

• Proof scope: stock reward visuals isolate wrapper/state behavior; foreign-resource visual conversion is not re-tested. Prison uses proof-only backing-box mirroring after key award so the exact entry reconstruction helper can be tested without the full four-box frontend.

• Runtime status: Runtime-confirmed bounded. The user manually validated v04 and reported the tested first-item/key swaps and location-owned checkpoint behavior working perfectly. This confirms the exercised logical-reward-vs-destination-state separation, including moved keys awarding without carrying their source checkpoint and original key locations retaining their physical checkpoint/state behavior. It does not claim exhaustive coverage of every item/location permutation.

• Proof packaging correction (2026-10-02): v01 is superseded as a validation package because it omitted Safe Stage Select. v02 added the Runtime-confirmed compact eight-stage selector presentation plus its selector-specific one-shot auto-save bypass. v03 clustering is also superseded by the cleaner first-item-swap v04 design.

• First-item-swap v04 validation correction (2026-10-02): v03's coordinate clustering is superseded. v04 returns to v02's exact wrapper/Safe-Stage-Select base and swaps logical/visual identities only: Wind first Herbs <-> Circle, Water first Mana <-> Triangle, Earth first Formula <-> Square, Fire starting Potion <-> Triangle Up, and Prison first Herbs <-> L1 key. Each moved key therefore awards from a non-checkpoint destination, while its original physical key location holds the mundane first-stage reward but retains the researched destination wrapper. User manual validation reported the proof working perfectly. This directly Runtime-confirms the exercised key-without-checkpoint, checkpoint-without-key, and late revisit/non-downgrade behavior.

Runtime-confirmed bounded Audio-1 isolation. The user confirmed Temple played the seeded “Friendship!” clip while the previously affected Bridge and Prison robot/miniboss audio remained vanilla. The proof preserved stock descriptors 0x41/0x42/0x43, replaced only Temple events 123/124, and routed through isolated 486 -> 329 -> 319. Audio-2 event-125 isolation is also Runtime-confirmed: TEMPLE-0003 -> shao-laugh behaved as expected, with stock opening Scorpion lines and the later selected Audio-2 replacement. Proof SHA-256 f0c87bbc52365361bcbc288f5db37d3918deee85136bef29728229cf4efb8a12.