I Gave Gold War Machine Onslaught's Boss Beam.

Gold War Machine already looks like a boss character, so giving him first-form Onslaught's Mega Optic Blast feels almost inevitable. The implementation is less obvious. The visible beam is a linked family of stock class-$B4 objects, the body is Gold's native airborne medium-punch choreography, and the palette is shared engine state that can be overwritten mid-super.

The first working version proved the route. Combined v3 makes it a playable move: a short punch piano works, the super costs two levels, Duo Team Attack locks it out, hit and chip are deliberately balanced, only Gold loses OTG, and the final lit pose hands off to stock unlit recovery and natural air physics instead of floating motionless.

Combined v3 is the only current player build

Run the final CMD beside your own clean mvsc.zip:

& ".\MVSC-MEGAMAN-GWM-COMBINED-v3.cmd" ".\mvsc.zip"

It writes mvsc_megaman_gwm_combined_v3.zip, includes and downloads no ROM, preserves the input, and refuses a patched, stacked, reordered, duplicated, missing, extra or mislabeled set.

For online play, both peers need identical case-sensitive ordered member data and a room/emulator that accepts modified CRCs. Stock member sizes and no graphics expansion do not guarantee that a Fightcade room will accept the set. This is unofficial and has no claimed Capcom or Fightcade support. The one current Discord announcement lives in the Mega Man companion article, so there is not a second standalone Gold message to drift out of sync.

What Combined v3 fixes

The input accepts a controller piano without becoming sloppy

Gold's command remains airborne QCF + any two punches in either a normal jump or a true down-up super jump. At the terminal stage, v5 accepts all three punch pairs together or a short one-update roll when at least two punches are held and at least one punch has a new press edge. It preserves the native direction-release window. Singles, QCB, stale-held pairs, release-only pairs and an active repeat state +$B0=$2A reject.

Ground QCF+2P remains Proton Cannon. Plain air MP remains Gold's ordinary plasma. Ordinary War Machine ($02) is unchanged; every custom path requires Gold fighter id $0028.

The beam costs two full levels and cannot run inside Duo

One level now rejects before custom state, beam allocation or palette lease. Two levels accept and pay exactly 2→0; hit and guard cannot refund the shooter. The commit adapter at $3F26B6 calls the native hyper commit wrapper and reaches stock meter spend with d0=1, producing the required second debit without inventing a separate meter store.

On a one-level attempt, native QCF parser progress occurs during the motion, then the final +$1C8..+$1CD record returns to 000000000000; meter remains 1→1, with no custom state, B4 object or palette lease. Duo is a separate earlier gate: its real countdown check rejects before parser consumption, so that lane truly leaves the parser unchanged.

Variable Cross is not identified by fighter +$B0. Its authoritative per-side countdown words are $FF4034 for P1 and $FF4036 for P2, selected by fighter +$02. During a real QCB+HP+HK Duo, the custom recognizer checks that timer before touching its six-byte parser record. The measured reject leaves meter, parser, custom action, B4 allocation and palette lease unchanged.

Hit damage is 52 and guarded chip is 7

The donor's 17 standing/air contacts dealt 45 total damage from shared Dmg $06 rows. Gold v5 substitutes owner-private clones with Dmg $07 before common collision math caches the row. The result is 17 contacts and 52 total damage without editing native Onslaught's $0F78D2/$0F78F2.

On guard, 13 contacts used to produce 13 chip. Subtype B is naturally no-chip. For subtype A, guard contacts alternate between the ordinary private row and a private +$16 bit-1 clone; only the guard path advances parity. Seven guarded contacts pay one point, six skip it. All hit contacts stay active, so the hit total remains 52.

Gold's beam does not OTG

This policy is Gold-specific. When the target is genuinely prone in state $08, step $0004, the owner-scoped wrapper marks the custom Gold B4 object so the engine skip at $0D711E ignores that attacker. The frozen true-prone lane records zero Gold B4 contacts. Standing, crouching and airborne controls still connect, and native Onslaught is untouched.

Mega Man's Magnetic Shockwave intentionally follows the opposite policy: it preserves the original move's OTG behavior. Combined v3 distinguishes the two owners rather than imposing a global rule.

The ending is unlit and immediately returns to natural falling

The old cooldown fix turned off the chest light but held Gold in a private motionless countdown, which produced the choppy “two falling frames, then float” report. V5 removes that manual loop. On the first frame with no marked B4 object, it releases the palette lease, selects Gold's stock unlit air-MP recovery group $02 / subaction $12, clears the private hold metadata, and calls the native return-to-air path.

The first unlit frame provides the requested cooldown/finish read, but Gold no longer sits there. Gravity resumes immediately through the stock air system.

Missing beam graphics are not reproduced from a clean accepted parent

Reports #1–4 showed missing or corrupted beam graphics on local archives, but both reported local ROMs were also known to be corrupted and the defect did not appear in the patch delta. Gold v5 writes only mvc.10, mvce.03a and mvce.04a. Every graphics member mvc.13m through mvc.20m is byte-identical between the installer-accepted canonical parent and the tested candidate.

Treat a missing segment as a real patch regression only after the final installer accepts the exact canonical parent and the same clean-parent reproduction still shows it. Do not use a previously patched, corrupt, reordered or relabeled archive as the graphics oracle.

There is a separate visual limitation: the large white/cyan oval or apparent “cutout” at beam contact is native class-$B4 Onslaught composition. Removing its live subtype slices produced invisible damage or rectangular gaps. Combined v3 keeps that coherent stock donor presentation. It is not evidence that graphics data was omitted from the patch.

Compact release evidence

The frozen Gold component identities are source 97197eb0986b66960de86383dc80d1b8034af4920bb8c7d2de145173de191e62, 2,168-byte payload 5888cd0154a204a3c8d6eca385eb01dc335f510909f889b5983740985d56cfd5, resource 6252bae7ba2abeca572d5df1d5f18841e4696fbc689982e103986cafaee710a9, hook plan c4e463bb5703a280d9ccfb5a0cedbf49c50362006f64b168c0fdc21e5539bbbb, final evidence component record 77cf2ade30e302c6b0d9bccc68fcf96a294fcb3c69e1587a96b0b5279d8f2876, and normalized release component 5cbc7b714a24406e29821a69eaa4e1f1cbaef53adaed72cf8213faf64b585803.

The air-normal cancel evidence proves the action window on a true whiff. The shared hit-contact timing control also failed to make LK/HK contact for stock Ryu, so this binder does not pretend it has a separate hit-confirm oracle. That qualification is part of the freeze, not hidden in a footnote.

N41 replication ledger: exact state, hooks and private rows

Live RAM ownership

+$1C8..+$1CD is temporary command-parser progress, not a moves-used list. +$1CE is the $A5 palette/provenance lease. In +$1CF, bit 0 records a common palette-writer interruption and bit 1 is guarded-contact chip parity. Both runtime bits clear on action init/release. Fighter +$02 selects which native Duo timer belongs to the owner. On an accepted Gold Mega Optic activation, fighter +$B0=$2A and +$E6=$1A (P1 $FF30B0/$FF30E6, P2 $FF34B0/$FF34E6).

Fixed Gold payload map

The payload links at CPU $3F2000..$3F2877, stored in mvc.10 +$072000..+$072877 after 68000 word-order conversion.

Corrected 13-hook plan

The hit-row cache hook is CPU $01A952, not the stale research address $0D7426. $0D73D4 is a different, earlier collision-row hook; both are necessary so the private Dmg $07 row exists before each common consumer caches it.

The two byte columns below are copied from the frozen hook plan. Plain member is the decrypted, word-swapped member order used for a plaintext preimage comparison. Encrypted member is the actual HxD byte order in the canonical encrypted parent. Do not paste the plain column into mvce.03a/.04a.

In final Combined v3, $01CD1E is intentionally replaced by the one shared owner instead:

CPU plaintext fetched: 4A2E00E86700000C -> 4EF9003F30004E71
encrypted member HxD:   B7E6BA813793ED6B -> 59A8A5A973B6C4AF
dispatcher:              $3F3000, class $B4 -> $3F2560, otherwise -> Mega $3F138A

Every other Gold hook remains exactly the frozen component hook above.

Stock rows and Gold-private rows

Native Onslaught's rows remain byte-identical:

$0F78D2  060003c010300008000f190a80050c2404640012001404010000000000000000
$0F78F2  060003c010300008000f190a80050c2405640012001406010000000000000000

Gold uses these unique private byte patterns:

$3F27F8  070003c010300008000f190a80050c2404640012001404010000000000000000
$3F2818  070003c010300008000f190a80050c2405640012001406010000000000000000
$3F2838  070003c010300008000f190a80050c2404640012001406010000000000000000

$3F27F8 is hit row A, $3F2818 is hit row B, and $3F2838 is the alternating no-chip A clone. The fourth allocation at $3F2858 is byte-identical to $3F2818; subtype B is already naturally no-chip. The meaningful byte edits are Dmg +$00: $06→$07 and row-A guard property +$16: $04→$06. Keeping private clones prevents native Onslaught or another consumer of $0F78D2/$0F78F2 from inheriting Gold's balance.

Graphics-member clean-parent proof

The candidate changed only mvc.10, mvce.03a and mvce.04a. The clean/candidate SHA-256 for each 4 MiB graphics member is identical:

The compatibility identity is the exact member data, not the outer ZIP's compression metadata. The recorded clean outer archive SHA-256 is 6f63627cc37c554f74e8bf07b21730fa7f85511c7d5d07449850be98dde91da8, but the installer makes its decision from the canonical ordered member catalogue.

Permanent-edit workflow

1. Observe live fighter/object/row state in MAME or FBNeo; $FFxxxx is RAM, not an HxD offset.
2. Assemble with m68k-elf-as, link at $3F2000, and fail on exported symbol drift.
3. Store the 2,168-byte payload in mvc.10 +$072000 after swapping each 68000 word's byte order.
4. For every hook, require the exact clean plaintext and encrypted preimage shown above.
5. Derive encrypted executable words at the exact CPU word address; byte swapping alone is not CPS-2 encryption.
6. Build a new ordered archive, decrypt changed program ranges back to CPU order, and re-encrypt to prove byte-for-byte equality.
7. Run owner negatives: ordinary War Machine, native Onslaught, ground Proton Cannon, plain air MP, one-bar and Duo states.
8. Run behavior deltas: hit, guard, true prone, crouch, air, normal-jump fall and true-superjump fall.

HxD answers “what bytes are stored in this extracted member?” SwapEndian/word_swap answers “how are bytes ordered inside each 68000 word?” XCopy/CPS-2 encryption answers “what encrypted opcode word represents this CPU instruction at this exact address?” They are three separate transforms.

Harness architecture and reuse

Gold v5 uses bounded lanes instead of replaying every historical matrix after every edit. smoke checks install/boot/command. delta checks the behavior touched by the edit. release runs the full composition, static byte scope and packaging only after both components freeze.

Each emulator case is isolated and has a hard wall timeout. A cached PASS binds ordered ZIP member semantics, post-sign output, receipt, emulator, manifest, runner, Lua 5.1 compiler, harness, declared dofile dependencies, allowed environment, command, timeout, completion marker and exact artifact inventory. A case-local DONE without that fingerprint is rejected. The runner also rehashes source and dependencies after execution and terminates the whole process group if a case hangs.

The contact harness logs object class/subtype, owner chain, cached row at object +$8C, victim row, HP-write PC, contact count, damage and meter. That is how the late-row substitution bug was found: putting Dmg $07 only into a postprocessor was too late because $0D73D4 had already cached the stock row. The fixed pair $0D73D4→$3F26CE and $01A952→$3F271E moves substitution before both consumers.

Recovery lanes record the last live B4, first unlit animation, subsequent Y/velocity changes and landing. The prone lane requires the actual $08/$0004 state when the beam arrives; “the target looked down” is not enough. The Duo lane performs the real QCB+HP+HK activation and observes the native per-side countdown, rather than forcing a convenient fighter state byte.

Historical engineering appendix

Old unversioned, v1 and v2 Gold installers are revoked. Standalone v3/v4 and Combined v1/v2 are historical freezes only and are intentionally not linked as current player choices. Combined v3 must always begin from the exact clean parent.

Follow the boss object's topology

Onslaught does not draw one huge beam sprite. A class-$B4 root creates linked subtype objects that own placement, palette, collision and render lists. Gold's custom action calls the native family, then marks only the lineage whose owner is fighter $0028. Native Onslaught and unmarked B4 objects resume the displaced stock dispatcher.

Gold's measured chest origin comes from ordinary air MP: subtype $06 uses forward +20, vertical -82; subtype $00 keeps the donor family's one-pixel relation at forward +21, vertical -81. The custom super suppresses Gold's normal class-$1C chest plasma only during this action. It does not add a body hitbox.

Why palette lifetime needed a lease

The beam's colors can look right on spawn and then inherit Gold's palette after hit flash or a common palette reload. The fix is owner-scoped lifetime, not a one-time palette copy. Fighter +$1CE=$A5 marks the lease; marked descendants keep it live, the common repaint hook restores the optic palette while active, and the final descendant releases it. +$1CF bit0 records an interrupted palette write so the next safe update reapplies it.

Why the native contact oval remains

Render-queue tracing showed that repeated subtype-$04 display lists compose the bright contact oval. Removing a live slice did not remove its collision; the game produced invisible damage. Replacing it with narrower donor lists opened rectangular holes. Because the patch does not import new art or expand graphics ROM, the coherent native Onslaught presentation is the honest stock-size limit.

Why v5 recovery replaced the v4 cooldown loop

The earlier presentation revision correctly removed the unexplained chest light but stayed in a private fixed-air countdown. Testers then saw Gold alternate two falling frames while hovering. V5 keeps the desired first unlit frame and deletes the motionless policy: the engine's own RETURN_TO_AIR owns gravity, fall animation and landing from that point onward.

That distinction is the general lesson of this port. Reusing a native effect is not just calling its spawner. A robust character port must own command grammar, cost, team modes, object ancestry, collision-row timing, meter returns, palette lifetime, recovery and cleanup—and must prove that every shared donor remains unchanged.

Archived deep research record

The following original reverse-engineering sections are retained intact for provenance and reuse. Their v2/v3/v4 wording is historical context only. They expose no current player download and do not override Combined v3's two-level cost, Duo ban, 52 damage, 7 chip, Gold-only no-OTG, natural recovery, corrected $01A952 hook or frozen identities above.

What v2 got wrong—and how v3 fixes it

The new play captures invalidate the old “chest-origin” label. V2 installs a fixed −64 placement formula, advances the borrowed air-MP chain only until its fire event, then holds Gold motionless while the class-$B4 family continues. That explains both visible complaints: the cap is attached to the fighter origin rather than the rendered chest plate, and the body stops performing the move. The donor property rows also feed hyper-gauge charge through their stock boss behavior. V3 filters only the Gold-owned donor returns, so the shooter earns zero meter from the custom beam on hit, block or whiff while the defender keeps the unmodified stock gauge path. A stock Ryu control later settled the separate repeat-use question: a second air Hyper can be legal in the same jump if the first move fully recovers before landing. Gold therefore follows that timing instead of receiving an invented one-use-per-jump lock.

The presentation target is the readable logic of an airborne Uni-Beam: wind-up, chest flash, braced discharge and recovery. Marvel Super Heroes Iron Man and Marvel Tōkon: Fighting Souls make that intent especially clear, but their art is reference only. Cross-ROM analysis found no exact Iron Man/War Machine body-tile twins, and importing those graphics would violate this patch's stock-ROM/Fightcade constraint. V3 therefore continues Gold's existing group $18, sub $02 body chain through all twelve observed records, suppresses only the normal class-$1C plasma child while the custom action marker is live, and attaches Onslaught's already present beam family to the measured chest pixel. The anchor is forward +20, Y −82 on subrecord $06, then forward +21, Y −81 on subrecord $00; “forward” mirrors with facing. The fighter body carries zero attack metadata during the super, so only the native class-$B4 beam family can hit.

An exact render-consumer trace proves that the huge white/cyan contact cap is real class-$B4 donor composition—not a random tile, background hole, palette fault or hit spark. The repeated subtype-$04 display lists at $322AC4 and $322D2A build the oval slice by slice. Hiding a slice leaves active, invisible damage; substituting narrower stock lists opens rectangular gaps. Under the Fightcade constraint—no ROM expansion, new graphics or imported sprite data—there is no safe stock-list replacement. V3 therefore keeps the donor-native cap as a documented visual limitation instead of disguising collision or weakening the object family.

Fix the refund at the return path, not in the damage table

Simply changing HIT TEST Shc would affect every stock user of the borrowed rows. V3 instead interposes at the common hyper-gauge adder $1CD1E and checks the caller that is returning into it. The custom Gold path is suppressed only for the subtype-$04 hit return at $1CCAE and the subtype-$02 guard return at $1CD16; both must also trace back to the marked Gold-owned class-$B4 family. The defender route at $1CC2A is never redirected. Ordinary attacks, native Onslaught and the victim's gauge therefore keep using the stock adder.

flowchart LR
  H["custom B4 hit<br/>return $1CCAE / subtype $04"] --> G{"Gold-owned<br/>private lineage?"}
  B["custom B4 guard<br/>return $1CD16 / subtype $02"] --> G
  G -->|"yes"| Z["skip shooter credit<br/>refund = 0"]
  G -->|"no"| A["stock gauge adder<br/>$1CD1E"]
  D["defender return<br/>$1CC2A"] --> A
  O["every ordinary caller"] --> A

That historical v3 gate was tested three ways because “one level spent” alone was not enough. A whiff ended one level lower; a hit ended one level lower; a guard ended one level lower. The defender received the same gauge as the stock control. This separates activation cost from post-contact reward and makes the rule reusable for any future borrowed boss attack.

First, name the two things correctly

Gold War Machine is not “ordinary War Machine with whatever palette happens to be loaded” at the point where code should be gated. The two share art and much of a dispatcher family, but the engine keeps distinct playable identities:

That one comparison must sit in front of the command recognizer, the new fighter state and every object exception. Testing the gold palette on screen is not enough; the live gate must read fighter id $28. A control run with id $02 must remain byte-for-byte on War Machine's stock routes.

Published move lists call the requested first-form attack Mega Optic Blast. The executable does not contain or display an ASCII MEGA OPTIC BLAST label; it identifies the move numerically as e6=$0A and structurally through its class-$B4 family. Its fire event creates a subtype-$06 root, which grows subtype-$00, $02 and $04 pieces. It is not the e6=$06 lunge/fragment action we first mistook for the donor, and it is not a separate second-form Giant Onslaught sequence. In this post, “Mega Optic Blast” is established guide/community nomenclature tied to the proven numeric route, not a title card added by the patch or a readable string found in the ROM.

flowchart LR
  R["airborne giant-beam request"] --> C{"recipient id"}
  C -->|"$02"| W["ordinary War Machine<br/>negative control"]
  C -->|"$28"| G["Gold War Machine<br/>intended recipient"]
  R --> D{"Onslaught donor"}
  D -->|"first form / e6=$0A"| O["Mega Optic Blast<br/>class $B4"]
  D -->|"e6=$06"| F["lunge / fragment family<br/>rejected donor"]
  D -->|"second form"| X["Giant Onslaught eye pillar<br/>not this patch"]
  G --> J["Gold-only airborne state"]
  O --> J

Follow the boss, not the screenshot

First-form Onslaught's special dispatch cluster begins at $26F78. Action e6=$0A routes to handler $277BE. The event body begins at $2784E, advances the phase, sets hold timer +$4E=$00A0, then tail-jumps from $27858 to $A546E. That allocator creates the native class-$B4, subtype-$06 root. The root is the entry to a linked $00 / $02 / $04 segment family, not a stream of independent class-$68 fragments.

There is one less obvious dependency. Stock class-$B4 expects an Onslaught $22 parent showing animation group $02, sub $2C. That animation is the boss body/charge presentation wrapped around the effect. Gold War Machine is supposed to keep his airborne MP pose, so the mod omits Onslaught's body and charge art—but it cannot omit the contract silently. A custom admission path must be limited to a privately marked Gold-owned root. Gold War Machine himself stays $28 at all times; donor identity is written directly to the beam objects at their native subtype initializer tails.

The useful donor trail is compact:

This is the opposite of a sprite-import problem. The target ROM already contains the art, palette, object allocator, animation schedule and collision behavior. The missing work is permission: admit one privately marked Gold-owned root to the stock class-$B4 family without weakening the same checks for every other object in the match or temporarily changing the fighter's identity.

These two frames remain stock Onslaught donor references. They are not class-$68 candidate captures and they are not the patched fighter proof; the frozen left/right Gold War Machine captures appear below and are tied to the release payload by the evidence ledger.

How one beam object summons the rest

The native beam does not allocate six columns from one fixed “draw this move” table. It is a small object network driven by events and counters:

1. $A546E allocates one class-$B4, subtype-$06 root and links owner +$54 to the fighter.
2. The root's animation event at $A5AE2 calls $A5488.
3. $A5488 reserves two objects and creates the linked subtype-$00 body emitter and subtype-$02 tip; the tip points back to the body through +$58.
4. Subtype $00 initializes its timer to $6000. It emits one subtype-$04 middle/tail piece immediately, then $A5650..$A565C emits another every three eligible updates through $A54D4.
5. Timer underflow, animation completion, off-screen rules, interruption or allocation failure ends the family through the native free paths.

flowchart LR
  P["Gold parent state"] --> R["$B4/$06 root<br/>$A546E"]
  R -->|"animation event"| E["$A5488"]
  E --> B["$B4/$00<br/>body emitter"]
  E --> T["$B4/$02<br/>linked tip"]
  B -->|"immediate, then every 3 updates"| M1["$B4/$04"]
  B --> M2["$B4/$04"]
  B --> MN["... up to 33 attempts"]
  R & B & T & M1 & M2 & MN --> F["native lifetime + free paths"]

The $60 high-byte timer permits 33 subtype-$04 allocation attempts. Including the root, body and tip, the theoretical lifetime is 36 allocations, not 36 simultaneous objects. The accepted fixtures peak at six or seven live $B4 objects because older tail pieces retire while new ones are emitted. This is how the game “knows how many”: an explicit counter and event schedule, not the number of beam sprites and not a global projectile preload.

Every marked damaging descendant is stamped with bank +$47=$04, id +$52=$22, hit-set +$68=$000FD7FC and shape table +$6C=$003A8800. Subtypes $00/$02/$04 begin on property row +$80=$34; subtype $00 periodically rearms row $35, and a $04 child can inherit its emitter's current row. Row $34 at $000F78D2 displays Dmg=$06, Piy=$00, Sto=$08, Snd=$00, Slp=$0F, Shc=$04, Grd=$00, Mut=$0000; row $35 at $000F78F2 displays the same fields except Shc=$05. Their other differences live in bytes HIT TEST does not show, so I do not invent names for them. Snd does not mean sound—it is the standing hit-stun countdown. The subtype-6 event posts projectile cue $0450 separately after the linked pair is created.

The same Hit Test columns apply to the beam

Capcom's developer menu labels the 32-byte property record Dmg Piy Sto Snd Slp Shc Grd Mut. The Magnetic Shockwave construction ledger shows real Roll, Hulk and 10 ROCK MAN captures and the complete byte layout. The operational meaning is the same for Onslaught's row $34:

00 Dachi is a different developer-menu artifact: Capcom's shipped name for internal id $00, apparently a large standing/template scaffold rather than a finished secret fighter. It is not the meaning of Snd, and its animation tree is not this property table. Experiments that replace a Dachi branch and alter an assist are evidence of a reused helper route, but not proof that every assist literally has id zero; each helper still needs its own allocator, owner, donor identity, palette, collision, sound and lifetime.

This also answers why copying beam pictures or Cajun Explosion pictures into another animation can produce art with no damage. Collision belongs to a live object carrying the correct class/subtype, owner, donor identity, hit-set, shape table, property row and active flags. Audio is a separate event. Nothing is missing because it was not loaded at boot; the runtime initializer contract was never created.

One motion, two altitude contracts

Gold War Machine's ground QCF + two punches already belongs to Proton Cannon. That route must stay exactly where it is. The new recognizer exists only in the airborne command chain and runs after the stock air hypers and specials have had first refusal.

The “use air MP” request describes presentation, not a replacement normal. The parent state enters Gold War Machine's stock airborne medium-punch chain—animation group $18, sub $02—and lets its twelve observed records continue through wind-up, discharge and recovery. The normal class-$1C plasma allocation is rejected only when Gold's private super marker is live. The body attack fields are zero during that state, so a chest flash or pose cannot become a second invisible hitbox. With no matching QCF+2P record, plain air MP still creates its normal plasma and follows the stock route.

Why calling the stock spawner is not enough

The native class-$B4 family defends its assumptions. Its root follows +$54 to the parent and expects fighter id $22 plus animation $022C: group $02, sub $2C. Calling $A546E directly from Gold War Machine $28 therefore does not recreate the boss context. Globally removing that check would be worse—it would loosen the contract for every stock $B4 object in the match.

The subtype chain also copies donor-owned graphics and collision identity at several initializer tails. Fixing only the $06 root is insufficient because $00, $02 and $04 descendants can inherit Gold War Machine fields and render the wrong art. The release therefore uses narrow hooks for each native subtype, and every one must distinguish the marked custom lineage from stock Onslaught objects.

V3 keeps the correction object-local and explicit. At each marked $B4 subtype initializer tail, the payload stamps +$47=$04, +$52=$0022, +$68=$000FD7FC and +$6C=$003A8800 directly on that effect object. It never writes $22 into Gold War Machine, not even for one instruction window. The v2 formula was measured from the fighter root rather than the rendered chest plate, which is why real play showed the cap around Gold's side/hip. V3 instead uses two measured body records: sub $06 attaches forward +20, Y −82; sub $00 attaches forward +21, Y −81. “Forward” is evaluated after facing, so the art and collision roots mirror together. Gold's own X/Y remains untouched.

The release design keeps those defenses intact for stock objects and creates a narrow exception:

sequenceDiagram
  participant G as "Gold War Machine $28"
  participant P as "custom parent state"
  participant R as "marked B4 subtype $06 root"
  participant H as "stock class-$B4 handler"
  participant C as "subtypes $00 / $02 / $04"

  G->>P: airborne QCF + 2P
  P->>P: air-MP startup + one hyper commit
  P->>R: call $A546E, owner $28, private marker
  R->>H: request stock update
  H->>R: admit marked Gold provenance without $022C body art
  R->>C: grow the native subtype chain
  H->>C: stamp +47/+52/+68/+6C at subtype init tails
  H->>C: mirror marked art + hitboxes from the measured chest anchor
  C-->>P: final marked object retires
  P->>P: clear A5 provenance and +1CF busy latch
  P->>P: call stock $A4B0 to restore Gold's runtime rows

Gold War Machine remains the real parent and owner for scope and cleanup. The effect roots and descendants receive Onslaught's object-local art identity where the rendering tree expects it. The exception therefore requires the object class, private marker, Gold owner id and owner marker together. Native Onslaught follows the unaltered $022C stock branch; unrelated class-$B4 allocations cannot enter the custom one.

The palette has the same lifetime trap found during the Magnetic Shockwave restoration, but not the same legal solution. Mega Man's frozen patch could lease a writable character source workspace. Gold War Machine's +$2C8 instead points into immutable program ROM. The rejected draft tried to treat that address as writable; CPS-2 ignores those writes, so any apparently correct first frame was really depending on later native class-$B4 palette updates. There was nothing valid to back up or restore at that ROM address.

The 1,214-byte v2 payload therefore leases the writable runtime destinations directly: row +$20 under the primary pointer at +$288, and row +$20 under the secondary pointer at +$28C. It copies the donor's 12-bit colors from $1CBDE4 while preserving the CPS-2 tag nibble required by each destination: the primary row retains its existing high tags, and the secondary row receives the stock $F high tags. The adjacent $1CBE04 row remains part of the native class-$B4 cycling path; it is not misrepresented as a writable Gold source.

A direct runtime repaint would still lose a race with a later common base-palette reload. V3 keeps the scoped interpose at $A4C6, reproduces the displaced $A4B0 copy/busy behavior, and reapplies the optic row only when all of these are true: fighter id $28, state b0=$2A, action e6=$1A, and provenance byte +$1CE=$A5. Fighter byte +$1CF records that the global palette writer was busy; when it clears, the active lease is repainted once instead of advancing through a partially written row.

Cleanup reverses that ordering deliberately. It clears +$1CE provenance and the +$1CF busy latch before calling stock $A4B0. The common reload reconstructs Gold War Machine's current base and alternate runtime rows, while the scoped $A4C6 wrapper sees no $A5 marker and therefore does not repaint Onslaught colors. V3 requalifies those palette-lifetime mechanics in the dense contact and interruption matrix. The same traces rule out the shared-row lifetime as the source of the apparent cutout: the shape persists with correct palette rows because it belongs to the native subtype-$04 display lists.

flowchart TD
  ROM["Gold +$2C8<br/>immutable program ROM"] -. "never written or backed up" .-> Guard["source-immutability gate"]
  Donor["Onslaught RGB12<br/>$1CBDE4"] --> Primary["+$288 + $20<br/>preserve existing high tags"]
  Donor --> Secondary["+$28C + $20<br/>retain stock $F tags"]
  Lease["+$1CE = $A5 provenance<br/>+$1CF = palette-busy latch"] --> Reload["scoped $A4C6 wrapper"]
  Reload --> Scope{"id $28 / b0 $2A<br/>e6 $1A / marker $A5?"}
  Scope -->|"yes"| Primary
  Scope -->|"yes"| Secondary
  Scope -->|"no"| Stock["stock palette result unchanged"]
  Primary --> Beam["marked class-$B4 family"]
  Secondary --> Beam
  Beam --> Retire{"final marked object retired?"}
  Retire -->|"no"| Reload
  Retire -->|"yes"| Clear["clear +$1CE / +$1CF"]
  Clear --> Restore["call stock $A4B0"]
  Restore --> Stock

The “cutout square” is native beam composition

The alarming screenshot is not a corrupt sprite decode, checkerboard palette failure, stage hole or hit spark. The giant pink honeycomb body, white center and layered cyan/purple cap are genuine first-form Onslaught class-$B4 art. A clean stock boss capture produces the same shapes and colors. The difference is context: boss-scale pieces now surround a human-sized airborne fighter, so their overlap reads like a square missing from the beam.

The reusable answer came from tracing the renderer instead of guessing at screenshots. $494A enqueues six-byte (layer word, object long) pairs into $FFE080..$FFE588, with the count at $FFE07E. Consumer $24BD0 walks that queue backward; $24C3A reads the selected object's +$40 sprite-list pointer. On the marked frame, the custom family contributes one subtype-$00 muzzle list at $322A62 and repeated subtype-$04 lists. Active list $322AC4 and its alternate $322D2A both keep the rounded cap. The shape is the combined result of multiple stock pieces, not one bad rectangle that can simply be hidden.

The controlled removals also establish the safety boundary:

That gives future character work a repeatable draw-queue method:

1. capture the exact objectionable frame, not merely the move's action number;
2. record every queue pair, owner, class, subtype and +$40 display-list pointer before the consumer draws it;
3. suppress one marked draw at a time in a research-only ROM and compare the framebuffer;
4. keep collision overlays and damage logs running during every visual suppression; and
5. remove the research interpose before freezing the release.

This distinguishes a background seam from a composite object and prevents a “cleaner” screenshot from silently shipping an invisible hitbox.

There is therefore no safe correction available under the project's constraints. Removing the shape would require a custom same-count display list or new graphics composition, which is a separate art project. This release does not expand the ROM, import another game's sprites or ship an invisible damaging segment. V3 transparently keeps the native donor cap as a known visual limitation. The temporary $24C3A research interpose used to prove the lists is not present in the release payload.

flowchart LR
  S["Early Gold capture<br/>looks corrupt"] --> V{"compare with stock<br/>Onslaught B4"}
  V -->|"same art + palette"| N["native boss art<br/>decode is valid"]
  N --> P["test object-local<br/>origin placement"]
  P --> A["native boss origin<br/>detached"]
  P --> B["v1 +16<br/>still too far away"]
  P --> C["v2 -64 mirrored<br/>hip-origin failure"]
  P --> D["v3 measured<br/>chest attachment"]
  A --> R["reject"]
  B --> R
  C --> R
  D --> F["accept after<br/>visual + hitbox gates"]

The withdrawn captures explain why v3 exists

These are not donor frames or a forced debug state. Each image came from an ordinary-input v2 run, and the right/left reversal proved the family could mirror and clean up. They are retained as superseded engineering evidence. They did not prove a chest attachment, moving body choreography, clean contact art or visually aligned collision.

Each family cleaned up its object ownership, runtime palette lease, $A5 provenance and +$1CF busy latch. That remains valuable lifecycle evidence. V3 preserves it and adds the missing body, chest, meter-return and contact proof in ordinary and true super jumps.

How the address map becomes the patch

The full CPS-2 hex workflow applies here too. The Gold build is a useful second example because the donor and recipient share neither a safe parent identity nor a writable palette source:

1. verify the exact clean archive and construct the logical 68000 view;
2. trace e6=$0A → $277BE → event body $2784E → tail jump $27858 → allocator $A546E;
3. map every $B4/$06/$00/$02/$04 initializer, identity field, palette consumer and free path;
4. add an airborne command record and Gold-only parent state in an all-$FF park at $3F2000;
5. interpose only the eleven exact sites whose stock preimages match, including the full eight-byte common-palette hook at $A4C6;
6. encrypt only the changed opcode words for the canonical encrypted-Euro mvsc parent, then word-swap and split them back into their original members; and
7. accept the result only after real-input normal/super-jump, meter, both-facing, close-range, palette-busy, interruption, pool-failure, native-Onslaught and ordinary-War-Machine controls.

That is what “hex editing a move onto another character” means in a release build. The visible hook bytes are the smallest part. Most of the work is proving which state owns the objects and that every rejection and cleanup route remains stock. The published installer contains the custom payload, preimage assertions and hashes—not Capcom ROM data.

What the v3 harness proves

The v3 verifier drives the ordinary matcher, watches the full object family and deliberately disturbs the lifetime edges that broke earlier candidates. Every lane starts in a fresh emulator process, and every pass is tied to a checksummed evidence file rather than a summary label alone.

One negative test is supposed to fail. The harness removes only the $A4C6 wrapper and triggers a real $A4B0 reload during the beam's first update; the palette mismatch then appears exactly where predicted. Restoring the hook makes the otherwise identical run pass. That controlled failure is evidence that the wrapper fixes the palette lifetime, rather than a release failure hidden by the suite.

The historical v3 answer was yes with at least one level. In current Combined v3, select Gold War Machine, enter an ordinary jump or a true down-up super jump, then perform QCF + any two punch buttons with two levels. He continues through the native air-MP body choreography and fires Onslaught's class-$B4 Mega Optic Blast from the measured chest anchor. Ground QCF+2P remains Proton Cannon; plain air MP and ordinary War Machine stay stock. The apparent contact cutout remains because it is native donor composition and no safe stock-only substitute preserved both presentation and collision.

Public corroboration: the Marvel vs. Capcom mini-FAQ lists first-form Onslaught's QCF+two-punch move as Mega Optic Blast and separates it from the second-form move list. The corrected e6 value, handler, fire event, object-class/subtype lineage, parent-animation prerequisite and palette sources in this construction ledger come from local disassembly and visual validation against the verified arcade program.