Marvel vs. Capcom Promised Mega Man Magnetic Shockwave. I Put It Back in the Arcade Game.

Marvel vs. Capcom ends Mega Man's story with a perfect Mega Man joke. He defeats Onslaught, a Special Weapon capsule falls into frame, the Mega Man 3 fanfare plays, and the screen announces YOU GOT MAGNETIC SHOCKWAVE. Then the arcade machine takes the weapon away.

The PlayStation port keeps the promise. Finish Arcade Mode with Mega Man, hold Select while choosing him, and quarter-circle back plus two punches becomes a hidden fourth Hyper Combo. This project restores that missing route with the arcade game's own Onslaught columns, palette, collision and finish-title renderer. The current revision also fixes the parts that mattered at a real controller: the command can be pianoed, it can cancel from Mega Man's normal chain, and the Wolverine launcher reproduction carries without speculative geometry edits.

Combined v3 is the only current player build

Put the CMD beside your own clean mvsc.zip and run:

& ".\MVSC-MEGAMAN-GWM-COMBINED-v3.cmd" ".\mvsc.zip"

The output is mvsc_megaman_gwm_combined_v3.zip. The installer contains patch code, manifests and checksums only. It includes no ROM, downloads no ROM, preserves the input, and refuses an archive whose case-sensitive ordered 21-member data does not match the canonical parent.

For Fightcade or another online setup, both players need identical case-sensitive, ordered member data and a room/emulator configuration that accepts modified CRCs. The patch stays stock-size and does not expand a ROM member, but that does not imply automatic room acceptance. This is an unofficial community patch; no official Capcom or Fightcade support is claimed.

One Discord announcement for the combined build

This is the single current release message, copied byte-for-byte from DISCORD-POST.md inside the final Discord ZIP. It is 1,648 UTF-8 bytes including its final newline, below Discord's 2,000-character limit.

# Mega Man v5 + Gold War Machine v5 — Combined v3
> One Windows installer for a clean encrypted Euro-parent `mvsc.zip`. No ROM is included or downloaded.
 
## <a id="bug-fixes-and-decisions"></a>Bug fixes and decisions
- Mega v5 adds lenient QCB+PP and an asserted LK-to-HK-to-Shockwave cancel
- Mega v5 preserves original OTG and source geometry; a separate standing-HK gate proves four-wave airborne carry, natural landing, and cleanup
- Gold v5 adds lenient airborne QCF+2P, costs exactly two levels, never refunds meter, and rejects activation during native Variable Cross
- Gold v5 uses owner-scoped no-OTG, 17 contacts for 52 hit damage, and 7 total guard chip
- Gold v5 keeps stock graphics and finishes with the unlit native air-MP fall/landing recovery
- Gold super meter cost: **2 levels**
- Gold duo policy: **reject Gold Mega Optic activation before parser consumption while the native Variable Cross countdown is active**
 
## <a id="inputs"></a>Inputs
- **Mega Man:** Mega Man on the ground: QCB + any two punches; simultaneous or a short one/two-update piano roll
- **Gold War Machine:** Gold War Machine while airborne in a normal or super jump: QCF + any two punches; simultaneous or a one-update held-plus-new piano roll
 
## <a id="install"></a>Install
Put `MVSC-MEGAMAN-GWM-COMBINED-v3.cmd` beside your clean `mvsc.zip`, open PowerShell there, and run:
 
```powershell
& ".\MVSC-MEGAMAN-GWM-COMBINED-v3.cmd" ".\mvsc.zip"
```
 
- Output: `mvsc_megaman_gwm_combined_v3.zip`
- Clean-parent only; older patched/combined/stacked sets are rejected.
- Both Fightcade peers need byte-identical patched member data.
- Public Fightcade rooms may reject the modified CRCs.
- No official Fightcade support is claimed.

What Combined v3 fixes

Magnetic Shockwave input is now made for human hands

The old terminal matcher effectively wanted both punch edges in one parser update. That works in a deterministic harness and can feel inconsistent on a controller. The v5 adapter keeps the native QCB direction history, but at terminal stage $08 it accepts any two punches currently held when at least one punch has a real new press edge. The edge expression is:

current(+$D6) & ~previous(+$D8) & $0070 != 0

Simultaneous LP+MP still works. LP+MP, LP+HP and MP+HP rolls spanning one or two recognizer updates work in both facings. A single punch, a stale held pair, a release-only transition, QCF ownership and an overlong separated pair still reject. Reducing PPP to PP does not count as a press.

LK to HK can actually cancel into Magnetic Shockwave

The missing state was fighter +$B0=$28, Mega Man's normal attack/normal-chain class. The v4 private gate erased Magnetic parser progress in that class even though stock Hyper Mega Man continues tracking its own command there. V5 adds exactly that stock-compatible class; it does not open hitstun, blockstun, knockdown, tag, landing or airborne states.

Fresh real-input controls prove LK → HK → Magnetic on hit, block and true whiff. This intentionally matches Hyper Mega Man's whiff-cancel behavior rather than inventing a hit-only rule. The accepted move still latches fighter +$E6=$1C, enters the custom action, and pays exactly one level at the normal commit point. The accepted state pair is +$B0=$2A / +$E6=$1C.

The reported Wolverine carry failure was the cancel failure

Mega Man's real launcher is standing HK. Crouching HP is a horizontal buster and is not a valid launcher oracle. In the exact standing-HK reproduction:

The four wave contacts deal 14, 13, 12, 8 in that lane at x positions 250, 302, 485 and 681, a 431-pixel carry span. The marked lineage cleans up at age 190; Wolverine lands naturally at age 195, x=747. Every late hit is the same stock class-$24 row $0F7872.

No damage-row, rehit, reaction or geometry byte was changed. A source-style spacing experiment overhit, and changing $0F7872+$0F from $16 to $02 was a measured no-op. The production decision is therefore to preserve the proven geometry.

Magnetic Shockwave keeps its original OTG behavior

Source-move knowledge settled the policy: Magnetic Shockwave has always been OTG, so the restoration preserves that behavior. A true-prone diagnostic aligned one marked class-$24 child and recorded the native HP write at $01B74E, row $0F7872, victim state +$B0=$1E, step $0004, HP 122→108. The alignment was diagnostic only. Its temporary geometry and the rejected no-OTG wrapper are not in the frozen source or payload.

This is deliberately different from Gold War Machine's custom boss beam. Gold's beam has an owner-scoped no-OTG policy; Mega Man's Magnetic Shockwave retains source parity.

Gold's combined-side balance and recovery are also fixed

Combined v3 includes the frozen Gold v5 component: airborne QCF+2P with a short one-update punch roll, a two-level requirement and debit, rejection before parser consumption during Duo Team Attack, 17 contacts for 52 hit damage, 13 guarded contacts for 7 total chip, Gold-only no-OTG, and stock unlit air-MP recovery followed by normal gravity and landing. The Gold War Machine article contains its exact 13-hook plan and private damage rows.

Compact release evidence

No picture is asked to stand in for the evidence. Each current claim is tied to a bounded case set, a machine-readable ledger or component record, and an immutable payload identity. The one-pass Combined release completed all three tiers and is frozen under the identities below.

The Mega component identities are fixed: source cae1075df20f2f6f538d798a9f9c579901d8745d3144dd9e9282da6e739d4a42, 1,206-byte payload 74a7cce1b3dc00c9421b7bf7745b60f3610597d775bb75ebf937b26cf31d4d33, and resource 1a28666bc7f4468b7caf8b8b75db490426e2494135ced85884c177758ef7375b.

N41 replication ledger: RAM, hooks and exact bytes

This section answers the two practical questions directly: where command tracking lives while the move is being entered, and which permanent program bytes change. The RAM record is temporary parser progress. It is not a permanent list of command moves a player has used.

Live fighter RAM

The useful rolled-input trace is exact: P1 $FF31C9 changes $0E→$0D at PC $3F142A, then $0D→$0C→$0B at $3F1454. At the second punch edge, D6=$0031, D8=$0011; the move latches on that age with fighter +$B0=$2A and +$E6=$1C. A PPP-release negative reaches D6=$0031, D8=$0071, so the adapter correctly sees no newly pressed punch.

Fixed Mega payload symbols

The payload is linked at CPU $3F1000 and stored in mvc.10 at member offset +$071000. For a raw mvc.10, subtract $380000 from the CPU address and swap each byte pair. The assembler checks the fixed public symbols before regenerating the resource.

Mega external hooks: exact clean-parent before and component after

The Plain CPU column is what the 68000 fetches after word order is normalized. The Encrypted member column is what HxD sees in the canonical mvce.03a/.04a member. In final Combined v3, the five non-meter component hooks stay the same. $01CD1E points to the shared Combined dispatcher, not directly to either component wrapper.

Final Combined v3 replaces only the last component target with the shared target:

CPU plaintext:   4A2E00E86700000C -> 4EF9003F30004E71
encrypted HxD:   B7E6BA813793ED6B -> 59A8A5A973B6C4AF
shared payload:  $3F3000 in mvc.10 +$073000, 20 bytes
dispatch targets: class $B4 -> Gold $3F2560; otherwise -> Mega $3F138A

Complete Mega v4-to-v5 payload delta

These are the four and only four coalesced payload regions: 288 differing bytes total. They are copied from the frozen byte-diff evidence in 68000 CPU byte order. External hook addresses did not move.

$3F1024..$3F1053 — 48 bytes

v4  672a7000102e0002012dc038660c0c2e00010274640470004e751d7c0004004d1d7c001c00e64ef9000617f070004e75
v5  4efa04580000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

$3F12EC..$3F1317 — 44 bytes

v4  4eb9000197104e75000000000000000000000000000000000000000000000000000000000000000000000000
v5  6000010a00000000102e00b00c00002867125500630e5100670a5900620a4a6e0008660470014e7570004e75

$3F1366..$3F1381 — 28 bytes

v4  102e00b0550063105100670c5900620c4e714a6e000866046000fc96
v5  6100ff8c4a0067146000fca600000000000000000000000000000000

$3F13F8..$3F14B5 — 190 bytes

v4  ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
v5  0c13000867304eb90001971066700c130008666e0c2b000e00016666302e00d602400070675c32005341c2406654532b000170024e75302e00d602400070673632005341c24066180c2b000d000167080c2b000c0001661e532b000170024e75322e00d84641c240670c700026803740000470014e754eb900019710670470014e7570004e750c000002672e4a0067147000102e0002012dc038660c0c2e00010274640470004e751d7c0004004d1d7c001c00e64ef9000617f070024e75

The first block jumps to the moved result gate. $3F12EC now branches to the terminal adapter and the helper at $3F12F4 admits exactly B0=$28. $3F135C calls that helper while padding preserves the fixed $3F138A meter wrapper. $3F13F8..$3F14B5 holds the result normalizer, bounded punch-edge adapter and moved meter/state gate. It reads only +$D6, +$D8 and the existing +$1C8..+$1CD record; it allocates no new fighter RAM.

Native finish-title data

The move's final-team title remains Capcom's stock class-$C0 renderer. Token $5A points at the blank 64-byte record at CPU $0C3C90; the logical record bytes are:

6cee6cee6cee6cee6aec6b2e6ae46b406b086ae86b206b026b286cee6cee6cee6cee6cee6cee6cee6ae86b046b2a6aec6b0e6b006ae46b0c6cee6cee6cee6cee

The 64 decoded bytes hash to f1088827140a3b3fc63e5da69b2ff63d5ea65ac3a5e57f7ce148397498808c1f. The aligned row edit at $0F7872+$18 is logical 0000→005A; row +$04 remains stock $90, because its bits also feed damage/gauge behavior. The wrapper at $01240C admits the exact Magnetic row only after final-team phase $0A00. A partner KO remains phase $0800 and produces no title.

MAME, HxD, SwapEndian and XCopy are different layers

For a reusable permanent edit, record all four coordinates: CPU address, member name, member offset, and exact clean-parent preimage. Assemble and assert symbols; convert payload/data word order; derive encrypted executable hooks from their CPU word addresses; refuse preimage drift; build a new ZIP; then decrypt the final program back and prove the intended CPU instructions. Never translate a MAME $FFxxxx RAM observation into an HxD offset.

Harness architecture that made this faster and safer

The release runner now has three explicit tiers:

Each case runs in its own emulator process with a hard wall timeout. A cached PASS is reused only when its fingerprint still binds the ordered semantic ZIP-member identity, build receipt, actual post-sign artifact, emulator, manifest, runner, Lua compiler, harness and every declared dofile dependency, command, allowed environment, timeout, completion marker and complete artifact inventory. A bare DONE file is never enough. Case ROMs are private/read-only, source and declared dependencies are rehashed after the run, and the whole process group is terminated on timeout.

The harnesses write only deterministic fixture state—team selection, positions, life and meter. They do not write an accepted move, +$B0 or +$E6. Real joypad input must advance the parser. For carry work, the log records launcher contact, latch, debit, camera, root/child ancestry, active hit row, every HP-write PC, victim position/velocity/state and final cleanup. Pinning target geometry every frame was rejected because it changes the question and made an old Magneto “two-hit” oracle look more authoritative than the natural run.

The reusable release sequence is:

1. verify the exact ordered 21-member clean parent
2. assemble both payloads and assert fixed symbols
3. freeze source/resource/hook/evidence identities
4. compose both components once; give $01CD1E one shared owner
5. decrypt-back and re-encrypt changed executable words
6. run smoke, then delta, then release in isolated processes
7. exercise the real Windows CMD against the clean parent
8. inventory the ROM-free Discord transport
9. seal the compact binder and publish its final identities

Historical engineering appendix

Everything below explains how the restoration was discovered. It is not an alternate player download path. The old unversioned, v1 and v2 installers are revoked. Standalone v3/v4 and Combined v1/v2 names describe historical freezes only; they are intentionally not linked here and must not be stacked into Combined v3.

The PSX port proves the move is additive

The US disc boots SLUS-01059. Mega Man's battle overlay is PL10_10.A0; SHA-256 45db4e1ac9c78e2f32a67346d0564140b8a81184a0e9d5b8385e7b3895d9f675. The ending is in the separate END10.ARC. That split proves an ending image is not a playable battle animation.

The recognizer is raw overlay offset +$0BEC, link-time $800C1BCC, and captured live relocation $801628D0 for the observed P2 load. At live $801628E0 it reads owner byte +$3BE. If enabled, it builds command definition $80177F34, calls the shared matcher at $801628F8 with history owner+$1E8, checks one level at $80162908, sets action $1C at $80162918, and dispatches to handler $801668DC. Neighboring Mega Man recognizers remain in place: Magnetic is a fourth route, not a replacement character.

No MIPS code or PSX sprite is copied into CPS-2. The PSX executable is behavioral evidence. The arcade target supplies its own 68000 routing, objects and art.

The arcade already owns the expensive effect

First-form Onslaught's orange columns are native class-$24 roots and children using row $0F7872. The restoration reuses that family instead of importing ending frames. The hard part was not drawing a column; it was making ownership, palette lifetime, meter accounting, cleanup and the finish title belong to Mega Man without changing native Onslaught.

The palette lease uses fighter +$1CE/+$1CF, immediately after the six-byte command record. A marked child keeps the lease alive; the final marked child restores the owner. This prevents the column from inheriting Mega Man's colors during hit flash or a common palette reload. Those bytes are effect provenance and must never be described as command-history storage.

Why the custom KO overlay was removed

The early v2 experiment created a private bitmap title and hooked the lethal damage write. It could fire when the active opponent died even though a partner remained. The replacement registers MAGNETIC / SHOCKWAVE in the stock class-$C0 title system and gates it on final-team phase. This keeps Capcom's glyphs, layout and actual team-finish rule.

Why one-level cost needs a post-hit filter

The stock Onslaught columns award meter to their attacker on contact. Spending one level at startup was not enough: the custom super could refill itself on hit or guard. The component wrapper at $3F138A recognizes only marked Magnetic lineage owned by the same Mega Man and suppresses only the attacker return sites. Defender gauge and native Onslaught take the displaced stock path. Combined v3's $3F3000 dispatcher chooses that wrapper for non-$B4 objects and Gold's wrapper for $B4.

What was measured, and what remains a qualification

The current evidence proves the ordinary launcher-to-Shockwave Wolverine lane, all intended input pairs/facings and negatives, hit/block/whiff cancels, one-level debit, original OTG parity and full marked cleanup. A future carry change still requires a natural trace where a later visible marked root reaches a genuinely airborne and hittable victim but produces no $0F7872 HP write. “Falls out after two or three hits” alone is not enough to justify geometry or a blind hit cap.

The restoration remains stock-size, uses no custom graphics or QSound writes, and keeps the arcade ending, PSX battle overlay and CPS-2 Onslaught donor correctly separated: story promise, behavior reference, and target-native implementation.

Archived deep research record

The following original research sections are retained intact for provenance and reuse. Their v2/v3/v4 release-language is historical context only. They contain no current player download path and do not override the Combined v3 contract, component hashes, corrected input/carry/OTG decisions or frozen identities above.

Why the v2 KO title was removed

V2 did not discover a dormant arcade move-name card. It authored a private 224×64 class-$24 object and a small custom 5×7 alphabet, then hooked the lethal damage write. The hook checks the active opponent's life but not the surviving partner or the engine's final-team result phase. That is why the title can appear after the first character dies—and why its typography does not match Capcom's native Hyper Combo finish presentation.

V3 removes the fifth damage hook, the custom title object, its marker, its graphics-seat writes and the banner-art generator. Then it follows the native result path instead. The stock game records the lethal hit row, advances global fight phase from $0800 to $0A00 only when the opposing team is actually finished, and later creates a common class-$C0 title object. That object composes two lines from MvC's existing large gold-and-blue glyph tiles. The new name is a 64-byte record in a stock blank/unreferenced title slot, not imported graphics and not a second text renderer.

V3 also treats Hyper Mega Man as the action-law reference, not merely a meter reference. Magnetic Shockwave must be rejected while Mega Man is in hitstun, blockstun, knockdown, tag transition or an already-committed attack; it must remain vulnerable and interruptible through the same legal startup window; and it must commit its one meter level exactly once. The broader parity pass found another v2 defect that a minimum-meter assertion had hidden: the move spent one level and then its borrowed column hits refilled Mega Man's gauge, while stock Hyper Mega Man remained one level down. V3 therefore requires zero shooter refund on hit, block and whiff while preserving the defender's stock gauge behavior. A new command is additive only when it obeys the fighter's existing right to act and its actual resource cost remains paid.

▶ Play

How v3 replaces the killing-hit overlay with the arcade's native title

The PSX port names the move during its own Hyper Combo presentation. V2 tried to echo that beat inside the arcade game, but it did so through a private object and custom bitmap lettering. Its lethal-hit hook checked the active victim, not the whole opposing team, so the card could appear after the first partner fell. That was the wrong finish condition and the wrong presentation path.

The v3 build removes that fifth $1B74A hook, the private class-$24 title object, its marker, the 64 custom tiles at $F8D0, and the title-art generator. A controlled stock Hyper Mega Man comparison supplied the correct oracle: when the active opponent dies with a reserve alive, global phase stays $0800 and the partner enters. When the last opposing fighter dies, phase advances to $0A00; roughly 40 frames later Capcom creates its native finish-title object.

The reusable path is now mapped. $123F4..$12426 consumes the recorded hit-property row and passes its title token to $C2176; the common class-$C0 handler at $C2300..$C2442 assembles and queues two lines of stock glyphs. Token $5A was unused by the stock title maps, and its 64-byte record at $C3C90 was a blank, unreferenced slot. V3 writes MAGNETIC / SHOCKWAVE there and changes only Magnetic row $F7872 +$19 to token $5A. A narrow wrapper at $1240C recognizes that exact row only after phase $0A00 and enters the stock show path. All other rows reconstruct Capcom's original bit test and continue unchanged.

That last detail prevented a subtle combat regression. An earlier experiment enabled the row's stock title bit directly; the title appeared, but the same shared bit also changed defender gauge and hit/block damage. The experiment was rejected. The consumer wrapper leaves row +$04=$90 byte-exact, so the final title is native without altering the attack. Partner KO is a measured negative, final-team KO is a measured one-title positive, and stock Hyper Mega Man/Shinkuu title controls remain intact.

These are lossless 384×224 captures from the same frozen P1-left fixture. Their SHA-256 values are 7e023b488aa7584ad79fee9636d1a7053865217494081f0df42c1fe48f21dc0c for the partner-KO negative and 9ecac5277351f2ccbc09162c4b996e9fd1540b8b3b23cd421a36ccc0af35fbb7 for the final-team title. A live DHC finish and a true simultaneous double KO were not captured, so this release does not label either scenario as a measured pass. The exact-row plus final-phase gate covers the ordinary nonfinal false-positive path; that is a code guarantee, not a substitute for those two missing live captures.

Why v3 cannot steal a turn—or pay itself back

The v2 recognizer was late enough to preserve Mega Man's stock hypers, but “late” was not the same as “legal.” If its temporary QCB parser progress survived while Mega Man was already attacking or being hit, the fallback could still promote that buffered command into action $1C. That made the new weapon look as if it could cancel states that Hyper Mega Man cannot.

V3 gates the recognizer on the fighter's actual state before it asks whether QCB+PP matched. Live Y at +$10 must equal the engine's floor coordinate at +$2C4. The fighter state at +$B0 must be neutral $00, controllable crouch $0A, or the exact one-frame $0C/step-zero PP transition also observed immediately before stock Hyper Mega Man latches. Airborne movement, an established attack, hitstun, blockstun, knockdown, tag, landing and every other non-controllable state are rejected. On rejection, v3 clears only its temporary six-byte parser-progress record at +$1C8; that prevents a QCB+PP buffered in the air or during a forbidden state from firing on the first legal landing frame.

Passing the recognizer still does not spend meter immediately. Magnetic follows Mega Man's stock Hyper timing: after 16 startup updates, stock commit routine $148FE performs the freeze and the single one-level debit. The fighter remains vulnerable through the measured pre-commit startup, so an opponent can interrupt it instead of watching Mega Man become an untouchable scripted object.

The second defect lived after the debit. Onslaught's stock columns naturally award meter to their attacker on contact, so v2 could fall from three levels to two and then creep upward on its own hit or block. V3 wraps the common meter adder at $1CD1E without editing the damage row. The stack return address distinguishes defender award $1CC2A, attacker-on-hit $1CCAE, and attacker-on-block $1CD16. Only the two attacker sites are candidates, and suppression occurs only when the live object is a marked Magnetic root/child, uses exact row $F7872, and resolves to the same Mega Man owner. Defender gauge, native Onslaught, and every other attack run the displaced stock path.

That is why the final result stays 3→2 on hit, block and whiff while the defender's stock gauge and damage behavior remain byte-exact. “Costs one level” now describes the complete move, not only the instant when the super flash happens.

One reward, three different realities

The ending, the PSX battle move and the arcade patch look related because they tell the same story. Internally they are three different artifacts.

That distinction saved this project from becoming a sprite-import job it did not need to be. The Cable port, 3rd Strike work, and Magneto construction ledger all required us to reason about new art, animation capacity and expanded address space. Here, the target game already owns the expensive part: a complete battle-tested column effect. The missing part is routing.

timeline
  title From ending reward to arcade command
  1998 : Arcade Mega Man defeats Onslaught
       : Ending says "You Got Magnetic Shockwave"
       : No player command is installed
  1999 : PlayStation port adds a hidden Mega Man modifier
       : QCB + two punches enters a fourth hyper state
  2026 : PSX overlay is disassembled as behavioral evidence
       : Arcade Onslaught objects and palette are traced
       : Mega Man receives an additive CPS-2 command and state

Read the PSX port as a design document

The US disc boots SLUS-01059. Mega Man's battle overlay is PL10_10.A0; its SHA-256 is 45db4e1ac9c78e2f32a67346d0564140b8a81184a0e9d5b8385e7b3895d9f675. The ending lives in the separate END10.ARC archive. In plain language, the PS1 disc keeps Mega Man's ending movie bundle and his in-match program in different files. END10.ARC supplies the Get Weapon presentation—the pose, columns and promise—while PL10_10.A0 supplies the code that can recognize an input and enter a battle state.

That separation matters because an ending image is not automatically a playable animation. A move used in a fight also needs command recognition, meter handling, timing, collision, object creation and cleanup. Finding the hidden recognizer in the normal battle overlay proves Capcom implemented that second system too; the PS1 game is not somehow loading the ending archive into the middle of a match. For the arcade port, END10.ARC is therefore a visual reference and PL10_10.A0 is behavioral evidence—not a source of CPS-2-ready code or sprites.

The recognizer is raw overlay file offset +$0BEC, link-time address $800C1BCC, and captured live relocation $801628D0 after the A0 loader relocates it. The live capture had Mega Man in the P2 slot; the address is evidence of that loaded overlay, not a universal P1 address. Those address spaces must not be mixed. At live $801628E0 it reads Mega Man object byte +$3BE. If the byte is zero, the function returns and ordinary Mega Man continues untouched. If it is nonzero, the live chain is:

• build unique command-definition pointer $80177F34 (link form $800DB234);
• call shared matcher $800566D0 at $801628F8, with history a2=owner+$1E8;
• call meter gate $8003D150 at $80162908, with a1=1;
• call state setter $80162308 at $80162918, with a1=$1C; and
• dispatch state $1C to live handler $801668DC.

The neighboring recognizers are still there. None is replaced, redirected or skipped. That is the binary answer to the most important design question: Magnetic Shockwave is additive on PSX. Here, additive means “one more command and action on ordinary Mega Man.” It does not mean damage is added to another hyper, and it does not mean the Select code loads a replacement Mega Man. The modifier byte simply opens an extra recognizer with its own history storage and action $1C; Hyper Mega Man, Rush Drill and Beat Plane retain their existing recognizers and states. The arcade version should add it with the same preserve-the-old-routes rule.

; behavior-level transcription of live recognizer $801628D0
if object[$3BE] == 0: return false
if !match(command[$80177F34], history[$1E8]): return false
if !has_meter(1): return false
enter_action($1C)
return true

The first 24 live bytes of $80177F34, read as little-endian halfwords, are:

0003 9000 001C 0001 0004 0005 0001 0070 0004 FFFC 0004 FFFC

That table independently exposes private command id $001C and two-punch mask $0070. The public move guide supplies the QCB player interpretation; fully naming every packed matcher halfword would require a complete decode of the shared input grammar, so I do not invent one here. Bytes after those 24 include relocated pointers and are not printed as if they were more command words.

Public move documentation supplies the player-facing half of that code path: clear Arcade Mode as Mega Man, hold Select while choosing him, then use QCB + two punches. The disassembly independently proves the mode byte, separate matcher storage and one-stock action. I did not assign an exact memory-card unlock bit: the runtime modifier propagation is proven, but the individual save-data bit and the exact Select-latch instruction are not yet isolated. That uncertainty does not cross the implementation boundary because the requested arcade behavior is enabled by default.

What the PSX handler actually does

The hidden action is more specific than “spawn a beam.” Live handler $801668DC (raw overlay +$4BF8, link $800C5BD8) installs script $80177B0C, sets phase timer +$48=$003C (60 handler updates), selects animation/action $44, requests owner sound/event $0450, requests generic effect $2E phase $08, and calls owned setup $8016DE9C(owner, 0). When owner event byte +$39 becomes nonzero, the handler clears it and makes four calls in the same update to live child constructor $8016D980, with selectors 6, 8, 18, and 20 ($06/$08/$12/$14). Timer expiry requests effect $2E phase $0A and reinstalls the script for recovery.

$8016DE9C is not a hidden fifth column. It allocates a separate owner-bound type-$D4 presentation/setup lineage used during the hyper flash; the live capture shows it gone before the damaging columns become active. It never calls the type-$D0 column constructor.

These are the exact static/link call sites in PL10_10.A0; the loader patches them to the live constructor above:

800C5CB4  jal  $800D0C80    ; a1 = $06
800C5CBC  jal  $800D0C80    ; a1 = $08
800C5CC8  jal  $800D0C80    ; a1 = $12
800C5CD4  jal  $800D0C80    ; a1 = $14

The constructor is now mapped far enough to remove the earlier inference. It allocates through $8004A250, stores dispatcher/type $D0 at child +$5C, selector at +$2C, owner pointer at +$50, and copies owner byte +$FC into child +$CD as an owner-state cookie. The child frees when the current owner +$FC no longer matches that copied byte. Selector/2 indexes 16-byte records at $8017E8F4:

So the PS1 handler creates four owner-tied type-$D0 column roots simultaneously, with a recorded 32-pixel gap between the inner origins. Each root later calls $8016F618 once from $8016DD04 to create one type-$E0 visual helper; helpers do not create more $D0 roots. The four roots then diverge through selector-specific timed motion/frame streams at $8017E9E4/$8017EA04/$8017EAA4/$8017EAC4. The owner did not call the four roots on consecutive frames, and there is no second generation of column roots. This exact topology is evidence, not code copied into the arcade build.

Where the PS1 columns get collision and sound

The root's effect descriptor family begins at $80170B44; its 16 visual variants resolve records $801736AC..$8017379C. Each record selects property index $48 at $8017A1A8, whose raw halfwords are 006B 0000 006C 0000 0000 0000 0000 0000. In the live object that means box $6B is installed at +$88 and attacking box $6C at +$8C; the collision engine at $80048E90/$80041710 compares the attacker's +$8C..+$92 against the defender's vulnerability box. Under owner-copied box base $8017AD58, raw box $6B at $8017B0B0 is (0,13,0,10) and attack box $6C at $8017B0B8 is (0,18,0,14). Root action/attack id is $43, and attack-data row $8017AB98 contains the complete 32-byte property record; I do not assign arcade field names to its bytes because the PS1 schema is a different engine.

Audio is separate from all of that geometry. The Mega Man owner posts event $0450 through $80086370; the four roots do not need a HIT TEST-style Snd byte to make that sound. This is why loading a sprite, loading a hitbox and posting audio must be treated as three distinct operations.

stateDiagram-v2
  state "Grounded Mega Man" as Neutral
  state "Magnetic recognizer" as Match
  state "Action $1C startup" as Startup
  state "Animation event" as Event
  state "60-update active / recovery" as Active
  state "Ordinary command chain" as Stock

  [*] --> Neutral
  Neutral --> Stock: existing inputs
  Neutral --> Match: QCB + PP candidate
  Match --> Neutral: no modifier or no meter
  Match --> Startup: modifier set + one level
  Startup --> Event: script raises object +$39
  Event --> Active: same-update selectors 6, 8, 18, 20
  Active --> Neutral: timer expires + cleanup
  Stock --> Neutral

Find the move that is already hiding in the arcade

The CPS-2 lineage has two Magnetic Shockwave relatives worth comparing: X-Men vs. Street Fighter Magneto's violet columns are the recognizable signature, while Marvel vs. Capcom Onslaught's are orange, emerge directly from the ground and match the reward shown in Mega Man's ending. Mega Man needs the MvC Onslaught branch.

Tracing the arcade boss reaches the alternate Onslaught spawner at $271EE and its palette setup at $272DE. One call creates three class-$24 roots at facing-mirrored X offsets $30/$90/$F0 with delays 0/$0A/$14. The routine stamps those roots with graphics bank $04 and fighter id $22, so their descendants resolve Onslaught's existing orange art rather than indexing Mega Man's graphics tree. The root handler at $96044 grows the vertical segments.

The collision contract becomes hybrid through stock data flow, not through a special “use Mega Man's boxes” rule. At $2728E/$27294, the spawner first copies two fields from its caller because Mega Man is still the invoking object: +$68 is the hit-set directory pointer and +$6C is the base of the rectangle-shape table. They initially arrive as Mega Man's pair.

The spawner then forces id $22. When the class-$24 initializer calls native animation composer $135E6, that routine looks up the new id and rewrites only +$68, producing Onslaught hit-set $000FD7FC. It has no corresponding write to +$6C, so the already-copied Mega Man shape base $003A8000 remains in the root. Each child copies the resolved pair from its parent. Forced id $22 plus row +$80=$31 separately resolves Onslaught property record $000F7872.

So the careful answer to “why does it need Mega Man's $3A8000?” is: need has not been proven; it survives because the native routines never replace that field. The frozen build preserves the stock result and its live tests prove that the hybrid damages correctly in both facings. Forcing Onslaught's $3A8800 shape base would be a separate collision experiment requiring its own A/B hitbox and gameplay gate; the current evidence does not establish that rewrite as necessary or better. “Use Onslaught's move” still does not mean every pointer automatically becomes Onslaught's.

That gives the target build a much smaller architecture than a cross-game sprite transplant:

architecture-beta
  group evidence(cloud)["Behavioral evidence"]
  service ending(disk)["Arcade ending"] in evidence
  service psx(database)["PSX Mega Man overlay"] in evidence

  group cps2(server)["Stock CPS-2 ROM"]
  service input(internet)["Late QCB+PP recognizer"] in cps2
  service state(server)["Mega Man action $1C"] in cps2
  service boss(server)["Onslaught spawner"] in cps2
  service art(disk)["Orange arcade art + palette"] in cps2

  ending:R --> L:state
  psx:R --> L:input
  input:R --> L:state
  state:R --> L:boss
  boss:R --> L:art

Lineage FAQ: which game owns what?

Does the arcade ROM already contain Magnetic Shockwave?

Yes for Onslaught; no for playable Mega Man. The arcade has the complete target-native effect system: parent spawner $271EE, palette setup $272DE, class-$24 roots, vertical child handler $96044, attack behavior and cleanup. That is real battle logic, not ending-only scenery.

What stock arcade Mega Man lacks is the route into it. His grounded command chain has no QCB + PP entry for this move, and his special dispatcher has no Magnetic action case. The ending demonstrates the reward, but it does not connect the player object to Onslaught's battle handler. The patch adds that missing recognizer and dispatcher route; it does not reconstruct the columns from scratch.

Did the PlayStation port donate executable code or sprites?

No. It donated behavior and state evidence. The PSX move is MIPS code inside a packed A0 battle overlay. The arcade target is 68000 code driving CPS-2 objects, tile banks and palette RAM. Those are different instruction sets, link models, object layouts and graphics pipelines. PL10_10.A0 proves that Capcom treated Magnetic Shockwave as a separate, additive one-level action. END10.ARC and the PSX battle visuals show the intended presentation. Neither file is copied into the CPS-2 build.

The implementation translates the state contract—grounded QCB + PP, one stock, dedicated action, startup event, active effect and recovery—then expresses it through the arcade's own matcher, Mega Man state conventions and Onslaught children.

Is MvC Onslaught's effect descended from X-Men vs. Street Fighter Magneto?

The code structure provides strong evidence of an adapted lineage:

MvC preserves the three-root class, order and exact delay cadence, widens the footprint, and retargets identity and color for Onslaught. That combination is much stronger than a visual resemblance. It is also narrower than a claim of literal copying.

flowchart LR
  subgraph X["XvSF Magneto"]
    X0["class $24<br/>delay 0 / x 28"]
    X1["class $24<br/>delay 10 / x 92"]
    X2["class $24<br/>delay 20 / x 156"]
    XP["palette $11891C"]
  end

  X0 & X1 & X2 --> L["strong adapted lineage<br/>same topology + cadence"]

  subgraph M["MvC Onslaught"]
    M0["class $24<br/>delay 0 / x 48"]
    M1["class $24<br/>delay 10 / x 144"]
    M2["class $24<br/>delay 20 / x 240"]
    MP["bank $04 / id $22<br/>orange $1CBC44"]
  end

  L --> M0 & M1 & M2
  M0 & M1 & M2 --> P["Mega Man patch calls<br/>the native MvC path"]

Read Capcom's Hit Test grid without guessing

The secret developer menu has two tools whose names invite people to merge them into one. They are not the same tool. HIT TEST is a read-only browser for a character's 32-byte attack-property records. HIT EDITER is the animation and rectangle viewer/editor. The screenshot that started this question is HIT TEST. Its literal shipped label is 08 RORIROROOL, but it is Roll, not Wolverine. The identity comes from the selector, not from trying to normalize that odd glyph run: debug index $08 maps to even fighter id $10, and id $10 is Roll. Wolverine is id $08, which belongs at debug index $04; the same raw table independently contains the separate entry 04 WOLVERINE. RORIROROOL is therefore a real Capcom debug-label quirk, not damaged text, and the binary evidence does not justify inventing a cleaner expansion for it.

I captured the same screen from the real FBNeo framebuffer for Hulk and Mega Man. Capcom calls Mega Man ROCK MAN here. The hexadecimal number at left is the roster index; the normal even fighter id is that index times two, so 03 HULK is id $06 and 10 ROCK MAN is id $20.

The renderer at $0D976E reads the per-character pointer directory at $0E68AE. Every displayed row is one $20-byte record; the two-digit number at left is that table's own property-row id. It is not an animation group, sprite frame, command id or move name. HIT TEST does not say which row belongs to “Magnetic Shockwave,” and this patch does not rewrite Mega Man's property table. The new move's damaging objects keep Onslaught's id and therefore consume Onslaught's rows.

That Mut correction matters. On hit, $1B810 masks its low six bits into victim timer +$106 and clears gate +$83. While the timer is nonzero, the collision path remains open. When it expires, the engine restores $83=$80; $0D7402 sees the negative byte and rejects another hit. So Mut lets a continuing beam or repeated object hit again for up to 63 ticks. High bits beyond the nonzero test are not yet given a meaning here. Calling the field “muteki” or post-hit invulnerability reverses the proven gate polarity.

packet-beta
  0-7: "Dmg +$00"
  8-47: "not displayed +$01..+$05"
  48-55: "Piy +$06"
  56-63: "Sto +$07"
  64-71: "Snd +$08"
  72-79: "Slp +$09"
  80-127: "not displayed +$0A..+$0F"
  128-135: "Shc +$10"
  136-191: "not displayed +$11..+$17"
  192-199: "Grd +$18"
  200-207: "not displayed +$19"
  208-223: "Mut +$1A.W"
  224-255: "not displayed +$1C..+$1F"

The colors are renderer emphasis, not extra properties. Its comparison points are Dmg=$0F, Piy=$04, Sto=$0E, Snd=$18, Slp=$0A, and nonzero Shc/Grd/Mut; they help a developer spot unusual values but do not create another flag. The values remain hexadecimal bytes, except Mut, which is a four-digit big-endian word. To reproduce the screen, enter secret-menu item B. HIT TEST; hold P1 B1 and tap Left/Right to change character, then use Up/Down to scroll rows. In the separate 1. HIT EDITER, hold P1 B6/Strong Kick and tap Up/Down to change character; Start cycles Character Select Mode to Hit Edit Mode and then exits.

What 00 DACHI really is

00 Dachi is Capcom's literal shipped name at $0DBE72 for debug roster index and internal id $00; it is not a finished secret fighter. Interpreting dachi/tachi as Japanese fighting-game “standing” terminology is plausible, but the binary supplies neither kanji nor an English gloss. What the binary does prove is a substantial development/template slot: animation tree $164B66 contains 23 top groups, 165 chains and 815 records, alongside its own hit, property, shape and palette directories.

That structure makes the reported assist experiments credible: replacing a branch in a shared template can make another fighter's animation appear in a helper call, and breaking a reused contract can stop helpers. It does not prove that every assist literally is Dachi. The special-partner ids are separate, and live helpers are effect objects carrying donor identity, graphics bank, palette and owner. A particular assist's use of Dachi must be proven by tracing that assist's summon and animation call; the name and large tree alone are not enough.

Adding frames to Dachi therefore does not create a new assist by itself. A new helper still needs a selection id, allocator/summon route, parent and facing setup, action handler, art identity, palette, collision/property row, sound, use count, lifetime, interruption and cleanup. The shared tree can provide animation capacity; it cannot provide the missing behavior contract.

Add a fourth route without stealing one

Mega Man already owns three arcade hypers:

The command is not just “an unused motion.” It gets its own matcher descriptor, temporary private parser-progress record at +$1C8, and unused Mega Man action byte $1C. The eight-word descriptor is kept verbatim in the source so input behavior can be audited independently of the handler. The v4 input-reliability revision uses the same negative-header, two-button grammar as Mega Man's stock Hyper Combo records:

packet-beta
  0-15: "$0003 flags"
  16-31: "$8000 native 2-button mode"
  32-47: "$001C command id"
  48-63: "$0000"
  64-79: "$0004"
  80-95: "$0005"
  96-111: "$0001"
  112-127: "$0070 punch mask"

The words are 0003 8000 001C 0000 0004 0005 0001 0070. Here $0070 is the set of LP/MP/HP bits available to the chord test; it does not mean “accept one punch.” Negative header $8000 sends $19710 through its native two-button route, where the selected mask is counted and two button edges are required. Direction words $0004/$0005/$0001 are Down, Down-Back and Back. They are not interchangeable with the QCF words $0004/$0006/$0002.

That corrects an earlier description of frozen v3. V3 actually used positive header $1000, which selects the parser's any-new-selected-bit route, then a private wrapper reread the currently held input word to demand Back and two punches again. A completed QCB could be valid in the parser's history but fail that late test as soon as the player released Back before pressing PP. Repeating 214+PPP often worked only because the second attempt happened to overlap the held direction and buttons. V4 removes the duplicate policy: $19710 decides the QCB and two-punch chord once, and the wrapper returns its flags directly.

The recognizer is deliberately late in Mega Man's grounded command chain. Every stock hyper gets first refusal; Magnetic runs only after those detectors decline the input. That placement matters because the shared matcher maintains state. An early prototype called the new matcher first and a regression run exposed unreliable Rush Drill recognition. The harness did exactly what it was built to do: it turned “the old branches probably still work” into a failed gate, and the hook moved after the stock hyper chain.

flowchart LR
  G["Grounded Mega Man input"] --> HMM{"Hyper Mega Man?"}
  HMM -->|yes| H["Stock Hyper Mega Man state"]
  HMM -->|no| Rush{"Rush Drill?"}
  Rush -->|yes| R["Stock Rush Drill state"]
  Rush -->|no| Beat{"Beat Plane?"}
  Beat -->|yes| B["Stock Beat Plane state"]
  Beat -->|no| Mag{"QCB + PP + 1 level?"}
  Mag -->|yes| M["New action $1C"]
  Mag -->|no| Rest["Original fall-through"]

Build the parent state from native pieces

The arcade ending pose is dedicated scroll artwork, not a normal fighter chain. For battle, the new handler uses Mega Man's own crouching-heavy-punch release at $157E50, the closest stock braced pose. Its body boxsets contain no attack rectangle, and the new state never calls the Mega Buster handler, so borrowing the pose does not secretly fire a buster.

The held sprite list is $31BEF6 with collision set $0006. Under Mega Man hit-set base $000FD20C, that body row begins at $000FD26C; it is body-only. The damaging geometry belongs to the separately allocated class-$24 lineage described below. The custom parent also does not add a PS1-style $0450 sound post. It relies on the stock hyper commit and the native root's $0175 effect cue, so HIT TEST's Snd value cannot diagnose missing audio.

The state then:

1. grounds and faces Mega Man using stock helpers;
2. restores his base palette and clears motion;
3. installs a 60-frame lifecycle and the crouching release chain;
4. waits for that chain's action event;
5. uses the stock hyper commit path to flash and debit exactly one level;
6. calls the native Onslaught spawner once;
7. holds the braced frame while the roots and segments advance; and
8. returns through the stock neutral transition.

The fan-out is arcade-native. It deliberately does not imitate the PSX handler's four selector calls instruction for instruction. The counts come from loops in the handler, not from the number of pictures in a sprite list:

flowchart LR
  E{"Mega Man action event"} --> C["Spend 1 Hyper level once"]
  C --> S["Onslaught spawner $271EE"]
  S -->|"delay 0 / x $30"| R0["root 0 / id $22"]
  S -->|"delay $0A / x $90"| R1["root 1 / id $22"]
  S -->|"delay $14 / x $F0"| R2["root 2 / id $22"]
  R0 --> V0["3 batches x 12 children"]
  R1 --> V1["3 batches x 12 children"]
  R2 --> V2["3 batches x 12 children"]
  V0 & V1 & V2 --> K["108 child attempts total<br/>pool permitting / no third generation"]

The first loop is in $271EE: d6=2 plus DBRA makes exactly three roots. At each root event, $96186 loads d6=$0B; the $96190 allocation loop therefore creates exactly twelve children, numbered +$B0=0..11 with visual variants +$27=11..0. On completion, $961FA decrements root repeat counter +$50, shifts the root by a facing-aware $120, and restarts until it has produced three batches. That is 36 child attempts per root and 108 across three roots, subject to object-pool availability. Children do not summon grandchildren. The root is the emitter; one parent loop allocates each twelve-piece vertical batch.

The live peak of 39 class-$24 objects is therefore not the lifetime total. It is three roots plus 36 children alive together at the measured peak. Every root and child uses property row $31 at $000F7872: displayed values Dmg=$0C, Piy=$00, Sto=$08, Snd=$00, Slp=$0F, Shc=$0B, Grd=$00, Mut=$0000. Remember that Snd is standing hit-stun, not audio. The root handler posts effect cue $0175 separately after allocating the batch. Any low-looking launch is the stock reaction/property path used by this hybrid object family, not evidence that a sound or hitbox failed to load.

Why a copied explosion can render and never hit

CPS-2 does not need to “load Magnetic Shockwave at the start of the match.” Its program, tile and sound data are already in the ROM set. What must be created at runtime is the object contract. A sprite-list pointer can make Gambit's Cajun Explosion—or any donor art—appear while remaining completely harmless. A visible animation is not automatically an attack.

A working donor effect normally needs all of these pieces together:

1. the correct allocator, object class and subtype;
2. owner, parent, side, facing and spawn position;
3. graphics bank and donor identity for animation lookup;
4. hit-set and shape-table pointers for rectangles;
5. property-row id plus active collision flags;
6. palette and effect/QSound event;
7. timer, animation event, interruption and destructor; and
8. any parent loop or child emitter that creates the rest of the family.

Repointing Mega Man to Cajun Explosion art supplies perhaps item 3 and none of the others. That is why it can draw without a hitbox. The claimed six-column Cajun limit must be traced in Gambit's own loop, counter or animation-event handler; it cannot be inferred from six visible images. Magnetic gives us the concrete comparison: a three-root DBRA, a twelve-child DBRA, and a three-batch root counter are the actual sources of its count.

The hex-edit workflow, without hand-waving

“Give one character another character's move” sounds like changing an id byte because a forced state can produce a persuasive screenshot. A distributable CPS-2 patch is a longer chain. This is the same address-first method used for both Magnetic Shockwave and Gold War Machine's beam:

1. Fingerprint the clean set. Verify the exact case-sensitive 21-member archive, member sizes and SHA-256 values. A Phoenix set, encrypted parent and previously patched set are not interchangeable inputs.
2. Build the logical CPU view. Interleave/word-swap the program members into the 68000 address space used by disassembly. Keep CPU addresses, member offsets and on-disk byte order in separate columns; treating $610C4 as a raw ZIP-member offset patches the wrong bytes.
3. Trace consumers, not labels. Follow the command matcher into the fighter dispatcher, then follow the donor allocator through object class, subtypes, animation events, palette, hit-set, property row, sound and free path. A tile address alone proves only that something can draw.
4. Assemble into proven stock space. Scan the verified clean base for the same all-$FF park, assemble position-specific 68000 code, and fail if the payload does not fit. This project uses $3F1000; it does not enlarge mvc.10.
5. Replace exact preimages. Each hook asserts the original six or eight bytes before replacing them. The encrypted parent then needs the patched opcode words run through the CPS-2 cipher; writing Phoenix plaintext into mvsc.zip does not create a valid encrypted build.
6. Split and verify. Convert the logical image back to member byte order, replace only the intended program members, preserve names/order/sizes, reopen the ZIP, and compare every changed run with the patch ledger.
7. Prove behavior under real input. Test meter debit, both facings, ground/air rejection, stock moves, collision, palette reloads, tag/interrupt paths, object-pool failure and final cleanup. A forced action id is a diagnostic, not an acceptance test.

flowchart LR
  A["hash exact clean ZIP"] --> B["logical 68000 image<br/>CPU addresses"]
  B --> C["trace command + donor<br/>object contract"]
  C --> D["assemble into verified<br/>all-$FF park"]
  D --> E["encrypt changed opcode words<br/>for canonical mvsc"]
  E --> H["word-swap / split members"]
  H --> I["assert byte scope + sizes"]
  I --> J["real-input lifecycle gate"]
  J --> K["new ZIP + hashes<br/>no Capcom ROM data distributed"]

This is why the patch source can be explained publicly without publishing a ROM. The reproducible work is the address map, assertions, payload, transformation and test evidence. The user supplies the copyrighted clean archive; the installer refuses anything whose bytes do not match.

The frozen v3 footprint and public audit materials

V3 is a stock-size patch: no ROM member grows and no graphics or QSound member changes. Its linked 68000 payload is 1,016 bytes at CPU $3F1000; the payload SHA-256 is 1ab0d5821438356ca3bc248244c6d71153fcda3c464e089038b0db5202c278c2. Six narrow code hooks route the command, state, palette lifetime, attacker-meter return and native final-title eligibility. Two data writes register the 64-byte stock-glyph title record and assign token $5A to the exact Magnetic hit row. Only mvc.10, mvce.03a and mvce.04a change.

The six hooks are $610C4 for the late grounded command fallback, $62D04 for Mega Man action $1C, $96044 and $962C0 for the marked Onslaught-object palette lease, $1CD1E for the Magnetic-only attacker meter-return filter, and $1240C for exact-row/final-phase title eligibility. The two data writes are the unused stock record at $C3C90 and byte +$19 of hit row $F7872. The old damage hook at $1B74A is byte-for-byte stock, row +$04 remains $90, and every graphics member is unchanged.

Make the harness argue with the result

The first focused live trace proved the new route itself. A real character selection produced Mega Man id $20; real QCB + LP + MP input latched action $1C; the state advanced 0→2→4; the meter fell from 3 to 2 at the action event; and exactly three forced id-$22 roots appeared before their vertical descendants. The active class-$24 population then grew as the columns expanded. The fixture opponent fell from 144 to 117 life, and Mega Man returned to neutral.

That success was not enough. The acceptance harness also asks hostile questions:

The early-hook build failed that regression suite even though Magnetic itself looked right. Moving the recognizer after the stock hypers restored their precedence, then the next run appeared to fail left-facing damage. Direct disassembly ruled out the first theory: the stock spawner at $2722E already tests parent facing byte +$4B, and $27234 negates each +$30, +$90, and +$F0 root offset when facing is zero.

The defect was in the harness's cross/push setup, not the native spawner. Running the controlled left fixture first kept the intended contact geometry. The frozen gate recorded left Magnetic life 144→106 and right Magnetic 144→117; both latched $1C, spent exactly one level (3→2) and reached a live peak of 39 marked class-$24 roots/children while the root loops continued through their longer batch lifetime. A later matrix caught a genuine shared-fallback bug: super-jump QCB+2P could reach the late hook while airborne. The v3 $3F135C tail guard now compares live Y to the engine's floor coordinate before entering the recognizer; zero-meter and airborne attempts both remain unlatched. Hyper Mega Man reported $0E, Rush Drill $08, and Beat Plane $0A through their original routes.

Those are exactly the failures a screenshot cannot reveal. The late-recognizer build passes the gameplay rows. A denser visual capture added one more row—and stopped an earlier build before it could become the release.

This is the same lesson behind the secret test-menu work and the harness post: instrumentation is evidence only when the fixture can distinguish the move we intended from a donor branch, stale state, forced facing or an input sequence that never authentically reached the dispatcher.

The columns passed—and then inherited Mega Man's colors

The gameplay gate said PASS because the roots spawned, hit, spent meter and retired correctly. The captured video still contained a release blocker: after contact, a column could turn black, expose a white checker edge, and throw blue shapes through otherwise correct Onslaught geometry.

This was not corrupt tile indexing. It was an ownership race over one palette row.

Stock routine $272DE installs Onslaught's orange source row from $1CBC44 into a transient live slot. The class-$24 effect children continue sampling that slot after Mega Man has left his custom parent state. When hit flash ends, stock palette restore $A4B0 rebuilds Mega Man's live colors from his object pointer at +$2C8. That restore writes Mega Man's third base-palette row over the same slot that the surviving Onslaught children still expect to be orange.

A RAM diagnostic made the causal link exact: applying the +$2C8 row through the same restore shape reproduced the observed black core, checker border and blue impact frames. The tile geometry did not change; only its color lookup did.

sequenceDiagram
  participant M as "Mega action $1C"
  participant O as "$272DE orange setup"
  participant R as "shared live effect row"
  participant C as "class-$24 children"
  participant F as "hit flash"
  participant B as "$A4B0 base restore"

  M->>O: action event
  O->>R: copy orange $1CBC44
  M->>C: spawn three roots
  C->>R: render correct orange columns
  F->>R: all-white flash
  Note over F,R: dense capture age 122
  B->>R: copy Mega Man +$2C8 row
  C->>R: surviving children reuse overwritten row
  Note over C,R: first visible corruption age 123

The dense harness captured every frame around the transition. Age 122 is completely white; age 123 is the first visible black/checker frame. A normal eight-frame screenshot cadence could step over that boundary and make the defect look intermittent. The palette invariant catches it even when the camera does not.

Fix the owner, not the symptom

Repainting the two live rows every few frames would only race $A4B0 again. The durable fix is a source-row lease: for as long as this invocation owns a marked shockwave child, the selected Mega Man palette source itself supplies orange whenever stock code rebuilds the live buffers.

Mega Man's +$2C8 pointer addresses a palette workspace with two banks. Fighter byte +$277 selects the first bank when zero and the second bank at +$60 when nonzero; the effect row begins at +$40 inside that selected bank. On the spawn event, the payload:

1. normalizes the selected bank to 0 or 1;
2. saves the exact 32 source bytes already present there;
3. copies Onslaught row $1CBC44 into that selected source row only;
4. calls stock $A4B0, so both live buffers receive orange through the normal path; and
5. keeps the lease until the final proven descendant leaves the active-object list.

The unselected bank and the +$2C8 pointer never change. Cleanup restores the bytes that were actually present—not a guessed “default Mega Man” row—so dynamically prepared palettes survive the round trip.

flowchart LR
  S["Mega action event"] --> B{"+$277 palette bank"}
  B -->|"0"| P["+$2C8 + $40"]
  B -->|"nonzero"| A["+$2C8 + $60 + $40"]
  P --> K["save exact 32-byte row"]
  A --> K
  K --> O["write orange $1CBC44<br/>into selected source"]
  O --> R["stock $A4B0 reloads<br/>both live buffers"]
  R --> C["marked class-$24 lineage renders"]
  C --> Q{"another marked object<br/>in the live list?"}
  Q -->|"yes"| R
  Q -->|"no"| X["restore exact saved row<br/>reload / clear lease"]

The scratch space almost became a second bug

The first source-lease draft solved the colors but treated a quiet-looking fighter region as one contiguous 32-byte backup. A whole-ROM audit invalidated that assumption. The common command layer uses +$1E8, +$1F0, +$208, +$210 and +$218; generic code also touches +$1F8. A palette fix that trampled one of those records could look perfect and quietly break a later tag command.

The frozen layout therefore splits the backup around every proven consumer:

That audit changed the acceptance gate. Before each Magnetic run, the harness poisons both backup ranges and then checks the saved row byte-for-byte on every active, non-busy frame. After the last object, it requires the source, both live rows, metadata and split backup to be restored exactly. Then it performs a real HP+HK team command. The frozen build reaches stock state b0=$40, proof that the palette repair did not purchase clean columns by damaging the common command parser.

Give only this wave the lease

The object hooks cannot treat every class-$24 object as Mega Man's. Immediately after $271EE returns, the payload walks the engine's live list and marks only roots with class $24, forced Onslaught id $22, root subtype and parent equal to this Mega Man. Children are accepted through one verified parent hop. Native Onslaught objects never inherit the private +$27=$1C marker.

At $96044, only that proven lineage refreshes the orange live row. At $962C0, the terminal path scans the real active list—not stale object-pool slots—for another child with the same owner. The last one restores the exact split backup. If the global palette writer is busy, that terminal object waits one update and retries instead of restoring into an in-flight transaction. Zero allocation, partial allocation, repeated use, overlap and both selected palette banks all have explicit gates.

Correction: ordinary-match Rush is not Rush Drill

The reported footage shows Rush appearing beside Mega Man during normal match play. It does not show the Rush Drill hyper. Those are separate ownership paths and the earlier heading blurred them together.

I therefore defined a dedicated normal.helper_assisted lane for the reusable character harness. It records the fighter's input and animation, the helper's class/subtype, owner and child chain, both collision ledgers, damage, stun, reaction, sound and teardown. That separate ordinary-Rush investigation was not captured as part of the frozen v3 release proof, so I do not classify the detached or oddly placed Rush in this clip as a stock quirk, a patch regression or correct behavior. The screenshot identifies a question; it does not identify its cause. The v3 claim is deliberately narrower: Magnetic's own lifecycle and the three stock hypers pass, while this unrelated helper route remains a named follow-up lane.

Rush Drill remains a separate regression

Rush did not donate storage, frames or animation-table entries to Magnetic Shockwave. V2 changed five hooks, including $1B74A. V3 restores that damage site and retains the four command/state and palette-lifetime hooks at $610C4, $62D04, $96044 and $962C0; its two additional hooks at $1CD1E and $1240C filter only Magnetic's attacker-meter return and native-title eligibility. Rush Drill's recognizer at $6131A, action $08, handler and art are untouched.

I also ran that comparison instead of stopping at the address map. Canonical stock and the frozen Magnetic ROM both accepted real Rush Drill input, entered action $08, spent meter 3→2 and dealt the same damage. From ages 24 through 200 I captured every eighth frame: all 23 stock/patched pairs were pixel-for-pixel identical. Age 104 below even has the same PNG SHA-256 on both sides, 5cf91dd02ac4a6eb7623e0624b0abfa83e16fa1dd6de0b6191de5319fab6b5a5.

That controlled comparison proves only that Rush Drill is unchanged. It says nothing about the ordinary-play Rush helper shown above. V3 makes no graphics or QSound edit at all: the isolated KO-title seat and fifth damage hook are gone. The helper-assisted lane remains the right way to investigate that ordinary-play clip, but it is not silently counted as a frozen v3 pass.

Cable is part of this progress, not a footnote

The parallel Cable port is now at mvsc_cable_v33.zip, md5 e8bc68d130d0a776ccb1a56a2d3335c9. Its latest narrow gates preserve a 99-tick rifle-repeat window, play four eight-phase shots, record four independent damage contacts and post four $165 gun commands. The air-beam fixture measures vertical travel of −69 / 0 / +48 pixels by strength. v33 also posts Cable's imported $161 Hyper Viper Beam call once, and a 69-frame gate retains the Electrap canister and blue detonation.

That is meaningful progress, but it is not a “Cable complete” claim. Muzzle placement still needs hands-on acceptance; ground Viper Beam still behaves like the donor projectile; the automated air path still needs manual gameplay acceptance; Electrap remains silent; Hyper Viper Beam still needs source-accurate mash growth, steering and collision alignment; and Time Flip, AHVB, Psy-Charge, Crackdown, portions of the animation census and move audio remain open. The same harness discipline used here is why each of those statements is separated into a measured pass or a named failure.

The broader lesson is that an existing move can often be routed to another character, but “any character can have any move” is too broad. Reuse is cheap only when the target ROM already contains the donor's complete art and object family and we can reproduce its ownership contract safely. Presentation, palette, collision, command precedence and cleanup still have to be engineered and tested. Magnetic and Mega Optic Blast are examples of successful contract adapters, not a generic one-byte move-swap switch.

The two versions are different in exactly the useful way

The PSX port did not contain a secret cache of arcade-ready sprites waiting to be copied. It contained something more valuable: Capcom's answer to the design question. Magnetic Shockwave is a fourth Mega Man hyper, gated by selection, grounded, one level, and routed through its own state.

The arcade executable contained the complementary answer. It already knew how to draw, animate, collide and retire Onslaught's orange ground columns. It simply never gave playable Mega Man a way to ask for them.

So the port is a join across evidence:

• the arcade ending says why Mega Man should own the move;
• the PSX battle overlay says where it belongs in his command grammar;
• the arcade Onslaught code says how the effect should exist on CPS-2; and
• the regression harness says whether adding it damaged the fighter he already was.

The command is no longer a promise the cabinet forgets. Select Mega Man, build one level, stay on the ground, and input QCB + two punches: the fourth hyper runs on CPS-2. The last Onslaught child keeps its orange source until it leaves the screen; Mega Man gets his exact palette back; HP+HK still calls the team. The weapon is home.

Public corroboration: the Mega Man Knowledge Base documents the ending reward and PSX-only use; the GameFAQs secrets guide documents the clear/Select/QCB+2P sequence. Addresses, hashes, action ids, object fields, timing and fan-out counts in this post come from local static disassembly and live traces of the verified PSX and CPS-2 binaries, not from those summaries.