I always take Rogue as the helper.
When I pick two characters in Marvel vs. Capcom, she is the one who comes in to save me. Other people spam Colossus and the assists that actually annoy you. I found out in certain tournaments that Rogue ranked lower, so you could take a higher-tier point character and still score. I kept picking her. She looked cool. Nobody used her. So I kept using her further and further.
That is the whole reason this ROM exists as an idea. I have been playing with her as a helper for so long that I wanted to play as her.
Jin's chair looked like the right place, because Storm had just fitted it.
The probe said Rogue does not fit. The chair that actually opens is the one
the Magneto costing reserved and never spent: Hulk $06 and Orange Hulk $26,
a 100% tile-share pair. Evicting one frees zero. Evicting both frees bank 2.
Exact V18b status — 2026-08-25
The current acceptance candidate is private V18b SHA-256
fe6b487b7f75fe7b562e549892e872a492d92060001956fe0ef34b099195cdc5.
Its fail-closed ledger fixes the denominator at 97 requirements: 17 ACCEPTED,
1 WAIVED, 63 OPEN, 15 HOLD, and 1 FAIL. That leaves 79 blockers. The project
does not convert infrastructure rows into a completion percentage, so parity
remains null, playability remains false, and a parity release remains
unauthorized.
The previous 30 August V18b playtest package is no longer offered. A new one-file builder is in validation, and its download is temporarily withheld. That distribution change closes no ledger row and does not promote V29, parity, or full playability.
What is accepted is deliberately narrow:
- walk and idle body-push: 24/24 across both Rogue owners, sides, and facings;
- stolen Hadouken metadata/hit/block/chip/debit: 24/24, plus 8/8 combo cases and 8/8 negatives;
- Goodnight pose and captured-stun scope: 8/8;
- bounded point/bench placement for Hadouken and Goodnight: 8/8.
The clip that made Ryu look as if he were simply jumping beside Rogue came from the quarantined failed V13 archive, but the visual report remains open rather than being dismissed with that provenance. Exact V18b's eight-lane capture is byte-exact to the accepted private-V16 regression; it is not a fresh XvSF source comparison. The earlier source matrix reached only 5/8 exact 93-sample pose windows, 7/8 exact held-stun windows, and 0/8 source-exact complete release trajectories. A new same-MAME source/target gate must bind action, phase, relative XY, velocity, unique victim OBJ ownership, and the composited PNG on the same frame before the “jumping beside Rogue” observation can close. The ledger therefore accepts only the narrow historical pose/stun regression. Full victim choreography, natural command access, damage, presentation, release, and cleanup remain unaccepted.
That does not accept the complete moveset. CATCH 07 is the one exact ROM
FAIL: source release is +140, while V18b releases at +136/+137. The sealed
all-phase evidence observes damage, positional displacement, and both-fighter
idle in all 32 positive Ryu lanes with zero watchdogs. That is a narrow
functional result, not the full slam gate: damage RNG was unset, and seeded
damage, victim stun/pose, ground contact, cleanup, a fresh throw-idle gate,
extended play, and negative lanes are absent. Selector, geometry, and launch
remain HOLD; slam, damage, stun, and recovery remain OPEN. Exact V18b already
contains record-1 param $0100; the old $0100 watchdog belongs to an earlier
isolated child. Independent review receipt SHA-256:
f8f1b2ddc7b35b04c1cd28774cd4efe962c1975c02dedaa609c3f4b193109cac.
An earlier scheduler attempt produced no evidence: its staged XMvSF key was
wrong, so MAME never left startup screens, and that capture root remains
retired. R6 derives the correct 20-member source archive with key SHA-1
65905400f4462c175baa93b43e015e8596def31b and preserves all 19 non-key
members; that repaired staging only. The later reviewed V27 diagnostic records
ordered exact-V29 opcode reads/prefetch at $E62 and $CEA1A, but records
$CA34=0 and $D970=0. V28 advances the observer into an ordinary-input
Rogue-versus-Ryu match and records both addresses. Matrix M1 then varies owner,
identity, facing, CATCH, and assist-attempt lanes and broadens the strict
read/prefetch subset by one caller. Neither package proves instruction
retirement or behavior, and no Power Drain scheduler lane or gameplay case is
accepted.
The source command census also proves Rogue has no persistent flight mode; the
real remaining movement scope is jumps, super jump, air dash, dash links, and
complete air attacks.
Exact V18b ordinary-input replay — 2026-08-30
This exact-V18b ordinary-input move replay stayed on the published candidate
bytes, SHA-256
fe6b487b7f75fe7b562e549892e872a492d92060001956fe0ef34b099195cdc5.
It did not test private V29 and did not build another ROM.
The signed-side FBNeo diagnostic completed 26 unique captures: 13 native
Rogue lanes for public $06 and the same 13 for secret $26, with ordinary
two-player controls and passive Ryu $12. Setup X was $0100; every lane kept
its required positive signed distance (+64, +72, or +240), with zero side
flips, zero out-of-bounds targets, exact owner identity, and intact fighter
pointers.
- 8 PASS: forward air dash, the no-back-air-dash negative, airborne PP as attack-not-dash, and back+PP as attack-not-dash, for both Rogue owners.
- 18 HOLD: ground/air/rising Repeating Punch, Power Dive, and Diving Kick contact lanes. Their state/action, child, cleanup, identity, pointer, and signed-geometry checks all pass. Natural one-run damage remains non-gating until a matched-RNG or predeclared distribution gate exists.
- 0 deterministic move-contract failures, 0 invalid, 0 missing. That is the result of the move-specific signed scorer, not a claim that all generic gate receipts pass. The generic receipts also require move-specific QSound proof, which this diagnostic explicitly excludes.
Receipt SHA-256 is
76b7e4ced057f66bfd5d1739da27770874af77c7609c4461511a320ea5deab5d;
capture-manifest SHA-256 is
d073ebc7cb5a178c8ae681024f895d54536ac4c2301109608b2abc47f9b75c9f.
An independent clean-room rescore reproduced the canonical JSON and Markdown
byte for byte.
The 18 damage HOLDs now have a sealed source-only ordinal-barrier design.
It fixes 18 comparisons and 54 future serial captures: 27 calibration cases at
seed $1357, followed by 27 confirmation cases at $2468. Same-seed-only
screenshots do not qualify—the older ground-LP trace reached damage at source
ordinals 27/28, 42/43, 57/58 but target ordinals 34/35, 49/50, 64/65.
Future evidence must align the complete contiguous RNG prefix, transaction,
and global ordinals before comparing damage. After the single logged pre-input
seed write, the barrier may not call, advance, freeze, force, rewrite, or reseed
RNG. Seven exact-V18b runtime row bindings are still missing, so the
package has no runner, commands, runtime root, scoring authority, or credit.
Its static verifier and all 15 hostile tests pass. Package aggregate SHA-256 is
da3855a65360b1d65586c3b549757b3f0039f1c91234e2cab5e5878aad9822be;
receipt SHA-256 is
8a73a80c8b441e87e8833c3e1d25313487a06f23a654de61d9b11c46aa754140.
The separately sealed five-route public-Rogue/P1 trial is intentionally stricter about its one sampled damage sequence. Standing kick, crouching punch, and jumping punch pass. Standing punch and the six-button standing chain fail only that single-run equality check:
stand P stock 4 / 8 / 10 V18b 3 / 7 / 10
stand magic stock 4 / 3 / 6 / 5 / 7 / 5
V18b 3 / 3 / 6 / 5 / 7 / 5All five routes match their input schedules, exact states, contacts, cancel
continuity, transition timing, and recovery. Because RNG is not controlled in
this run, the two damage differences are RNG-unresolved single-run
mismatches, not confirmed deterministic regressions. The receipt is SHA-256
fa73a02742d46798d817c49a77769327d91ed1d6e4f0b14f97ff571a09720989;
terminal seal SHA-256 is
020c9ddf5f7fb2b57f0efdf38bb14d1c0d1bbc5fadfdf1e70a8ff26adbfd3c15.
A signed-facing expansion defines the full 40-lane chain denominator: two Rogue owners × P1/P2 × right/left × five routes. Static V2 fixes that Cartesian product, but it does not authorize execution. Activation V5 was rejected for one pre-guard import P0 and four provenance/tool-path P1 defects. V6 repaired those, then a concurrent root replacement exposed one remaining check/resolve TOCTOU P1.
Additive V7 is now sealed source-only. Its pinned verifier and 47/47 hostile
tests pass, and an independent review of the exact sealed subject reports
P0=0/P1=0. Retained no-follow directory descriptors and device/inode/type/mode
continuity checks statically close the V6 defect, but the policy remains
default-deny with no commands. All 40 bindings are structurally expressible and
remain 0 executed / 0 scored. Only the five public-$06/P1/right routes have
direct stock-source scope; the other 35 remain blockers, and no symmetry
artifact is admitted. V7 final-seal SHA-256 is
cdab8deea738e1aca7bdfcb2412b192bd9f7ce0fd66f04e86a44c26dd9fffdf8;
independent-review receipt SHA-256 is
cda54142b65ece9c9d3e160290c9b8073a540079d0c6e6269899d7add0647a3b.
No candidate, ROM, FBNeo, emulator, capture, scoring, or gameplay was authorized
by V7, so every V2–V7 chain-preparation credit remains zero. The shared behavior
reporter was separately corrected so a legacy unsigned capture may prove exact
absolute geometry without silently claiming signed-side geometry; the full
harness self-test passes after that regression was added.
New one-file builder is in validation; download temporarily withheld. The
fixed ledger remains 17/97 with 79 blockers, parity null, and
playability/release authority false. Private V29 is not being offered.
The newest gates stopped bad evidence before it became a patch
Open the sealed execution-gate and Power Drain proof history (R6–R15, renderer V2–V7, static V3–V23)
The CATCH scheduler has advanced from R6 through R15 as an execution design,
but it still has zero runtime cases. R10 was rejected for three ownership
and lock-release gaps. R11 closes the direct post-Popen signal/opcode-trace
window with a separate inherited-lock custodian, but a hostile review rejects
activation again: a forked child can call setsid(), escape the tracked PGID,
and remain alive while R11 reports groups_absent; a pathname replacement
after the final coverage call also goes unobserved before explicit unlock. The
review additionally reproduces an unreaped-custodian warning and no PID-
generation binding. Its verifier and 7/7 hostile tests pass; rejection receipt
SHA-256:
a78d7b970977a6fb51e5fb73d9a57ce2979da0813a5744627a71eeb31c764434.
R12 closes the R11 cooperative-lifetime gaps, but its independent review
rejects activation too. SETEXEC occurs before CPython's close_fds, so the
target inherits closable copies of the canonical flock, anchor, and control
descriptors. A harmless target can close those copies; directly killing the
custodian then releases both anchor and flock while the target remains alive,
allowing a second owner to acquire both. The review's 7/7 hostile tests pass,
each reproducing R12's native 37/37 suite; rejection receipt SHA-256:
d6ad7ed57c489f409721ef99e805b5741827dce43e6c681f764d81fdc631a8a6.
R13 adds explicit target leases, an exact post-exec descriptor census, and a
separate exact-target exit sentinel. Its own 48/48 tests pass twice, but the
distinct review rejects execution approval: later lifecycle helpers launch
through a mutable source pathname without a retained or launch-time-rehashed
helper identity in their readiness record. The review's 20/20 static tests
pass twice; rejection receipt SHA-256:
0e35e02a7e77b6785c175c8b95a17fe74204a588eeed46d26f29846366b40c87.
R14 closes that helper-source defect; its verifier and 56/56 hostile tests
pass twice. Its distinct review credits the R13 repair, then rejects execution
approval on a deeper target boundary. The last retained-executable digest
precedes the target lease census, sentinel readiness, integrity check, and
PT_DETACH, with no kernel writer exclusion spanning that interval. The
review's 24/24 tests pass twice; rejection receipt SHA-256:
177dd776d1ba8b34c5651e91febd77b0b1659be4b28199755926ccd9410ad2d0.
R15 moves the complete retained-executable identity after the lease census,
sentinel readiness, and integrity check; its verifier and 52/52 static/mock
tests pass twice. Its distinct 24/24 review approves only that corrected
static HOLD evidence. The selected MAME CodeDirectory is ad-hoc, and a
ptrace-stopped sample does not prove kernel-enforced CDHash continuity through
detach. R15's predicate remains false before detach or ACK; dormant
predecessor-era authority schemas must be replaced, not enabled, by any later
executor. Review receipt SHA-256:
3b3450c9964d5e660d9bc01730bff91e4b5f3c93acb2b1196531d8427461c88d.
It cannot create a runtime root.
The first 80-frame live walk renderer was stopped for the same reason. V2 was
rejected for invalid Lua exclusive-create mode plus ownership, frame, PNG,
runtime-input, and cleanup gaps. V3 fixes many of those static checks, then its
own independent review finds five more blockers before launch: its exact ZIP
preflight asks for mvc.03a/mvc.04a where V18b contains
mvce.03a/mvce.04a; it asks for qsound_hle.7z where the pinned ZIP
contains dl-1425.bin; it accepts either physical OBJ bank without binding
the vblank-latched buffered render bank to the PNG; it ignores CPS-2 output
X/Y offsets when OBJ attribute $80 is set; and TERM/HUP can kill its guardian
while the detached child survives. The documented tests also create
__pycache__ and invalidate the supposedly immutable package. The review's
11/11 tests pass; rejection receipt SHA-256:
efb5696c2574b0e821c1d469e3ac72d729a82c4bed5696ce0d3f95546d9fc5fa.
V4 seals those static renderer checks, but its independent review rejects the
runner before launch. Exact MAME 0.287 returns attotime userdata from
screen:time_until_vblank_start(); V4 feeds that object to a constructor that
expects numeric seconds and later compares it with a number, so it cannot
reach its first wait or capture. It also hashes the retained executable before
launch without proving the same bytes after exec and before the first
instruction. The review's 20/20 tests pass; rejection receipt SHA-256:
e60a6ac4155bbf76ec9955fac88a2ba82a3f270f3962ee5942de3943d2915852.
V5 corrects attotime arithmetic and adds a stopped-exec digest; its 41/41
tests pass. Its independent static review still rejects execution approval.
The last retained-FD digest precedes a pathname-only check, detach, and
OWNED, while the next full digest is post-run. Its named same-inode mutation
fixture also sets mode 0500, requests O_RDWR, and never proves a byte
changed. The review's 20/20 tests pass twice; rejection receipt SHA-256:
f12ea24f6b6bc620c1a8754d87db17c4704d6a15f385e83ab8c4b26b99df9b5b.
V6 adds the final stopped-state digest and a real mode-0700, same-device/
inode/size byte-change control; its 43/43 tests pass. Its distinct review still
rejects execution approval. The digest returns in user space, Python compares
it, and only then calls PT_DETACH; no kernel-enforced no-writer interval
spans that last window. The positive control changes bytes before the digest,
and the post-run hash is only later detection. The review's 40/40 tests pass
twice; rejection receipt SHA-256:
a00e241e49f5d7bf2b71f4888358f46423ec905bbd57fba60808855ee28f018a.
V7's distinct 24/24 review likewise approves only a static HOLD. The exact
selected MAME CodeDirectory is ad-hoc, and a stopped, ptraced sample does not
prove CDHash/page continuity through detach. Review receipt SHA-256:
8ba58aa96a2cc87a31679896f6823215a440730560be97fbdb3c4db8bcfa1629.
The first non-ptrace, start-suspended hardened-copy contract is now sealed,
and its distinct review rejects claimed completeness. V1 accepts six poisoned
mock records: status transition, CodeDirectory/CDHash, process generation,
original-image identity/mode, parsed policy/dependency contents, and mutation
observations are each under-bound. The narrow no-executor tombstone is real,
but it authorizes nothing. Review receipt SHA-256:
d9156834dd8532d9c12727fcd858d7445c6359eeab7aedfd081fad1a595d6dd0
(42/42 hostile tests twice).
V2 repairs several represented fields: exact status masks, CDHash derivation,
separate generations and modes, equal-size changed-byte/edit coverage, parsed
entitlement/dependency rows, R15 lifecycle shape, and attempted-versus-observed
mutation results. Its independent review still rejects contract completeness.
An enforced dependency closure can trust a forged non-null root/child Team-ID
domain while the exact post-sign ad-hoc identity keeps a null Team ID; root mode
is also not bound to exact post-sign mode. Eight further semantic gaps remain.
The exact review blocker is
V2_CORRECTED_STATIC_EVIDENCE_CONTRACT_REMAINS_SEMANTICALLY_UNDERBOUND.
Review receipt SHA-256:
3abe48a0a1a44fb045ad9df0919166171b899de5b74a5ff9fc029fd0a12e7e0a
(52/52 hostile tests twice). V1 and V2 are structural tombstones only. No
helper, MAME query, screenshot, runtime, gameplay, or visual credit exists.
Start-suspended V3 represents V2's nine requested repairs, but its distinct
review still rejects exact completeness under
V3_REPAIRED_STATIC_EVIDENCE_CONTRACT_REMAINS_SEMANTICALLY_UNDERBOUND_AT_PRIMARY_OBSERVATION_ROOTS:
seven primary observation roots remain underbound. V3 subject
receipt/logical/package SHA-256 are 78745d42…22a7b, 8f70f50e…6d090, and
b5cf3d7a…4fa03; review receipt/logical/package SHA-256 are
3b33324e…31f24, 011a7410…e14c5, and df4052fc…8d5b. The subject and
review suites pass 177/177 and 67/67 twice.
Start-suspended V4 represents those seven repairs, but its distinct review
rejects completeness again under
V4_STATIC_CONTRACT_REMAINS_INTERNALLY_INCONSISTENT_AND_UNDERBOUND_AT_CANONICAL_OBSERVATION_DENOMINATORS.
Five defects remain: conflicting Mach-O/dependency command denominators;
CodeDirectory slots not derived from embedded bytes; whole-file and non-text
slots not derived from zero-to-EOF bytes; potentially different executable-map
censuses without terminal enumeration; and missing segment/section containment
plus executable file-backed type checks. V4 subject receipt/logical/package
SHA-256 are 72bb8659…e88ff, c91591a0…169b, and cbf96e12…435ca; review
receipt/logical/package SHA-256 are a19c9296…419e, b1753178…e3d9, and
50aa6d62…8b46. The subject and review suites pass 199/199 and 55/55 twice.
Both revisions preserve three blockers and seven zero-credit fields; neither
authorizes a helper, MAME, FBNeo, a ROM, runtime, gameplay, parity, or release.
Start-suspended V5 represents all five V4 repair families and its verifier plus
79/79 hostile tests pass twice, but distinct review rejects exact completeness
under
V5_DEPENDENCY_ROWS_STOP_AT_INSTALL_NAMES_AND_OMIT_RESOLVED_LIBRARY_IDENTITY_MODE_SIGNATURE_TEAM_ID_AND_CLOSURE.
Four families are materially present: one canonical byte-derived Mach-O list,
embedded CodeDirectory slots, zero-to-EOF byte roots, and section containment/
type checks. Dependency rows regress to requested install names without
resolved library identity/mode/bytes/signature/Team ID/closure. The mapping
model also cannot represent non-executable/submap query rows, leaves backing
identity unjoined, and permits an empty census. V5 subject
receipt/logical/package SHA-256 are 801eb237…a5e5, 760caeac…de4, and
f9367479…a5fa; review receipt/logical/package SHA-256 are d5cc16dd…419d,
cee88330…55c9, and 3cb97f71…87b. Root replayed the independent verifier
and 31/31 hostile tests twice. The structural tombstone, three blockers, null
runtime authority, and seven zero credits remain exact.
Start-suspended V6 restores a resolved dependency graph and full raw
region/submap state machine, and its verifier plus 75/75 hostile tests pass
twice. Distinct review still rejects completeness under
V6_ORDERED_RPATH_ROOTS_ARE_CALLER_INJECTED_AND_NOT_BYTE_DERIVED_FROM_PER_LOADER_LC_RPATH_COMMANDS.
V6 never parses LC_RPATH; caller-supplied global roots can resolve @rpath
without loader run-path bytes. Raw object_id/object_offset remain unjoined to
mapping vnode/file claims; EXEC_MAPPING_JOINER is absent from assessment;
file-backed non-executable leaves are unrepresentable; ad-hoc flags can carry
an unauthenticated Team-ID claim without CMS material; trailing-slash/NUL path
aliases remain; and mount IDs are caller-selected. V6 subject
receipt/logical/package SHA-256 are 91b31c5e…6a3c, a6af2d02…faf5, and
7b54effa…e4a0; review receipt/logical/package SHA-256 are
dd1ebbc2…e575, bd48a49d…9709, and 5f87865c…c9c2. Root replayed the
independent verifier and 45/45 hostile tests twice. The tombstone, three
blockers, null runtime authority, and seven zero credits remain exact.
Start-suspended V7 repairs those loader, mapping, signature, path, and mount
representations, but its distinct review still rejects completeness under
V7_RESOLVER_CANDIDATE_EXISTENCE_IS_INFERRED_FROM_CALLER_SUPPLIED_CLOSURE_MEMBERS_WITHOUT_A_JOINED_PROBE_OBSERVATION.
The byte-derived per-loader LC_RPATH stacks and the repaired raw mapping joins
survive clean-room reconstruction. Resolver truth does not: V7 decides whether
a candidate exists solely by finding its path in the caller-supplied closure
member list. There is no probe API/result/errno/sample/path/vnode observation,
so the same accepted evidence can represent an absent earlier candidate or an
existing earlier candidate that should win. V7 subject receipt/logical/package
SHA-256 are 7bfec77d…0696, d7c2bdfb…55f9, and 6d6c5994…ae16; review
receipt/logical/package SHA-256 are 6d901499…adb9, 38f6ff96…d0a, and
cf4acd54…2b14. Root replayed the subject verifier/109 hostile tests twice and
the review verifier/30 hostile tests twice with no cache residue. V7 preserves
the tombstone, three blockers, null runtime authority, and seven zero credits;
it authorizes no helper, MAME, runtime case, or gameplay credit.
Start-suspended V8 replaces closure-list inference with five dependency edges
and eight ordered probe records: five OPENED and three exact ENOENT rows.
Its distinct review confirms that internal denominator but rejects exact
completeness under
V8_OPENAT_PROBES_OMIT_DIRFD_AND_PATHNAME_ARGUMENTS_SO_ENOENT_IS_NOT_JOINED_TO_THE_DERIVED_CANDIDATE.
V8 derives a parent and leaf, but does not record the actual openat dirfd or
pathname argument and has no directory-FD provenance tying those claims to the
operation. The same sealed row can come from the intended parent or an
unrelated directory; O_NOFOLLOW protects only the final component. Positive
rows also omit the fstat target FD, descriptor epoch, and open-to-fstat
chronology. V8 subject receipt/logical/package SHA-256 are
3b52163f…07c9, 81667a31…5ddf, and ea68fcc8…2ae4; review
receipt/logical/package SHA-256 are 90fb4e3d…06ff, e78a687f…5a84, and
1b8adedf…77b. Root replayed the subject verifier/142 hostile tests twice and
the review verifier/40 hostile tests twice with no cache residue. V8 preserves
the tombstone, three blockers, null runtime authority, and seven zero credits;
it authorizes no helper, MAME, runtime case, or gameplay credit.
Start-suspended V9 adds the actual one-component openat dirfd/pathname,
root-to-parent directory-handle chains, descriptor epochs, explicit positive
fstat targets, and reverse close chronology. Its distinct review reproduces
all eight candidates and 114 represented operations, then rejects exact
completeness under
V9_PARENT_HANDLE_IS_NOT_REVALIDATED_TO_THE_DERIVED_PATH_AT_LEAF_OPENAT_SO_RENAME_REPLACEMENT_PRESERVES_THE_ACCEPTED_PROJECTION.
A rename/replacement between terminal-parent FSTAT and leaf OPENAT leaves
the held FD attached to the old directory. That FD can return the same
ENOENT while the canonical path now contains the candidate, and the original
path can be restored before V9's next witness. V9 subject
receipt/logical/package SHA-256 are 9e0bbb68…afc9, cbeaa56c…004f, and
184663cb…25df8; review receipt/logical/package SHA-256 are
383cf9e5…fe8f, cb1f4155…00f4, and 791655ae…9e8f. Root replayed the
review verifier/60 hostile tests twice with no cache residue. V9 preserves the
tombstone, three blockers, null runtime authority, false execution/resume, and
seven zero credits; it authorizes no helper, MAME, runtime case, or gameplay
credit.
Start-suspended V10 adds one epoched kqueue, native vnode/mount watch rows,
stabilized before/after GETFSSTAT censuses, parent-watch-before-child
chronology, and a fresh independent parent/leaf revalidation. Its verifier and
281/281 hostile tests pass, but distinct review rejects exact completeness
under
V10_ZERO_TIMEOUT_KEVENT_DRAIN_IS_NOT_A_COMPLETION_FENCE_FOR_PRECEDING_DARWIN_FILESYSTEM_STATE_CHANGES
and
V10_VERIFIER_LACKS_EXACT_AUTHORITY_FIELD_MANIFESTS_SO_A_NEWLY_SEALED_INTERNALLY_CONSISTENT_DOCUMENT_CAN_CHANGE_AUTHORITY_LIMITING_MEANINGS.
Apple's XNU VFS wrappers
perform the filesystem operation before posting the vnode notification, so an
empty zero-timeout poll is not a completion fence. The package verifier also
leaves some authority-limiting document meanings outside exact manifests;
newly consistent seals cannot supply that missing schema. V10 subject
receipt/logical/package SHA-256 are 5debfcaf…5524, 52a22c59…2b8e, and
f079f3ce…964c; review receipt/logical/package SHA-256 are
daedbaf6…3fc5, bfd3a2c3…4791, and 7a707709…a262. Root replayed the
subject verifier/281 tests twice and review verifier/15 tests twice with no
cache residue. V10 retains the three blockers, null authority, false
execution/resume, and seven zero credits. A successor may claim paired
endpoint/census equality and zero events returned by immediate polls, not
continuous namespace stability or mutation exclusion.
Start-suspended V11 encodes that narrow claim and exact-manifests its authority
fields. It sets continuous stability, mutation exclusion, in-flight exclusion,
notification fencing, and mount quiescence false; its quiescence primitive and
runtime authority are null. Distinct review confirms the narrow theorem for
strictly parsed canonical JSON but rejects the public Python validator under
V11_VALIDATE_NATIVE_OBSERVATION_MAPPING_BOUNDARY_DOES_NOT_REQUIRE_EXACT_CANONICAL_JSON_BUILTIN_TYPES.
The function accepts general mappings and uses dispatched equality, length,
and iteration without first requiring the exact built-in JSON value domain.
V11 subject receipt/logical/package SHA-256 are b45d19a3…7804,
75777df6…9c6, and 642575b4…925a; review receipt/logical/package SHA-256
are 1e0574dd…9685, edb2b787…f55d, and 35028103…9c20. Root replayed
30/30 subject and 30/30 review tests twice with no cache residue. V11 remains
REJECT/HOLD with null authority, false execution/resume, three blockers, and
seven zero credits. A successor must parse strict canonical JSON at ingress or
recursively require exact built-in JSON types before validation.
Start-suspended V12 implements that exact repair. Its only public observation
validator accepts exact built-in bytes, strict-parses canonical UTF-8 JSON,
recursively requires exact built-in JSON values before evaluating the theorem,
and exposes no legacy general-mapping entry point. Distinct review approves
only the same two represented digest equalities and two immediate zero-event
returns. V12 subject receipt/logical/package SHA-256 are
cb7ec0fa…ad19, 808cba55…61ec, and 20bb30eb…5358; review
receipt/logical/package SHA-256 are c4cb51f8…01af, da6f2081…0dd1, and
003875ce…d47. Root replayed 40/40 subject and 36/36 review tests twice with
no cache residue. The result is approve narrow static theorem / runtime
HOLD: the stronger nonclaims remain false, authority remains null,
execution/resume remain false, all seven credits remain zero, and the same
three blockers remain. This closes a validator defect, not a gameplay row.
Power Drain's metadata work did make one bounded advance. Independent V3
review reproduces 7,829 rooted states, 3,218 instruction addresses, 173 state
and 112 unique direct-jump edges, 11 conservative owner-write hits, and five
indexed exits. It binds all 37 loaded non-stdlib Capstone Python origins plus
the selected dylib. The allocator result remains conditional on an unproved
free-stack/active-record integrity invariant, and all six lifecycle
denominators remain open. That verdict is approve corrections, retain
HOLD, not approval to build or run. Review receipt SHA-256:
66d8e598cc29f47899384ed25685f905849aa216ddd573461e098db8f42cef64.
Independent review now rejects V4's one-of-five closure accounting. The raw
facts reproduce: 12 branches carry nine selectors to nine targets, and all
four remaining state tables have the listed conditional maps. But V4 repeats
the old walk with $0179FE unresolved, then performs a disconnected fixed-
window scan. It never binds $02B0B2 to $016FBA, exhaustively checks the
root-local or mid-body predecessor set, or feeds the nine targets back into the
walk. Its correct augmented-walk constants are present but unused. Four nearby
selector branches at $0170B4/$0170BA/$0170D6/$0170E6 are outside the real
root graph, but only the independent review proves that exclusion.
The review's reimplementation shows the repair: 8,050 rooted states, 3,431
instruction addresses, 187 state and 126 unique direct-jump edges, plus nine
explicit indexed edges. That evidence cannot retroactively repair V4's seal,
so all five indexed transfers remain unclosed for sealed-proof accounting and
all six lifecycle denominators remain open. Review verifier and 38/38
adversarial tests pass; rejection receipt SHA-256:
94ef33f3e2e6c619bd27de66b4f88a57c00500fca2b0725aa019296031af5554.
V5 executes that augmented graph, but its own independent review rejects the
sealed closure too. V5 never enumerates incoming edges to the 12 selector
BRA opcodes. A root-local poisoned edge can jump directly to a branch,
bypass its MOVEQ/D0 selector load, and still pass the predicate. Exact V29
does have the safe 12/12 immediate fallthrough predecessors, but an external
review cannot retroactively add that binding to V5. The independent verifier
and 43/43 tests pass; rejection receipt SHA-256:
e984288fe3d42de2cf73fdbfa12aa54f17cc643cd6f56c1418d072b81e51dd28.
V6 adds that predecessor obligation, but its independent review rejects the
closure again for a deeper reason: the walk stops whenever A0 changes, even
though those instructions do not end control reachability. Continuing the
same exact-V29 root walk exposes four legitimate dispatcher ingresses at
$017314/$017386/$0176EE/$0176F4. Selectors $24/$26 add two omitted targets,
$017F08/$017F62, so the real known root surface is 16 ingresses and 11
targets rather than 12 and nine. Three indirect exits remain unresolved:
$0185C6 JMP (A0), $01870C JMP (A0), and $0187EC JSR (A1). The independent
verifier and 48/48 hostile tests pass; rejection receipt SHA-256:
3185ac7dcfdf57b8bd4a863baf67d251b33662b6cce65629e30496b5acec06b1.
V6 earns zero closures. V7 separates control reachability from owner-pointer
provenance and reproduces 16 ingresses, 11 selectors, 11 targets, and the same
three unresolved exits. Its independent review still rejects closure: 36
reachable A0/A1 postincrement sites implicitly update a tracked address
register, and 12 retain stale known provenance. Conservative kills reduce the
abstract graph from 30,902 to 30,038 states without changing the 1,523-PC /
3,630-edge control graph. The review's 64/64 tests pass; rejection receipt
SHA-256:
e051dcd9cea02c98c703edf97694199f9fbec7b79c130ad581012bdacd511af0.
V8 repairs those 12 stale facts, but its own review finds four more reachable
register-typed predecrement ABCD sites. The true automatic-write surface is
40 sites / 44 effects, not 36; six CMPM/ABCD/ADDX/SUBX poisons expose the
classifier gap. Its 50/50 review tests pass; rejection receipt SHA-256:
4f811d4f59f6241f09203c77ac4c8c48898812f976ba54489d978fed6208ecee.
V9 makes address mode authoritative regardless of operand type. Its 72/72
subject tests and a distinct 64/64 review reproduce 40/44, 30,038 states,
1,523 PCs, 3,630 edges, and 16/11/11. That review approves only corrected
static HOLD evidence. Three indirect exits remain unresolved; zero of five
transfers close and gate 5 remains open. Review receipt SHA-256:
6ba4f1473bdb94f685e94e79648dc9e04170c2d996dc860049cd99a42ebcc5a9.
V9 has no ROM, runtime, or gameplay claim.
V10 seals three physical 92-byte / 23-entry tables and all 69 rows. It also
corrects their boundary map: table 1 is followed by code, table 2 is followed
by table 3 row $00, and table 3 is followed by code. Its distinct 64/64
review approves only corrected static HOLD evidence. The base graph is
30,038 states / 1,523 PCs / 3,630 edges; a conditional even-ID expansion
reaches 70,101 states and 36 downstream indexed exits. But the root has 18
reads and zero writers or modeled ingress for fighter ID +$0052(A6), so odd,
negative, $002E, and larger values remain unexcluded. One of 18 indirect-JSR
targets returns; 17 stop at unresolved +$00E4(A6) selectors. Zero of five
transfers close and gate 5 stays open. Review receipt SHA-256:
a1648da1bbeeba0cf35d9b950dd24ccd79013f8e7bd0c510b2087256ae709c8c.
V11 broadens the raw writer/alias census and its distinct 92/92 review confirms
the complete 355/81 and 0/3 candidate arrays, all three tables and 69 rows,
$06/$26 target equality, a narrow syntactic return, and five physical
+$00E4 rows. It does not prove that a candidate is executable or reachable.
Zero of five transfers close and gate 5 remains open. Review receipt SHA-256:
edf40a3a33d1d93eba145ea75a6ac2df7a9de585da95f01b716f3ef57aa1738c.
V12 through V25 used opcode hash fa820be5…95ab4, which omitted MAME's
inclusive word beginning at $100000. V26 corrects DATA 0800 to OPCODE
6B41 there and pins corrected hash 38171f8b…0d23. Only the all-even
candidate decodes at $0FFFFE and $100000 change. V26 regenerates the
current direct, indirect, return, root, scheduler, and wrapper tables with
zero classified-row delta. Older receipts remain sealed history, not current
whole-opcode-view authority.
V12 then checks every one of the 2,097,152 even starts in the then-current
four-megabyte V29 opcode view. Its distinct review reproduces 1,702,359 valid
decodes,
2,740 indirect controls with 391 target-capable candidates, 6,800 return-family
candidates, 695,439 explicit memory destinations, and 443 direct A6+$52
starts. That is a materially broader syntactic envelope, not executable
reachability, points-to provenance, saved-stack/exception-return integrity,
overlap closure, whole-record-copy completeness, or fighter-ID value-domain
proof. V12 is approved only as scoped static HOLD evidence. Zero of five
transfers close and gate 5 remains open under
V12_ROOT_A6_0052_EXECUTABLE_REACHABILITY_POINTS_TO_AND_STACK_PROOF_OPEN_OVER_EXACT_EVEN_ENTRY_SYNTACTIC_ENVELOPE.
Review receipt SHA-256:
7bb05429b3458ea394e495971fe6695d0adce834a72c4e5f40dbd6a0ae614fe0
(88/88 hostile tests twice). It creates no ROM, runtime, gameplay, parity,
release, or percentage authority.
Power Drain V13 retains the 391-row control partition, 3,336 selector
equations, 359 same-field copies, and one (A7)+ source, but its distinct
review rejects the sealed census under
V13_STACK_UNION_OMITS_A7_INDEX_MOVEM_MASK_SR_STOP_USP_AND_FIXED_A6_MOVEP_MOVEM_WRITE_FOOTPRINTS.
The 90,316-row stack union omitted 2,410 A7-index sites, 208 MOVEM masks
containing A7, SR/STOP/USP surfaces, and the special footprints of 1,190
fixed-A6 MOVEP plus nine MOVEM destinations. V13 subject
receipt/logical/package SHA-256 are d3421ed0…d86e, 23ddd6f2…587a, and
cbaf3ce0…1100; review receipt/logical/package SHA-256 are e8792bd5…fc1a,
af0c625f…b5b, and 4e5ad384…f6efe. Subject/review suites pass 83/83 and
96/96 twice.
Final frozen Power Drain V14 repairs those census and footprint defects and is
independently approved only as a scoped static HOLD. Its 55,054 fixed-A6 writes
partition into 53,855 ordinary, 1,190 MOVEP, and nine MOVEM rows; 443 overlap
+$52..+$53, 54,611 are disjoint, and no special-footprint row overlaps. The
corrected explicit A7/system-state union is 95,477. The separate 2,097,152-even-
entry exception-policy universe is conservative policy, not executable
reachability or saved-frame integrity. V14 subject receipt/logical/package
SHA-256 are e29cc788…c649, c9d3afaa…ede6, and 1bc94fab…fd9c; review
receipt/logical/package SHA-256 are 116e299f…c7486, 8ef26bd8…4084, and
61926782…233a. Root replayed the subject verifier/100 hostile tests twice and
the independent verifier/108 hostile tests twice with no cache residue.
The first blocker remains
V14_ROOT_A6_0052_EXECUTABLE_PROVENANCE_OPEN_AT_DERIVED_CONTROL_POINTERS_SAVED_FRAMES_AND_NONLOCAL_RECORD_COPY_VALUE_DOMAIN.
Zero of five transfers close, gate 5 stays open, and runtime/gameplay credit
remains zero.
Power Drain V15 then isolates one conditional valid-admission theorem at
$02DA24. Given the normal constructor/action-root path, the same live
class-$38 A6 record, $02D9DC CLR.W +$0A(A6), exact modeled returns, and no
external aliases or record reuse, the least selector fixed point is exactly
{$0000,$0002,$0004,$0006}. Table bytes 0054008c012a019a resolve to
$02DA7C/$02DAB4/$02DB52/$02DBC2; 13 tuple traversals derive all seven local
writers, including the $02DA44 sibling probe.
The distinct review approves only that conditional scoped static HOLD and
reproduces the retained global blockers: 2,740 unresolved indirect controls,
6,800 returns, 35,211 dynamic-A6 destinations, 588,961 non-A6 pointer
destinations, and 3,175 fixed-A6 +$08..+$0B overlaps (3,162 ordinary / 12
MOVEP / one MOVEM). V15 subject receipt/logical/package SHA-256 are
7fa7861d…e8c5d, de05fba2…9fa42, and c8ab3116…a7266; review
receipt/logical/package SHA-256 are 2b62ca41…3c523, 146bf5ee…63e7f, and
0b7f37c4…0d5eb. Root replayed the subject verifier/151 hostile tests twice
and the review verifier/98 hostile tests twice with no cache residue.
The first blocker is
V15_VALID_ADMISSION_IS_NOT_WHOLE_PROGRAM_INGRESS_EXCLUSION__CALL_RETURN_A6_FIELD_ALIAS_SAVED_FRAME_AND_RECORD_LIFETIME_PROVENANCE_OPEN.
V15 does not close $02DA24 globally, closes zero of five transfers, leaves
gate 5 open, and grants zero runtime, gameplay, parity, percentage, or release
authority.
Power Drain V16 then applies that same conditional admission contract to the
sibling dispatcher at $02DA38. Its exact bytes and 17 tuple traversals do
reproduce the four arrival words, the same least fixed point, all four sibling
targets, all seven local writers, and the $02DBA0 BNE/RTS barrier. The
distinct review still rejects the package under
V16_GLOBAL_IMPLICIT_A6_WRITEBACK_CENSUS_UNDERBOUND_29750_VS_30715__965_REGISTER_TYPED_PREPOST_ROWS_OMITTED.
The correct implicit-A6 count is 30,715: 270 SUBX, 257 CMPM, 248 ADDX, 125
ABCD, and 65 SBCD register-typed pre/post rows were omitted. V16 also misses
three LINK.W A6 rows, while 1,013 read-only CMPA rows contaminate its claimed
A6 mutator denominator. Its poison list is declarative; connected alias/LINK
mutations and extra $02DA30/$02DA34 targets can pass; self-consistent and
duplicate-key receipt forgeries also pass. V16 subject
receipt/logical/package SHA-256 are 552226e6…efae, 2a4ae2a7…f26c, and
a0bd61a8…1c03; review receipt/logical/package SHA-256 are
162985c1…5dd9, 706d5bee…1a68, and 924a2f84…ab4. Root replayed the
subject verifier/224 hostile tests twice and the review verifier/202 hostile
tests twice with no cache residue. The narrow lattice remains conditional
evidence only; V16 closes 0/5 transfers, leaves gate 5 open, and grants zero
runtime or gameplay credit.
Power Drain V17 repairs the complete sealed V16-review defect list. The full
even-start census is 30,715 implicit-A6 rows, including the omitted
270/257/248/125/65 SUBX/CMPM/ADDX/ABCD/SBCD partition. The 4,826
last-operand-A6 rows split into 3,813 mutator/replacement rows plus 1,013
read-only CMPA rows; all three LINK.W A6 rows are explicit. All 61 poison
actions execute and reject, the exact BNE/RTS barrier is bound, injected
targets are tracked, and canonical duplicate-key-rejecting seals survive.
Distinct review independently rebuilds the then-current V29 view and all
2,097,152 even
starts, all 22 census manifests, 17 traversals, seven writers, the four-state
relation, 20 calls, five RTS sites, four external tails, and 61/61 poison
rejections. It approves only the narrow conditional static theorem. V17
subject receipt/logical/package SHA-256 are cf3e51c8…7252,
745ab9aa…ebb, and 0f6f4b09…ef2a; review receipt/logical/package SHA-256
are e3398635…e854, 21b995da…e2b, and 598912cc…579. Root replayed the
review verifier/286 hostile tests twice with no cache residue. A5 disjointness
and whole-program ingress, alias, callee, saved-frame, record-identity, and
lifetime provenance remain open. V17 closes 0/5 transfers, leaves gate 5
open, and grants zero runtime or gameplay credit.
Power Drain V18 advances one bounded alias/call slice. For the four fixed
allocator slots, the two connected A5 word writes are disjoint from
A6+$08..+$0B in all eight 24-bit footprint comparisons. Separately, the
direct $02D9E2->$01CD1E graph reproduces 299 states/PCs, 365 edges, two
nested calls, three modeled returns, two root RTS sites, depth two, no
unresolved control, and no direct A5/A6 register replacement or writeback.
Sixty executable poison actions reject and 97/97 subject tests pass twice.
Distinct review approves only those two separate conditional facts. V18 does
not carry a fixed-slot producer to $02D9E2 through a control/data path with
the same A5 epoch, so their composition remains open under
V18_SLOT_PRODUCERS_ARE_NOT_JOINED_TO_02D9E2_BY_A_PRODUCER_TO_CALL_CONTROL_DATA_PATH_OR_SAME_A5_EPOCH_PROOF__ROLE_GLOBAL_INGRESS_ALIAS_SAVED_FRAME_IDENTITY_AND_LIFETIME_OPEN.
V18 subject receipt/logical/package SHA-256 are fff63778…e682,
05039fae…f91e, and 64c2c737…23ad; review receipt/logical/package SHA-256
are 17b1e174…a09f, eb1d5f92…3a92, and 506a2b17…bd7. Root replayed the
replacement subject verifier/97 hostile tests twice and the review verifier/77
hostile tests twice with no cache residue. V18 closes 0/5 transfers, leaves
gate 5 open, and grants zero runtime or gameplay credit.
Power Drain V19 attempts the missing producer-to-call bridge without creating
the four deltas at the destination. It derives each fixed slot at its real LEA
and carries its A5/A6 epoch to $00D970, then stops. A complete scan of all
2,097,152 even OPCODE starts finds 52 direct calls to that shared join: four
fixed-slot primaries, 24 role-global primaries, and 24 contingent retries.
Those 48 non-fixed ingresses leave retry preservation and the path to
$02D9E2 unproved, so V19 has zero accepted target witnesses under
V19_SHARED_D970_JOIN_HAS_48_NON_FIXED_DIRECT_INGRESSES__24_ROLE_GLOBAL_PRIMARY_AND_24_CONTINGENT_RETRY__SAME_A5_A6_EPOCH_TO_02D9E2_NOT_PROVED.
Distinct review independently reproduces the 4+24+24 partition, four prefixes
ending at $00D970, and no target witness. V19 subject
receipt/logical/package SHA-256 are 412d55f2…4c20, 7497faa7…4d0f, and
438b16de…e72c; review receipt/logical/package SHA-256 are
da5f0687…eb86, 342da0dd…781d, and 618b26a4…2968. Root replayed 53/53
subject and 55/55 review tests twice with no cache residue. The result remains
HOLD: 0/5 transfers, gate 5 open, and zero runtime or gameplay credit.
Power Drain V20 corrects one concrete decoder mistake: four retry gaps use
read-only TST.B, but the other 20 use mutating
BCLR.B #0,-$3FF0(A5), not BTST. Its subject also proposes wrapper
A5/A6-prefix and A7-delta facts. Distinct review accepts only the exact-V29
52-call census/classification and that byte-derived BCLR correction; it rejects
the wrapper claims because the independently pinned outer oracle belongs to a
different v8 archive and no independent exact-V29 artifact seals both high
wrapper ranges. The blocker is
V20_EXACT_V29_WRAPPER_PLACEMENT_AND_CONTENT_CONTINUITY_UNPROVED__NO_INDEPENDENT_EXACT_V29_SEAL_FOR_OUTER_3DB9E2_3DBAEA_AND_CATCH_3DB562_3DB6B2.
V20 subject receipt/logical/package SHA-256 are 187b864a…fedd,
291821b9…cba9, and 28368f58…e6f; review receipt/logical/package SHA-256
are c8abaf40…f842, 80e38263…3d81, and 7549ea01…e0f4. Root replayed
117/117 subject and 83/83 final review tests twice with no cache residue. The
result is still REJECT/HOLD, 0/5 transfers, gate 5 open, and zero runtime
or gameplay credit.
Power Drain V21 closes that one code-image defect and nothing broader. A new
subject reconstructs exact V29 directly from its ordered 21-member archive and
seals the complete catch [$3DB562,$3DB6B2) range at 336 bytes / SHA-256
19017d38…c82 and outer [$3DB9E2,$3DBAEA) range at 264 bytes / SHA-256
cd6f30f8…49c. Its 140-row bounded decode includes all six bytes of
$3DBAE4 JMP.L $3DB562. Distinct review approves only that exact placement
and content continuity, then rejects the subject's blocker order. The first
remaining blocker is the unsealed exact-V29 31-writer effective-address,
width, and path denominator. The isolated A5 anchor is not a dominance proof;
A5/A6/A7 domains, physical-24-bit disjointness from the live [S-8,S+4)
return-plus-D0/A0-save region, retries, $00D060 normal return, and the path
to $02D9E2 remain open. Subject receipt/input-aggregate SHA-256 are
d2be0a0d…798d and 883f21ba…9485; review receipt/input-aggregate SHA-256
are 8a28dbc4…fccb and ee7fda88…5413. Root replayed 36/36 subject and
50/50 review tests twice with no cache residue. V21 remains semantic HOLD,
0/5 transfers, gate 5 open, and zero runtime or gameplay credit.
Power Drain V22 closes the next denominator and nothing more. The exact V29
wrapper contains 31 ordinary non-stack writer sites: 14 outer and 17 catch,
24 byte and seven long. Five are data-dependent read-modify-writes; five
different CLR instructions have a preliminary MC68000 read cycle but are not
folded into that RMW count. Independent review also keeps two control-flow
views separate: 155 edges when calls are terminal, and 162 edges only in a
hypothetical normal-return projection. Root replayed 66/66 subject and 35/35
review tests twice. This seals the writer list, not a safe runtime domain, and
still closes 0/5 transfers.
Power Drain V23 then asks whether those writes can touch the wrapper's live
stack frame. It seals 52 direct call relations—four fixed-slot, 24 role-global,
and 24 retry—and the complete physical-24-bit frame
F12(S)=[S-8,S+4): saved D0, saved A0, and the return address. The correct
result is HOLD. None of the 52 callers has a proved nonempty reachable
pre-call A7 domain, so zero callers can be admitted without making the theorem
vacuous. The exact 52x31 matrix therefore records 1,612 static relational
alias obligations under unproved domains. They are not executed states and
not gameplay witnesses. Review also corrects the retry wording: four TST
gaps are read-only, while 20 BCLR gaps mutate memory; only local A5/A6/A7
register nonmutation is proved. Root replayed 102/102 subject and 32/32 review
tests twice. The next evidence order is reachable A7, then reachable A6 plus
the writer paths that actually execute, then full-frame disjointness. Until
that exists, Power Drain remains 0/5 and earns zero runtime or gameplay credit.
V28 records the scheduler and join
Power Drain V24 left all 52 direct-call rows UNKNOWN. V25 then mapped the
candidate control surface, but its opcode reconstruction omitted MAME's
inclusive word at byte $100000. V26 supersedes V25 and its review for
whole-opcode-view authority. Corrected V29 OPCODE SHA-256
38171f8b3b451ce1594a436969d0998c82317a6da0f4a0f8992454f026580d23
changes only $100000..$100001, from DATA 0800 to OPCODE 6B41. The two
affected all-even candidates begin at $0FFFFE and $100000.
V26's regenerated tables have zero classified-row delta: 88 direct
controls, 2,740 indirect-control candidates, 6,800 return candidates, a
620-node / 685-edge root projection with 49 barriers, a 303 / 411
assumed-return scheduler projection, a strict 140 / 155 wrapper graph, and 52
still-UNKNOWN caller obligations. Receipt SHA-256:
c866a565df0cc2caa683de4003b3c8ce0bfd1fb8e1117e5240746e46940b2fe8.
MAME's exact-tag sources show the separate program/opcode maps and inclusive
decrypt range in cps2.cpp,
cps2crypt.cpp,
and the 68000 reset path in
m68000-sdf.cpp.
V27 supplies the first repeatable read-only startup observation. Two isolated
MAME 0.287 launches produced byte-identical deterministic opcode-read cores,
recording ordered opcode reads/prefetch at reset $E2, TRAP-0, $362, $38E,
$E62, $105A, and $CEA1A. The descriptor-write tap also records $FF0040
with state $0C and entry $E62. Both runs
also observe DATA/OPCODE 0800/6B41 at $100000. The taps can include
prefetch—they are not instruction-retirement hooks—and the capped 64/256
counts are lower bounds. Most importantly, both captures record zero
$CA34 and zero $D970 observations. Repeatability receipt SHA-256:
7058371a66dbbd1537e1cf8f5ae51fb406f04d9555d6300c8b3738ecd19b2322.
Independent narrow-approval SHA-256:
389dd71c38c91ca54ea4f692ca0a4adcd42f9019790abbdec957427fdf96c8ee.
V27 seals no Power Drain transfer and grants zero gameplay or release credit.
V28 then changes the evidence scenario, not the ROM. Two fresh isolated MAME
0.287 runs use only ordinary input to naturally select P1 Rogue $06 against
P2 Ryu $12, enter match phase $0800, and complete the same neutral window.
Their deterministic evidence cores are byte-identical. Each records 733
reads/prefetches at scheduler $CA34, 8,798 reads/prefetches across the 52
known caller sites, and 4,003 entry reads/prefetches at shared join $D970.
Sixteen of the 52 caller sites appear somewhere in the full capture.
The verifier recomputes 1,688 full narrow, phase-gated correlations across
exactly eight role_global caller sites and the four fighter roots $FF3000,
$FF3400, $FF3800, and $FF3C00. The body callback exposes a guarded active
user-stack top equal to the expected return PC. That is still an opcode
read/prefetch witness: it is not instruction retirement, untapped
adjacency, or full control-flow closure. The other 44/52 caller obligations
have no full witness here, and complete joint-state, exception, interrupt,
retry, and return-epoch domains remain UNKNOWN.
Repeatability receipt SHA-256:
480a0a779ac6d28c2fea2871c3717e27a59a3c576baa0d96cd7b4eff1ee03b57.
After two verifier fixes requested during independent review, the retained
package passes all 11 fail-closed adversarial tests and receives the bounded
verdict APPROVE_NARROW. Independent review SHA-256:
318db14af26dd587b1501fd15df2b322b9acccb26044445f1f7bab3821335063.
It still seals no Power Drain transfer and grants
zero gameplay, ledger, parity, build, release, or download credit.
Matrix M1 broadens the observed subset once
Matrix M1 is an append-only evidence package over the same private ROM V29; it is not another ROM version. Eleven fresh initial executions cover the neutral baseline, four CATCH configurations, four MP+MK partner-call attempts, and a non-fight CSS negative. Only productive discovery lanes are repeated, leaving 13 retained captures.
The two neutral B0 runs reproduce V28 exactly: 1,688 full narrow correlations, eight caller sites times 211, with byte-identical deterministic cores. Under M1's stricter post-orientation boundary, 1,680 rows remain, eight sites times 210. That hard regression had to pass before any discovery row could count.
Only C1 and C3 broaden the strict subset. Each byte-identical repeat records 32
rows at fixed-slot caller $CB50 while the same row also has scheduler A5
$FF8000, fixed A6 $FF3400, Rogue's active CATCH $20/$32, and the victim's
captured $22|$1C / $34|$36 state. C0 and C2 add no site. The four partner-call
lanes each retain 36 rows during the exact eight MP+MK press frames, but add no
caller and explicitly leave assist activation unproved. The non-fight N0 lane
records zero correlations.
The strict union is therefore 9/52, with $CB50 the only repeatable new
site and 43 caller obligations still unobserved. Broader post-attempt and retry
sightings remain context only. Retry pairing is non-consuming opcode-read/
prefetch chronology, not one-to-one execution or instruction retirement.
Matrix receipt SHA-256:
cf4c4c65a197edee4a849039f48064e5dc4b345d5e9c861ea98429c9dd8784da.
Repeatability SHA-256:
e7a5acb2ea6ccb27bef89b984a9b87b559ae7bde1981769c9c9af26d002a6163.
The pinned verifier passes before and after all 16 adversarial tests. Independent
review approves only this narrow design/result boundary, SHA-256
7e4be0a355dedd01c04474ba0ecfa9c8299a0cee3abbfa965cd85f49b7b90876.
Every gameplay, ledger, parity, release, and download credit remains zero.
Matrix M2 tests tag-once and closes nothing
Matrix M2 completed a bounded 12-capture ordinary-input tag experiment. The
baseline reproduced 1,688 V28-full rows in two byte-identical runs, and both
sealed $CB50 regression lanes retained 32 rows. Across all eight tag variants,
one four-frame HP+HK chord and natural release were observed, but the lifecycle
passed through a both-active interval instead of the required adjacent
point-only-to-bench-only transition. No contiguous 60-frame settlement was
observed.
Every tag lane therefore remains conservatively classified HOLD, not a successful tag discovery. No new caller was qualified: the observed union remains 9/52, with 43 obligations unobserved. The result grants no gameplay, ledger, parity, release, or download credit, so private V29 remains unpromoted and no Rogue patch is currently offered while the one-file builder is validated.
Matrix receipt SHA-256:
ed768342c393543d674b8a627b391b509f64442230516eccc4cade18010d70fe.
Frozen aggregate SHA-256:
328023088328a9c36e09d9ba3a60f52dd2166939deab8b0372ae5df4fa626ceb.
Independent review SHA-256:
dc4eaa8b2748ec86a994c764a3be1e101699540e28785f119a282329d5e49a5f.
The terminal verifier passes over 197 frozen files, and all 35 hostile tests
pass. Terminal seal SHA-256:
b093e339a1c5b8e8f04e2f51d4b41d4fe5ec6dd19cbe34a7cc84cf61caeb2248.
V29 restores one helper call — no gameplay credit
The newest linear artifact is private V29 SHA-256
573b7224c2160bc830d53ab5fba55389825727b5ff1ed81828983687333bf14b,
MD5 3fdcf6a54b973974d4e5b61f19101cd3. It is a direct child of exact V28,
not of the accepted V18b baseline. The exact-V28 helper census accounts for all
38 Rogue-blob calls to eight requested XMvSF helper families. Thirty-two still
ended in the fail-closed RTS family; one of those sites had a complete native
MvC homolog and an exact one-site recipe.
V29 applies only that recipe:
$39C19C 4eb90039cf8c JSR $39CF8C ; graft RTS stub
→4eb900014ef2 JSR $014EF2 ; native MvC inner resetThe six-byte request changes three logical DATA/OPCODE bytes and three raw
mvc.10 bytes. It adds no wrapper and consumes no cave. Every other ROM member
is byte-identical to V28; ZIP order and semantic metadata are preserved. The
builder check and 10/10 focused tests pass, including a fresh byte-identical
serialization. Build receipt SHA-256:
6c422a59b81bb3b793cc2113ac118e1d9d94c55c069f253eb427d245d8163db5.
This is the late D4=$08 global-reset homolog reached from Rogue's e6=$2E
terminal family. The V29 build receipt establishes that call boundary only;
at build time no emulator or guard was launched. The later V27 opcode-read/prefetch
trace supplied no evidence for this helper call. V28 records a narrow scheduler/
join subset but does not identify this helper call as an instruction-retirement
event or test its behavior; no clip was recorded, and no ledger row changed.
Walk/body-push should not be patched
from the old video report:
the exact V18b 24/24 gate is accepted and its program surfaces remain
byte-identical through V28; V29 does not touch them. CATCH 07 still releases
four or three frames early, Power Drain still lacks a complete source-family
contract, and Goodnight victim choreography remains broader than its accepted
pose window.
The prepared exact-candidate denominator is 2,956 ordered cases across 58
groups: 210 XMvSF source cases and 2,746 target cases, covering all 85 runtime-
testable ledger lanes. They remain 2,956 planned / 0 executed. The late
D4=$08 source/current/patched trace is an additional zero-case scoring
obligation over existing complete-special lanes, not a synthetic gameplay
PASS. A distinct sibling review independently reconstructs that matrix and
passes 30/30 adversarial tests; receipt SHA-256
83a9f1d92db59520c429aadd0cbf0f2605cef5fd3951cae7bd18243e208418b9.
That approval permits static catalog adoption only and grants no runtime or
gameplay credit.
The class-$48 cleanup lock remains separate. A later carrierless-acquisition
audit shows that delete-before-set can close same-address ABA only if every
nonzero or unknown writer of the four fighter-slot +$267 bytes passes
through one wrapper. That semantic writer denominator is not closed, and a
byte-exact fail-closed wrapper proof would still follow it. The native-move
promotion matrix therefore remains hard-locked and zero-credit pending those
ownership proofs, exact request/authority/capture binding, scored MAME
execution, and a new ledger revision. Neither V27 nor V28 satisfies that gameplay
matrix. The current audit receipt is
13fa0827324c60f4be9cccb1a38734e300866a32f6ea7cfb7d12be06e8014272.
The next Power Drain helper audit also stops before a ROM. It proves the
candidate-only one-site shape $39AE3E: JSR $39CF8C -> JSR $3AB22A, three
operand-byte deltas and no new cave, and closes 4/8 mandatory static gates.
But the inherited subtype-$08 evidence matches timing and expanded-cell
counts 12/12 while raw lists/attributes match 0/12 and transforms only 1/12.
That is not visible animation parity. The next blocker is a semantic map of
the 12 source records through list parts, attributes, transforms, tiles,
palettes, and rendered geometry; all-context owner roles, every-exit cleanup,
and independent review remain open. The 22/22-tested audit therefore grants no
postimage, build, runtime, or ledger credit.
The append-only geometry pass now resolves that surface question without
authorizing the patch. Native MvC $181BF6 repacks all 12 source bank-3
records into target bank 0: 12/12 oriented-cell sets, 303/303 cells, 12/12
alpha planes, 12/12 pen planes, and palette selector $0A->$10. Comparing
against target bank 3 fails all 12. The defect has narrowed to exact V29's
$3AB18A: MOVE.B #$06,+$47(A6); an eventual bounded repair would change only
the exact-site byte at $3AB18D from $06 to native $00. The preimage occurs
twice, so this cannot be a blind pattern replacement. Independent review,
live palette/RGB and cadence, cleanup, owner/player/facing coverage, and stock
class-$38 regressions remain open. The 24/24-tested receipt grants no ROM,
build, runtime, ledger, or parity credit.
Native-move R5 is now statically sealed for 572 fresh MAME processes: 156
stock-XMvSF source point cases, 312 exact-V18b point cases, and 104 contextual
bench cases. Its 42/42 Python tests, 5/5 Lua syntax checks, bundle recomposition,
and sealed R2/R4 lineage pass. Execution is intentionally locked and has run
zero cases, so it grants no gameplay, percentage, ZIP, or release credit.
Preparation receipt SHA-256:
2ff608d42961e81626d01918cf3e66a773010a372c9fa847f563a6d0aea02377.
R6 adds a hard-locked execution contract for only a two-case Repeating Punch
smoke—one source case and its matching public-V18b case. Its audit and 15/15
tests pass, but every runtime binding is null and execute exits 3. It cannot
launch, score gameplay, attribute a ROM failure, or authorize later phases.
Receipt SHA-256:
c521c20462d1cb0baf2cfe29b3401353dfaae099fcdecbad52d7846ef90b0c48.
The parallel R6 pointer preparation is still
HOLD_POINTER_NORMALIZATION_UNBOUND_ROM_NOT_EVALUATED: 0/9 R5 pointer
fields is reviewed or statically complete. It also exposed a contract conflict:
R6's proposed entries shape and EXPLICITLY_REVIEWED_FOR_PHASE_A status do
not satisfy R5's required fields/roles shape and
REVIEWED_EXACT_RELOCATION_MAP_BOUND status. R6 demands that reviewed map
before its smoke, while the map itself needs fresh observations first. Receipt
SHA-256:
1d7e39c61a229dbf98e05859ef1f5e22ea7186fbbfa1c2b20bee854727fc71b6.
R7 resolves that circularity only on paper. Its P0 bootstrap preserves the
exact 572-case R5 order to record nine raw pointer fields without comparison,
PASS/FAIL, ROM evaluation, or scoring. The static audit and 19/19 tests pass;
all 41 runtime/review/scoring bindings remain null. No emulator, capture,
map, runtime case, ledger row, or gameplay credit exists. Any eventual scored
run must recapture all 572 cases after independent map review. Receipt SHA-256:
b271c657a69272f3a86e1132e3983e21a06407c16442cb2213a7a6bcb765c1a8.
Later runtime-adapter work remains locked too. R8c closes three earlier static
defects, but an independent 10/10 adversarial review reproduces six activation
blockers: an authority-bypassing public spawn path, an asynchronous-exception
gap around spawn, request-controlled non-global locks, unsafe executable paths,
identity drift during the 572-case loop, and non-durable process quarantine.
R8c has executed zero emulator/guard/ROM cases and cannot be activated.
Independent rejection receipt SHA-256:
29da3282926370d9fd4242f6fa3cf27d60e57e4de9e3292370e9d097cb6d272f.
R8d is rejected too. Its production entry is hard-locked, but an independently
reproduced 14/14 adversarial suite reaches all 16 provider methods through a
public synthetic lifecycle path that never checks that lock. Provider identity,
global lock/nonce state, verified executable objects, fresh identity checks,
process-tree absence, and durable keeper transfer remain unbound assertions.
R8d stays unactivated and zero-runtime. Rejection receipt SHA-256:
b8393d85e0c27ffa67f6e8027855b3ccdd0e38eb1624dff34147cf61cb65a517.
R8e closes that public bypass only by deleting the runtime-adapter surface.
The whole-package AST audit finds no provider/backend, callable injection,
predecessor import, process/lock/filesystem service, or activation path. Its
zero-argument front door consists only of return 3, with all 18 future
runtime bindings null. Agent and independent root replays pass the audit and
16/16 adversarial tests. R8e is therefore a static tombstone, not an executable
successor, and still produces zero MAME/guard/ROM/runtime/gameplay credit.
Receipt SHA-256:
cea0f0a499a944fa2b2d24470d56c4e3c9a157040ca8165627825123c0b6a8b4.
The exact helper-route census accounts for all 38 relocated calls: 34 still
target the CLEAN RTS stub and four are promoted. Seven families retain RTS
residue. The $011600->$014EF2 homolog now has enough static ownership proof
to authorize exactly one private experiment at V18b's relocated $39C19C
call—not an integration, acceptance, or release claim.
That experiment is now built as quarantined private V19. It changes only
mvc.10, and only three logical data/opcode bytes at
$39C19F/$39C1A0/$39C1A1, redirecting $39C19C from the CLEAN RTS stub to
$014EF2. Independent --check, 9/9 focused tests, and archive integrity
checks pass. Its ZIP is SHA-256
31f17a70c4d00fbc0abf7dbd62997329634152ef21bd3e861cd473b4dca01c92,
MD5 be79abcc37985acc705ec849e9f946bf. No emulator was run: every matched
trace, owner/side, watchdog/throw, move, team/assist, and stock-caller gate is
pending, so V19 earns zero gameplay or parity credit and cannot be promoted.
Exact V18b remains the current 17/97 ledger candidate.
The newer private V20 archive is a separate direct child of exact V18b, not a
replacement for that baseline and not stacked on V19. It installs
identity-matched Goodnight victim geometry for Wolverine, Rogue, Gambit,
Chun-Li/Shadow Lady, and Zangief while deliberately preserving the existing
Ryu $12 route. Its deterministic static review passes; its SHA-256 is
f327cf7218e5994e0730c1d2b4465084960bbbbb15ee33ba770cb8d8ecc689a6.
It has never run and earns zero gameplay or ledger credit. The first V20
correlated trace/scorer proposal is also hard-locked: independent 12/12 tests
show that stale sessions, reversed/interleaved events, wrong tap/PC pairs, and
a self-consistent changed manifest can pass. V2 rejection receipt SHA-256:
41fca6836ea21471d5be7f94d7d6fa33c6bfdec2b7657060be7235796bc9b5c6.
The append-only V3 replacement now passes independent static review. It begins
only at the exact captured-victim leaf $01418E, requires one contiguous
same-frame path through $39F9E0, $3AB000, optional fallback $014236,
order-only $014254, and exact A3 checkpoint $014284, and validates every
complete repeated session. Stale/interleaved streams, identity substitution,
and wrong-but-even fallback bases fail closed. The frozen surface is 64 mapped
target lanes, 128 exact-base fallback lanes, and 24 unscored source lanes. Root
replay passes 12 generator, 20 scorer, and 10 independent tests plus Lua
syntax. This proves selector route/A3 arithmetic only; command, contact,
choreography, gameplay, and ledger credit remain zero. Independent review
receipt SHA-256:
df2cd63b6a079316d6f881c8b74fae21ece521307638b8d160d34bb558943bec.
The reported Power Drain heart now has an exact-V18b/V20 static transfer. The
source Rogue palette, decoded visible heart tiles, list transforms, normalized
animation, motion table, constructor, and complete class-$84 producer surface
are preserved. That authorizes no color patch; a matched exact-build live
matrix is still required. The separate late class-$48 helper retains older
defects but was not the visible kiss particle. Static receipt SHA-256:
adfc2f0074939918a0386c7e6b2580a4a622a42fa8b5c0e6a7193ae72fe6cf64.
An independent 9/9 adversarial replay confirms the source-exact transfer and
the no-color-patch boundary; review receipt SHA-256:
c4597771aa294d32da8c0f29810d702088c1980a6a7bf9a7e73238fa42d7d736.
Heart presentation remains OPEN and latch/steal remains HOLD.
Private V21 is a static-only child of exact V20, SHA-256
d5d0cb249afba1c295009cd14214b920e935d4436b64997169180b7f18a2df0e.
Across the same 28 class-$38 callsites, its route census changes from 25 RTS /
2 native / 1 Goodnight to 24 RTS / 2 native / 1 Goodnight / 1 Repeating Punch.
The new child carries target-private $5250 (RP) routing metadata. Outer
router $3AB156 sends that tagged subtype-$08 object to translated handler
$3AB176 and tail-jumps every non-RP object to the unchanged $39E456
Goodnight router. $3AB176 maps only source $066134..$06617B; $06617C
begins the separate class-$3C constructor and was deliberately excluded.
Only mvc.10 and mvce.03a differ from V20. Build receipt SHA-256:
b7d6f5f13794f91deef70e06bd54d20e71da8ba3b257ec8ff8ccd107307682d7.
Maintained 11/11 and independent 14/14 adversarial tests pass with verdict
APPROVE_PRIVATE_STATIC_ONLY; independent review SHA-256:
e3ca0a6d5338657066a817a60687dc59d7502bc834973465f16aeb1928ade652.
This is not a runtime result. All eight live gates remain, it grants no
gameplay, parity, or ledger credit, and exact V18b remains the 17/97 baseline
with 79 blockers.
Private V22 is the first exact current-QSound descendant of V21. Its SHA-256 is
ac41a2abaec73362a27eb28d4000bcf2b6627555ad3db5caca08d02188b8502c.
It changes the opcode hook, one 128-byte action row, the owner transport, and
the four QSound members—nothing else. The static package has 35 source actions,
31 row actions, four common gameplay actions, 28 PCM clips, and all samples
contained within their $8000 windows. Maintained 7/7 and independent 14/14
tests pass. That is static packaging, not proof that the voices sound
normal. Natural owner posts, pitch, rate, loops, duration, missing/chipmunk
audio, stock interference, and extended play still need exact-hash recordings.
The next defect was not another missing move. V21 had introduced two
target-private pool-C tags at object +$6E: Goodnight $4753 and Repeating
Punch $5250. Both MvC allocators clear only $00..$5F, and native free
$0044E6 never clears +$6E. A reused slot could therefore carry the wrong
identity into the next object.
Private V23 implements a statically verified patch for that narrow lifecycle
surface. Its SHA-256 is
7f7f9f4f865fbb89dee2c373c095ce3083b2619479c6f672a7cae0dc44aec69f.
Only mvc.10 changes, with 89 logical bytes. RP and Goodnight clear +$6E
before native free. The RP landing class-$3C call uses a private clone of the
already-correct native constructor and clears inherited metadata only after a
successful allocation; the failure displacement changes $34->$38 so failed
A0 is never touched. The shared constructor, handler, vector, and V22 audio
remain exact. Maintained 7/7 and independent 14/14 tests pass. This still earns
zero gameplay credit.
The specific report that Ryu looks like he is merely jumping upward with Rogue
was checked separately. Exact V23 still contains the accepted captured action-
$34 implementation: all six keepalive-3 sites, the class-$10 route, Ryu's
$12->$39FA00->$014254 selector path, the animation/list regions, and all eight
GFX members are statically preserved. That does not transfer the old video
evidence. V20's selector and V23 have never been run, and V23 changes the final
Goodnight cleanup route, so a fresh exact-V23 capture is still mandatory;
roster-wide victim choreography remains OPEN.
The V23 lifecycle plan inherits V21's 120 RP rows once and adds 424 exact
cleanup/reuse/failure/negative rows, for 544 total. Its checker, 12 maintained
tests, and 18 independent adversarial tests pass. Every row is unexecuted;
recording clearance and request binding are null, authorized commands are
empty, and activation is HARD_LOCKED.
The animation census also corrected the broadest visual assumption. Public
$06 and secret $26 each expose 278 addressable actions through the same
physical tree: 1,488 records, 238 jumps, 784 actor lists, and 14,359 mapped
tiles. All 14,359 tile payloads are byte-exact and the reachable tree contains
zero unexpected Hulk-residue tiles. The closed mismatch set is seven timing
records and six actor-list records. One empty EFFECT-00 stub explains all 19
unreachable Rogue tiles. Nine named hypers—111 records, 74 lists, and 2,100
tiles—have no static timing or actor-semantic mismatch. Public palette data is
96/96 words exact; Shadow Rogue intentionally differs 48/96. The independently
reviewed core program projection is 126,704 bytes across 20 intervals.
That does not prove the supers render correctly in play. Effect ownership, background/cut-in routing, palette selection, cleanup, and retained-roster negatives remain live gates, so no graphics patch was issued. A first visual preparation was rejected because its broader surface omitted 328 core cut-in bytes. Append-only V2 restores those bytes and proves a 127,282-byte, 17-interval superset while leaving the hard-locked plan unchanged: 2,628 HOLD rows, including 2,308 developer-menu/injection rows that can never earn parity credit and 320 natural or natural-route-pending rows. No command, screenshot, capture, or runtime result exists.
Audio and pacing therefore remain live blockers. Exact V18b still has its mixed QSound row, while V22/V23 are quarantined static children. The ordinary owner-post design defines 216 future processes but has run zero. The split- clock speed design has also run zero; each owner still needs 120 cumulative within-gameplay-segment host-monotonic seconds and 240 samples in a throttled, audio-enabled same-hash run.

Why Jin looked right
Storm fitted Jin's freed bank-3 space: 12,329 new slots against 12,873 freed, +544. That measurement is why Jin's chair looked like the right place for an X-Man.
Rogue is not Storm. Same method, Captain America kept in the survivor set, zero reliance on "0xFF means free" as ownership:
- Jin exclusive (supply)12,873tile slots
tiles no surviving roster member references
- Rogue new slots (demand)14,212tile slots
14,359 source tiles minus 147 survivor-shared
- Bank 3 all-0xFF non-char656tile slots
candidates, not owned
two guests, one chair
Jin’s chair, two different X-Men
Storm was the fit. Rogue is the one I wanted.
- Storm in Jin's chair+544 slots / +4.4%Storm needs12,329Jin frees12,873
margin +544
- Rogue in Jin's chair-1,339 slots / -9.4%Rogue needs14,212Jin frees12,873
margin −1,339
Cap stays. Cap's exclusive GFX lives in bank 0. Jin's lives in bank 3. A fighter
addresses exactly one bank. Early Storm/Magneto playtests showed leftover identity:
Magneto's cut-in still Captain America, Storm's HUD still printed JIN. A tile
budget that "fits" while the HUD still says Jin is not a replacement. Magneto and
Storm later closed two natural P1/LP identity paths on a separate candidate;
Storm's gameplay HUD still says JIN. H-bank expansion of a clean Euro parent was
authorized as a fallback while the Jin ledger stayed red. It is not the product.
expand_vanilla_hbank_authorized is false on this path.
The chair that actually opens
The unified Magneto article already measured this
family: Hulk $06 and Orange Hulk $26 share 100% of their tiles. Deleting
Hulk alone frees literally zero. Deleting both frees 16,427 exclusive slots
in bank 2.
Magneto did not spend that opening. He sat on Captain America $04 with MAG_TREE
in the expansion band. Dual Rogue spends it.
- Hulk+OH exclusive (supply)16,427tile slots
palette pair; both ids or nothing
- Rogue new slots (demand)14,151tile slots
14,359 source minus 208 survivor-shared in bank 2
- Leftover pinned as armor2,276tile slots
Shadow Rogue idle keeps reserved Hulk armor tiles
bank 2 after the family leaves
What Dual Rogue actually consumes
- Hulk+OH exclusive 16,42716,427 tiles14,1512,276
Select graph is 15 public ids. $26 is the existing Orange Hulk secret box,
not a second grid cell. Hulk's public cell is row 3 col 2, palette $02.
Parent is vanilla Euro mvsc md5 e7dbef6dd363c11fddd12f0d446f647b. Source is
xmvsfj.zip md5 3d424538843cfce0e03b96d73277f60b. The historical
early-candidate archive—not V18b and not currently offered—was named
mvsc_rogue_hulk_v1.zip, md5 a6c411ce0e9c0f35ac41a1b03bdb1fe7, SHA-256
4651010a2af0b5163e43dcb10f40d91ceff416a92761c3bec14c1f2ab7daee9f.
What the live stills actually show

Shadow Rogue is Shadow Lady, not a dim Rogue
The first secret seating darkened XvSF Rogue in place. Word0 landed at $07A9. That read
as a tint, not as a character. Stock Marvel vs. Capcom already owns the pair that
should sit here: Shadow Lady’s two palettes on $1C92E4 — navy on P, magenta on K,
mahogany skin on both.
$1C9164 is a role remap of that row onto Rogue’s pens. Dual Rogue’s layout is
not Chun-Li’s. Pen 0 is the white streak. Pens 1–5 are peach skin. Pens 6–8 are gold
hair, gloves, and boots. Pens 9–10 are the khaki jacket. Pens 11–13 are the green
leotard. Pen 14 is lips.
Putting Shadow Lady’s gold $0FF0 on Dual Rogue’s gold pens painted a yellow bodysuit.
Navy belongs on the gold and the green: $0248 / $0127 / $0115 / $0004. Skin
stays mahogany $0510. The streak follows Shadow Lady’s white→navy. Lips stay burgundy
$0810. K is $0A47 / $0713. Live secret palram matches that row: rom0=$248 live0=$248 mismatches=0. Public Dual Rogue $1C8344 stays the undarkened XvSF row.
Unlock still uses LP, so the live secret match shows the P colors.
A palette-only remap cannot split hair from skin: both still share pens 1–5. If the 100% pass wants a white streak on mahogany without painting the hair navy-adjacent, that is a later GFX seat, not a second pal row.
The yellow smear was Hulk EFFECT 00
The first Dual Rogue seating still ran Hulk’s hit spawn for L1 group 24: a 24-smear
EFFECT list that stuck in the stage sky as a yellow blob (live idle window y 67–92,
x 3–83). That is not Rogue art. stub_l1_spritelists() now points group 24 at an
empty mode-4 sprite list at $28A3F6 on both public and shadow trees (67 sites each).
After the stub the same idle window has 0 yellow pixels. The stub stays until her
own dash-trail EFFECT is seated — part of the same 100% pass as her 68K.
The super window is a mask, not a rectangle
An earlier seating pointed Hulk's hyper at XvSF KAO faces ($2A75DA) — the 144×64 select heads from $0FB432. Those are not in-match cut-ins. Stock MvC hypers at $0C15EA are 176×224, origin (0,0), with a thick jagged black left edge. Ryu's is the reference. Painting Hulk's shared hyper tiles in place is forbidden: 44 opaque tiles belong to other characters.
The donor bust is XvSF table $0802C4 index 2: Rogue cel $2A6A24 (208×240), P1 pal $11A45C, P2 pal $11B07C. P1 and P2 are palette rows, not two cels. Cover-scale ate her fists and hair. compose_mvc_cutin.py now contain-scales the full opaque bust into the interior box past the p90 jagged tooth, left-aligns, and inks a 4px black stroke only on the jagged left edge. Shared Hulk hyper tiles stay untouched. The result is a new 1×1 cel on sole-owner tiles in blank GFX $1A000–$1C000.
Hulk's hyper record $0C15FA now points at $28BE38. P2 is $0C1A1A. VS KAO records stay KAO. Live MAME fills fraction $FF3273=$FF and stock $FF3274=$03, then QCF+PP. Stock drops from $03 to $00. The cut-in cel is hers. The super kit is not. Live play still crashes, glitches, and can become Ryu.
Win portraits are a different table ($080224) and a different pose. Rogue's smile, hand-out / hip cel is $2A576A with pal $11BFDC (word0 $0DD6). Storm's $11BF3C is the wrong row. That bust is blit-centered onto Hulk's win canvas as cel $28C276, then hung on $0C14D2 / $0C1572 / extra family $0C18F2.
SPECIAL 00 was the first live special
Hulk's first special is Gamma Charge: charge back, forward + punch. HIT EDITER group Char Gp $2C sub $00 still prints SPECIAL 00. The animation pointer is Rogue's dash at $3D0636. That seating was her body on his charge recognizer: the first proof that a special slot on this chair could play her art. The yellow charge smear that used to trail her is Hulk EFFECT 00; that list is now an empty sprite list.
The continued 100% pass does not stop at that dash. Her CLEAN 68K now owns a detector. Power Drain is live on the same chair.
Her 68K sits in CLEAN
The freeze still holds: vanilla Euro mvsc only, no XvSF 68K copied onto Hulk’s
window at $02F6FC. That window stays parked so versus construction at $030E28
still has a legal family successor. CODE_DIR for Hulk and Orange Hulk still
points at $03050E / $030516. Init at $00D14C still runs $00A4B0, which is
how $00A4CE uploads the body palette. Her fight 68K lives somewhere else.
CPS-2's opcode and data views differ through the encrypted word beginning at
$100000. Exact V29 reads DATA 0800 and OPCODE 6B41 at that boundary;
data == opcode begins at $100002. In Hulk's first-megabyte window the
views agree on about four words in a thousand, so a Rogue overlay that looks
right as opcode can still read vanilla Hulk as data. Rogue's blob at $399816
is safely in the equal-view region, and its PC-relative tables read what the
detector expects.
The blob lands at $399816. Reloc delta $372B82. The detector at $39C6F0
copies XvSF $026508–$026C94 — normals through Power Drain — including the
stolen-id dispatcher at $026780. That dispatcher is move.w $342(a6) into a
per-victim QCF, not a meter table. Ryu indexes $08. Strider indexes $0E. Copy
it through so QCF after the kiss latches the move she actually stole.
Tail used 2,616 bytes with 904 of headroom. Receipt status
STATIC_PAL_SAFE_GRAFT_CLEAN. Matcher $013C30 keeps the vanilla family successor
$019710. Eligibility $012450 keeps $017486. Magneto’s fight 68K lives at
MAG_TREE $588000 in the expansion band. Those are two different answers to
“where does the guest’s brain go.” Dual Rogue does not take Magneto’s expansion
path. She takes the empty CLEAN that the first megabyte would have lied about.
- 1blob$399816–$39C6F0 · 11.7 KBdata == opcode; reloc delta $372B82
- 2detector$39C6F0–$39CE7C · 1.9 KBXvSF $026508–$026C94, stolen-id dispatcher $026780 included
- 3tail veneers$39CE7C–$39D128 · 684 Bpal wrapper, spawn, type $48 hook $39D0A8, grab $39D0CA
- 4headroom$39D128–$3A0000 · 11.7 KB904 bytes
- Adetector$39C6F0 · marker
- Btype $48 hook$39D0A8 · marker
- Cgrab veneer$39D0CA · marker
Power Drain is live
Power Drain is QCB+LK. The live question is not “does a special fire.” SPECIAL 00 already proved a slot can play her art. The 100% question is whether her kiss holds the person she kissed, writes the steal, and then lets her fire their QCF.
The grab veneer at $39D0CA is 94 bytes. QCB can turn Dual Rogue away from the
victim, so the veneer compares $c against the opponent and writes facing into
$4b and $b3 (0 = right, 1 = left). It snaps the victim $24 pixels in front
of that facing, JSR’s Rogue’s hook $39BCE0 ($02915E), then JSR’s MvC attach
$0187EE so the pair take actions $32 / $34. Opponent $a8 is pushed, the
attach runs, $a8 is restored. Stock $0187CA is the same attach plus
move.w $52, $a8(opponent). That extra write is how a defender’s X leaves the
kiss and lands on the far side of the screen. The veneer is the attach I want,
without that write.
Live Dual Rogue $06 vs Ryu $12, public yellow and green, zip md5
a6c411ce0e9c0f35ac41a1b03bdb1fe7:
- age 16: still walking in,
face=$01,p2x=132 - age 20:
action=$32 group=$20 p2act=$34 face=$00 p1x=79 p2x=115 steal=$0012 - age 204: stolen Hadouken latch
special=$08/ group$2Csub$18
Thirty-six pixels. Face flipped toward Ryu. Steal id $12. That is her kiss,
then her stolen QCF. The detector did what $026780 is for.
The next 100% slice on this same object is the projectile. MvC type $48 is Ryu
Hadouken at $072A80. Its first instruction is a PC-relative table fetch
(move.w table(pc,d0.w),d0 / jmp table(pc,d0.w)), so the head stays vanilla —
a six-byte JMP there clobbers the fetch. The isolated jmp $0135E6 at $072B14
already trampolines to CLEAN $39D0A8: parent $54, steal $37A, write $52,
then the stock D1 walk. The spawn veneer at $39CED8 already copies
$37A → $52 before it writes type $48. XvSF oracle vs Ryu is life 144→132,
debit 12, special $08. That debit, on this zip, is the measurement I am still
taking. Same veneer discipline. One more field.

The 100% pass
The 100% pass is one seating, taken further, until Dual Rogue is the fighter I
play in XvSF — on a vanilla Euro parent, without expanding the ROM, and without
copying her 68K onto $02F6FC.
Every closed slice on this chair used one method. Name the XvSF oracle. Find the
MvC object that already speaks that language. Write a veneer that is small enough
to live in CLEAN. Live-gate it. Keep the stock path that versus construction
still needs. The kiss is that method: $0187EE is MvC’s attach, $39D0CA is the
94 bytes that face, snap, and restore. The stolen QCF is that method: $026780
came with the detector. Type $48 is that method in progress: vanilla head at
$072A80, isolated trampoline at $072B14, steal already on $52 before the
type byte.
After debit, the named slices are the same job. The following is the live remainder recorded on the historical early candidate, not a claim about exact V18b and not a short-harness promotion:
She still plays like Hulk. The button-to-group map on this chair is still
Hulk’s, so Gamma Charge / Gamma Crush fire in her slots and her own specials
do not. After a special she can glitch into playing like Ryu — stolen-id
leftover from $026780, not a second character on the roster. The Street
Fighter supers she should be able to use after Power Drain do not work. Her
own supers do not behave. Matches still crash.
Getting her to XvSF level is the rest of the 100% pass: measure those oracles
in X-Men vs. Street Fighter, write veneers that speak MvC, live-gate them,
keep Hulk’s window $02F6FC parked. Copying XvSF 68K onto that window is not
the path.
Assists and DHC at $07A242 / $09DA20 still carry Hulk’s partner kit because
Rogue never had a row there. PCM $3A0..$3BF remaps the IDs, but audible exact-
V18b voice/rate parity remains unaccepted. The complete source command census
contains no persistent flight mode; jumps, super jump, air dash, dash links,
and air attacks are the real movement requirements. An early short MAME harness
PASS is historical evidence for its own hash, not an exact-V18b playtest.
historical seating baseline
What the early candidate had seated
These rows describe the early graft receipt and its own candidate hash. They do not override the exact-V18b acceptance ledger above.
| route | public $06 | secret $26 |
|---|---|---|
| tiles / tree / pal | verified | verified |
| HIT names + slots | verified | bridgedalias $26→$06 |
| HUD word | verified | bridgedSHADOWROGUE glyphs exist |
| hyper cut-in | verified$28BE38 cel | verifiedsame cel, P2 pal |
| her specials | bridgedHulk recognizer; not hers | bridgedsame |
| her own supers | bridgedcut-in only; kit is Hulk’s | bridgedsame |
| stolen SF supers | bridgeddo not work in play | bridgedsame |
| win portrait | verified$28C276 · pal $11BFDC | verifiedextra family +$420 |
| versus pal upload | verified | verifiedShadow Lady navy · $0248 |
| select grid / wordmark | verifiedv6 $2A576A smile | bridged100% pass: $26 large figure |
| HUD portrait | verified1px rails + E outline | verifiedsame $6EC6 |
| EFFECT 00 smear | verifiedstub $28A3F6 | verifiedsame empty sl |
| 68K CLEAN blob | verified$399816 | verifiedsame graft |
| Power Drain kiss | verifiedgroup $20 · $24 snap | bridgedaliased $26→$06 |
| stolen QCF latch | verifiedspecial $08 steal $0012 | bridgedsame detector |
| stolen projectile debit | bridged100% pass · type $48 D1 | bridgedsame slice |
| live stability | bridgedplays like Hulk; after special can be Ryu; crashes | bridgedsame graft |
| QSound IDs | bridged$1E0→$3A0 remap | bridgedshared row |
| PCM / assists / DHC / air movement | bridgedexact-V18b acceptance still open | bridgedexact-V18b acceptance still open |
What we are doing better now
The Jin draft treated expansion as the authorized next step after a red ledger. The better move was to spend a chair the Magneto plan had already priced and then not used.
The editor side is the same instrument as Magneto and Storm. Dest dump profile
rogue-mvc keeps overlay 0, accept_label HULK, live id $06. Join v5 closed
the four ETC cells that stock-shape mapping parked at MvC 29. Scoreboard:
196 HIT, 197 dest, names 100%, slots 100%. Details live in
the harness post.
The 68K work is the same discipline taken further. An earlier pal-upload skip at
$00A4CE greyscaled the body and crashed before versus, so versus upload stays
the stock path: do not poke $FF3052. Hulk’s window $02F6FC stays parked.
Her blob sits in CLEAN $399816 so opcode and data agree. Power Drain can
kiss. SPECIAL 00 was the first live special on this chair, and it is still
Hulk’s recognizer. The 100% pass is that same seating, continued until she
plays like the Rogue in X-Men vs. Street Fighter: her specials, her supers,
stolen Street Fighter supers after Power Drain, a match that does not crash
or turn into Ryu. Assists and DHC, PCM $3A0, and source-exact jumps, super
jump, air dash, dash links, and air attacks. The source census contains no
persistent flight state. I keep taking her toward the fighter I play in XvSF.
That is the project.
From helper to Dual Rogue

GATE_rogue_id06.png; sprites/rogue-gate
Name the XvSF tree
id $06xmvsfj.md5 3d424538…
Render gate: bomber jacket, white streak, flight pose. xmvsfu.zip was damaged. Decryption was never the story.
COVERAGE 15% OF THE ANIMATION TREE
Read this sectionneed 14212 freed 12873 margin −1339PHASE2_ROGUE_JIN_GFX_PROBE.json
Jin's chair is short
−1,339exclusive-only margin
Storm fitted. Rogue does not. All-FF still short. Other-nonchar is not owned.
COVERAGE 30% OF THE ANIMATION TREE
Read this sectionexpand_hbank = false Jin occupied by Storm parent md5 e7dbef6d…rogue_hulk_allocation_ledger_v1.json
Retire h-bank as product
falseexpand_vanilla_hbank_authorized
Vanilla Euro 21-member set. Storm already occupies Jin. Leftover HUD-says-JIN is a failed eviction, not a port.
COVERAGE 40% OF THE ANIMATION TREE
Read this sectionRetracted here
Jin $18 plus h-bank is the Dual Rogue pathneed 14151 freed 16427 armor pin 2276PHASE2_ROGUE_HULK_GFX_PROBE.json verdict FITS
Spend the Hulk family
+2,276exclusive margin after armor pin
Same two-slot fact the Magneto costing published. Magneto sat on Cap instead. Rogue takes $06 and $26.
COVERAGE 60% OF THE ANIMATION TREE
Read this sectionHIT 196/196 overlay 0 accept_label HULKROGUE_L1_TO_MVC.json; ORACLE_SCOREBOARD.json
HIT oracle 196/196
100%names and slots
Dest overlay 0. accept_label HULK. ETC cells resolve at editor L1 26, not mapped 29.
COVERAGE 85% OF THE ANIMATION TREE
Read this section
live/public.log RESULT=PASS
Live match body
48 / 48palette words at $914000
HUD word ROGUE. Select grid and wordmark are Rogue. Hyper and win cels are seated. EFFECT 00 smear is stubbed. CLEAN 68K and Power Drain come next on the rail.
COVERAGE 78% OF THE ANIMATION TREE
Read this section
compose_mvc_cutin.py; Hulk rec $0C15FA
Jagged hyper cut-in
$28BE38new 1×1 cel, not KAO
XvSF $2A6A24 contain-scaled past the jagged tooth into Hulk’s 176×224 mask. Live QCF+PP consumes stock $03. Shared hyper tiles were not painted. Win cel $28C276 from $2A576A pal $11BFDC.
COVERAGE 86% OF THE ANIMATION TREE
Read this section
destination_hit_deep/g005_s000.png; live/special snapshots
SPECIAL 00 live
CG $3D0636Rogue dash, Hulk recognizer
HIT EDITER prints SPECIAL 00. Charge-back, forward + LP in MAME plays her dash. Hulk EFFECT 00 is stubbed to empty sl $28A3F6.
COVERAGE 90% OF THE ANIMATION TREE
Read this section
live/secret.log RESULT=PASS BODY_PAL mismatches=0
Secret $26 versus pal
$0248palram word0 at $914000
Unlock bit 2, Up from Ryu, Up+LP on $26. Directory $1C9164 is a Shadow Lady role remap: mahogany $0510, navy on gold and green pens $0248/$0127/$0004, K $0A47/$0713. Do not poke $FF3052 after versus; $00A4CE already ran.
COVERAGE 92% OF THE ANIMATION TREE
Read this sectionL1 group 24 stubbed public 67 · shadow 67 idle yellow px = 0PROGRAM_SEAT_RECEIPT.json effect_stub; live/public 0001.png
EFFECT 00 stub
$28A3F6empty mode-4 sprite list
Group 24 was Hulk’s yellow dash smear stuck in the sky. Both trees now point 67 sites at an empty list. The stub stays until her own dash-trail EFFECT is seated.
COVERAGE 94% OF THE ANIMATION TREE
Read this sectionblob $399816 detector $39C6F0 window parkedROGUE_68K_GRAFT_RECEIPT.json STATIC_PAL_SAFE_GRAFT_CLEAN
CLEAN 68K graft
$399816blob · detector $39C6F0
Hulk window $02F6FC parked for versus init $030E28. Stolen-id dispatcher $026780 indexes $342 onto per-victim QCF. Tail used 2616, headroom 904. No XvSF 68K copy onto $02F6FC.
COVERAGE 96% OF THE ANIMATION TREE
Read this section
live/absorb.log age 20 / age 204; grab_setup_route $39D0CA
Power Drain kiss + steal
group $20steal $0012 · QCF $08
Grab veneer faces, snaps $24, JSR $39BCE0, JSR $0187EE, restores $a8. Live vs Ryu: age 20 p1x=79 p2x=115 p2act=$34; age 204 special=$08. Stolen type $48 debit is the next 100% slice.
COVERAGE 98% OF THE ANIMATION TREE
Read this sectionstrict union = 9 / 52 new repeatable site = $CB50 behavior credit = 0V28 REPEATABILITY_RECEIPT.json; Matrix M1 MATRIX_RECEIPT.json; Matrix M1 INDEPENDENT_REVIEW.json
Matrix M1 broadens strict coverage once
9 / 52full narrow caller witnesses
V28 establishes the byte-identical 8/52 neutral baseline. Matrix M1 repeats it, then adds only fixed-slot $CB50 in two exact active-CATCH lanes. The other 43 callers and complete execution/state/exception/return domains remain UNKNOWN.
COVERAGE 98% OF THE ANIMATION TREE
Read this section
Magneto’s two-tree story and this one share a lab:
the unified Magneto article,
the nested HIT harness.
The helper I always picked is on the roster cell. The square is her smiling
XvSF bust, not a tiny idle body. Her 68K lives in CLEAN $399816. Exact V18b
has real bounded passes, but its ledger still carries 79 OPEN/HOLD/FAIL
blockers and no completion percentage. V28 establishes the 8/52 neutral
read/prefetch baseline. Matrix M1 repeats it and adds only $CB50 during two
exact active-CATCH configurations, moving the strict subset to 9/52. Those taps
do not prove instruction retirement, one-to-one retry execution, caller
closure, or behavior. The other 43 caller obligations and the complete state,
exception, interrupt, retry, and return-epoch domains remain UNKNOWN. The
12-capture Matrix M2 tag experiment qualifies no additional caller: all eight
tag variants remain HOLD because their lifecycle crosses a both-active interval
and never reaches the required contiguous 60-frame settlement. It awards zero
gameplay or release credit, and the Rogue download remains temporarily withheld.
The locked 572-case
native-move matrix, CATCH choreography, full moves and combos, audio,
presentation, team/stock regression, and one same-hash manual run remain
downstream. That is the rest of the project, not a caption.










