case studyUpdated Aug 30, 202671 min read$31

I Always Picked Rogue as My Helper. She Took Hulk's Chair.

I wanted to play as the helper I always picked. Rogue took Hulk's slot, but borrowed machinery still blocks a finished fighter—and the download stays withheld.

Download status · Every public patch

Jump to evidence
cps2marvel-vs-capcomxmvsfroguehulk
CPS-2 Reverse EngineeringPart 38 of 43
Browse all writing
On this page

I always take Rogue as the helper.

When I pick two characters in Marvel vs. Capcom, she is the one who comes in to save me. Other people spam Colossus and the assists that actually annoy you. I found out in certain tournaments that Rogue ranked lower, so you could take a higher-tier point character and still score. I kept picking her. She looked cool. Nobody used her. So I kept using her further and further.

That is the whole reason this ROM exists as an idea. I have been playing with her as a helper for so long that I wanted to play as her.

Jin's chair looked like the right place, because Storm had just fitted it. The probe said Rogue does not fit. The chair that actually opens is the one the Magneto costing reserved and never spent: Hulk $06 and Orange Hulk $26, a 100% tile-share pair. Evicting one frees zero. Evicting both frees bank 2.

Exact V18b status — 2026-08-25

The current acceptance candidate is private V18b SHA-256 fe6b487b7f75fe7b562e549892e872a492d92060001956fe0ef34b099195cdc5. Its fail-closed ledger fixes the denominator at 97 requirements: 17 ACCEPTED, 1 WAIVED, 63 OPEN, 15 HOLD, and 1 FAIL. That leaves 79 blockers. The project does not convert infrastructure rows into a completion percentage, so parity remains null, playability remains false, and a parity release remains unauthorized.

The previous 30 August V18b playtest package is no longer offered. A new one-file builder is in validation, and its download is temporarily withheld. That distribution change closes no ledger row and does not promote V29, parity, or full playability.

What is accepted is deliberately narrow:

  • walk and idle body-push: 24/24 across both Rogue owners, sides, and facings;
  • stolen Hadouken metadata/hit/block/chip/debit: 24/24, plus 8/8 combo cases and 8/8 negatives;
  • Goodnight pose and captured-stun scope: 8/8;
  • bounded point/bench placement for Hadouken and Goodnight: 8/8.

The clip that made Ryu look as if he were simply jumping beside Rogue came from the quarantined failed V13 archive, but the visual report remains open rather than being dismissed with that provenance. Exact V18b's eight-lane capture is byte-exact to the accepted private-V16 regression; it is not a fresh XvSF source comparison. The earlier source matrix reached only 5/8 exact 93-sample pose windows, 7/8 exact held-stun windows, and 0/8 source-exact complete release trajectories. A new same-MAME source/target gate must bind action, phase, relative XY, velocity, unique victim OBJ ownership, and the composited PNG on the same frame before the “jumping beside Rogue” observation can close. The ledger therefore accepts only the narrow historical pose/stun regression. Full victim choreography, natural command access, damage, presentation, release, and cleanup remain unaccepted.

That does not accept the complete moveset. CATCH 07 is the one exact ROM FAIL: source release is +140, while V18b releases at +136/+137. The sealed all-phase evidence observes damage, positional displacement, and both-fighter idle in all 32 positive Ryu lanes with zero watchdogs. That is a narrow functional result, not the full slam gate: damage RNG was unset, and seeded damage, victim stun/pose, ground contact, cleanup, a fresh throw-idle gate, extended play, and negative lanes are absent. Selector, geometry, and launch remain HOLD; slam, damage, stun, and recovery remain OPEN. Exact V18b already contains record-1 param $0100; the old $0100 watchdog belongs to an earlier isolated child. Independent review receipt SHA-256: f8f1b2ddc7b35b04c1cd28774cd4efe962c1975c02dedaa609c3f4b193109cac. An earlier scheduler attempt produced no evidence: its staged XMvSF key was wrong, so MAME never left startup screens, and that capture root remains retired. R6 derives the correct 20-member source archive with key SHA-1 65905400f4462c175baa93b43e015e8596def31b and preserves all 19 non-key members; that repaired staging only. The later reviewed V27 diagnostic records ordered exact-V29 opcode reads/prefetch at $E62 and $CEA1A, but records $CA34=0 and $D970=0. V28 advances the observer into an ordinary-input Rogue-versus-Ryu match and records both addresses. Matrix M1 then varies owner, identity, facing, CATCH, and assist-attempt lanes and broadens the strict read/prefetch subset by one caller. Neither package proves instruction retirement or behavior, and no Power Drain scheduler lane or gameplay case is accepted. The source command census also proves Rogue has no persistent flight mode; the real remaining movement scope is jumps, super jump, air dash, dash links, and complete air attacks.

Exact V18b ordinary-input replay — 2026-08-30

This exact-V18b ordinary-input move replay stayed on the published candidate bytes, SHA-256 fe6b487b7f75fe7b562e549892e872a492d92060001956fe0ef34b099195cdc5. It did not test private V29 and did not build another ROM.

The signed-side FBNeo diagnostic completed 26 unique captures: 13 native Rogue lanes for public $06 and the same 13 for secret $26, with ordinary two-player controls and passive Ryu $12. Setup X was $0100; every lane kept its required positive signed distance (+64, +72, or +240), with zero side flips, zero out-of-bounds targets, exact owner identity, and intact fighter pointers.

  • 8 PASS: forward air dash, the no-back-air-dash negative, airborne PP as attack-not-dash, and back+PP as attack-not-dash, for both Rogue owners.
  • 18 HOLD: ground/air/rising Repeating Punch, Power Dive, and Diving Kick contact lanes. Their state/action, child, cleanup, identity, pointer, and signed-geometry checks all pass. Natural one-run damage remains non-gating until a matched-RNG or predeclared distribution gate exists.
  • 0 deterministic move-contract failures, 0 invalid, 0 missing. That is the result of the move-specific signed scorer, not a claim that all generic gate receipts pass. The generic receipts also require move-specific QSound proof, which this diagnostic explicitly excludes.

Receipt SHA-256 is 76b7e4ced057f66bfd5d1739da27770874af77c7609c4461511a320ea5deab5d; capture-manifest SHA-256 is d073ebc7cb5a178c8ae681024f895d54536ac4c2301109608b2abc47f9b75c9f. An independent clean-room rescore reproduced the canonical JSON and Markdown byte for byte.

The 18 damage HOLDs now have a sealed source-only ordinal-barrier design. It fixes 18 comparisons and 54 future serial captures: 27 calibration cases at seed $1357, followed by 27 confirmation cases at $2468. Same-seed-only screenshots do not qualify—the older ground-LP trace reached damage at source ordinals 27/28, 42/43, 57/58 but target ordinals 34/35, 49/50, 64/65. Future evidence must align the complete contiguous RNG prefix, transaction, and global ordinals before comparing damage. After the single logged pre-input seed write, the barrier may not call, advance, freeze, force, rewrite, or reseed RNG. Seven exact-V18b runtime row bindings are still missing, so the package has no runner, commands, runtime root, scoring authority, or credit. Its static verifier and all 15 hostile tests pass. Package aggregate SHA-256 is da3855a65360b1d65586c3b549757b3f0039f1c91234e2cab5e5878aad9822be; receipt SHA-256 is 8a73a80c8b441e87e8833c3e1d25313487a06f23a654de61d9b11c46aa754140.

The separately sealed five-route public-Rogue/P1 trial is intentionally stricter about its one sampled damage sequence. Standing kick, crouching punch, and jumping punch pass. Standing punch and the six-button standing chain fail only that single-run equality check:

stand P      stock 4 / 8 / 10      V18b 3 / 7 / 10
stand magic  stock 4 / 3 / 6 / 5 / 7 / 5
             V18b 3 / 3 / 6 / 5 / 7 / 5

All five routes match their input schedules, exact states, contacts, cancel continuity, transition timing, and recovery. Because RNG is not controlled in this run, the two damage differences are RNG-unresolved single-run mismatches, not confirmed deterministic regressions. The receipt is SHA-256 fa73a02742d46798d817c49a77769327d91ed1d6e4f0b14f97ff571a09720989; terminal seal SHA-256 is 020c9ddf5f7fb2b57f0efdf38bb14d1c0d1bbc5fadfdf1e70a8ff26adbfd3c15.

A signed-facing expansion defines the full 40-lane chain denominator: two Rogue owners × P1/P2 × right/left × five routes. Static V2 fixes that Cartesian product, but it does not authorize execution. Activation V5 was rejected for one pre-guard import P0 and four provenance/tool-path P1 defects. V6 repaired those, then a concurrent root replacement exposed one remaining check/resolve TOCTOU P1.

Additive V7 is now sealed source-only. Its pinned verifier and 47/47 hostile tests pass, and an independent review of the exact sealed subject reports P0=0/P1=0. Retained no-follow directory descriptors and device/inode/type/mode continuity checks statically close the V6 defect, but the policy remains default-deny with no commands. All 40 bindings are structurally expressible and remain 0 executed / 0 scored. Only the five public-$06/P1/right routes have direct stock-source scope; the other 35 remain blockers, and no symmetry artifact is admitted. V7 final-seal SHA-256 is cdab8deea738e1aca7bdfcb2412b192bd9f7ce0fd66f04e86a44c26dd9fffdf8; independent-review receipt SHA-256 is cda54142b65ece9c9d3e160290c9b8073a540079d0c6e6269899d7add0647a3b. No candidate, ROM, FBNeo, emulator, capture, scoring, or gameplay was authorized by V7, so every V2–V7 chain-preparation credit remains zero. The shared behavior reporter was separately corrected so a legacy unsigned capture may prove exact absolute geometry without silently claiming signed-side geometry; the full harness self-test passes after that regression was added.

Download temporarily withheld

New one-file builder is in validation; download temporarily withheld. The fixed ledger remains 17/97 with 79 blockers, parity null, and playability/release authority false. Private V29 is not being offered.

The newest gates stopped bad evidence before it became a patch

Open the sealed execution-gate and Power Drain proof history (R6–R15, renderer V2–V7, static V3–V23)

The CATCH scheduler has advanced from R6 through R15 as an execution design, but it still has zero runtime cases. R10 was rejected for three ownership and lock-release gaps. R11 closes the direct post-Popen signal/opcode-trace window with a separate inherited-lock custodian, but a hostile review rejects activation again: a forked child can call setsid(), escape the tracked PGID, and remain alive while R11 reports groups_absent; a pathname replacement after the final coverage call also goes unobserved before explicit unlock. The review additionally reproduces an unreaped-custodian warning and no PID- generation binding. Its verifier and 7/7 hostile tests pass; rejection receipt SHA-256: a78d7b970977a6fb51e5fb73d9a57ce2979da0813a5744627a71eeb31c764434. R12 closes the R11 cooperative-lifetime gaps, but its independent review rejects activation too. SETEXEC occurs before CPython's close_fds, so the target inherits closable copies of the canonical flock, anchor, and control descriptors. A harmless target can close those copies; directly killing the custodian then releases both anchor and flock while the target remains alive, allowing a second owner to acquire both. The review's 7/7 hostile tests pass, each reproducing R12's native 37/37 suite; rejection receipt SHA-256: d6ad7ed57c489f409721ef99e805b5741827dce43e6c681f764d81fdc631a8a6. R13 adds explicit target leases, an exact post-exec descriptor census, and a separate exact-target exit sentinel. Its own 48/48 tests pass twice, but the distinct review rejects execution approval: later lifecycle helpers launch through a mutable source pathname without a retained or launch-time-rehashed helper identity in their readiness record. The review's 20/20 static tests pass twice; rejection receipt SHA-256: 0e35e02a7e77b6785c175c8b95a17fe74204a588eeed46d26f29846366b40c87. R14 closes that helper-source defect; its verifier and 56/56 hostile tests pass twice. Its distinct review credits the R13 repair, then rejects execution approval on a deeper target boundary. The last retained-executable digest precedes the target lease census, sentinel readiness, integrity check, and PT_DETACH, with no kernel writer exclusion spanning that interval. The review's 24/24 tests pass twice; rejection receipt SHA-256: 177dd776d1ba8b34c5651e91febd77b0b1659be4b28199755926ccd9410ad2d0. R15 moves the complete retained-executable identity after the lease census, sentinel readiness, and integrity check; its verifier and 52/52 static/mock tests pass twice. Its distinct 24/24 review approves only that corrected static HOLD evidence. The selected MAME CodeDirectory is ad-hoc, and a ptrace-stopped sample does not prove kernel-enforced CDHash continuity through detach. R15's predicate remains false before detach or ACK; dormant predecessor-era authority schemas must be replaced, not enabled, by any later executor. Review receipt SHA-256: 3b3450c9964d5e660d9bc01730bff91e4b5f3c93acb2b1196531d8427461c88d. It cannot create a runtime root.

The first 80-frame live walk renderer was stopped for the same reason. V2 was rejected for invalid Lua exclusive-create mode plus ownership, frame, PNG, runtime-input, and cleanup gaps. V3 fixes many of those static checks, then its own independent review finds five more blockers before launch: its exact ZIP preflight asks for mvc.03a/mvc.04a where V18b contains mvce.03a/mvce.04a; it asks for qsound_hle.7z where the pinned ZIP contains dl-1425.bin; it accepts either physical OBJ bank without binding the vblank-latched buffered render bank to the PNG; it ignores CPS-2 output X/Y offsets when OBJ attribute $80 is set; and TERM/HUP can kill its guardian while the detached child survives. The documented tests also create __pycache__ and invalidate the supposedly immutable package. The review's 11/11 tests pass; rejection receipt SHA-256: efb5696c2574b0e821c1d469e3ac72d729a82c4bed5696ce0d3f95546d9fc5fa. V4 seals those static renderer checks, but its independent review rejects the runner before launch. Exact MAME 0.287 returns attotime userdata from screen:time_until_vblank_start(); V4 feeds that object to a constructor that expects numeric seconds and later compares it with a number, so it cannot reach its first wait or capture. It also hashes the retained executable before launch without proving the same bytes after exec and before the first instruction. The review's 20/20 tests pass; rejection receipt SHA-256: e60a6ac4155bbf76ec9955fac88a2ba82a3f270f3962ee5942de3943d2915852. V5 corrects attotime arithmetic and adds a stopped-exec digest; its 41/41 tests pass. Its independent static review still rejects execution approval. The last retained-FD digest precedes a pathname-only check, detach, and OWNED, while the next full digest is post-run. Its named same-inode mutation fixture also sets mode 0500, requests O_RDWR, and never proves a byte changed. The review's 20/20 tests pass twice; rejection receipt SHA-256: f12ea24f6b6bc620c1a8754d87db17c4704d6a15f385e83ab8c4b26b99df9b5b. V6 adds the final stopped-state digest and a real mode-0700, same-device/ inode/size byte-change control; its 43/43 tests pass. Its distinct review still rejects execution approval. The digest returns in user space, Python compares it, and only then calls PT_DETACH; no kernel-enforced no-writer interval spans that last window. The positive control changes bytes before the digest, and the post-run hash is only later detection. The review's 40/40 tests pass twice; rejection receipt SHA-256: a00e241e49f5d7bf2b71f4888358f46423ec905bbd57fba60808855ee28f018a. V7's distinct 24/24 review likewise approves only a static HOLD. The exact selected MAME CodeDirectory is ad-hoc, and a stopped, ptraced sample does not prove CDHash/page continuity through detach. Review receipt SHA-256: 8ba58aa96a2cc87a31679896f6823215a440730560be97fbdb3c4db8bcfa1629. The first non-ptrace, start-suspended hardened-copy contract is now sealed, and its distinct review rejects claimed completeness. V1 accepts six poisoned mock records: status transition, CodeDirectory/CDHash, process generation, original-image identity/mode, parsed policy/dependency contents, and mutation observations are each under-bound. The narrow no-executor tombstone is real, but it authorizes nothing. Review receipt SHA-256: d9156834dd8532d9c12727fcd858d7445c6359eeab7aedfd081fad1a595d6dd0 (42/42 hostile tests twice).

V2 repairs several represented fields: exact status masks, CDHash derivation, separate generations and modes, equal-size changed-byte/edit coverage, parsed entitlement/dependency rows, R15 lifecycle shape, and attempted-versus-observed mutation results. Its independent review still rejects contract completeness. An enforced dependency closure can trust a forged non-null root/child Team-ID domain while the exact post-sign ad-hoc identity keeps a null Team ID; root mode is also not bound to exact post-sign mode. Eight further semantic gaps remain. The exact review blocker is V2_CORRECTED_STATIC_EVIDENCE_CONTRACT_REMAINS_SEMANTICALLY_UNDERBOUND. Review receipt SHA-256: 3abe48a0a1a44fb045ad9df0919166171b899de5b74a5ff9fc029fd0a12e7e0a (52/52 hostile tests twice). V1 and V2 are structural tombstones only. No helper, MAME query, screenshot, runtime, gameplay, or visual credit exists.

Start-suspended V3 represents V2's nine requested repairs, but its distinct review still rejects exact completeness under V3_REPAIRED_STATIC_EVIDENCE_CONTRACT_REMAINS_SEMANTICALLY_UNDERBOUND_AT_PRIMARY_OBSERVATION_ROOTS: seven primary observation roots remain underbound. V3 subject receipt/logical/package SHA-256 are 78745d42…22a7b, 8f70f50e…6d090, and b5cf3d7a…4fa03; review receipt/logical/package SHA-256 are 3b33324e…31f24, 011a7410…e14c5, and df4052fc…8d5b. The subject and review suites pass 177/177 and 67/67 twice.

Start-suspended V4 represents those seven repairs, but its distinct review rejects completeness again under V4_STATIC_CONTRACT_REMAINS_INTERNALLY_INCONSISTENT_AND_UNDERBOUND_AT_CANONICAL_OBSERVATION_DENOMINATORS. Five defects remain: conflicting Mach-O/dependency command denominators; CodeDirectory slots not derived from embedded bytes; whole-file and non-text slots not derived from zero-to-EOF bytes; potentially different executable-map censuses without terminal enumeration; and missing segment/section containment plus executable file-backed type checks. V4 subject receipt/logical/package SHA-256 are 72bb8659…e88ff, c91591a0…169b, and cbf96e12…435ca; review receipt/logical/package SHA-256 are a19c9296…419e, b1753178…e3d9, and 50aa6d62…8b46. The subject and review suites pass 199/199 and 55/55 twice. Both revisions preserve three blockers and seven zero-credit fields; neither authorizes a helper, MAME, FBNeo, a ROM, runtime, gameplay, parity, or release.

Start-suspended V5 represents all five V4 repair families and its verifier plus 79/79 hostile tests pass twice, but distinct review rejects exact completeness under V5_DEPENDENCY_ROWS_STOP_AT_INSTALL_NAMES_AND_OMIT_RESOLVED_LIBRARY_IDENTITY_MODE_SIGNATURE_TEAM_ID_AND_CLOSURE. Four families are materially present: one canonical byte-derived Mach-O list, embedded CodeDirectory slots, zero-to-EOF byte roots, and section containment/ type checks. Dependency rows regress to requested install names without resolved library identity/mode/bytes/signature/Team ID/closure. The mapping model also cannot represent non-executable/submap query rows, leaves backing identity unjoined, and permits an empty census. V5 subject receipt/logical/package SHA-256 are 801eb237…a5e5, 760caeac…de4, and f9367479…a5fa; review receipt/logical/package SHA-256 are d5cc16dd…419d, cee88330…55c9, and 3cb97f71…87b. Root replayed the independent verifier and 31/31 hostile tests twice. The structural tombstone, three blockers, null runtime authority, and seven zero credits remain exact.

Start-suspended V6 restores a resolved dependency graph and full raw region/submap state machine, and its verifier plus 75/75 hostile tests pass twice. Distinct review still rejects completeness under V6_ORDERED_RPATH_ROOTS_ARE_CALLER_INJECTED_AND_NOT_BYTE_DERIVED_FROM_PER_LOADER_LC_RPATH_COMMANDS. V6 never parses LC_RPATH; caller-supplied global roots can resolve @rpath without loader run-path bytes. Raw object_id/object_offset remain unjoined to mapping vnode/file claims; EXEC_MAPPING_JOINER is absent from assessment; file-backed non-executable leaves are unrepresentable; ad-hoc flags can carry an unauthenticated Team-ID claim without CMS material; trailing-slash/NUL path aliases remain; and mount IDs are caller-selected. V6 subject receipt/logical/package SHA-256 are 91b31c5e…6a3c, a6af2d02…faf5, and 7b54effa…e4a0; review receipt/logical/package SHA-256 are dd1ebbc2…e575, bd48a49d…9709, and 5f87865c…c9c2. Root replayed the independent verifier and 45/45 hostile tests twice. The tombstone, three blockers, null runtime authority, and seven zero credits remain exact.

Start-suspended V7 repairs those loader, mapping, signature, path, and mount representations, but its distinct review still rejects completeness under V7_RESOLVER_CANDIDATE_EXISTENCE_IS_INFERRED_FROM_CALLER_SUPPLIED_CLOSURE_MEMBERS_WITHOUT_A_JOINED_PROBE_OBSERVATION. The byte-derived per-loader LC_RPATH stacks and the repaired raw mapping joins survive clean-room reconstruction. Resolver truth does not: V7 decides whether a candidate exists solely by finding its path in the caller-supplied closure member list. There is no probe API/result/errno/sample/path/vnode observation, so the same accepted evidence can represent an absent earlier candidate or an existing earlier candidate that should win. V7 subject receipt/logical/package SHA-256 are 7bfec77d…0696, d7c2bdfb…55f9, and 6d6c5994…ae16; review receipt/logical/package SHA-256 are 6d901499…adb9, 38f6ff96…d0a, and cf4acd54…2b14. Root replayed the subject verifier/109 hostile tests twice and the review verifier/30 hostile tests twice with no cache residue. V7 preserves the tombstone, three blockers, null runtime authority, and seven zero credits; it authorizes no helper, MAME, runtime case, or gameplay credit.

Start-suspended V8 replaces closure-list inference with five dependency edges and eight ordered probe records: five OPENED and three exact ENOENT rows. Its distinct review confirms that internal denominator but rejects exact completeness under V8_OPENAT_PROBES_OMIT_DIRFD_AND_PATHNAME_ARGUMENTS_SO_ENOENT_IS_NOT_JOINED_TO_THE_DERIVED_CANDIDATE. V8 derives a parent and leaf, but does not record the actual openat dirfd or pathname argument and has no directory-FD provenance tying those claims to the operation. The same sealed row can come from the intended parent or an unrelated directory; O_NOFOLLOW protects only the final component. Positive rows also omit the fstat target FD, descriptor epoch, and open-to-fstat chronology. V8 subject receipt/logical/package SHA-256 are 3b52163f…07c9, 81667a31…5ddf, and ea68fcc8…2ae4; review receipt/logical/package SHA-256 are 90fb4e3d…06ff, e78a687f…5a84, and 1b8adedf…77b. Root replayed the subject verifier/142 hostile tests twice and the review verifier/40 hostile tests twice with no cache residue. V8 preserves the tombstone, three blockers, null runtime authority, and seven zero credits; it authorizes no helper, MAME, runtime case, or gameplay credit.

Start-suspended V9 adds the actual one-component openat dirfd/pathname, root-to-parent directory-handle chains, descriptor epochs, explicit positive fstat targets, and reverse close chronology. Its distinct review reproduces all eight candidates and 114 represented operations, then rejects exact completeness under V9_PARENT_HANDLE_IS_NOT_REVALIDATED_TO_THE_DERIVED_PATH_AT_LEAF_OPENAT_SO_RENAME_REPLACEMENT_PRESERVES_THE_ACCEPTED_PROJECTION. A rename/replacement between terminal-parent FSTAT and leaf OPENAT leaves the held FD attached to the old directory. That FD can return the same ENOENT while the canonical path now contains the candidate, and the original path can be restored before V9's next witness. V9 subject receipt/logical/package SHA-256 are 9e0bbb68…afc9, cbeaa56c…004f, and 184663cb…25df8; review receipt/logical/package SHA-256 are 383cf9e5…fe8f, cb1f4155…00f4, and 791655ae…9e8f. Root replayed the review verifier/60 hostile tests twice with no cache residue. V9 preserves the tombstone, three blockers, null runtime authority, false execution/resume, and seven zero credits; it authorizes no helper, MAME, runtime case, or gameplay credit.

Start-suspended V10 adds one epoched kqueue, native vnode/mount watch rows, stabilized before/after GETFSSTAT censuses, parent-watch-before-child chronology, and a fresh independent parent/leaf revalidation. Its verifier and 281/281 hostile tests pass, but distinct review rejects exact completeness under V10_ZERO_TIMEOUT_KEVENT_DRAIN_IS_NOT_A_COMPLETION_FENCE_FOR_PRECEDING_DARWIN_FILESYSTEM_STATE_CHANGES and V10_VERIFIER_LACKS_EXACT_AUTHORITY_FIELD_MANIFESTS_SO_A_NEWLY_SEALED_INTERNALLY_CONSISTENT_DOCUMENT_CAN_CHANGE_AUTHORITY_LIMITING_MEANINGS. Apple's XNU VFS wrappers perform the filesystem operation before posting the vnode notification, so an empty zero-timeout poll is not a completion fence. The package verifier also leaves some authority-limiting document meanings outside exact manifests; newly consistent seals cannot supply that missing schema. V10 subject receipt/logical/package SHA-256 are 5debfcaf…5524, 52a22c59…2b8e, and f079f3ce…964c; review receipt/logical/package SHA-256 are daedbaf6…3fc5, bfd3a2c3…4791, and 7a707709…a262. Root replayed the subject verifier/281 tests twice and review verifier/15 tests twice with no cache residue. V10 retains the three blockers, null authority, false execution/resume, and seven zero credits. A successor may claim paired endpoint/census equality and zero events returned by immediate polls, not continuous namespace stability or mutation exclusion.

Start-suspended V11 encodes that narrow claim and exact-manifests its authority fields. It sets continuous stability, mutation exclusion, in-flight exclusion, notification fencing, and mount quiescence false; its quiescence primitive and runtime authority are null. Distinct review confirms the narrow theorem for strictly parsed canonical JSON but rejects the public Python validator under V11_VALIDATE_NATIVE_OBSERVATION_MAPPING_BOUNDARY_DOES_NOT_REQUIRE_EXACT_CANONICAL_JSON_BUILTIN_TYPES. The function accepts general mappings and uses dispatched equality, length, and iteration without first requiring the exact built-in JSON value domain. V11 subject receipt/logical/package SHA-256 are b45d19a3…7804, 75777df6…9c6, and 642575b4…925a; review receipt/logical/package SHA-256 are 1e0574dd…9685, edb2b787…f55d, and 35028103…9c20. Root replayed 30/30 subject and 30/30 review tests twice with no cache residue. V11 remains REJECT/HOLD with null authority, false execution/resume, three blockers, and seven zero credits. A successor must parse strict canonical JSON at ingress or recursively require exact built-in JSON types before validation.

Start-suspended V12 implements that exact repair. Its only public observation validator accepts exact built-in bytes, strict-parses canonical UTF-8 JSON, recursively requires exact built-in JSON values before evaluating the theorem, and exposes no legacy general-mapping entry point. Distinct review approves only the same two represented digest equalities and two immediate zero-event returns. V12 subject receipt/logical/package SHA-256 are cb7ec0fa…ad19, 808cba55…61ec, and 20bb30eb…5358; review receipt/logical/package SHA-256 are c4cb51f8…01af, da6f2081…0dd1, and 003875ce…d47. Root replayed 40/40 subject and 36/36 review tests twice with no cache residue. The result is approve narrow static theorem / runtime HOLD: the stronger nonclaims remain false, authority remains null, execution/resume remain false, all seven credits remain zero, and the same three blockers remain. This closes a validator defect, not a gameplay row.

Power Drain's metadata work did make one bounded advance. Independent V3 review reproduces 7,829 rooted states, 3,218 instruction addresses, 173 state and 112 unique direct-jump edges, 11 conservative owner-write hits, and five indexed exits. It binds all 37 loaded non-stdlib Capstone Python origins plus the selected dylib. The allocator result remains conditional on an unproved free-stack/active-record integrity invariant, and all six lifecycle denominators remain open. That verdict is approve corrections, retain HOLD, not approval to build or run. Review receipt SHA-256: 66d8e598cc29f47899384ed25685f905849aa216ddd573461e098db8f42cef64.

Independent review now rejects V4's one-of-five closure accounting. The raw facts reproduce: 12 branches carry nine selectors to nine targets, and all four remaining state tables have the listed conditional maps. But V4 repeats the old walk with $0179FE unresolved, then performs a disconnected fixed- window scan. It never binds $02B0B2 to $016FBA, exhaustively checks the root-local or mid-body predecessor set, or feeds the nine targets back into the walk. Its correct augmented-walk constants are present but unused. Four nearby selector branches at $0170B4/$0170BA/$0170D6/$0170E6 are outside the real root graph, but only the independent review proves that exclusion.

The review's reimplementation shows the repair: 8,050 rooted states, 3,431 instruction addresses, 187 state and 126 unique direct-jump edges, plus nine explicit indexed edges. That evidence cannot retroactively repair V4's seal, so all five indexed transfers remain unclosed for sealed-proof accounting and all six lifecycle denominators remain open. Review verifier and 38/38 adversarial tests pass; rejection receipt SHA-256: 94ef33f3e2e6c619bd27de66b4f88a57c00500fca2b0725aa019296031af5554. V5 executes that augmented graph, but its own independent review rejects the sealed closure too. V5 never enumerates incoming edges to the 12 selector BRA opcodes. A root-local poisoned edge can jump directly to a branch, bypass its MOVEQ/D0 selector load, and still pass the predicate. Exact V29 does have the safe 12/12 immediate fallthrough predecessors, but an external review cannot retroactively add that binding to V5. The independent verifier and 43/43 tests pass; rejection receipt SHA-256: e984288fe3d42de2cf73fdbfa12aa54f17cc643cd6f56c1418d072b81e51dd28. V6 adds that predecessor obligation, but its independent review rejects the closure again for a deeper reason: the walk stops whenever A0 changes, even though those instructions do not end control reachability. Continuing the same exact-V29 root walk exposes four legitimate dispatcher ingresses at $017314/$017386/$0176EE/$0176F4. Selectors $24/$26 add two omitted targets, $017F08/$017F62, so the real known root surface is 16 ingresses and 11 targets rather than 12 and nine. Three indirect exits remain unresolved: $0185C6 JMP (A0), $01870C JMP (A0), and $0187EC JSR (A1). The independent verifier and 48/48 hostile tests pass; rejection receipt SHA-256: 3185ac7dcfdf57b8bd4a863baf67d251b33662b6cce65629e30496b5acec06b1. V6 earns zero closures. V7 separates control reachability from owner-pointer provenance and reproduces 16 ingresses, 11 selectors, 11 targets, and the same three unresolved exits. Its independent review still rejects closure: 36 reachable A0/A1 postincrement sites implicitly update a tracked address register, and 12 retain stale known provenance. Conservative kills reduce the abstract graph from 30,902 to 30,038 states without changing the 1,523-PC / 3,630-edge control graph. The review's 64/64 tests pass; rejection receipt SHA-256: e051dcd9cea02c98c703edf97694199f9fbec7b79c130ad581012bdacd511af0. V8 repairs those 12 stale facts, but its own review finds four more reachable register-typed predecrement ABCD sites. The true automatic-write surface is 40 sites / 44 effects, not 36; six CMPM/ABCD/ADDX/SUBX poisons expose the classifier gap. Its 50/50 review tests pass; rejection receipt SHA-256: 4f811d4f59f6241f09203c77ac4c8c48898812f976ba54489d978fed6208ecee. V9 makes address mode authoritative regardless of operand type. Its 72/72 subject tests and a distinct 64/64 review reproduce 40/44, 30,038 states, 1,523 PCs, 3,630 edges, and 16/11/11. That review approves only corrected static HOLD evidence. Three indirect exits remain unresolved; zero of five transfers close and gate 5 remains open. Review receipt SHA-256: 6ba4f1473bdb94f685e94e79648dc9e04170c2d996dc860049cd99a42ebcc5a9. V9 has no ROM, runtime, or gameplay claim. V10 seals three physical 92-byte / 23-entry tables and all 69 rows. It also corrects their boundary map: table 1 is followed by code, table 2 is followed by table 3 row $00, and table 3 is followed by code. Its distinct 64/64 review approves only corrected static HOLD evidence. The base graph is 30,038 states / 1,523 PCs / 3,630 edges; a conditional even-ID expansion reaches 70,101 states and 36 downstream indexed exits. But the root has 18 reads and zero writers or modeled ingress for fighter ID +$0052(A6), so odd, negative, $002E, and larger values remain unexcluded. One of 18 indirect-JSR targets returns; 17 stop at unresolved +$00E4(A6) selectors. Zero of five transfers close and gate 5 stays open. Review receipt SHA-256: a1648da1bbeeba0cf35d9b950dd24ccd79013f8e7bd0c510b2087256ae709c8c.

V11 broadens the raw writer/alias census and its distinct 92/92 review confirms the complete 355/81 and 0/3 candidate arrays, all three tables and 69 rows, $06/$26 target equality, a narrow syntactic return, and five physical +$00E4 rows. It does not prove that a candidate is executable or reachable. Zero of five transfers close and gate 5 remains open. Review receipt SHA-256: edf40a3a33d1d93eba145ea75a6ac2df7a9de585da95f01b716f3ef57aa1738c.

30 August correction: one inclusive opcode word was missing

V12 through V25 used opcode hash fa820be5…95ab4, which omitted MAME's inclusive word beginning at $100000. V26 corrects DATA 0800 to OPCODE 6B41 there and pins corrected hash 38171f8b…0d23. Only the all-even candidate decodes at $0FFFFE and $100000 change. V26 regenerates the current direct, indirect, return, root, scheduler, and wrapper tables with zero classified-row delta. Older receipts remain sealed history, not current whole-opcode-view authority.

V12 then checks every one of the 2,097,152 even starts in the then-current four-megabyte V29 opcode view. Its distinct review reproduces 1,702,359 valid decodes, 2,740 indirect controls with 391 target-capable candidates, 6,800 return-family candidates, 695,439 explicit memory destinations, and 443 direct A6+$52 starts. That is a materially broader syntactic envelope, not executable reachability, points-to provenance, saved-stack/exception-return integrity, overlap closure, whole-record-copy completeness, or fighter-ID value-domain proof. V12 is approved only as scoped static HOLD evidence. Zero of five transfers close and gate 5 remains open under V12_ROOT_A6_0052_EXECUTABLE_REACHABILITY_POINTS_TO_AND_STACK_PROOF_OPEN_OVER_EXACT_EVEN_ENTRY_SYNTACTIC_ENVELOPE. Review receipt SHA-256: 7bb05429b3458ea394e495971fe6695d0adce834a72c4e5f40dbd6a0ae614fe0 (88/88 hostile tests twice). It creates no ROM, runtime, gameplay, parity, release, or percentage authority.

Power Drain V13 retains the 391-row control partition, 3,336 selector equations, 359 same-field copies, and one (A7)+ source, but its distinct review rejects the sealed census under V13_STACK_UNION_OMITS_A7_INDEX_MOVEM_MASK_SR_STOP_USP_AND_FIXED_A6_MOVEP_MOVEM_WRITE_FOOTPRINTS. The 90,316-row stack union omitted 2,410 A7-index sites, 208 MOVEM masks containing A7, SR/STOP/USP surfaces, and the special footprints of 1,190 fixed-A6 MOVEP plus nine MOVEM destinations. V13 subject receipt/logical/package SHA-256 are d3421ed0…d86e, 23ddd6f2…587a, and cbaf3ce0…1100; review receipt/logical/package SHA-256 are e8792bd5…fc1a, af0c625f…b5b, and 4e5ad384…f6efe. Subject/review suites pass 83/83 and 96/96 twice.

Final frozen Power Drain V14 repairs those census and footprint defects and is independently approved only as a scoped static HOLD. Its 55,054 fixed-A6 writes partition into 53,855 ordinary, 1,190 MOVEP, and nine MOVEM rows; 443 overlap +$52..+$53, 54,611 are disjoint, and no special-footprint row overlaps. The corrected explicit A7/system-state union is 95,477. The separate 2,097,152-even- entry exception-policy universe is conservative policy, not executable reachability or saved-frame integrity. V14 subject receipt/logical/package SHA-256 are e29cc788…c649, c9d3afaa…ede6, and 1bc94fab…fd9c; review receipt/logical/package SHA-256 are 116e299f…c7486, 8ef26bd8…4084, and 61926782…233a. Root replayed the subject verifier/100 hostile tests twice and the independent verifier/108 hostile tests twice with no cache residue.

The first blocker remains V14_ROOT_A6_0052_EXECUTABLE_PROVENANCE_OPEN_AT_DERIVED_CONTROL_POINTERS_SAVED_FRAMES_AND_NONLOCAL_RECORD_COPY_VALUE_DOMAIN. Zero of five transfers close, gate 5 stays open, and runtime/gameplay credit remains zero.

Power Drain V15 then isolates one conditional valid-admission theorem at $02DA24. Given the normal constructor/action-root path, the same live class-$38 A6 record, $02D9DC CLR.W +$0A(A6), exact modeled returns, and no external aliases or record reuse, the least selector fixed point is exactly {$0000,$0002,$0004,$0006}. Table bytes 0054008c012a019a resolve to $02DA7C/$02DAB4/$02DB52/$02DBC2; 13 tuple traversals derive all seven local writers, including the $02DA44 sibling probe.

The distinct review approves only that conditional scoped static HOLD and reproduces the retained global blockers: 2,740 unresolved indirect controls, 6,800 returns, 35,211 dynamic-A6 destinations, 588,961 non-A6 pointer destinations, and 3,175 fixed-A6 +$08..+$0B overlaps (3,162 ordinary / 12 MOVEP / one MOVEM). V15 subject receipt/logical/package SHA-256 are 7fa7861d…e8c5d, de05fba2…9fa42, and c8ab3116…a7266; review receipt/logical/package SHA-256 are 2b62ca41…3c523, 146bf5ee…63e7f, and 0b7f37c4…0d5eb. Root replayed the subject verifier/151 hostile tests twice and the review verifier/98 hostile tests twice with no cache residue.

The first blocker is V15_VALID_ADMISSION_IS_NOT_WHOLE_PROGRAM_INGRESS_EXCLUSION__CALL_RETURN_A6_FIELD_ALIAS_SAVED_FRAME_AND_RECORD_LIFETIME_PROVENANCE_OPEN. V15 does not close $02DA24 globally, closes zero of five transfers, leaves gate 5 open, and grants zero runtime, gameplay, parity, percentage, or release authority.

Power Drain V16 then applies that same conditional admission contract to the sibling dispatcher at $02DA38. Its exact bytes and 17 tuple traversals do reproduce the four arrival words, the same least fixed point, all four sibling targets, all seven local writers, and the $02DBA0 BNE/RTS barrier. The distinct review still rejects the package under V16_GLOBAL_IMPLICIT_A6_WRITEBACK_CENSUS_UNDERBOUND_29750_VS_30715__965_REGISTER_TYPED_PREPOST_ROWS_OMITTED. The correct implicit-A6 count is 30,715: 270 SUBX, 257 CMPM, 248 ADDX, 125 ABCD, and 65 SBCD register-typed pre/post rows were omitted. V16 also misses three LINK.W A6 rows, while 1,013 read-only CMPA rows contaminate its claimed A6 mutator denominator. Its poison list is declarative; connected alias/LINK mutations and extra $02DA30/$02DA34 targets can pass; self-consistent and duplicate-key receipt forgeries also pass. V16 subject receipt/logical/package SHA-256 are 552226e6…efae, 2a4ae2a7…f26c, and a0bd61a8…1c03; review receipt/logical/package SHA-256 are 162985c1…5dd9, 706d5bee…1a68, and 924a2f84…ab4. Root replayed the subject verifier/224 hostile tests twice and the review verifier/202 hostile tests twice with no cache residue. The narrow lattice remains conditional evidence only; V16 closes 0/5 transfers, leaves gate 5 open, and grants zero runtime or gameplay credit.

Power Drain V17 repairs the complete sealed V16-review defect list. The full even-start census is 30,715 implicit-A6 rows, including the omitted 270/257/248/125/65 SUBX/CMPM/ADDX/ABCD/SBCD partition. The 4,826 last-operand-A6 rows split into 3,813 mutator/replacement rows plus 1,013 read-only CMPA rows; all three LINK.W A6 rows are explicit. All 61 poison actions execute and reject, the exact BNE/RTS barrier is bound, injected targets are tracked, and canonical duplicate-key-rejecting seals survive. Distinct review independently rebuilds the then-current V29 view and all 2,097,152 even starts, all 22 census manifests, 17 traversals, seven writers, the four-state relation, 20 calls, five RTS sites, four external tails, and 61/61 poison rejections. It approves only the narrow conditional static theorem. V17 subject receipt/logical/package SHA-256 are cf3e51c8…7252, 745ab9aa…ebb, and 0f6f4b09…ef2a; review receipt/logical/package SHA-256 are e3398635…e854, 21b995da…e2b, and 598912cc…579. Root replayed the review verifier/286 hostile tests twice with no cache residue. A5 disjointness and whole-program ingress, alias, callee, saved-frame, record-identity, and lifetime provenance remain open. V17 closes 0/5 transfers, leaves gate 5 open, and grants zero runtime or gameplay credit.

Power Drain V18 advances one bounded alias/call slice. For the four fixed allocator slots, the two connected A5 word writes are disjoint from A6+$08..+$0B in all eight 24-bit footprint comparisons. Separately, the direct $02D9E2->$01CD1E graph reproduces 299 states/PCs, 365 edges, two nested calls, three modeled returns, two root RTS sites, depth two, no unresolved control, and no direct A5/A6 register replacement or writeback. Sixty executable poison actions reject and 97/97 subject tests pass twice. Distinct review approves only those two separate conditional facts. V18 does not carry a fixed-slot producer to $02D9E2 through a control/data path with the same A5 epoch, so their composition remains open under V18_SLOT_PRODUCERS_ARE_NOT_JOINED_TO_02D9E2_BY_A_PRODUCER_TO_CALL_CONTROL_DATA_PATH_OR_SAME_A5_EPOCH_PROOF__ROLE_GLOBAL_INGRESS_ALIAS_SAVED_FRAME_IDENTITY_AND_LIFETIME_OPEN. V18 subject receipt/logical/package SHA-256 are fff63778…e682, 05039fae…f91e, and 64c2c737…23ad; review receipt/logical/package SHA-256 are 17b1e174…a09f, eb1d5f92…3a92, and 506a2b17…bd7. Root replayed the replacement subject verifier/97 hostile tests twice and the review verifier/77 hostile tests twice with no cache residue. V18 closes 0/5 transfers, leaves gate 5 open, and grants zero runtime or gameplay credit.

Power Drain V19 attempts the missing producer-to-call bridge without creating the four deltas at the destination. It derives each fixed slot at its real LEA and carries its A5/A6 epoch to $00D970, then stops. A complete scan of all 2,097,152 even OPCODE starts finds 52 direct calls to that shared join: four fixed-slot primaries, 24 role-global primaries, and 24 contingent retries. Those 48 non-fixed ingresses leave retry preservation and the path to $02D9E2 unproved, so V19 has zero accepted target witnesses under V19_SHARED_D970_JOIN_HAS_48_NON_FIXED_DIRECT_INGRESSES__24_ROLE_GLOBAL_PRIMARY_AND_24_CONTINGENT_RETRY__SAME_A5_A6_EPOCH_TO_02D9E2_NOT_PROVED. Distinct review independently reproduces the 4+24+24 partition, four prefixes ending at $00D970, and no target witness. V19 subject receipt/logical/package SHA-256 are 412d55f2…4c20, 7497faa7…4d0f, and 438b16de…e72c; review receipt/logical/package SHA-256 are da5f0687…eb86, 342da0dd…781d, and 618b26a4…2968. Root replayed 53/53 subject and 55/55 review tests twice with no cache residue. The result remains HOLD: 0/5 transfers, gate 5 open, and zero runtime or gameplay credit.

Power Drain V20 corrects one concrete decoder mistake: four retry gaps use read-only TST.B, but the other 20 use mutating BCLR.B #0,-$3FF0(A5), not BTST. Its subject also proposes wrapper A5/A6-prefix and A7-delta facts. Distinct review accepts only the exact-V29 52-call census/classification and that byte-derived BCLR correction; it rejects the wrapper claims because the independently pinned outer oracle belongs to a different v8 archive and no independent exact-V29 artifact seals both high wrapper ranges. The blocker is V20_EXACT_V29_WRAPPER_PLACEMENT_AND_CONTENT_CONTINUITY_UNPROVED__NO_INDEPENDENT_EXACT_V29_SEAL_FOR_OUTER_3DB9E2_3DBAEA_AND_CATCH_3DB562_3DB6B2. V20 subject receipt/logical/package SHA-256 are 187b864a…fedd, 291821b9…cba9, and 28368f58…e6f; review receipt/logical/package SHA-256 are c8abaf40…f842, 80e38263…3d81, and 7549ea01…e0f4. Root replayed 117/117 subject and 83/83 final review tests twice with no cache residue. The result is still REJECT/HOLD, 0/5 transfers, gate 5 open, and zero runtime or gameplay credit.

Power Drain V21 closes that one code-image defect and nothing broader. A new subject reconstructs exact V29 directly from its ordered 21-member archive and seals the complete catch [$3DB562,$3DB6B2) range at 336 bytes / SHA-256 19017d38…c82 and outer [$3DB9E2,$3DBAEA) range at 264 bytes / SHA-256 cd6f30f8…49c. Its 140-row bounded decode includes all six bytes of $3DBAE4 JMP.L $3DB562. Distinct review approves only that exact placement and content continuity, then rejects the subject's blocker order. The first remaining blocker is the unsealed exact-V29 31-writer effective-address, width, and path denominator. The isolated A5 anchor is not a dominance proof; A5/A6/A7 domains, physical-24-bit disjointness from the live [S-8,S+4) return-plus-D0/A0-save region, retries, $00D060 normal return, and the path to $02D9E2 remain open. Subject receipt/input-aggregate SHA-256 are d2be0a0d…798d and 883f21ba…9485; review receipt/input-aggregate SHA-256 are 8a28dbc4…fccb and ee7fda88…5413. Root replayed 36/36 subject and 50/50 review tests twice with no cache residue. V21 remains semantic HOLD, 0/5 transfers, gate 5 open, and zero runtime or gameplay credit.

Power Drain V22 closes the next denominator and nothing more. The exact V29 wrapper contains 31 ordinary non-stack writer sites: 14 outer and 17 catch, 24 byte and seven long. Five are data-dependent read-modify-writes; five different CLR instructions have a preliminary MC68000 read cycle but are not folded into that RMW count. Independent review also keeps two control-flow views separate: 155 edges when calls are terminal, and 162 edges only in a hypothetical normal-return projection. Root replayed 66/66 subject and 35/35 review tests twice. This seals the writer list, not a safe runtime domain, and still closes 0/5 transfers.

Power Drain V23 then asks whether those writes can touch the wrapper's live stack frame. It seals 52 direct call relations—four fixed-slot, 24 role-global, and 24 retry—and the complete physical-24-bit frame F12(S)=[S-8,S+4): saved D0, saved A0, and the return address. The correct result is HOLD. None of the 52 callers has a proved nonempty reachable pre-call A7 domain, so zero callers can be admitted without making the theorem vacuous. The exact 52x31 matrix therefore records 1,612 static relational alias obligations under unproved domains. They are not executed states and not gameplay witnesses. Review also corrects the retry wording: four TST gaps are read-only, while 20 BCLR gaps mutate memory; only local A5/A6/A7 register nonmutation is proved. Root replayed 102/102 subject and 32/32 review tests twice. The next evidence order is reachable A7, then reachable A6 plus the writer paths that actually execute, then full-frame disjointness. Until that exists, Power Drain remains 0/5 and earns zero runtime or gameplay credit.

V28 records the scheduler and join

Power Drain V24 left all 52 direct-call rows UNKNOWN. V25 then mapped the candidate control surface, but its opcode reconstruction omitted MAME's inclusive word at byte $100000. V26 supersedes V25 and its review for whole-opcode-view authority. Corrected V29 OPCODE SHA-256 38171f8b3b451ce1594a436969d0998c82317a6da0f4a0f8992454f026580d23 changes only $100000..$100001, from DATA 0800 to OPCODE 6B41. The two affected all-even candidates begin at $0FFFFE and $100000.

V26's regenerated tables have zero classified-row delta: 88 direct controls, 2,740 indirect-control candidates, 6,800 return candidates, a 620-node / 685-edge root projection with 49 barriers, a 303 / 411 assumed-return scheduler projection, a strict 140 / 155 wrapper graph, and 52 still-UNKNOWN caller obligations. Receipt SHA-256: c866a565df0cc2caa683de4003b3c8ce0bfd1fb8e1117e5240746e46940b2fe8. MAME's exact-tag sources show the separate program/opcode maps and inclusive decrypt range in cps2.cpp, cps2crypt.cpp, and the 68000 reset path in m68000-sdf.cpp.

V27 supplies the first repeatable read-only startup observation. Two isolated MAME 0.287 launches produced byte-identical deterministic opcode-read cores, recording ordered opcode reads/prefetch at reset $E2, TRAP-0, $362, $38E, $E62, $105A, and $CEA1A. The descriptor-write tap also records $FF0040 with state $0C and entry $E62. Both runs also observe DATA/OPCODE 0800/6B41 at $100000. The taps can include prefetch—they are not instruction-retirement hooks—and the capped 64/256 counts are lower bounds. Most importantly, both captures record zero $CA34 and zero $D970 observations. Repeatability receipt SHA-256: 7058371a66dbbd1537e1cf8f5ae51fb406f04d9555d6300c8b3738ecd19b2322. Independent narrow-approval SHA-256: 389dd71c38c91ca54ea4f692ca0a4adcd42f9019790abbdec957427fdf96c8ee. V27 seals no Power Drain transfer and grants zero gameplay or release credit.

V28 then changes the evidence scenario, not the ROM. Two fresh isolated MAME 0.287 runs use only ordinary input to naturally select P1 Rogue $06 against P2 Ryu $12, enter match phase $0800, and complete the same neutral window. Their deterministic evidence cores are byte-identical. Each records 733 reads/prefetches at scheduler $CA34, 8,798 reads/prefetches across the 52 known caller sites, and 4,003 entry reads/prefetches at shared join $D970. Sixteen of the 52 caller sites appear somewhere in the full capture.

The verifier recomputes 1,688 full narrow, phase-gated correlations across exactly eight role_global caller sites and the four fighter roots $FF3000, $FF3400, $FF3800, and $FF3C00. The body callback exposes a guarded active user-stack top equal to the expected return PC. That is still an opcode read/prefetch witness: it is not instruction retirement, untapped adjacency, or full control-flow closure. The other 44/52 caller obligations have no full witness here, and complete joint-state, exception, interrupt, retry, and return-epoch domains remain UNKNOWN.

Repeatability receipt SHA-256: 480a0a779ac6d28c2fea2871c3717e27a59a3c576baa0d96cd7b4eff1ee03b57. After two verifier fixes requested during independent review, the retained package passes all 11 fail-closed adversarial tests and receives the bounded verdict APPROVE_NARROW. Independent review SHA-256: 318db14af26dd587b1501fd15df2b322b9acccb26044445f1f7bab3821335063. It still seals no Power Drain transfer and grants zero gameplay, ledger, parity, build, release, or download credit.

Matrix M1 broadens the observed subset once

Matrix M1 is an append-only evidence package over the same private ROM V29; it is not another ROM version. Eleven fresh initial executions cover the neutral baseline, four CATCH configurations, four MP+MK partner-call attempts, and a non-fight CSS negative. Only productive discovery lanes are repeated, leaving 13 retained captures.

The two neutral B0 runs reproduce V28 exactly: 1,688 full narrow correlations, eight caller sites times 211, with byte-identical deterministic cores. Under M1's stricter post-orientation boundary, 1,680 rows remain, eight sites times 210. That hard regression had to pass before any discovery row could count.

Only C1 and C3 broaden the strict subset. Each byte-identical repeat records 32 rows at fixed-slot caller $CB50 while the same row also has scheduler A5 $FF8000, fixed A6 $FF3400, Rogue's active CATCH $20/$32, and the victim's captured $22|$1C / $34|$36 state. C0 and C2 add no site. The four partner-call lanes each retain 36 rows during the exact eight MP+MK press frames, but add no caller and explicitly leave assist activation unproved. The non-fight N0 lane records zero correlations.

The strict union is therefore 9/52, with $CB50 the only repeatable new site and 43 caller obligations still unobserved. Broader post-attempt and retry sightings remain context only. Retry pairing is non-consuming opcode-read/ prefetch chronology, not one-to-one execution or instruction retirement.

Matrix receipt SHA-256: cf4c4c65a197edee4a849039f48064e5dc4b345d5e9c861ea98429c9dd8784da. Repeatability SHA-256: e7a5acb2ea6ccb27bef89b984a9b87b559ae7bde1981769c9c9af26d002a6163. The pinned verifier passes before and after all 16 adversarial tests. Independent review approves only this narrow design/result boundary, SHA-256 7e4be0a355dedd01c04474ba0ecfa9c8299a0cee3abbfa965cd85f49b7b90876. Every gameplay, ledger, parity, release, and download credit remains zero.

Matrix M2 tests tag-once and closes nothing

Matrix M2 completed a bounded 12-capture ordinary-input tag experiment. The baseline reproduced 1,688 V28-full rows in two byte-identical runs, and both sealed $CB50 regression lanes retained 32 rows. Across all eight tag variants, one four-frame HP+HK chord and natural release were observed, but the lifecycle passed through a both-active interval instead of the required adjacent point-only-to-bench-only transition. No contiguous 60-frame settlement was observed.

Every tag lane therefore remains conservatively classified HOLD, not a successful tag discovery. No new caller was qualified: the observed union remains 9/52, with 43 obligations unobserved. The result grants no gameplay, ledger, parity, release, or download credit, so private V29 remains unpromoted and no Rogue patch is currently offered while the one-file builder is validated.

Matrix receipt SHA-256: ed768342c393543d674b8a627b391b509f64442230516eccc4cade18010d70fe. Frozen aggregate SHA-256: 328023088328a9c36e09d9ba3a60f52dd2166939deab8b0372ae5df4fa626ceb. Independent review SHA-256: dc4eaa8b2748ec86a994c764a3be1e101699540e28785f119a282329d5e49a5f. The terminal verifier passes over 197 frozen files, and all 35 hostile tests pass. Terminal seal SHA-256: b093e339a1c5b8e8f04e2f51d4b41d4fe5ec6dd19cbe34a7cc84cf61caeb2248.

V29 restores one helper call — no gameplay credit

The newest linear artifact is private V29 SHA-256 573b7224c2160bc830d53ab5fba55389825727b5ff1ed81828983687333bf14b, MD5 3fdcf6a54b973974d4e5b61f19101cd3. It is a direct child of exact V28, not of the accepted V18b baseline. The exact-V28 helper census accounts for all 38 Rogue-blob calls to eight requested XMvSF helper families. Thirty-two still ended in the fail-closed RTS family; one of those sites had a complete native MvC homolog and an exact one-site recipe.

V29 applies only that recipe:

$39C19C  4eb90039cf8c  JSR $39CF8C  ; graft RTS stub
        →4eb900014ef2  JSR $014EF2  ; native MvC inner reset

The six-byte request changes three logical DATA/OPCODE bytes and three raw mvc.10 bytes. It adds no wrapper and consumes no cave. Every other ROM member is byte-identical to V28; ZIP order and semantic metadata are preserved. The builder check and 10/10 focused tests pass, including a fresh byte-identical serialization. Build receipt SHA-256: 6c422a59b81bb3b793cc2113ac118e1d9d94c55c069f253eb427d245d8163db5.

This is the late D4=$08 global-reset homolog reached from Rogue's e6=$2E terminal family. The V29 build receipt establishes that call boundary only; at build time no emulator or guard was launched. The later V27 opcode-read/prefetch trace supplied no evidence for this helper call. V28 records a narrow scheduler/ join subset but does not identify this helper call as an instruction-retirement event or test its behavior; no clip was recorded, and no ledger row changed. Walk/body-push should not be patched from the old video report: the exact V18b 24/24 gate is accepted and its program surfaces remain byte-identical through V28; V29 does not touch them. CATCH 07 still releases four or three frames early, Power Drain still lacks a complete source-family contract, and Goodnight victim choreography remains broader than its accepted pose window.

The prepared exact-candidate denominator is 2,956 ordered cases across 58 groups: 210 XMvSF source cases and 2,746 target cases, covering all 85 runtime- testable ledger lanes. They remain 2,956 planned / 0 executed. The late D4=$08 source/current/patched trace is an additional zero-case scoring obligation over existing complete-special lanes, not a synthetic gameplay PASS. A distinct sibling review independently reconstructs that matrix and passes 30/30 adversarial tests; receipt SHA-256 83a9f1d92db59520c429aadd0cbf0f2605cef5fd3951cae7bd18243e208418b9. That approval permits static catalog adoption only and grants no runtime or gameplay credit.

The class-$48 cleanup lock remains separate. A later carrierless-acquisition audit shows that delete-before-set can close same-address ABA only if every nonzero or unknown writer of the four fighter-slot +$267 bytes passes through one wrapper. That semantic writer denominator is not closed, and a byte-exact fail-closed wrapper proof would still follow it. The native-move promotion matrix therefore remains hard-locked and zero-credit pending those ownership proofs, exact request/authority/capture binding, scored MAME execution, and a new ledger revision. Neither V27 nor V28 satisfies that gameplay matrix. The current audit receipt is 13fa0827324c60f4be9cccb1a38734e300866a32f6ea7cfb7d12be06e8014272.

The next Power Drain helper audit also stops before a ROM. It proves the candidate-only one-site shape $39AE3E: JSR $39CF8C -> JSR $3AB22A, three operand-byte deltas and no new cave, and closes 4/8 mandatory static gates. But the inherited subtype-$08 evidence matches timing and expanded-cell counts 12/12 while raw lists/attributes match 0/12 and transforms only 1/12. That is not visible animation parity. The next blocker is a semantic map of the 12 source records through list parts, attributes, transforms, tiles, palettes, and rendered geometry; all-context owner roles, every-exit cleanup, and independent review remain open. The 22/22-tested audit therefore grants no postimage, build, runtime, or ledger credit.

The append-only geometry pass now resolves that surface question without authorizing the patch. Native MvC $181BF6 repacks all 12 source bank-3 records into target bank 0: 12/12 oriented-cell sets, 303/303 cells, 12/12 alpha planes, 12/12 pen planes, and palette selector $0A->$10. Comparing against target bank 3 fails all 12. The defect has narrowed to exact V29's $3AB18A: MOVE.B #$06,+$47(A6); an eventual bounded repair would change only the exact-site byte at $3AB18D from $06 to native $00. The preimage occurs twice, so this cannot be a blind pattern replacement. Independent review, live palette/RGB and cadence, cleanup, owner/player/facing coverage, and stock class-$38 regressions remain open. The 24/24-tested receipt grants no ROM, build, runtime, ledger, or parity credit.

Native-move R5 is now statically sealed for 572 fresh MAME processes: 156 stock-XMvSF source point cases, 312 exact-V18b point cases, and 104 contextual bench cases. Its 42/42 Python tests, 5/5 Lua syntax checks, bundle recomposition, and sealed R2/R4 lineage pass. Execution is intentionally locked and has run zero cases, so it grants no gameplay, percentage, ZIP, or release credit. Preparation receipt SHA-256: 2ff608d42961e81626d01918cf3e66a773010a372c9fa847f563a6d0aea02377.

R6 adds a hard-locked execution contract for only a two-case Repeating Punch smoke—one source case and its matching public-V18b case. Its audit and 15/15 tests pass, but every runtime binding is null and execute exits 3. It cannot launch, score gameplay, attribute a ROM failure, or authorize later phases. Receipt SHA-256: c521c20462d1cb0baf2cfe29b3401353dfaae099fcdecbad52d7846ef90b0c48.

The parallel R6 pointer preparation is still HOLD_POINTER_NORMALIZATION_UNBOUND_ROM_NOT_EVALUATED: 0/9 R5 pointer fields is reviewed or statically complete. It also exposed a contract conflict: R6's proposed entries shape and EXPLICITLY_REVIEWED_FOR_PHASE_A status do not satisfy R5's required fields/roles shape and REVIEWED_EXACT_RELOCATION_MAP_BOUND status. R6 demands that reviewed map before its smoke, while the map itself needs fresh observations first. Receipt SHA-256: 1d7e39c61a229dbf98e05859ef1f5e22ea7186fbbfa1c2b20bee854727fc71b6.

R7 resolves that circularity only on paper. Its P0 bootstrap preserves the exact 572-case R5 order to record nine raw pointer fields without comparison, PASS/FAIL, ROM evaluation, or scoring. The static audit and 19/19 tests pass; all 41 runtime/review/scoring bindings remain null. No emulator, capture, map, runtime case, ledger row, or gameplay credit exists. Any eventual scored run must recapture all 572 cases after independent map review. Receipt SHA-256: b271c657a69272f3a86e1132e3983e21a06407c16442cb2213a7a6bcb765c1a8.

Later runtime-adapter work remains locked too. R8c closes three earlier static defects, but an independent 10/10 adversarial review reproduces six activation blockers: an authority-bypassing public spawn path, an asynchronous-exception gap around spawn, request-controlled non-global locks, unsafe executable paths, identity drift during the 572-case loop, and non-durable process quarantine. R8c has executed zero emulator/guard/ROM cases and cannot be activated. Independent rejection receipt SHA-256: 29da3282926370d9fd4242f6fa3cf27d60e57e4de9e3292370e9d097cb6d272f.

R8d is rejected too. Its production entry is hard-locked, but an independently reproduced 14/14 adversarial suite reaches all 16 provider methods through a public synthetic lifecycle path that never checks that lock. Provider identity, global lock/nonce state, verified executable objects, fresh identity checks, process-tree absence, and durable keeper transfer remain unbound assertions. R8d stays unactivated and zero-runtime. Rejection receipt SHA-256: b8393d85e0c27ffa67f6e8027855b3ccdd0e38eb1624dff34147cf61cb65a517.

R8e closes that public bypass only by deleting the runtime-adapter surface. The whole-package AST audit finds no provider/backend, callable injection, predecessor import, process/lock/filesystem service, or activation path. Its zero-argument front door consists only of return 3, with all 18 future runtime bindings null. Agent and independent root replays pass the audit and 16/16 adversarial tests. R8e is therefore a static tombstone, not an executable successor, and still produces zero MAME/guard/ROM/runtime/gameplay credit. Receipt SHA-256: cea0f0a499a944fa2b2d24470d56c4e3c9a157040ca8165627825123c0b6a8b4.

The exact helper-route census accounts for all 38 relocated calls: 34 still target the CLEAN RTS stub and four are promoted. Seven families retain RTS residue. The $011600->$014EF2 homolog now has enough static ownership proof to authorize exactly one private experiment at V18b's relocated $39C19C call—not an integration, acceptance, or release claim.

That experiment is now built as quarantined private V19. It changes only mvc.10, and only three logical data/opcode bytes at $39C19F/$39C1A0/$39C1A1, redirecting $39C19C from the CLEAN RTS stub to $014EF2. Independent --check, 9/9 focused tests, and archive integrity checks pass. Its ZIP is SHA-256 31f17a70c4d00fbc0abf7dbd62997329634152ef21bd3e861cd473b4dca01c92, MD5 be79abcc37985acc705ec849e9f946bf. No emulator was run: every matched trace, owner/side, watchdog/throw, move, team/assist, and stock-caller gate is pending, so V19 earns zero gameplay or parity credit and cannot be promoted. Exact V18b remains the current 17/97 ledger candidate.

The newer private V20 archive is a separate direct child of exact V18b, not a replacement for that baseline and not stacked on V19. It installs identity-matched Goodnight victim geometry for Wolverine, Rogue, Gambit, Chun-Li/Shadow Lady, and Zangief while deliberately preserving the existing Ryu $12 route. Its deterministic static review passes; its SHA-256 is f327cf7218e5994e0730c1d2b4465084960bbbbb15ee33ba770cb8d8ecc689a6. It has never run and earns zero gameplay or ledger credit. The first V20 correlated trace/scorer proposal is also hard-locked: independent 12/12 tests show that stale sessions, reversed/interleaved events, wrong tap/PC pairs, and a self-consistent changed manifest can pass. V2 rejection receipt SHA-256: 41fca6836ea21471d5be7f94d7d6fa33c6bfdec2b7657060be7235796bc9b5c6.

The append-only V3 replacement now passes independent static review. It begins only at the exact captured-victim leaf $01418E, requires one contiguous same-frame path through $39F9E0, $3AB000, optional fallback $014236, order-only $014254, and exact A3 checkpoint $014284, and validates every complete repeated session. Stale/interleaved streams, identity substitution, and wrong-but-even fallback bases fail closed. The frozen surface is 64 mapped target lanes, 128 exact-base fallback lanes, and 24 unscored source lanes. Root replay passes 12 generator, 20 scorer, and 10 independent tests plus Lua syntax. This proves selector route/A3 arithmetic only; command, contact, choreography, gameplay, and ledger credit remain zero. Independent review receipt SHA-256: df2cd63b6a079316d6f881c8b74fae21ece521307638b8d160d34bb558943bec.

The reported Power Drain heart now has an exact-V18b/V20 static transfer. The source Rogue palette, decoded visible heart tiles, list transforms, normalized animation, motion table, constructor, and complete class-$84 producer surface are preserved. That authorizes no color patch; a matched exact-build live matrix is still required. The separate late class-$48 helper retains older defects but was not the visible kiss particle. Static receipt SHA-256: adfc2f0074939918a0386c7e6b2580a4a622a42fa8b5c0e6a7193ae72fe6cf64. An independent 9/9 adversarial replay confirms the source-exact transfer and the no-color-patch boundary; review receipt SHA-256: c4597771aa294d32da8c0f29810d702088c1980a6a7bf9a7e73238fa42d7d736. Heart presentation remains OPEN and latch/steal remains HOLD.

Private V21 is a static-only child of exact V20, SHA-256 d5d0cb249afba1c295009cd14214b920e935d4436b64997169180b7f18a2df0e. Across the same 28 class-$38 callsites, its route census changes from 25 RTS / 2 native / 1 Goodnight to 24 RTS / 2 native / 1 Goodnight / 1 Repeating Punch. The new child carries target-private $5250 (RP) routing metadata. Outer router $3AB156 sends that tagged subtype-$08 object to translated handler $3AB176 and tail-jumps every non-RP object to the unchanged $39E456 Goodnight router. $3AB176 maps only source $066134..$06617B; $06617C begins the separate class-$3C constructor and was deliberately excluded. Only mvc.10 and mvce.03a differ from V20. Build receipt SHA-256: b7d6f5f13794f91deef70e06bd54d20e71da8ba3b257ec8ff8ccd107307682d7. Maintained 11/11 and independent 14/14 adversarial tests pass with verdict APPROVE_PRIVATE_STATIC_ONLY; independent review SHA-256: e3ca0a6d5338657066a817a60687dc59d7502bc834973465f16aeb1928ade652. This is not a runtime result. All eight live gates remain, it grants no gameplay, parity, or ledger credit, and exact V18b remains the 17/97 baseline with 79 blockers.

Private V22 is the first exact current-QSound descendant of V21. Its SHA-256 is ac41a2abaec73362a27eb28d4000bcf2b6627555ad3db5caca08d02188b8502c. It changes the opcode hook, one 128-byte action row, the owner transport, and the four QSound members—nothing else. The static package has 35 source actions, 31 row actions, four common gameplay actions, 28 PCM clips, and all samples contained within their $8000 windows. Maintained 7/7 and independent 14/14 tests pass. That is static packaging, not proof that the voices sound normal. Natural owner posts, pitch, rate, loops, duration, missing/chipmunk audio, stock interference, and extended play still need exact-hash recordings.

The next defect was not another missing move. V21 had introduced two target-private pool-C tags at object +$6E: Goodnight $4753 and Repeating Punch $5250. Both MvC allocators clear only $00..$5F, and native free $0044E6 never clears +$6E. A reused slot could therefore carry the wrong identity into the next object.

Private V23 implements a statically verified patch for that narrow lifecycle surface. Its SHA-256 is 7f7f9f4f865fbb89dee2c373c095ce3083b2619479c6f672a7cae0dc44aec69f. Only mvc.10 changes, with 89 logical bytes. RP and Goodnight clear +$6E before native free. The RP landing class-$3C call uses a private clone of the already-correct native constructor and clears inherited metadata only after a successful allocation; the failure displacement changes $34->$38 so failed A0 is never touched. The shared constructor, handler, vector, and V22 audio remain exact. Maintained 7/7 and independent 14/14 tests pass. This still earns zero gameplay credit.

The specific report that Ryu looks like he is merely jumping upward with Rogue was checked separately. Exact V23 still contains the accepted captured action- $34 implementation: all six keepalive-3 sites, the class-$10 route, Ryu's $12->$39FA00->$014254 selector path, the animation/list regions, and all eight GFX members are statically preserved. That does not transfer the old video evidence. V20's selector and V23 have never been run, and V23 changes the final Goodnight cleanup route, so a fresh exact-V23 capture is still mandatory; roster-wide victim choreography remains OPEN.

The V23 lifecycle plan inherits V21's 120 RP rows once and adds 424 exact cleanup/reuse/failure/negative rows, for 544 total. Its checker, 12 maintained tests, and 18 independent adversarial tests pass. Every row is unexecuted; recording clearance and request binding are null, authorized commands are empty, and activation is HARD_LOCKED.

The animation census also corrected the broadest visual assumption. Public $06 and secret $26 each expose 278 addressable actions through the same physical tree: 1,488 records, 238 jumps, 784 actor lists, and 14,359 mapped tiles. All 14,359 tile payloads are byte-exact and the reachable tree contains zero unexpected Hulk-residue tiles. The closed mismatch set is seven timing records and six actor-list records. One empty EFFECT-00 stub explains all 19 unreachable Rogue tiles. Nine named hypers—111 records, 74 lists, and 2,100 tiles—have no static timing or actor-semantic mismatch. Public palette data is 96/96 words exact; Shadow Rogue intentionally differs 48/96. The independently reviewed core program projection is 126,704 bytes across 20 intervals.

That does not prove the supers render correctly in play. Effect ownership, background/cut-in routing, palette selection, cleanup, and retained-roster negatives remain live gates, so no graphics patch was issued. A first visual preparation was rejected because its broader surface omitted 328 core cut-in bytes. Append-only V2 restores those bytes and proves a 127,282-byte, 17-interval superset while leaving the hard-locked plan unchanged: 2,628 HOLD rows, including 2,308 developer-menu/injection rows that can never earn parity credit and 320 natural or natural-route-pending rows. No command, screenshot, capture, or runtime result exists.

Audio and pacing therefore remain live blockers. Exact V18b still has its mixed QSound row, while V22/V23 are quarantined static children. The ordinary owner-post design defines 216 future processes but has run zero. The split- clock speed design has also run zero; each owner still needs 120 cumulative within-gameplay-segment host-monotonic seconds and 240 samples in a throttled, audio-enabled same-hash run.

Rogue standing in Marvel vs. Capcom against Strider Hiryu. HUD word ROGUE, partner Ryu, Hulk portrait leftover
HISTORICAL EARLY-CANDIDATE MATCH // Euro mvsc Dual Rogue zip md5 a6c411ce0e9c0f35ac41a1b03bdb1fe7. Body palette 48/48 against $1C8344 and HUD word ROGUE are visual evidence for that build, not exact-V18b gameplay acceptance.

Why Jin looked right

Storm fitted Jin's freed bank-3 space: 12,329 new slots against 12,873 freed, +544. That measurement is why Jin's chair looked like the right place for an X-Man.

Rogue is not Storm. Same method, Captain America kept in the survivor set, zero reliance on "0xFF means free" as ownership:

Bank 3, Jin exclusive vs what Rogue actually needs
  • Jin exclusive (supply)12,873tile slots

    tiles no surviving roster member references

  • Rogue new slots (demand)14,212tile slots

    14,359 source tiles minus 147 survivor-shared

  • Bank 3 all-0xFF non-char656tile slots

    candidates, not owned

PHASE2_ROGUE_JIN_GFX_PROBE.json. Sharing is read-only. Margin −1,339.

two guests, one chair

Jin’s chair, two different X-Men

Storm was the fit. Rogue is the one I wanted.

  1. Storm in Jin's chair+544 slots / +4.4%
    Storm needs12,329Jin frees12,873

    margin +544

  2. Rogue in Jin's chair-1,339 slots / -9.4%
    Rogue needs14,212Jin frees12,873

    margin −1,339

Storm numbers from STORM_MVC PHASE2_GFX_BUDGET_PROBE.json. Rogue numbers from the Jin probe on the same Euro parent.
idx 00/4 · 8t (134.2 ms)
Four poses from the XvSF id $06 gate, held eight ticks each at 59.63 Hz. Extraction evidence, not MvC timing. Bomber jacket, white streak, flight pose.Rogue render-gate poses · 362×367 px · 4 frames · 32 ticks · 0.54 s @ 59.63 Hz · loops to frame 0rogue-gate.png — GATE_rogue_id06.png sliced 4x362; remainder 2 px cropped. CHARACTER_SELECT eviction renders.
Four-pose identity gate with XvSF pens
Palette-matched XvSF Rogue idle
‹›
matched idlegate strip (XvSF pens)
How we named the tree. Palette is still XvSF. This is not a seated MvC sprite list.

Cap stays. Cap's exclusive GFX lives in bank 0. Jin's lives in bank 3. A fighter addresses exactly one bank. Early Storm/Magneto playtests showed leftover identity: Magneto's cut-in still Captain America, Storm's HUD still printed JIN. A tile budget that "fits" while the HUD still says Jin is not a replacement. Magneto and Storm later closed two natural P1/LP identity paths on a separate candidate; Storm's gameplay HUD still says JIN. H-bank expansion of a clean Euro parent was authorized as a fallback while the Jin ledger stayed red. It is not the product. expand_vanilla_hbank_authorized is false on this path.

The chair that actually opens

The unified Magneto article already measured this family: Hulk $06 and Orange Hulk $26 share 100% of their tiles. Deleting Hulk alone frees literally zero. Deleting both frees 16,427 exclusive slots in bank 2.

Magneto did not spend that opening. He sat on Captain America $04 with MAG_TREE in the expansion band. Dual Rogue spends it.

Bank 2, Hulk family vs Rogue
  • Hulk+OH exclusive (supply)16,427tile slots

    palette pair; both ids or nothing

  • Rogue new slots (demand)14,151tile slots

    14,359 source minus 208 survivor-shared in bank 2

  • Leftover pinned as armor2,276tile slots

    Shadow Rogue idle keeps reserved Hulk armor tiles

PHASE2_ROGUE_HULK_GFX_PROBE.json verdict FITS. Bank-2 0xFF and other-nonchar are reported and not counted as owned.

bank 2 after the family leaves

What Dual Rogue actually consumes

Rogue newarmor pin
  1. Hulk+OH exclusive 16,42716,427 tiles
Armor pin ⊆ exclusive, |pin| ≤ leftover margin. Shadow Rogue is presentation-divergent (own tree, own HUD name, Shadow Lady palettes) and gameplay-aliased $26→$06 like Orange Hulk.

Select graph is 15 public ids. $26 is the existing Orange Hulk secret box, not a second grid cell. Hulk's public cell is row 3 col 2, palette $02. Parent is vanilla Euro mvsc md5 e7dbef6dd363c11fddd12f0d446f647b. Source is xmvsfj.zip md5 3d424538843cfce0e03b96d73277f60b. The historical early-candidate archive—not V18b and not currently offered—was named mvsc_rogue_hulk_v1.zip, md5 a6c411ce0e9c0f35ac41a1b03bdb1fe7, SHA-256 4651010a2af0b5163e43dcb10f40d91ceff416a92761c3bec14c1f2ab7daee9f.

What the live stills actually show

Character select: Hulk cell showing Rogue's smiling face filling the square, wordmark ROGUE
Character select: Hulk cell showing a miniature full-body Rogue idle
‹›
idle body in the squaresmiling bust $2A576A
XvSF’s Rogue square is a head crop of her smiling win bust, not the shouting KAO and not the idle body. v6 cover-scales that crop from $2A576A pal $11BFDC into Hulk’s 48×32 cell. Gold pin $0FC0 on pal $02 still passes. SELECT_ICON_RECEIPT.json schema hulk_cell_icon_v6.
48×32 Dual Rogue select cell: Rogue's smiling face, gold 1px frame, space-blue backdrop
The painted cell, nearest-neighbour 4×. Pal $02 in place. Source is XvSF win bust $2A576A, head and collar only — the same square as Rogue on the XvSF roster. This is the grid cell, not the standing figure on the left.
Shadow Rogue is the existing secret boxPattern $0C868 from Chun-Li sets bit 2 of $FF4199. One Up from Ryu $12 reaches $26. Confirm with Up+LP on that cell so $00A4CE runs for the right id.CONFIRMED IN GAME
Character select: navy Shadow Rogue on the extra Orange Hulk cell, wordmark ROGUE
cursor id$26
unlockbit 2 of $FF4199 = $04
confirmUp+LP on the extra cell
pal src$1C9164 · word0 $0248
MAMEsecret.log RESULT=PASS

Do not poke $FF3052 after versus start. Repeating Start after the lock burns the $26 match and lands in attract with a public team. $26 is not a second grid cell. The 100% pass still includes the secret-select large figure behind her.

MAME mame_rogue_hulk_live.lua case=secret · snapshot 0001.png

The match body is RoguePalette directory $1C8344, 48 words, mismatches=0. Pal word0 is not vanilla Hulk $06F0.CONFIRMED IN GAME
Rogue idle vs Strider Hiryu, HUD ROGUE, Ryu as partner
HUD wordROGUE
body pal src$1C8344
live dest$914000 · 48/48
68KCLEAN $399816
secret pal$1C9164 → $914000 · $0248

Partner in the public capture is Ryu. P2 is Strider / Gambit. Shadow Rogue versus palram is a Shadow Lady role remap, not a darkened XvSF row and not a RAM pin. Lifebar face $6EC6 has a 1px transparent frame so the blue rails and the nameplate E-ticks survive.

MAME case=public snapshot 0001.png · public BODY_PAL

The lifebar face is insetTile $6EC6. Row 0, row 31, and the right two columns are pen 15. Cap’s E keeps its trailing outline column.CONFIRMED IN GAME
Close crop of Dual Rogue’s 32×32 lifebar portrait, 1px gap on the blue rails
paint$6EC6 2×2
safe framerow0 / row31 / col30–31
nameROGUE · Cap E +1px outline
tableopcode $6EC6, data-view stays vanilla

The old idle crop filled the 32×32 and sat on the blue rails. Vanilla Hulk already left row 31 empty.

MAME case=public snapshot 0001.png crop

HIT EDITER already draws her treeDest tree $3CD180. accept_label on the dump profile is still HULK; the HIT line prints ROGUE.CONFIRMED IN GAME
HIT EDITER showing Rogue STAND FOOTWORK, CG_Ptr $3CD41A
editor line03 ROGUE · STAND FOOTWORK
CG_Ptr$003CD41A
dest tree$3CD180 public / $3D34D2 shadow
join196/196 names and slots
boxes / moveattrseated; $26 aliases $06

Walk/jump/gravity rows from XvSF Rogue are seated. T85AC left at Hulk $00040002 (no XvSF homolog). CATCH EDITER is the throw oracle; her throw handlers are the next 100% slice after Power Drain.

destination_hit_deep/g000_s000.png · ROGUE_L1_TO_MVC.json

The secret match body is Shadow Lady’s morphDirectory $1C9164. Live palram word0 $0248, skin $0510, navy on gold and green pens. Not a dim Dual Rogue.CONFIRMED IN GAME
Shadow Rogue airborne in a live match: navy suit, mahogany skin, white streak
live word0$0248
skin$0510 mahogany
P navy$0248 / $0127 / $0004
K cloth in ROM$0A47 magenta / $0713
select row 19$1D2CE4 · $0248

Role remap from stock Shadow Lady $1C92E4. Public Dual Rogue $1C8344 stays undarkened XvSF. Do not globally morph P2 portrait pal $1D4F04.

MAME case=secret snapshot 0003.png · BODY_PAL mismatches=0

Shadow Rogue is Shadow Lady, not a dim Rogue

The first secret seating darkened XvSF Rogue in place. Word0 landed at $07A9. That read as a tint, not as a character. Stock Marvel vs. Capcom already owns the pair that should sit here: Shadow Lady’s two palettes on $1C92E4 — navy on P, magenta on K, mahogany skin on both.

$1C9164 is a role remap of that row onto Rogue’s pens. Dual Rogue’s layout is not Chun-Li’s. Pen 0 is the white streak. Pens 1–5 are peach skin. Pens 6–8 are gold hair, gloves, and boots. Pens 9–10 are the khaki jacket. Pens 11–13 are the green leotard. Pen 14 is lips.

Putting Shadow Lady’s gold $0FF0 on Dual Rogue’s gold pens painted a yellow bodysuit. Navy belongs on the gold and the green: $0248 / $0127 / $0115 / $0004. Skin stays mahogany $0510. The streak follows Shadow Lady’s white→navy. Lips stay burgundy $0810. K is $0A47 / $0713. Live secret palram matches that row: rom0=$248 live0=$248 mismatches=0. Public Dual Rogue $1C8344 stays the undarkened XvSF row. Unlock still uses LP, so the live secret match shows the P colors.

A palette-only remap cannot split hair from skin: both still share pens 1–5. If the 100% pass wants a white streak on mahogany without painting the hair navy-adjacent, that is a later GFX seat, not a second pal row.

Shadow Rogue idle in Shadow Lady navy and mahogany
Dual Rogue idle in the public XvSF yellow and green row
‹›
public $06 · $1C8344secret $26 · $1C9164
Same idle cel. Secret is Shadow Lady’s morph, not a darkened public row. Live secret palram word0 $0248. Navy sits on gold and green roles; $0FF0 does not.

The yellow smear was Hulk EFFECT 00

The first Dual Rogue seating still ran Hulk’s hit spawn for L1 group 24: a 24-smear EFFECT list that stuck in the stage sky as a yellow blob (live idle window y 67–92, x 3–83). That is not Rogue art. stub_l1_spritelists() now points group 24 at an empty mode-4 sprite list at $28A3F6 on both public and shadow trees (67 sites each). After the stub the same idle window has 0 yellow pixels. The stub stays until her own dash-trail EFFECT is seated — part of the same 100% pass as her 68K.

The super window is a mask, not a rectangle

An earlier seating pointed Hulk's hyper at XvSF KAO faces ($2A75DA) — the 144×64 select heads from $0FB432. Those are not in-match cut-ins. Stock MvC hypers at $0C15EA are 176×224, origin (0,0), with a thick jagged black left edge. Ryu's is the reference. Painting Hulk's shared hyper tiles in place is forbidden: 44 opaque tiles belong to other characters.

The donor bust is XvSF table $0802C4 index 2: Rogue cel $2A6A24 (208×240), P1 pal $11A45C, P2 pal $11B07C. P1 and P2 are palette rows, not two cels. Cover-scale ate her fists and hair. compose_mvc_cutin.py now contain-scales the full opaque bust into the interior box past the p90 jagged tooth, left-aligns, and inks a 4px black stroke only on the jagged left edge. Shared Hulk hyper tiles stay untouched. The result is a new 1×1 cel on sole-owner tiles in blank GFX $1A000$1C000.

Hulk's hyper record $0C15FA now points at $28BE38. P2 is $0C1A1A. VS KAO records stay KAO. Live MAME fills fraction $FF3273=$FF and stock $FF3274=$03, then QCF+PP. Stock drops from $03 to $00. The cut-in cel is hers. The super kit is not. Live play still crashes, glitches, and can become Ryu.

Win portraits are a different table ($080224) and a different pose. Rogue's smile, hand-out / hip cel is $2A576A with pal $11BFDC (word0 $0DD6). Storm's $11BF3C is the wrong row. That bust is blit-centered onto Hulk's win canvas as cel $28C276, then hung on $0C14D2 / $0C1572 / extra family $0C18F2.

Seated Dual Rogue hyper: XvSF clenched-fist bust inside Hulk’s jagged mask
Stock MvC Ryu hyper cut-in with jagged black left edge
‹›
Ryu stock hyperRogue $28BE38
Same 176×224 window. Left ink is the cutout. Contain keeps both fists and the hair the cover blit cropped.
clip · loops
LIVE MATCH // QCF+PP after a one-shot meter fill. Super.log RESULT=PASS, stock $03→$00. Cel $28BE38 is seated on $0C15FA. Live jagged cut-in OBJ is not claimed here. The super kit is still not hers. Long playtest still crashes, glitches, and can become Ryu.
XvSF Rogue smile / hand-out blit-centered onto Hulk’s win canvas
Stock Hulk winning portrait
‹›
Hulk winRogue $28C276
Win-quote art, not the super. Pal source $11BFDC, not Storm’s $11BF3C.

SPECIAL 00 was the first live special

Hulk's first special is Gamma Charge: charge back, forward + punch. HIT EDITER group Char Gp $2C sub $00 still prints SPECIAL 00. The animation pointer is Rogue's dash at $3D0636. That seating was her body on his charge recognizer: the first proof that a special slot on this chair could play her art. The yellow charge smear that used to trail her is Hulk EFFECT 00; that list is now an empty sprite list.

The continued 100% pass does not stop at that dash. Her CLEAN 68K now owns a detector. Power Drain is live on the same chair.

SPECIAL 00 on the dest treeChar Gp $2C / sub $00. accept_label HULK. The HIT line prints ROGUE. Now_Cnt 00/13.CONFIRMED IN GAME
HIT EDITER CHAR SELECT MODE: Rogue SPECIAL 00 dash, CG_Ptr $3D0636
editor line03 ROGUE · SPECIAL 00
CG_Ptr$003D0636
Char Gp$2C $00
tagg005_s000
68K nowCLEAN $399816

SPECIAL 00 was the first live special: her dash on the charge slot. Power Drain is the next measured special on the same chair.

destination_hit_deep/g005_s000.png · COMPACT_NAME_TO_CHAIN.json

clip · loops
LIVE MATCH // charge-back, forward + LP. HUD word ROGUE. Recaptured after EFFECT 00 stub: no yellow smear. First live special on this chair. Power Drain is the next measured one.

Her 68K sits in CLEAN

The freeze still holds: vanilla Euro mvsc only, no XvSF 68K copied onto Hulk’s window at $02F6FC. That window stays parked so versus construction at $030E28 still has a legal family successor. CODE_DIR for Hulk and Orange Hulk still points at $03050E / $030516. Init at $00D14C still runs $00A4B0, which is how $00A4CE uploads the body palette. Her fight 68K lives somewhere else.

CPS-2's opcode and data views differ through the encrypted word beginning at $100000. Exact V29 reads DATA 0800 and OPCODE 6B41 at that boundary; data == opcode begins at $100002. In Hulk's first-megabyte window the views agree on about four words in a thousand, so a Rogue overlay that looks right as opcode can still read vanilla Hulk as data. Rogue's blob at $399816 is safely in the equal-view region, and its PC-relative tables read what the detector expects.

The blob lands at $399816. Reloc delta $372B82. The detector at $39C6F0 copies XvSF $026508$026C94 — normals through Power Drain — including the stolen-id dispatcher at $026780. That dispatcher is move.w $342(a6) into a per-victim QCF, not a meter table. Ryu indexes $08. Strider indexes $0E. Copy it through so QCF after the kiss latches the move she actually stole.

Tail used 2,616 bytes with 904 of headroom. Receipt status STATIC_PAL_SAFE_GRAFT_CLEAN. Matcher $013C30 keeps the vanilla family successor $019710. Eligibility $012450 keeps $017486. Magneto’s fight 68K lives at MAG_TREE $588000 in the expansion band. Those are two different answers to “where does the guest’s brain go.” Dual Rogue does not take Magneto’s expansion path. She takes the empty CLEAN that the first megabyte would have lied about.

CLEAN Dual Rogue 68K
1 · blob24 · headroomABC$399816$3A0000
  • 1
    blob
    $399816$39C6F0 · 11.7 KB
    data == opcode; reloc delta $372B82
  • 2
    detector
    $39C6F0$39CE7C · 1.9 KB
    XvSF $026508–$026C94, stolen-id dispatcher $026780 included
  • 3
    tail veneers
    $39CE7C$39D128 · 684 B
    pal wrapper, spawn, type $48 hook $39D0A8, grab $39D0CA
  • 4
    headroom
    $39D128$3A0000 · 11.7 KB
    904 bytes
  • A
    detector
    $39C6F0 · marker
  • B
    type $48 hook
    $39D0A8 · marker
  • C
    grab veneer
    $39D0CA · marker
Hulk window $02F6FC stays parked for versus init $030E28. XvSF 68K is not copied onto it. Receipt STATIC_PAL_SAFE_GRAFT_CLEAN.

Power Drain is live

Power Drain is QCB+LK. The live question is not “does a special fire.” SPECIAL 00 already proved a slot can play her art. The 100% question is whether her kiss holds the person she kissed, writes the steal, and then lets her fire their QCF.

The grab veneer at $39D0CA is 94 bytes. QCB can turn Dual Rogue away from the victim, so the veneer compares $c against the opponent and writes facing into $4b and $b3 (0 = right, 1 = left). It snaps the victim $24 pixels in front of that facing, JSR’s Rogue’s hook $39BCE0 ($02915E), then JSR’s MvC attach $0187EE so the pair take actions $32 / $34. Opponent $a8 is pushed, the attach runs, $a8 is restored. Stock $0187CA is the same attach plus move.w $52, $a8(opponent). That extra write is how a defender’s X leaves the kiss and lands on the far side of the screen. The veneer is the attach I want, without that write.

Live Dual Rogue $06 vs Ryu $12, public yellow and green, zip md5 a6c411ce0e9c0f35ac41a1b03bdb1fe7:

  • age 16: still walking in, face=$01, p2x=132
  • age 20: action=$32 group=$20 p2act=$34 face=$00 p1x=79 p2x=115 steal=$0012
  • age 204: stolen Hadouken latch special=$08 / group $2C sub $18

Thirty-six pixels. Face flipped toward Ryu. Steal id $12. That is her kiss, then her stolen QCF. The detector did what $026780 is for.

The next 100% slice on this same object is the projectile. MvC type $48 is Ryu Hadouken at $072A80. Its first instruction is a PC-relative table fetch (move.w table(pc,d0.w),d0 / jmp table(pc,d0.w)), so the head stays vanilla — a six-byte JMP there clobbers the fetch. The isolated jmp $0135E6 at $072B14 already trampolines to CLEAN $39D0A8: parent $54, steal $37A, write $52, then the stock D1 walk. The spawn veneer at $39CED8 already copies $37A$52 before it writes type $48. XvSF oracle vs Ryu is life 144→132, debit 12, special $08. That debit, on this zip, is the measurement I am still taking. Same veneer discipline. One more field.

The kiss holdsGrab veneer $39D0CA. Face, snap $24, JSR $39BCE0, JSR $0187EE, restore $a8. Public $06 vs Ryu $12.CONFIRMED IN GAME
Dual Rogue in public yellow and green kissing Ryu on the mountain stage. HUD word ROGUE. Ryu snapped in front, not on the far side.
group$20 Power Drain
actions$32 / $34
spacingp1x=79 p2x=115 · $24
steal$0012 Ryu
stolen QCFspecial $08 at age 204

Public Dual Rogue colors in this harness. Shadow Rogue’s navy remap is the secret $26 match. The 100% pass continues on the same slice: stolen type $48 D1, life debit, and a Hadouken that survives spawn the way XvSF does.

MAME case=absorb snapshot 0002.png · live/absorb.log age 20 / age 204

Dual Rogue finishing Power Drain on Ryu. HUD word ROGUE. Partner Ryu, P2 Ryu with Spider-Man.
LIVE MATCH // same absorb case, snapshot 0003. Group $20 still on Dual Rogue. The stolen QCF latch is already on this tick. Type $48 debit is the next measurement on the same object.

The 100% pass

The 100% pass is one seating, taken further, until Dual Rogue is the fighter I play in XvSF — on a vanilla Euro parent, without expanding the ROM, and without copying her 68K onto $02F6FC.

Every closed slice on this chair used one method. Name the XvSF oracle. Find the MvC object that already speaks that language. Write a veneer that is small enough to live in CLEAN. Live-gate it. Keep the stock path that versus construction still needs. The kiss is that method: $0187EE is MvC’s attach, $39D0CA is the 94 bytes that face, snap, and restore. The stolen QCF is that method: $026780 came with the detector. Type $48 is that method in progress: vanilla head at $072A80, isolated trampoline at $072B14, steal already on $52 before the type byte.

After debit, the named slices are the same job. The following is the live remainder recorded on the historical early candidate, not a claim about exact V18b and not a short-harness promotion:

She still plays like Hulk. The button-to-group map on this chair is still Hulk’s, so Gamma Charge / Gamma Crush fire in her slots and her own specials do not. After a special she can glitch into playing like Ryu — stolen-id leftover from $026780, not a second character on the roster. The Street Fighter supers she should be able to use after Power Drain do not work. Her own supers do not behave. Matches still crash.

Getting her to XvSF level is the rest of the 100% pass: measure those oracles in X-Men vs. Street Fighter, write veneers that speak MvC, live-gate them, keep Hulk’s window $02F6FC parked. Copying XvSF 68K onto that window is not the path.

Assists and DHC at $07A242 / $09DA20 still carry Hulk’s partner kit because Rogue never had a row there. PCM $3A0..$3BF remaps the IDs, but audible exact- V18b voice/rate parity remains unaccepted. The complete source command census contains no persistent flight mode; jumps, super jump, air dash, dash links, and air attacks are the real movement requirements. An early short MAME harness PASS is historical evidence for its own hash, not an exact-V18b playtest.

historical seating baseline

What the early candidate had seated

These rows describe the early graft receipt and its own candidate hash. They do not override the exact-V18b acceptance ledger above.

nativeverifiedbridgeddonorpending
routepublic $06secret $26
tiles / tree / palverifiedverified
HIT names + slotsverifiedbridgedalias $26→$06
HUD wordverifiedbridgedSHADOWROGUE glyphs exist
hyper cut-inverified$28BE38 celverifiedsame cel, P2 pal
her specialsbridgedHulk recognizer; not hersbridgedsame
her own supersbridgedcut-in only; kit is Hulk’sbridgedsame
stolen SF supersbridgeddo not work in playbridgedsame
win portraitverified$28C276 · pal $11BFDCverifiedextra family +$420
versus pal uploadverifiedverifiedShadow Lady navy · $0248
select grid / wordmarkverifiedv6 $2A576A smilebridged100% pass: $26 large figure
HUD portraitverified1px rails + E outlineverifiedsame $6EC6
EFFECT 00 smearverifiedstub $28A3F6verifiedsame empty sl
68K CLEAN blobverified$399816verifiedsame graft
Power Drain kissverifiedgroup $20 · $24 snapbridgedaliased $26→$06
stolen QCF latchverifiedspecial $08 steal $0012bridgedsame detector
stolen projectile debitbridged100% pass · type $48 D1bridgedsame slice
live stabilitybridgedplays like Hulk; after special can be Ryu; crashesbridgedsame graft
QSound IDsbridged$1E0→$3A0 remapbridgedshared row
PCM / assists / DHC / air movementbridgedexact-V18b acceptance still openbridgedexact-V18b acceptance still open
HISTORICAL EARLY-CANDIDATE BASELINE // ROGUE_68K_GRAFT_RECEIPT.json. Its short harness and long playtest remain useful diagnosis, but they are not same-hash V18b acceptance. No MAG-16 donor-id alias.

What we are doing better now

The Jin draft treated expansion as the authorized next step after a red ledger. The better move was to spend a chair the Magneto plan had already priced and then not used.

The editor side is the same instrument as Magneto and Storm. Dest dump profile rogue-mvc keeps overlay 0, accept_label HULK, live id $06. Join v5 closed the four ETC cells that stock-shape mapping parked at MvC 29. Scoreboard: 196 HIT, 197 dest, names 100%, slots 100%. Details live in the harness post.

The 68K work is the same discipline taken further. An earlier pal-upload skip at $00A4CE greyscaled the body and crashed before versus, so versus upload stays the stock path: do not poke $FF3052. Hulk’s window $02F6FC stays parked. Her blob sits in CLEAN $399816 so opcode and data agree. Power Drain can kiss. SPECIAL 00 was the first live special on this chair, and it is still Hulk’s recognizer. The 100% pass is that same seating, continued until she plays like the Rogue in X-Men vs. Street Fighter: her specials, her supers, stolen Street Fighter supers after Power Drain, a match that does not crash or turn into Ryu. Assists and DHC, PCM $3A0, and source-exact jumps, super jump, air dash, dash links, and air attacks. The source census contains no persistent flight state. I keep taking her toward the fighter I play in XvSF. That is the project.

From helper to Dual Rogue

13 STOPS · 2 CORRECTED · 1 RETRACTIONS · 1 OPEN
  1. Four-pose Rogue identity gate

    GATE_rogue_id06.png; sprites/rogue-gate

    01 / 13measuredextraction

    Name the XvSF tree

    id $06xmvsfj.md5 3d424538…

    Render gate: bomber jacket, white streak, flight pose. xmvsfu.zip was damaged. Decryption was never the story.

    COVERAGE 15% OF THE ANIMATION TREE

    Read this section
  2. need  14212
    freed 12873
    margin −1339

    PHASE2_ROGUE_JIN_GFX_PROBE.json

    02 / 13measuredbank-3 probe

    Jin's chair is short

    −1,339exclusive-only margin

    Storm fitted. Rogue does not. All-FF still short. Other-nonchar is not owned.

    COVERAGE 30% OF THE ANIMATION TREE

    Read this section
  3. expand_hbank = false
    Jin occupied by Storm
    parent md5 e7dbef6d…

    rogue_hulk_allocation_ledger_v1.json

    03 / 13correctedfreeze

    Retire h-bank as product

    falseexpand_vanilla_hbank_authorized

    Vanilla Euro 21-member set. Storm already occupies Jin. Leftover HUD-says-JIN is a failed eviction, not a port.

    COVERAGE 40% OF THE ANIMATION TREE

    Retracted here
    Jin $18 plus h-bank is the Dual Rogue path
    Read this section
  4. need  14151
    freed 16427
    armor pin 2276

    PHASE2_ROGUE_HULK_GFX_PROBE.json verdict FITS

    04 / 13measuredbank-2 probe

    Spend the Hulk family

    +2,276exclusive margin after armor pin

    Same two-slot fact the Magneto costing published. Magneto sat on Cap instead. Rogue takes $06 and $26.

    COVERAGE 60% OF THE ANIMATION TREE

    Read this section
  5. HIT 196/196
    overlay 0
    accept_label HULK

    ROGUE_L1_TO_MVC.json; ORACLE_SCOREBOARD.json

    05 / 13measuredjoin v5

    HIT oracle 196/196

    100%names and slots

    Dest overlay 0. accept_label HULK. ETC cells resolve at editor L1 26, not mapped 29.

    COVERAGE 85% OF THE ANIMATION TREE

    Read this section
  6. Rogue idle in a live MvC match

    live/public.log RESULT=PASS

    06 / 13measuredMAME public case

    Live match body

    48 / 48palette words at $914000

    HUD word ROGUE. Select grid and wordmark are Rogue. Hyper and win cels are seated. EFFECT 00 smear is stubbed. CLEAN 68K and Power Drain come next on the rail.

    COVERAGE 78% OF THE ANIMATION TREE

    Read this section
  7. Seated Dual Rogue jagged hyper cut-in

    compose_mvc_cutin.py; Hulk rec $0C15FA

    07 / 13measuredcompose

    Jagged hyper cut-in

    $28BE38new 1×1 cel, not KAO

    XvSF $2A6A24 contain-scaled past the jagged tooth into Hulk’s 176×224 mask. Live QCF+PP consumes stock $03. Shared hyper tiles were not painted. Win cel $28C276 from $2A576A pal $11BFDC.

    COVERAGE 86% OF THE ANIMATION TREE

    Read this section
  8. HIT EDITER Rogue SPECIAL 00

    destination_hit_deep/g005_s000.png; live/special snapshots

    08 / 13measuredHulk charge slot

    SPECIAL 00 live

    CG $3D0636Rogue dash, Hulk recognizer

    HIT EDITER prints SPECIAL 00. Charge-back, forward + LP in MAME plays her dash. Hulk EFFECT 00 is stubbed to empty sl $28A3F6.

    COVERAGE 90% OF THE ANIMATION TREE

    Read this section
  9. Shadow Rogue in a live match

    live/secret.log RESULT=PASS BODY_PAL mismatches=0

    09 / 13measuredOrange Hulk box

    Secret $26 versus pal

    $0248palram word0 at $914000

    Unlock bit 2, Up from Ryu, Up+LP on $26. Directory $1C9164 is a Shadow Lady role remap: mahogany $0510, navy on gold and green pens $0248/$0127/$0004, K $0A47/$0713. Do not poke $FF3052 after versus; $00A4CE already ran.

    COVERAGE 92% OF THE ANIMATION TREE

    Read this section
  10. L1 group 24 stubbed
    public 67 · shadow 67
    idle yellow px = 0

    PROGRAM_SEAT_RECEIPT.json effect_stub; live/public 0001.png

    10 / 13correctedHulk smear

    EFFECT 00 stub

    $28A3F6empty mode-4 sprite list

    Group 24 was Hulk’s yellow dash smear stuck in the sky. Both trees now point 67 sites at an empty list. The stub stays until her own dash-trail EFFECT is seated.

    COVERAGE 94% OF THE ANIMATION TREE

    Read this section
  11. blob $399816
    detector $39C6F0
    window parked

    ROGUE_68K_GRAFT_RECEIPT.json STATIC_PAL_SAFE_GRAFT_CLEAN

    11 / 13measuredopcode in $399816

    CLEAN 68K graft

    $399816blob · detector $39C6F0

    Hulk window $02F6FC parked for versus init $030E28. Stolen-id dispatcher $026780 indexes $342 onto per-victim QCF. Tail used 2616, headroom 904. No XvSF 68K copy onto $02F6FC.

    COVERAGE 96% OF THE ANIMATION TREE

    Read this section
  12. Dual Rogue Power Drain kiss on Ryu

    live/absorb.log age 20 / age 204; grab_setup_route $39D0CA

    12 / 13measuredlive absorb

    Power Drain kiss + steal

    group $20steal $0012 · QCF $08

    Grab veneer faces, snaps $24, JSR $39BCE0, JSR $0187EE, restores $a8. Live vs Ryu: age 20 p1x=79 p2x=115 p2act=$34; age 204 special=$08. Stolen type $48 debit is the next 100% slice.

    COVERAGE 98% OF THE ANIMATION TREE

    Read this section
  13. strict union = 9 / 52
    new repeatable site = $CB50
    behavior credit = 0

    V28 REPEATABILITY_RECEIPT.json; Matrix M1 MATRIX_RECEIPT.json; Matrix M1 INDEPENDENT_REVIEW.json

    13 / 13openV26–M1

    Matrix M1 broadens strict coverage once

    9 / 52full narrow caller witnesses

    V28 establishes the byte-identical 8/52 neutral baseline. Matrix M1 repeats it, then adds only fixed-slot $CB50 in two exact active-CATCH lanes. The other 43 callers and complete execution/state/exception/return domains remain UNKNOWN.

    COVERAGE 98% OF THE ANIMATION TREE

    Read this section
Stops are stages of proof, not a calendar.

Magneto’s two-tree story and this one share a lab: the unified Magneto article, the nested HIT harness. The helper I always picked is on the roster cell. The square is her smiling XvSF bust, not a tiny idle body. Her 68K lives in CLEAN $399816. Exact V18b has real bounded passes, but its ledger still carries 79 OPEN/HOLD/FAIL blockers and no completion percentage. V28 establishes the 8/52 neutral read/prefetch baseline. Matrix M1 repeats it and adds only $CB50 during two exact active-CATCH configurations, moving the strict subset to 9/52. Those taps do not prove instruction retirement, one-to-one retry execution, caller closure, or behavior. The other 43 caller obligations and the complete state, exception, interrupt, retry, and return-epoch domains remain UNKNOWN. The 12-capture Matrix M2 tag experiment qualifies no additional caller: all eight tag variants remain HOLD because their lifecycle crosses a both-active interval and never reaches the required contiguous 60-frame settlement. It awards zero gameplay or release credit, and the Rogue download remains temporarily withheld. The locked 572-case native-move matrix, CATCH choreography, full moves and combos, audio, presentation, team/stock regression, and one same-hash manual run remain downstream. That is the rest of the project, not a caption.

Written by Daniel Plas Rivera · 15,526 words · $31

ShareXLinkedIn