SeymourBETA

Update 2.199

8/1/2026

v2.199.0.0BETAMINOR

SeymourAug 1, 2026

Aurora: viewer enrichment (F1–F6) driven by analysis of noclip.website / fahrenheit / Spira Modifier

F1 per-anchor scale/pose: overlay now consumes anchor.scale (real ATEL scaleOwnSize 0x7028 via AuroraSceneRenderer.GetMonsterScale) × global factor; per-monster flipX; slider renamed "Scale global".
F2 real ground: getGroundY (downward mesh raycast, per-cell cache); drag-to-place prefers mesh hits; plane fallback at the ANCHOR's own Y (no longer y=0 — proven klyt00_00 Y=2.9 case) + honest badge; G key = ground-snap (POST /drag).
F3 .ath catalog: FfxLib/Monster/MonsterAthAnimCatalog.cs (game-named animation cycles; source: fahrenheit .ath tables — m109/m117/m124 + m001 motions); "🎬 Animação (.ath)" panel in the overlay (dropdown, Play/Stop/T-pose, name↔clip token matching).
F4 encounter zones (honest infrastructure): BuildEncounterZones resolves jppc/map/{area}/{mapKey}/bin/mapout.vpa and serializes zones+zonesNote; overlay draws polygons with a toggle. Truth: the MAP1 decoder still does NOT decode the corpus (NoZonesParsed) — zero fake zones, honest note in the panel (doc FFX_MAPOUT_VPA_MAP1_BLOB_LAYOUT_NOTE_2026-08-01.md: dispatch table has 2 layouts + blobs are not sentinel-terminated = next RE step).
F5 assets: THREE.Cache.enabled (no re-download within the session); fetchCached (Cache API, network-first for anchors); "📦 N MB loaded" counter (resource timing); model fallback cascade _animated.gltf → .gltf → degraded; GLB converter (GltfContainerWriter in PhyreModelExportLab — glb subcommand, ~25% smaller on real maps; viewer/editor prefer .glb).
F6 UI: shortcuts P/V/S/F/T/B/G/1-9 (camera savestates Shift+N); Focar/Topo/Frente/Fit/Reset buttons; anchor inspector (click → select → editable X/Y/Z + Apply via POST /drag; shows ATEL scale/flipX/degraded).
Gates: --filter AuroraOverlayEnrichment 7/7 PASS; full suite 275/275 PASS; builds 0 errors; node --check OK. Docs: FFX_AURORA_VIEWER_ENRICHMENT_2026-08-01.md, FFX_ATH_ANIM_CATALOG_IMPORT_2026-08-01.md, FFX_MAPOUT_VPA_MAP1_BLOB_LAYOUT_NOTE_2026-08-01.md. Status: Needs Testing (visual smoke in the viewer; in-game RT2 not promoted). ### PATCH

v2.198.4.2

v2.199.0.1BETAREVISION

SeymourAug 1, 2026

Full PPP handoff for the PPP editor lane

docs/reverse/PPP_EDITOR_HANDOFF_2026-08-01.md (new, ~236 lines): consolidation of ALL PPP/Phyre/magic_.dll (HD) knowledge — what PPP is (587 magic_.dll; PE32 .text vtable + .data blob), validated 16B C1 slot (handler_table_index local to fp.h; argument_relative proven in 0x7170F0), 3 physical dispatch tables (0xC3A500/418 pppSysProgTbl, 0xC3E798/246, 0xC86080/32; +4/+8/+0xC/+0x1C/+0x20/+0x24 fields; reproducible extractor), U1 handlers 10/10 (FFX_BoneAnim, 16B/8B window, byte-identical clone groups), Draw chain (BuildVfxTexture_TypeK → lppEnv 0xC3A4C4 → TextureSlotCache 0xCCCA64 → Phyre_Map_LowerBound), PppMem 62 functions (pppKeThRes32=0x736A20 confirmed), C2 FULL 184 families (27 knobs + 157; 226/226 pytest), EgoVM/HostContextTable (512 slots @ 0xC64CE8), Yonishi (84 families/51,378 samples), 583/587 DLLs decompiled (1,907,920 lines), T3/T4 proofs (3/3 visual on Power Break), F4 validated, catacombs, noclip/fahrenheit crossrefs, editor golden rules (pppColor lowest priority; names ≠ truth; backup+SHA), what's missing (C3/Path B, T1/T2 probe). No behavior change — baseline untouched. ### REVISION ### MINOR

v2.199.0.0

v2.199.0.2BETAREVISION

SeymourAug 1, 2026

F1: ATEL codec cross-validation × fahrenheit (encoding + opcode table)

docs/reverse/FFX_FAHRENHEIT_ATEL_ENCODING_CROSSCHECK_2026-08-01.md (new): encoding CONFIRMED 1:1 between our FfxLib/Ai and fahrenheit (bit 7 = u16 operand; low 7 bits = opcode 0..0x7A; 1/3B size); 19 opcodes we use confirmed by their AtelOp enum (LAND 0x02, EQ 0x06, NE 0x07, ADD 0x14, SUB 0x15, MUL 0x17, DIV 0x16, MOD 0x18, POPI0 0x59, PUSHI0 0x67, PUSHV 0x9F, POPV 0xA0, PUSHII 0xAE, JMP 0xB0, CALL 0xB5, RET 0x3C, POPXCJMP 0xD6, POPXNCJMP 0xD7 (our guard branch), CALLPOPA 0xD8); comparison-name divergence re-documented (their 0x0A "GT" = A<=B in executable truth); inventory of what they have and we don't (REQ family 0x36–0x53, PUSHN/PUSHT/PUSHVP/PUSHFIX 0xC1–0xC4, LABEL/TAG 0x9D/0x9E, locals POPI/POPF/PUSHI/PUSHF 0x59–0x74, CJMP/NCJMP 0xB1/0xB2); their compiler state (lexer+parser+AST complete, emitter NOT implemented — compiler round-trip blocked on their side; C# builds, C++ loaders need VC toolset absent here). Artifact: work/fahrenheit_atel_opcodes.txt (123 opcodes). No behavior change — baseline untouched. ### REVISION ### REVISION

v2.199.0.1

v2.199.1.0BETAPATCH

SeymourAug 1, 2026

Sphere Grid Canvas: SUPERMD cleanup (encoding, dead Stamps, Square legacy, hook/compiler texts, Open* from corpus, re-baseline on Save)

Encoding (§4.1): SphereGridCanvas_Control.axaml rewritten from scratch in pt-BR — 402 CP1252-mojibake chars / 29 types unrecoverable ("Ícones", "Salvar cópia", "referência", "POSIÇÃO", "CONTEÚDO", "LINKS DESTE NÓ", "editá-lo", "≥320", "índice cru", "Remover nó", "nó #", "✕"); code-behind comment mojibake fixed; SphereGridBuilder_Control.axaml CONFIRMED clean (untouched). Post-fix scan: 30 non-ASCII = legitimate pt-BR accents + symbols (◎ ✕ ≥ ≤ —).
Dead Stamps removed (§4.2): PlaceStamp, StampShape, CurrentStamp, Mode.Stamp, SetStampDiamond/SetStampLine, ToolMode.StampDiamond/StampLine.
Square legacy removed (§4.3): SphereGridSquarePackageWriter.cs deleted (SHA256 manifest was only consumed by the retired v5 hook); Save Square/Export Square buttons + ExportSquarePackage()/RetailBaseline/ResolveHookConfigDir/SquareModeSummary removed; SaveToProject now re-baselines after save (was SaveSquare-only).
New-theory texts (§4.4/§4.7): Banner, Validate, SaveCopy, SphereGridDeployPolicy, TopologySafetySummary updated — counts ≤ 1024 need NO hook (header-driven engine; struct 1024/1024/128; save 1280/1280); the old 861/882 crash was hook v5 / anomalous grid, never a clean deploy; "hook/compiler" → "clean RT2 test (disposable save)".
Open from corpus (§4.6):* ResolveAbmapDir resolves the vanilla corpus (FFX Extracted\...\abmap) FIRST (project only on Save); new warning "project has this grid modified (≠ vanilla)" when the project diverges from corpus.
Toolbar simplified (§4.5): "Square Mode (dat0X + dat1X)" → "Edit topology (counts)"; RT2 checkbox moved next to Save; duplicate buttons removed.
Validation: Release build 0 errors; SphereGrid tests 2/2 PASS (SphereGridAddNodeRepro); gates --spheregrid-layout-rt0/--spheregrid-build-rt0/--spheregrid-edit-rt0 PASS; baseline 276/277 (sole failure = MagicDllCorpusSmokeTests, MagicDll lane, out of scope). Record fix: the ".cs mojibake (687/693/694)" cited in the SUPERMD verification was a display artifact — bytes are valid UTF-8 (→=E2 86 92, Á=C3 81, emojis F0 9F...); only text semantics were fixed. ### REVISION

v2.199.0.2

v2.199.1.1BETAREVISION

SeymourAug 1, 2026

Knowledge-Bases Inventory for the FFX.EXE Operation

docs/ai/KNOWLEDGE_BASES_2026-08-01.md indexes the 11 bases: 5 fahrenheit repos (main/excel/save-ui-rework + local-settings with ATEL assembler + managed-loader with addresses), Spira Modifier 0.73 (discovered: full ATEL RE tool — decompiled to C# in work/_spira_modifier_decomp/; AtelCallTargets catalog 298 entries IDs 95..28967; kernel formats with offsets: AttackData 92/96B (a_ability, SphereTypeForSphereGrid@93), MonsterStat 128B, EncounterTable 14B/entry (btl.bin), MonsterLoot/Treasure/WeaponName/PlayerSaveFile), Phyre_Engine (901 headers + 23 Core modules — structs for the DB), PS3 SDKs (3.40/3.70/4.00 + TrueBlueGaryOPA + SuperExtra).
Address convention proven: managed-loader addresses are RVAs → VA = RVA + 0x400000 (proof: ToBtlPadScrollWait loader 0x498DB0 vs Ghidra 0x898DB0; get_global_value on the DB).
DB backups before the operation: backups_ffxoficial\*.before_operacao_total_20260801_055545.i64. ### PATCH

v2.199.1.0

v2.199.1.2BETAREVISION

SeymourAug 1, 2026

FFX.EXE Operation: 1st rename wave applied (+2,674 canonical / +1,995 COPY) + Spira Modifier formats doc

docs/reverse/SPIRA_MODIFIER_FORMATS_2026-08-01.md: formats extracted from the Spira Modifier 0.73 decompile — AttackData (a_ability: 92/96B, 25× StatusChance, SphereTypeForSphereGrid@93), MonsterStat (128B), MonsterLoot (280B), TreasureEntry (4B — matches ours), EncounterTable (btl.bin, 14B/entry), ATEL catalog (298 entries IDs 95..28967 → atel_call_targets.json).
1st rename wave: fahrenheit-managed-loader addresses (RVAs → VA+0x400000; proven convention) + call.g.cs (__addr_*): 2,674 applied on canonical + 1,995 on COPY (via MCP), default-only (27,138/2,797 already-named preserved). Scripts: work/_fahrenheit_probe/{extract_loader_renames.py, ida_apply_renames_from_json.py, apply_json_in_gui.py}. ### REVISION

v2.199.1.1

v2.199.1.3BETAREVISION

SeymourAug 1, 2026

sphere.bin `activates` bit order PROVEN (3 sources) + 0xc0000374 crash grid forensics (02:38 grid was CLEAN — SUPERMD §5 correction) + clean-RT2 preflight

docs/reverse/FFX_SPHERE_BIN_ACTIVATES_BIT_ORDER_PROVEN_2026-08-01.md (new): Sphere.activates@+0x0A — 11 categories proven (STRENGTH=bit0, DEFENSE=1, MAGIC=2, MAGIC_DEFENSE=3, AGILITY=4, LUCK=5, EVASION=6, ACCURACY=7, HP=8, MP=9, ABILITY=10; All=0x07FF) via 3 independent sources: fahrenheit sphere.cs enum (same order already in our SphereTargets); parsed jppc corpus (3/3/3/1/1-bit groups: entry0 0x0103=STR+DEF+HP=Power, entry1 0x020C=Mana, entry2 0x00D0=Speed, entry3 0x0400=Ability, entry4 0x0020=Luck, entry9 0x07FF=Friend, Key L1–L4 special 8..11, Return/Teleport/Clear/Master special 1..4); panel.bin effect bits (SphereGridNodeSphereRequirement: PowerSphere→0x0001=STR, ManaSphere→0x0004=MAG, SpeedSphere→0x0010=AGL, AbilitySphere→0x0400) — runtime does activates & effect. SphereTargets comment fixed (said "not proven", attributed 0x0103 to Ability). Record fix: v2.198.3.4 "indices = SphereGridNodeSphereRequirementKind" was misleading (table index ≠ requirement enum).
docs/reverse/SPHERE_GRID_CRASH_GRID_FORENSICS_2026-08-01.md (new): byte parse of deployed dat02.dat 02:38:29 (98/861/882; node 860 = (129,-172) U3=0 Red=0x19 Cl=64 U6=170 = correct bucket; dat10 content 0x19 matches) — grid was CLEAN; SUPERMD §5 values (Cluster=851/Redundant=854/Unused3=855/Unknown6=0/content=0x07) came from a wrong-offset parse. The truly anomalous grids live in the June backups (repair-node860-meta 17/06 U6=0; corrupt 20/06 clusters=1). The 02:39/02:40 crash ran with hooks active (ffx-hooks+ffx-probe loaded) + clean grid → hypothesis: v5 hook (guard pad/canary); decisive test = RT2 with hooks OFF.
Clean-RT2 preflight applied: work/_sg_rt2_preflight/rt2_hooks_toggle.ps1 -Off (ffx-hooks.dll/ffx-probe.dll → .RT2OFF; legacy sidecars → .legado; ff10-file-loader.dll+dinput8.dll kept for overlay). Restore: -On or FFX-RESTORE.bat.
Validation: Release build 0 errors; baseline 283/283 PASS (MagicDllCorpusSmokeTests failure gone — MagicDll lane fixed); offline_ci sole FAIL = BattleCompanionActivationLab (drift sentinel mcyt00_21 — annotated other-lane pending, out of scope). No product behavior change (docs + comment + work/ scripts). ### REVISION

v2.199.1.2

v2.199.1.4BETAREVISION

SeymourAug 1, 2026

F2–F5 of the fahrenheit plan: ATEL data import + high-level assembler feasibility

docs/reverse/PPP_FAHRENHEIT_ATEL_IMPORT_2026-08-01.md (F2+F3+F4): fahrenheit call-target tables extracted (11 namespaces: VAs 0x850050 Common/0x842618 Battle/... + counts 616/296/145/138...; handler struct IDENTICAL to our EBP — cross-validation); 129 FFX auto-abilities (0x8000+) + 487 FFX-2 command IDs (caveat: FFX-2 ≠ FFX; 0x3049 = pcom_seed_cannon there vs Firaga in our fixture); REQ dialect documented (0x36–0x3B: REQ/REQSW/REQEW/PREQ/PREQSW/PREQEW + F/T/B/P prefixes + SW/EW suffixes — EVENT/field family, not used in battle AiFile); AtelOp enum confirms our table (POPXCJMP=0xD6/POPXNCJMP=0xD7/CALLPOPA=0xD8/PUSHII=0xAE). Artifacts: work/f2_fahrenheit_calltargets.json + work/f3_fahrenheit_ability_names.json.
docs/reverse/PPP_ATEL_ASSEMBLER_F5_FEASIBILITY_2026-08-01.md (F5): high-level ATEL assembler feasibility — 3 options (reference fahrenheit LGPL vs port the syntax vs own language); recommendation: port the syntax (Option B — our fixed opcode table, zero dependency, small scope); 4-batch roadmap (L1 lexer/parser → L2 emitter via fixed AiVarConditionBuilder → L3 while/func → L4 UI with 3-layer preview); risks (LGPL, semantic-bug repeat).
docs/reverse/PPP_EDITOR_HANDOFF_2026-08-01.md (+10 lines from the PPP editor lane — empirical fixes: the 4 "corrupt" DLLs open for parsing; 576/581 editable; keys are GLOBAL host-table indices — depend on a runtime probe). No behavior change — baseline 283/283 untouched. ### REVISION ### REVISION

v2.199.1.3

v2.199.1.5BETAREVISION

SeymourAug 1, 2026

Jarvis-WIRE lane created (hook specialist, lane 2) + Operation Demonio: F8 Menu (UnX 0.9.1.9 + dxgi.dll SpecialK 0.8.36 fork) code-review plan + our hooks knowledge base

docs/ai/agents/JARVIS-WIRE.md (new): lane-2 hook specialist identity (not Jarvis-Hook): domain, required reading, core truths (WireInstance is NOT the C++<->C# pattern - MMFs are; CreateRemoteThread retired; always verify calling convention), output format, guardrails (nothing written to the game without explicit order).
docs/reverse/HOOKS_WIRE_KNOWLEDGE_BASE_2026-08-01.md (new): hooks architecture consolidation: 4 layers (dinput8 ffgriever loader -> ff10-file-loader/ffx-probe/ffx-hooks -> editor), 2 MMF blocks (FFXProbeBlock_v1 580B + FFXHooksBlock_v1 256B), InstallHooks factory table with 20+ hooks (MusicHook, NovaSuperDamage, RonsoMana, NulWard, GridTeach v4.5, KimahriLancetDualGrant, TrueNewNode, FullGridCompiler, ItemStackCap 99->255, DoubleTripleDrop, Element, AbilitySfx, ResolverLog, FieldScout/WireInstance, FieldProbe, BattleEnd, ArenaProgressSidecar, SinCurse, ArenaPlus*; PhaseTurnEdge disabled; BootSkip WIRE-ME), F7 flag system (env + .flag + config), lessons (retn4 double-pop; NulWard x NovaClamp conflicts; TrueNewNode x FullGrid), sibling labs (63 RuntimeTools folders).
docs/reverse/F8_UNX_CODEREVIEW_PLAN_2026-08-01.md (new): Operation Demonio in 5 phases (F0 forensic recon -> F1 hook map with PDBs -> F2 menu call inventory item-by-item -> F3 11 inconsistency classes -> F4 read-only dynamic verification -> F5 delivery), bases (binaries+PDBs, real 19/07 logs, fahrenheit 5 repos, noclip, IDA MCP 13338), menu tree extracted from strings (Boost.FFX/SpeedHack.FFX/Fun.FFX PlayableSeymour/Language redirects/Cheat Engine with sig scan + "mem b D2A8E2 2" patches).
docs/reverse/F8_UNX_INCONSISTENCY_REGISTER_2026-08-01.md (new): live register with template + 8 seeds: INC-001 19/07 05:54 boot crash (dxgi.log stops after D3D11 hooks/nvapi); INC-002 F8 DI8_GetDeviceState_Override x our GetDeviceState hook (same target); INC-003 D3D11/Present x Aurora overlay; INC-004 hardcoded cheat offsets without version gate; INC-005 orphan UnX.ini in game dir; INC-006 language redirects x ff10-file-loader; INC-007 SuspendThread/Thread32 x MH_ApplyQueued; INC-008 WININET auto-update.
Recon: work/f8_recon/ (pe_scan.py, manifest.txt with SHA256 + PE analysis, unx_strings_ascii.txt 798 / utf16 253). PE findings: unx.dll exports SKPlugIn_Init (SpecialK plugin), ImGui menu, imports keybd_event/SuspendThread/Thread32; dxgi.dll .SK_Hook/.tls/.rsrc 4.3MB sections, WININET + d3dx9_43 + VCOMP140 imports; PDBs included (dxgi.pdb 62MB, unx.pdb 6MB). No behavior change - baseline untouched.

v2.199.1.4

Back to updates

SeymourBETA

Update 2.199

8/1/2026

v2.199.0.0BETAMINOR

SeymourAug 1, 2026

Aurora: viewer enrichment (F1–F6) driven by analysis of noclip.website / fahrenheit / Spira Modifier

F1 per-anchor scale/pose: overlay now consumes anchor.scale (real ATEL scaleOwnSize 0x7028 via AuroraSceneRenderer.GetMonsterScale) × global factor; per-monster flipX; slider renamed "Scale global".
F2 real ground: getGroundY (downward mesh raycast, per-cell cache); drag-to-place prefers mesh hits; plane fallback at the ANCHOR's own Y (no longer y=0 — proven klyt00_00 Y=2.9 case) + honest badge; G key = ground-snap (POST /drag).
F3 .ath catalog: FfxLib/Monster/MonsterAthAnimCatalog.cs (game-named animation cycles; source: fahrenheit .ath tables — m109/m117/m124 + m001 motions); "🎬 Animação (.ath)" panel in the overlay (dropdown, Play/Stop/T-pose, name↔clip token matching).
F4 encounter zones (honest infrastructure): BuildEncounterZones resolves jppc/map/{area}/{mapKey}/bin/mapout.vpa and serializes zones+zonesNote; overlay draws polygons with a toggle. Truth: the MAP1 decoder still does NOT decode the corpus (NoZonesParsed) — zero fake zones, honest note in the panel (doc FFX_MAPOUT_VPA_MAP1_BLOB_LAYOUT_NOTE_2026-08-01.md: dispatch table has 2 layouts + blobs are not sentinel-terminated = next RE step).
F5 assets: THREE.Cache.enabled (no re-download within the session); fetchCached (Cache API, network-first for anchors); "📦 N MB loaded" counter (resource timing); model fallback cascade _animated.gltf → .gltf → degraded; GLB converter (GltfContainerWriter in PhyreModelExportLab — glb subcommand, ~25% smaller on real maps; viewer/editor prefer .glb).
F6 UI: shortcuts P/V/S/F/T/B/G/1-9 (camera savestates Shift+N); Focar/Topo/Frente/Fit/Reset buttons; anchor inspector (click → select → editable X/Y/Z + Apply via POST /drag; shows ATEL scale/flipX/degraded).
Gates: --filter AuroraOverlayEnrichment 7/7 PASS; full suite 275/275 PASS; builds 0 errors; node --check OK. Docs: FFX_AURORA_VIEWER_ENRICHMENT_2026-08-01.md, FFX_ATH_ANIM_CATALOG_IMPORT_2026-08-01.md, FFX_MAPOUT_VPA_MAP1_BLOB_LAYOUT_NOTE_2026-08-01.md. Status: Needs Testing (visual smoke in the viewer; in-game RT2 not promoted). ### PATCH

v2.198.4.2

v2.199.0.1BETAREVISION

SeymourAug 1, 2026

Full PPP handoff for the PPP editor lane

docs/reverse/PPP_EDITOR_HANDOFF_2026-08-01.md (new, ~236 lines): consolidation of ALL PPP/Phyre/magic_.dll (HD) knowledge — what PPP is (587 magic_.dll; PE32 .text vtable + .data blob), validated 16B C1 slot (handler_table_index local to fp.h; argument_relative proven in 0x7170F0), 3 physical dispatch tables (0xC3A500/418 pppSysProgTbl, 0xC3E798/246, 0xC86080/32; +4/+8/+0xC/+0x1C/+0x20/+0x24 fields; reproducible extractor), U1 handlers 10/10 (FFX_BoneAnim, 16B/8B window, byte-identical clone groups), Draw chain (BuildVfxTexture_TypeK → lppEnv 0xC3A4C4 → TextureSlotCache 0xCCCA64 → Phyre_Map_LowerBound), PppMem 62 functions (pppKeThRes32=0x736A20 confirmed), C2 FULL 184 families (27 knobs + 157; 226/226 pytest), EgoVM/HostContextTable (512 slots @ 0xC64CE8), Yonishi (84 families/51,378 samples), 583/587 DLLs decompiled (1,907,920 lines), T3/T4 proofs (3/3 visual on Power Break), F4 validated, catacombs, noclip/fahrenheit crossrefs, editor golden rules (pppColor lowest priority; names ≠ truth; backup+SHA), what's missing (C3/Path B, T1/T2 probe). No behavior change — baseline untouched. ### REVISION ### MINOR

v2.199.0.0

v2.199.0.2BETAREVISION

SeymourAug 1, 2026

F1: ATEL codec cross-validation × fahrenheit (encoding + opcode table)

docs/reverse/FFX_FAHRENHEIT_ATEL_ENCODING_CROSSCHECK_2026-08-01.md (new): encoding CONFIRMED 1:1 between our FfxLib/Ai and fahrenheit (bit 7 = u16 operand; low 7 bits = opcode 0..0x7A; 1/3B size); 19 opcodes we use confirmed by their AtelOp enum (LAND 0x02, EQ 0x06, NE 0x07, ADD 0x14, SUB 0x15, MUL 0x17, DIV 0x16, MOD 0x18, POPI0 0x59, PUSHI0 0x67, PUSHV 0x9F, POPV 0xA0, PUSHII 0xAE, JMP 0xB0, CALL 0xB5, RET 0x3C, POPXCJMP 0xD6, POPXNCJMP 0xD7 (our guard branch), CALLPOPA 0xD8); comparison-name divergence re-documented (their 0x0A "GT" = A<=B in executable truth); inventory of what they have and we don't (REQ family 0x36–0x53, PUSHN/PUSHT/PUSHVP/PUSHFIX 0xC1–0xC4, LABEL/TAG 0x9D/0x9E, locals POPI/POPF/PUSHI/PUSHF 0x59–0x74, CJMP/NCJMP 0xB1/0xB2); their compiler state (lexer+parser+AST complete, emitter NOT implemented — compiler round-trip blocked on their side; C# builds, C++ loaders need VC toolset absent here). Artifact: work/fahrenheit_atel_opcodes.txt (123 opcodes). No behavior change — baseline untouched. ### REVISION ### REVISION

v2.199.0.1

v2.199.1.0BETAPATCH

SeymourAug 1, 2026

Sphere Grid Canvas: SUPERMD cleanup (encoding, dead Stamps, Square legacy, hook/compiler texts, Open* from corpus, re-baseline on Save)

Encoding (§4.1): SphereGridCanvas_Control.axaml rewritten from scratch in pt-BR — 402 CP1252-mojibake chars / 29 types unrecoverable ("Ícones", "Salvar cópia", "referência", "POSIÇÃO", "CONTEÚDO", "LINKS DESTE NÓ", "editá-lo", "≥320", "índice cru", "Remover nó", "nó #", "✕"); code-behind comment mojibake fixed; SphereGridBuilder_Control.axaml CONFIRMED clean (untouched). Post-fix scan: 30 non-ASCII = legitimate pt-BR accents + symbols (◎ ✕ ≥ ≤ —).
Dead Stamps removed (§4.2): PlaceStamp, StampShape, CurrentStamp, Mode.Stamp, SetStampDiamond/SetStampLine, ToolMode.StampDiamond/StampLine.
Square legacy removed (§4.3): SphereGridSquarePackageWriter.cs deleted (SHA256 manifest was only consumed by the retired v5 hook); Save Square/Export Square buttons + ExportSquarePackage()/RetailBaseline/ResolveHookConfigDir/SquareModeSummary removed; SaveToProject now re-baselines after save (was SaveSquare-only).
New-theory texts (§4.4/§4.7): Banner, Validate, SaveCopy, SphereGridDeployPolicy, TopologySafetySummary updated — counts ≤ 1024 need NO hook (header-driven engine; struct 1024/1024/128; save 1280/1280); the old 861/882 crash was hook v5 / anomalous grid, never a clean deploy; "hook/compiler" → "clean RT2 test (disposable save)".
Open from corpus (§4.6):* ResolveAbmapDir resolves the vanilla corpus (FFX Extracted\...\abmap) FIRST (project only on Save); new warning "project has this grid modified (≠ vanilla)" when the project diverges from corpus.
Toolbar simplified (§4.5): "Square Mode (dat0X + dat1X)" → "Edit topology (counts)"; RT2 checkbox moved next to Save; duplicate buttons removed.
Validation: Release build 0 errors; SphereGrid tests 2/2 PASS (SphereGridAddNodeRepro); gates --spheregrid-layout-rt0/--spheregrid-build-rt0/--spheregrid-edit-rt0 PASS; baseline 276/277 (sole failure = MagicDllCorpusSmokeTests, MagicDll lane, out of scope). Record fix: the ".cs mojibake (687/693/694)" cited in the SUPERMD verification was a display artifact — bytes are valid UTF-8 (→=E2 86 92, Á=C3 81, emojis F0 9F...); only text semantics were fixed. ### REVISION

v2.199.0.2

v2.199.1.1BETAREVISION

SeymourAug 1, 2026

Knowledge-Bases Inventory for the FFX.EXE Operation

docs/ai/KNOWLEDGE_BASES_2026-08-01.md indexes the 11 bases: 5 fahrenheit repos (main/excel/save-ui-rework + local-settings with ATEL assembler + managed-loader with addresses), Spira Modifier 0.73 (discovered: full ATEL RE tool — decompiled to C# in work/_spira_modifier_decomp/; AtelCallTargets catalog 298 entries IDs 95..28967; kernel formats with offsets: AttackData 92/96B (a_ability, SphereTypeForSphereGrid@93), MonsterStat 128B, EncounterTable 14B/entry (btl.bin), MonsterLoot/Treasure/WeaponName/PlayerSaveFile), Phyre_Engine (901 headers + 23 Core modules — structs for the DB), PS3 SDKs (3.40/3.70/4.00 + TrueBlueGaryOPA + SuperExtra).
Address convention proven: managed-loader addresses are RVAs → VA = RVA + 0x400000 (proof: ToBtlPadScrollWait loader 0x498DB0 vs Ghidra 0x898DB0; get_global_value on the DB).
DB backups before the operation: backups_ffxoficial\*.before_operacao_total_20260801_055545.i64. ### PATCH

v2.199.1.0

v2.199.1.2BETAREVISION

SeymourAug 1, 2026

FFX.EXE Operation: 1st rename wave applied (+2,674 canonical / +1,995 COPY) + Spira Modifier formats doc

docs/reverse/SPIRA_MODIFIER_FORMATS_2026-08-01.md: formats extracted from the Spira Modifier 0.73 decompile — AttackData (a_ability: 92/96B, 25× StatusChance, SphereTypeForSphereGrid@93), MonsterStat (128B), MonsterLoot (280B), TreasureEntry (4B — matches ours), EncounterTable (btl.bin, 14B/entry), ATEL catalog (298 entries IDs 95..28967 → atel_call_targets.json).
1st rename wave: fahrenheit-managed-loader addresses (RVAs → VA+0x400000; proven convention) + call.g.cs (__addr_*): 2,674 applied on canonical + 1,995 on COPY (via MCP), default-only (27,138/2,797 already-named preserved). Scripts: work/_fahrenheit_probe/{extract_loader_renames.py, ida_apply_renames_from_json.py, apply_json_in_gui.py}. ### REVISION

v2.199.1.1

v2.199.1.3BETAREVISION

SeymourAug 1, 2026

sphere.bin `activates` bit order PROVEN (3 sources) + 0xc0000374 crash grid forensics (02:38 grid was CLEAN — SUPERMD §5 correction) + clean-RT2 preflight

docs/reverse/FFX_SPHERE_BIN_ACTIVATES_BIT_ORDER_PROVEN_2026-08-01.md (new): Sphere.activates@+0x0A — 11 categories proven (STRENGTH=bit0, DEFENSE=1, MAGIC=2, MAGIC_DEFENSE=3, AGILITY=4, LUCK=5, EVASION=6, ACCURACY=7, HP=8, MP=9, ABILITY=10; All=0x07FF) via 3 independent sources: fahrenheit sphere.cs enum (same order already in our SphereTargets); parsed jppc corpus (3/3/3/1/1-bit groups: entry0 0x0103=STR+DEF+HP=Power, entry1 0x020C=Mana, entry2 0x00D0=Speed, entry3 0x0400=Ability, entry4 0x0020=Luck, entry9 0x07FF=Friend, Key L1–L4 special 8..11, Return/Teleport/Clear/Master special 1..4); panel.bin effect bits (SphereGridNodeSphereRequirement: PowerSphere→0x0001=STR, ManaSphere→0x0004=MAG, SpeedSphere→0x0010=AGL, AbilitySphere→0x0400) — runtime does activates & effect. SphereTargets comment fixed (said "not proven", attributed 0x0103 to Ability). Record fix: v2.198.3.4 "indices = SphereGridNodeSphereRequirementKind" was misleading (table index ≠ requirement enum).
docs/reverse/SPHERE_GRID_CRASH_GRID_FORENSICS_2026-08-01.md (new): byte parse of deployed dat02.dat 02:38:29 (98/861/882; node 860 = (129,-172) U3=0 Red=0x19 Cl=64 U6=170 = correct bucket; dat10 content 0x19 matches) — grid was CLEAN; SUPERMD §5 values (Cluster=851/Redundant=854/Unused3=855/Unknown6=0/content=0x07) came from a wrong-offset parse. The truly anomalous grids live in the June backups (repair-node860-meta 17/06 U6=0; corrupt 20/06 clusters=1). The 02:39/02:40 crash ran with hooks active (ffx-hooks+ffx-probe loaded) + clean grid → hypothesis: v5 hook (guard pad/canary); decisive test = RT2 with hooks OFF.
Clean-RT2 preflight applied: work/_sg_rt2_preflight/rt2_hooks_toggle.ps1 -Off (ffx-hooks.dll/ffx-probe.dll → .RT2OFF; legacy sidecars → .legado; ff10-file-loader.dll+dinput8.dll kept for overlay). Restore: -On or FFX-RESTORE.bat.
Validation: Release build 0 errors; baseline 283/283 PASS (MagicDllCorpusSmokeTests failure gone — MagicDll lane fixed); offline_ci sole FAIL = BattleCompanionActivationLab (drift sentinel mcyt00_21 — annotated other-lane pending, out of scope). No product behavior change (docs + comment + work/ scripts). ### REVISION

v2.199.1.2

v2.199.1.4BETAREVISION

SeymourAug 1, 2026

F2–F5 of the fahrenheit plan: ATEL data import + high-level assembler feasibility

docs/reverse/PPP_FAHRENHEIT_ATEL_IMPORT_2026-08-01.md (F2+F3+F4): fahrenheit call-target tables extracted (11 namespaces: VAs 0x850050 Common/0x842618 Battle/... + counts 616/296/145/138...; handler struct IDENTICAL to our EBP — cross-validation); 129 FFX auto-abilities (0x8000+) + 487 FFX-2 command IDs (caveat: FFX-2 ≠ FFX; 0x3049 = pcom_seed_cannon there vs Firaga in our fixture); REQ dialect documented (0x36–0x3B: REQ/REQSW/REQEW/PREQ/PREQSW/PREQEW + F/T/B/P prefixes + SW/EW suffixes — EVENT/field family, not used in battle AiFile); AtelOp enum confirms our table (POPXCJMP=0xD6/POPXNCJMP=0xD7/CALLPOPA=0xD8/PUSHII=0xAE). Artifacts: work/f2_fahrenheit_calltargets.json + work/f3_fahrenheit_ability_names.json.
docs/reverse/PPP_ATEL_ASSEMBLER_F5_FEASIBILITY_2026-08-01.md (F5): high-level ATEL assembler feasibility — 3 options (reference fahrenheit LGPL vs port the syntax vs own language); recommendation: port the syntax (Option B — our fixed opcode table, zero dependency, small scope); 4-batch roadmap (L1 lexer/parser → L2 emitter via fixed AiVarConditionBuilder → L3 while/func → L4 UI with 3-layer preview); risks (LGPL, semantic-bug repeat).
docs/reverse/PPP_EDITOR_HANDOFF_2026-08-01.md (+10 lines from the PPP editor lane — empirical fixes: the 4 "corrupt" DLLs open for parsing; 576/581 editable; keys are GLOBAL host-table indices — depend on a runtime probe). No behavior change — baseline 283/283 untouched. ### REVISION ### REVISION

v2.199.1.3

v2.199.1.5BETAREVISION

SeymourAug 1, 2026

Jarvis-WIRE lane created (hook specialist, lane 2) + Operation Demonio: F8 Menu (UnX 0.9.1.9 + dxgi.dll SpecialK 0.8.36 fork) code-review plan + our hooks knowledge base

docs/ai/agents/JARVIS-WIRE.md (new): lane-2 hook specialist identity (not Jarvis-Hook): domain, required reading, core truths (WireInstance is NOT the C++<->C# pattern - MMFs are; CreateRemoteThread retired; always verify calling convention), output format, guardrails (nothing written to the game without explicit order).
docs/reverse/HOOKS_WIRE_KNOWLEDGE_BASE_2026-08-01.md (new): hooks architecture consolidation: 4 layers (dinput8 ffgriever loader -> ff10-file-loader/ffx-probe/ffx-hooks -> editor), 2 MMF blocks (FFXProbeBlock_v1 580B + FFXHooksBlock_v1 256B), InstallHooks factory table with 20+ hooks (MusicHook, NovaSuperDamage, RonsoMana, NulWard, GridTeach v4.5, KimahriLancetDualGrant, TrueNewNode, FullGridCompiler, ItemStackCap 99->255, DoubleTripleDrop, Element, AbilitySfx, ResolverLog, FieldScout/WireInstance, FieldProbe, BattleEnd, ArenaProgressSidecar, SinCurse, ArenaPlus*; PhaseTurnEdge disabled; BootSkip WIRE-ME), F7 flag system (env + .flag + config), lessons (retn4 double-pop; NulWard x NovaClamp conflicts; TrueNewNode x FullGrid), sibling labs (63 RuntimeTools folders).
docs/reverse/F8_UNX_CODEREVIEW_PLAN_2026-08-01.md (new): Operation Demonio in 5 phases (F0 forensic recon -> F1 hook map with PDBs -> F2 menu call inventory item-by-item -> F3 11 inconsistency classes -> F4 read-only dynamic verification -> F5 delivery), bases (binaries+PDBs, real 19/07 logs, fahrenheit 5 repos, noclip, IDA MCP 13338), menu tree extracted from strings (Boost.FFX/SpeedHack.FFX/Fun.FFX PlayableSeymour/Language redirects/Cheat Engine with sig scan + "mem b D2A8E2 2" patches).
docs/reverse/F8_UNX_INCONSISTENCY_REGISTER_2026-08-01.md (new): live register with template + 8 seeds: INC-001 19/07 05:54 boot crash (dxgi.log stops after D3D11 hooks/nvapi); INC-002 F8 DI8_GetDeviceState_Override x our GetDeviceState hook (same target); INC-003 D3D11/Present x Aurora overlay; INC-004 hardcoded cheat offsets without version gate; INC-005 orphan UnX.ini in game dir; INC-006 language redirects x ff10-file-loader; INC-007 SuspendThread/Thread32 x MH_ApplyQueued; INC-008 WININET auto-update.
Recon: work/f8_recon/ (pe_scan.py, manifest.txt with SHA256 + PE analysis, unx_strings_ascii.txt 798 / utf16 253). PE findings: unx.dll exports SKPlugIn_Init (SpecialK plugin), ImGui menu, imports keybd_event/SuspendThread/Thread32; dxgi.dll .SK_Hook/.tls/.rsrc 4.3MB sections, WININET + d3dx9_43 + VCOMP140 imports; PDBs included (dxgi.pdb 62MB, unx.pdb 6MB). No behavior change - baseline untouched.

v2.199.1.4