SeymourBETA

Update 2.207

8/2/2026

v2.207.0.0BETAMINOR

SeymourAug 1, 2026

F5-L4: high-level ATEL script panel in the Monster AI Editor (dry-run with diff)

MonsterAiEditor_DataModel.AtelScriptLab.cs (new partial): observable AtelScriptText/AtelScriptResult/AtelScriptDiffSummary/AtelScriptDiffLines + CompileAtelDryRun() — parses/compiles the script against the SELECTED monster (AiAutomation.PickCombatWorker/PickMainEntrypoint) and shows the diff (AiScript_Diff.Compare, Added/Modified/Removed). Dry-run: nothing is saved (save stays on the editor's existing channels). Actionable errors (syntax/emission).
MonsterAiAtelScriptLab_Window.axaml + .cs (new): window with script editor (Consolas), "Compile (dry-run)" button, summary + diff ListBox. "Script ATEL (F5)" button added to the MonsterAiEditor_Control toolbar.
Baseline: 332/332 PASS (329 + 3 from another lane). ### MINOR ### MINOR

v2.206.0.0

v2.207.0.1BETAREVISION

SeymourAug 1, 2026

F6: battle/save structs cross-validation (fahrenheit PS2 × our HD offsets)

docs/reverse/PPP_FAHRENHEIT_STRUCTS_CROSSREF_F6_2026-08-01.md: fahrenheit inventory (PS2 ChrRam 0x1EC with stats @0x68–0x77 and equip @0x52/0x53; CtbEntry 4B + CtbBaseData tick_speed; save_impl/ply_save) vs ours (HD MemoryChr with script pointers +0xF78.., FfxSaveSphereGrid with bounds guard, decompiled HD CTB queue). Honest verdict: PS2 ≠ HD (the HD MemoryChr includes the script/VM layer; PS2 executes MIPS) — PS2 stats are field-by-field validation candidates against the HD aggregator (0x7B2DD0); CtbBaseData is semantics reference for the CTB queue; nothing promoted without HD proof. Read-only — baseline 332/332 untouched. ### REVISION ### MINOR

v2.207.0.0

v2.207.0.2BETAREVISION

SeymourAug 1, 2026

F7: cross-validation of the ATEL codecs (fahrenheit ↔ ours) — 3/3 validated

docs/reverse/PPP_FAHRENHEIT_CODEC_CROSSVALIDATION_F7_2026-08-01.md: F7-A our syntax → their parser (var x = 0; accepted; their lexer EOF bug documented — crash on trailing newline, lexer.cs:74); F7-B our generated AiFile (324 instructions via AtelLangLab) → walk with their fetch rule (bit 0x80 = operand): closed exactly, 0 opcodes outside their AtelOp enum; F7-C our KnownOpcode (49) ⊆ their enum (123): 0 missing. Limits: their compiler does NOT emit bytes (AtelAssembler never called); validation covers dialect/fetch/table, not the full worker layout. Conclusion: both codecs speak the same dialect — our fixed semantics (v2.198.4.1) is the executable truth. Read-only — baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.1

v2.207.0.2BETAREVISION

SeymourAug 1, 2026

Operation Demonio session 2: full inventory of the new F8 (InGameMenu of FfxHooksDll)

docs/reverse/F8_UNX_INCONSISTENCY_REGISTER_2026-08-01.md (+45 lines): the new F8 = our ecosystem plugin switchboard (UnX reimplementation over our hook layer). Architecture mapped in dllmain.cpp: gate ingame_menu.flag/FFXHOOKS_ENABLE_INGAME_MENU/Aurora config; infra = AuroraD3D11 overlay (Present vtable[8]); input = GetAsyncKeyState (poll on Present) + WndProc subclass (WM_KEYDOWN/SYSKEYDOWN, 90/150ms debounce) - no DirectInput, zero conflict with the probe (contrast with legacy UnX that crashed on GetDeviceState); rows 0-2 = Aurora labels/detail/refresh, 3+ = plugins (Running/Disk-on/Disk-off/Absent); plugin toggle READ-ONLY (staging via editor; live unload blocked); 1.5s refresh; pure GDI draw on memDC.
Verdict: the new F8 does NOT write to game memory (zero writes - no Btl.battle_trigger/HP/.text patch of legacy UnX) - offset/ABI/save-corruption classes do not apply. Risks R-ING-01..05 (low): GetAsyncKeyState per frame on Present; WndProc subclass vs third-party overlays (DiscordHook/SpecialK); F8/INSERT always consumed; 1.5s refresh I/O; R-ING-05 (RT2 pending): Present vtable[8] = same target as UnX SK_BeginBufferSwap - coexistence untested. Known softlock gate already documented in code: field_scout* x native_menu = titl00. No behavior change - baseline untouched.

v2.207.0.1

v2.207.0.3BETAREVISION

SeymourAug 1, 2026

IDA GOLDEN RULE: ATEL call-target tables verified on the canonical db + cross-reference comments + F2 doc fix

Verification (no name without proof): the fahrenheit addresses (0x850050 Common, 0x842618 Battle...) belong to the PS2 binary — lookup on the canonical db showed empty names + non-pointer dwords → NOT renamed on HD. The real HD tables are already named: AtelCallTargetsCommon@0xC50050, AtelCallTargetsBattle@0xC42618, AtelCallTargets@0x1328518 (fahrenheit naming already applied by another lane — validates the nomenclature, not the addresses).
Cross-reference comments applied on the 3 HD tables (16B struct +0 init/+4 exec/+8 ret_float/+0xC ret_int; PS2 refs with counts) — GOLDEN RULE fulfilled.
docs/reverse/PPP_FAHRENHEIT_ATEL_IMPORT_2026-08-01.md fixed with the verification note (PS2 addresses = reference from the other binary, not HD rename targets). Baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.2

v2.207.0.4BETAREVISION

SeymourAug 1, 2026

F6.1: stats field-by-field verification PS2×HD on the aggregator (0x7B2DD0) + IDA comment

Decompile of FFX_Battle_PoolActorByTargetType_structural (0x7B2DD0) — READ/WRITE dispatcher with 346 actor-property cases. Cases 0x0A–0x13 accumulate 8 bytes at pad_0764[331..337/348] (HD FFXBattleActorRecord region +0x79B..) = candidate 8-stats block (strength/defense/magic/magic_defense/agility/luck/evasion/accuracy).
Confirmed: PS2 offsets (ChrRam +0x68..0x77) do NOT match HD (HD record is much larger; the dispatcher indexes by CASE ID, not offset).
GOLDEN RULE: cross-reference comment applied at case 0x0A (0x7B2F9D) on the canonical db. PPP_FAHRENHEIT_STRUCTS_CROSSREF_F6 updated (§4b). Pending: pin the 8-stats order (case names — future work). Baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.3

v2.207.0.5BETAREVISION

SeymourAug 1, 2026

F6.2: FULL case map of dispatcher 0x7B2DD0 + correction of F6.1

Correction of the previous delivery: the real 8-stats candidate block is 338..345 (cases 0x12C–0x135, 8 contiguous bytes) — not "331..337/348" (7B + 1B from another block).
Real function semantics: AVERAGE of the property per target type (total /= counter at the end), not raw stat sum.
Full case→offset map documented (14 blocks: 331..337, 338..345, 346–351, 380–383, 426–434, 436–438, 483–508, 606–643, 674, 698/699, 82–93, 158–176, 326...) in doc F6 §4b.
GOLDEN RULE: IDA comments applied (function 0x7B2DD0 + case 0x0A 0x7B2F9D). ⚠️ MCP 13337 busy/saving after set_func_cmt — verify post-save; reapply work/_ida_set_comments.py if needed.
Baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.4

v2.207.0.6BETAREVISION

SeymourAug 1, 2026

F7/F8 reconciliation plan (handoff to the Jarvis-HOOK lane)

docs/reverse/F7F8_RECONCILIATION_PLAN_2026-08-01.md (new, ~250 lines): final consolidation of Operation Demonio findings for the hooks lane. P1 (proven): the new F8 (dashboard, 56 rows, UnX/ProjectX) was removed from dllmain in commit 53d82b2a (07/27) and the active 09:05 build has no dashboard - F8 fell back to the InGameMenu switchboard (legacy); source recoverable (blobs c66aa478/a14f8732/76887427/d9516135 + RT2OFF/pre_magic_ppp_trace builds + .obj). P2-P8: F7 key contention (NativeMenu x LabMenu) and F8 (dashboard x InGameMenu), duplicate gates (ingame_menu_v2.flag), field_scout x native_menu gate to verify, ffx-hooks.ini missing in game dir, Present vtable[8] detour order. 6-step recovery map (git show + 11 diff blocks + vcxproj + config + lab build + gates), target architecture with single key owner (F7=NativeMenu RAM untouched; F8=dashboard; InGameMenu=fallback), classified UnX parity (port cheats/dialog-skip/language via clean hooks; NEVER hardcoded .text patches 0x392930/0x30B040/Btl.battle_trigger/Sleep-5s thread), 4 waves with gates (RT2 on _isolated, baseline 283/283). No behavior change - baseline untouched.

v2.207.0.5

v2.207.0.7BETAREVISION

SeymourAug 1, 2026

External Sphere Grid knowledge cross-checked (fahrenheit-crew Discord + FFXRando) + 2 anchor regression tests

docs/reverse/SPHERE_GRID_EXTERNAL_KNOWLEDGE_2026-08-01.md (new): Discord thread (Titan/Dragoon/peppy) cross-checked with our RE: (1) Anchor idx = the link's curve control node (our AnchorNode; Validate() catches OOB; RemoveNode fixes anchors — link anchored on the removed node becomes straight 0xFFFF); (2) LOCK 3 = content 0x00 is the game's default when it can't find the node (sgelems.cs L215) — our flow never emits it (EmptyContent=0xFF + validated picker); (3) header↔structs coherence (Dragoon) = what our WriteLayout/Validate already guarantee; (4) limits are per-grid (peppy "per-grid") = confirms our RE (static LpAbilityMapEngine 1024/1024/128 per grid); (5) FFXRando (nyterage/FFXRando, MIT, C++): SphereGridRandomizer.cpp shuffles CONTENT only (topology/counts preserved; NODE_NULL=skip) — validates the Safe Transplant directive (content edit = safe; new topology = risk, gated by DeployPolicy).
2 new tests in SphereGridAddNodeReproTests.cs (4/4 PASS on the area): RemoveNode_WithAnchorLinks_KeepsGraphValid (vanilla Standard has 411 curved links; removing the anchor node keeps the grid valid, no orphan anchors, round-trip OK) + Validate_CatchesOutOfRangeAnchor. No product behavior change. ### REVISION

v2.207.0.6

v2.207.0.8BETAREVISION

SeymourAug 1, 2026

Sphere Grid editor write audit formalized ("the secret to not exploding")

docs/reverse/SPHERE_GRID_EDITOR_WRITE_AUDIT_2026-08-01.md (new): YES answer to "does our editor do exactly the safe thing?" — operation→bytes map (drag = pos + recomputed Unknown6; content = 1 byte in dat1X + RedundantContent; cluster; add/remove node/link with full reindex; link repoint) and the 7 invariants enforced by Validate() before ANY write: (1) header counts == real table sizes; (2) Unknown6 == spatial bucket; (3) RedundantContent == content; (4) cluster < clusterCount; (5) Node1/Node2 < nodeCount; (6) AnchorNode 0xFFFF or < nodeCount; (7) content in range (0xFF=empty). Single write path: UI → builder → Build() (throws if invalid) → WriteLayout → project; nothing is written unvalidated. Safe Transplant = byte-local (counts preserved) = proven safe zone; new topology = gated by DeployPolicy until the clean RT2. Residual risks: SphereGridAdapter writes sphere.bin (different file), PanelGrowWriter extends panel.bin. No behavior change. ### REVISION

v2.207.0.7

v2.207.1.0BETAPATCH

SeymourAug 2, 2026

F7 In-Live v2: multi-column DIFF (presets + BASE + AUTO + WEAK + RESIST + ABSORB multi-select), numeric input, HP up to 10x, Music with Preview/real names/Save/Reset, black-screen fix, LabMenu → F6

DIFF redesigned (multi-column): presets became prominent chips on top (Off/Hunter/Sombra de Sin/True Nightmare); side-by-side columns BASE STATUS (HP..LCK — 9 stats, ACC/EVA/LCK now editable too) / AUTO STATUS (25 statuses, multi-select checkboxes) / WEAK / RESIST / ABSORB (5 elements each, multi-select); ACTIONS column (Apply Now/Save/Back); L/R navigates columns and U/D rows; HP range up to 10x (100..10000) and stats up to 5x (100..5000).
Numeric input: Confirm on a BASE stat opens edit mode — type 0-9, Backspace, Confirm applies (clamped), Esc cancels (becomes "custom").
Music: new rows Preview (plays the Music Lock track via lab-proved override+SOUNDCMD), Save (persists f7_inlive.json) and Reset (back to default: no lock/battle/randomizer/fade); confirming on "Music Lock"/"Battle Entry" also previews; real names for the 181 tracks (F7TrackName now delegates to the LabMusicRuntimeName crosswalk: "Battle Theme", "Thunder Plain", "Crisis"...).
Black-screen fix: submenu→hub return now uses the pump path (g_nativeWantSpawn) instead of direct SpawnMenu(); F7_DifficultyApplyNow gained enemy-list validation (range check) + __try/__except — never kills the pump on invalid context (logs SEM-LISTA/LISTA-INVALIDA/EXCECAO).
Legacy LabMenu moved to F6 (was F7/F8 depending on InGameMenu) — F7 is now exclusive to FFX Editor In-Live; F8 is the InGameMenu (plugin switchboard).
New F7InLive APIs: F7_MusicPreview(track), F7_ResetMusic(), F7_StatusName(i) + GetArenaBattleMusicSoundCmdFn() getter in MusicHook.
Build -WithPolyHook -Release PASS; LabDeploy to Steam; RT2 Needs Testing (DIFF columns, numeric edit, audible preview, Apply in battle). ### REVISION

v2.207.0.8

v2.207.2.0BETAPATCH

SeymourAug 1, 2026

Sphere Grid editor: removed what doesn't make sense under the new truths (dead v5 code) + freeze handoff for the Jarvis-HOOK lane

Removed from the editor: SaveSquareToProject() (dead code — lost its only caller in the SUPERMD cleanup; SaveToProject with re-baseline already covers it) + dead dev-path fallback work/nul_ward_pack/command.bin in ResolveCommandBinPath (file doesn't exist; corpus covers it). The Sphere Grid editor area is now 100% free of v5 concepts (hook/manifest/sidecar/square).
docs/ai/HANDOFF_JARVIS-HOOK_SPHEREGRID_V5_FREEZE_2026-08-01.md (new): instruction for the Jarvis-HOOK lane to freeze the v5 stack (SphereGridFullGridCompilerHook.{cpp,h} + SphereGridTrueNewNodeHook.{cpp,h} → legacy/) without breaking the factory of the other hooks; dllmain contact points (includes L49-50, externs L97-98, Enabled L870-876, installs 11900-11931, removes 12168-12169); RT2 criterion (pass → delete; fail → isolated lab); ffx-probe.dll is NOT a hook (keep).
Validation: Release build 0 errors; SphereGrid tests 4/4 PASS (with anchors). Area baseline intact.

v2.207.1.0

v2.207.2.1BETAREVISION

SeymourAug 2, 2026

Sphere Grid lane closure (handoff + PORT_STATUS)

docs/ai/SESSION_HANDOFF.md: lane-closure handoff — the session's 5 commits (SUPERMD cleanup, sphere.bin bits PROVEN, crash forensics, write audit 7 invariants, dead v5 code removal) + state (editor 100% v5-free, game ready for the clean RT2) + pending items (human clean RT2, UI smoke, v5 stack freeze on the Jarvis-HOOK lane) + safe next step.
PORT_STATUS.md: closure update — area status consolidated; clean RT2 Needs Testing. ### PATCH

v2.207.2.0

v2.207.3.0BETAPATCH

SeymourAug 2, 2026

F7 In-Live fixes: AUTO layout (25 statuses visible), tick-based Force (no Sleep), offline RT0 gate

Layout fix: AUTO STATUS column with rowH 0.020 — all 25 statuses now fit on screen (Haste/Slow were clipped).
Force fix: F7_ForceLastBattle now schedules by ticks (g_forceRepeatLeft + ~10 frames between forces, processed in F7_TickMainThread) — the main-thread Sleep(120) (stutter ~1s with repeat 9) is gone.
Offline RT0 gate: RuntimeTools/FfxHooksDll/f7_config_rt0.ps1 — validates the f7_inlive.json contract (24 keys, clamp ranges, status/element masks, key-value round-trip) without launching the game. PASS.
Build PASS + LabDeploy to Steam (together with 2.207.4.0). ### REVISION

v2.207.2.1

v2.207.4.0BETAPATCH

SeymourAug 2, 2026

Sphere Grid hook stack v5 FROZEN (legacy)

Freeze executed (handoff HANDOFF_JARVIS-HOOK_SPHEREGRID_V5_FREEZE_2026-08-01.md): the 4 v5-stack files (SphereGridFullGridCompilerHook.{cpp,h} + SphereGridTrueNewNodeHook.{cpp,h}) moved to RuntimeTools/FfxHooksDll/legacy/spheregrid_v5/; dllmain.cpp cleaned (includes, externs, Enabled(), installs, removes, fault-handler calls) — zero remaining references; vcxproj + build_hooks.ps1 cleaned. Suspect #1 of the 0xc0000374 crash (08-01, hooks active + clean grid) out of the build.
Global fault VEH now always armed (FaultProbe VEH armed (global fault diagnosis)) — crash diagnostics kept, independent of the SG hook.
RT2 criterion kept: clean RT2 (disposable save, counts+1) PASS → delete legacy/spheregrid_v5/ + sg_* flags + manifest; FAIL → back as isolated lab (FFXHOOKS_SG_861_LAB_OVERRIDE).
Build -WithPolyHook -Release PASS; LabDeploy to Steam. ### PATCH

v2.207.3.0

v2.207.5.0BETAPATCH

SeymourAug 2, 2026

DIFF submenu black-screen fix: fake O_COUNT >0 on the native menu object

Root cause (my v2.207.1.0 bug): the multi-column DIFF sets g_f7RowCount = 0 (no 1D rows) and F7Sub_SpawnMenu wrote O_COUNT = 0 on the native menu object — the game's draw tick saw count 0 and never called our draw → submenu "open" but invisible → black screen (forced gate without 3D render and without menu) → only F7 (force close) returned to the game.
Fix: O_COUNT = g_f7RowCount > 0 ? g_f7RowCount : 8 at spawn (fake count 8 for DIFF — our multi-column draw/input don't use O_COUNT).
Extra (log diagnostics): the global VEH captured 2 real AVs at boot (FAULT AV READ pc=0x796B11D7/0x796B3908 accessed=0x10CDCDCD — freed heap; module 0x796B = likely fmodex calling an FFX callback at rva 0x291488) — suspect #1 for the user's idle crash ("game closing randomly while idle"); investigate 0x291488 in IDA next round.
Build PASS + LabDeploy to Steam (15:32→v4). ### PATCH

v2.207.4.0

v2.207.6.0BETAPATCH

SeymourAug 2, 2026

F7 DIFF: true 2D spatial navigation (presets with L/R, Down to BASE, Up on row 0 back) + numeric edit from scratch + Custom chip

Navigation fixed (user's mental map): PRESETS now navigate with L/R (horizontal chips) and Down goes to the BASE column; on data columns, L/R switches column and U/D moves rows; Up on BASE row 0 returns to presets. Before: L/R switched columns even on presets (you had to go sideways to "go down").
Numeric edit fixed: enters with the field zeroed (type the NEW value from scratch — before it accumulated over the current value: typing '0' became 10000/max); no digits + Confirm = keeps current; >> value _ placeholder shows current until typing; contextual footer ("type 0-9 / Backspace / X apply / Esc cancel").
"Custom" chip (5th): visible and navigable — becomes ACTIVE on any manual tweak (toggle/edit) (before: no chip lit = confusing). Selecting it keeps current values. Off (vals[0]=0) = disabled; custom (4) = enabled on commit.
Build PASS + LabDeploy to Steam. ### PATCH

v2.207.5.0

Back to updates

SeymourBETA

Update 2.207

8/2/2026

v2.207.0.0BETAMINOR

SeymourAug 1, 2026

F5-L4: high-level ATEL script panel in the Monster AI Editor (dry-run with diff)

MonsterAiEditor_DataModel.AtelScriptLab.cs (new partial): observable AtelScriptText/AtelScriptResult/AtelScriptDiffSummary/AtelScriptDiffLines + CompileAtelDryRun() — parses/compiles the script against the SELECTED monster (AiAutomation.PickCombatWorker/PickMainEntrypoint) and shows the diff (AiScript_Diff.Compare, Added/Modified/Removed). Dry-run: nothing is saved (save stays on the editor's existing channels). Actionable errors (syntax/emission).
MonsterAiAtelScriptLab_Window.axaml + .cs (new): window with script editor (Consolas), "Compile (dry-run)" button, summary + diff ListBox. "Script ATEL (F5)" button added to the MonsterAiEditor_Control toolbar.
Baseline: 332/332 PASS (329 + 3 from another lane). ### MINOR ### MINOR

v2.206.0.0

v2.207.0.1BETAREVISION

SeymourAug 1, 2026

F6: battle/save structs cross-validation (fahrenheit PS2 × our HD offsets)

docs/reverse/PPP_FAHRENHEIT_STRUCTS_CROSSREF_F6_2026-08-01.md: fahrenheit inventory (PS2 ChrRam 0x1EC with stats @0x68–0x77 and equip @0x52/0x53; CtbEntry 4B + CtbBaseData tick_speed; save_impl/ply_save) vs ours (HD MemoryChr with script pointers +0xF78.., FfxSaveSphereGrid with bounds guard, decompiled HD CTB queue). Honest verdict: PS2 ≠ HD (the HD MemoryChr includes the script/VM layer; PS2 executes MIPS) — PS2 stats are field-by-field validation candidates against the HD aggregator (0x7B2DD0); CtbBaseData is semantics reference for the CTB queue; nothing promoted without HD proof. Read-only — baseline 332/332 untouched. ### REVISION ### MINOR

v2.207.0.0

v2.207.0.2BETAREVISION

SeymourAug 1, 2026

F7: cross-validation of the ATEL codecs (fahrenheit ↔ ours) — 3/3 validated

docs/reverse/PPP_FAHRENHEIT_CODEC_CROSSVALIDATION_F7_2026-08-01.md: F7-A our syntax → their parser (var x = 0; accepted; their lexer EOF bug documented — crash on trailing newline, lexer.cs:74); F7-B our generated AiFile (324 instructions via AtelLangLab) → walk with their fetch rule (bit 0x80 = operand): closed exactly, 0 opcodes outside their AtelOp enum; F7-C our KnownOpcode (49) ⊆ their enum (123): 0 missing. Limits: their compiler does NOT emit bytes (AtelAssembler never called); validation covers dialect/fetch/table, not the full worker layout. Conclusion: both codecs speak the same dialect — our fixed semantics (v2.198.4.1) is the executable truth. Read-only — baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.1

v2.207.0.2BETAREVISION

SeymourAug 1, 2026

Operation Demonio session 2: full inventory of the new F8 (InGameMenu of FfxHooksDll)

docs/reverse/F8_UNX_INCONSISTENCY_REGISTER_2026-08-01.md (+45 lines): the new F8 = our ecosystem plugin switchboard (UnX reimplementation over our hook layer). Architecture mapped in dllmain.cpp: gate ingame_menu.flag/FFXHOOKS_ENABLE_INGAME_MENU/Aurora config; infra = AuroraD3D11 overlay (Present vtable[8]); input = GetAsyncKeyState (poll on Present) + WndProc subclass (WM_KEYDOWN/SYSKEYDOWN, 90/150ms debounce) - no DirectInput, zero conflict with the probe (contrast with legacy UnX that crashed on GetDeviceState); rows 0-2 = Aurora labels/detail/refresh, 3+ = plugins (Running/Disk-on/Disk-off/Absent); plugin toggle READ-ONLY (staging via editor; live unload blocked); 1.5s refresh; pure GDI draw on memDC.
Verdict: the new F8 does NOT write to game memory (zero writes - no Btl.battle_trigger/HP/.text patch of legacy UnX) - offset/ABI/save-corruption classes do not apply. Risks R-ING-01..05 (low): GetAsyncKeyState per frame on Present; WndProc subclass vs third-party overlays (DiscordHook/SpecialK); F8/INSERT always consumed; 1.5s refresh I/O; R-ING-05 (RT2 pending): Present vtable[8] = same target as UnX SK_BeginBufferSwap - coexistence untested. Known softlock gate already documented in code: field_scout* x native_menu = titl00. No behavior change - baseline untouched.

v2.207.0.1

v2.207.0.3BETAREVISION

SeymourAug 1, 2026

IDA GOLDEN RULE: ATEL call-target tables verified on the canonical db + cross-reference comments + F2 doc fix

Verification (no name without proof): the fahrenheit addresses (0x850050 Common, 0x842618 Battle...) belong to the PS2 binary — lookup on the canonical db showed empty names + non-pointer dwords → NOT renamed on HD. The real HD tables are already named: AtelCallTargetsCommon@0xC50050, AtelCallTargetsBattle@0xC42618, AtelCallTargets@0x1328518 (fahrenheit naming already applied by another lane — validates the nomenclature, not the addresses).
Cross-reference comments applied on the 3 HD tables (16B struct +0 init/+4 exec/+8 ret_float/+0xC ret_int; PS2 refs with counts) — GOLDEN RULE fulfilled.
docs/reverse/PPP_FAHRENHEIT_ATEL_IMPORT_2026-08-01.md fixed with the verification note (PS2 addresses = reference from the other binary, not HD rename targets). Baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.2

v2.207.0.4BETAREVISION

SeymourAug 1, 2026

F6.1: stats field-by-field verification PS2×HD on the aggregator (0x7B2DD0) + IDA comment

Decompile of FFX_Battle_PoolActorByTargetType_structural (0x7B2DD0) — READ/WRITE dispatcher with 346 actor-property cases. Cases 0x0A–0x13 accumulate 8 bytes at pad_0764[331..337/348] (HD FFXBattleActorRecord region +0x79B..) = candidate 8-stats block (strength/defense/magic/magic_defense/agility/luck/evasion/accuracy).
Confirmed: PS2 offsets (ChrRam +0x68..0x77) do NOT match HD (HD record is much larger; the dispatcher indexes by CASE ID, not offset).
GOLDEN RULE: cross-reference comment applied at case 0x0A (0x7B2F9D) on the canonical db. PPP_FAHRENHEIT_STRUCTS_CROSSREF_F6 updated (§4b). Pending: pin the 8-stats order (case names — future work). Baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.3

v2.207.0.5BETAREVISION

SeymourAug 1, 2026

F6.2: FULL case map of dispatcher 0x7B2DD0 + correction of F6.1

Correction of the previous delivery: the real 8-stats candidate block is 338..345 (cases 0x12C–0x135, 8 contiguous bytes) — not "331..337/348" (7B + 1B from another block).
Real function semantics: AVERAGE of the property per target type (total /= counter at the end), not raw stat sum.
Full case→offset map documented (14 blocks: 331..337, 338..345, 346–351, 380–383, 426–434, 436–438, 483–508, 606–643, 674, 698/699, 82–93, 158–176, 326...) in doc F6 §4b.
GOLDEN RULE: IDA comments applied (function 0x7B2DD0 + case 0x0A 0x7B2F9D). ⚠️ MCP 13337 busy/saving after set_func_cmt — verify post-save; reapply work/_ida_set_comments.py if needed.
Baseline 332/332 untouched. ### REVISION ### REVISION

v2.207.0.4

v2.207.0.6BETAREVISION

SeymourAug 1, 2026

F7/F8 reconciliation plan (handoff to the Jarvis-HOOK lane)

docs/reverse/F7F8_RECONCILIATION_PLAN_2026-08-01.md (new, ~250 lines): final consolidation of Operation Demonio findings for the hooks lane. P1 (proven): the new F8 (dashboard, 56 rows, UnX/ProjectX) was removed from dllmain in commit 53d82b2a (07/27) and the active 09:05 build has no dashboard - F8 fell back to the InGameMenu switchboard (legacy); source recoverable (blobs c66aa478/a14f8732/76887427/d9516135 + RT2OFF/pre_magic_ppp_trace builds + .obj). P2-P8: F7 key contention (NativeMenu x LabMenu) and F8 (dashboard x InGameMenu), duplicate gates (ingame_menu_v2.flag), field_scout x native_menu gate to verify, ffx-hooks.ini missing in game dir, Present vtable[8] detour order. 6-step recovery map (git show + 11 diff blocks + vcxproj + config + lab build + gates), target architecture with single key owner (F7=NativeMenu RAM untouched; F8=dashboard; InGameMenu=fallback), classified UnX parity (port cheats/dialog-skip/language via clean hooks; NEVER hardcoded .text patches 0x392930/0x30B040/Btl.battle_trigger/Sleep-5s thread), 4 waves with gates (RT2 on _isolated, baseline 283/283). No behavior change - baseline untouched.

v2.207.0.5

v2.207.0.7BETAREVISION

SeymourAug 1, 2026

External Sphere Grid knowledge cross-checked (fahrenheit-crew Discord + FFXRando) + 2 anchor regression tests

docs/reverse/SPHERE_GRID_EXTERNAL_KNOWLEDGE_2026-08-01.md (new): Discord thread (Titan/Dragoon/peppy) cross-checked with our RE: (1) Anchor idx = the link's curve control node (our AnchorNode; Validate() catches OOB; RemoveNode fixes anchors — link anchored on the removed node becomes straight 0xFFFF); (2) LOCK 3 = content 0x00 is the game's default when it can't find the node (sgelems.cs L215) — our flow never emits it (EmptyContent=0xFF + validated picker); (3) header↔structs coherence (Dragoon) = what our WriteLayout/Validate already guarantee; (4) limits are per-grid (peppy "per-grid") = confirms our RE (static LpAbilityMapEngine 1024/1024/128 per grid); (5) FFXRando (nyterage/FFXRando, MIT, C++): SphereGridRandomizer.cpp shuffles CONTENT only (topology/counts preserved; NODE_NULL=skip) — validates the Safe Transplant directive (content edit = safe; new topology = risk, gated by DeployPolicy).
2 new tests in SphereGridAddNodeReproTests.cs (4/4 PASS on the area): RemoveNode_WithAnchorLinks_KeepsGraphValid (vanilla Standard has 411 curved links; removing the anchor node keeps the grid valid, no orphan anchors, round-trip OK) + Validate_CatchesOutOfRangeAnchor. No product behavior change. ### REVISION

v2.207.0.6

v2.207.0.8BETAREVISION

SeymourAug 1, 2026

Sphere Grid editor write audit formalized ("the secret to not exploding")

docs/reverse/SPHERE_GRID_EDITOR_WRITE_AUDIT_2026-08-01.md (new): YES answer to "does our editor do exactly the safe thing?" — operation→bytes map (drag = pos + recomputed Unknown6; content = 1 byte in dat1X + RedundantContent; cluster; add/remove node/link with full reindex; link repoint) and the 7 invariants enforced by Validate() before ANY write: (1) header counts == real table sizes; (2) Unknown6 == spatial bucket; (3) RedundantContent == content; (4) cluster < clusterCount; (5) Node1/Node2 < nodeCount; (6) AnchorNode 0xFFFF or < nodeCount; (7) content in range (0xFF=empty). Single write path: UI → builder → Build() (throws if invalid) → WriteLayout → project; nothing is written unvalidated. Safe Transplant = byte-local (counts preserved) = proven safe zone; new topology = gated by DeployPolicy until the clean RT2. Residual risks: SphereGridAdapter writes sphere.bin (different file), PanelGrowWriter extends panel.bin. No behavior change. ### REVISION

v2.207.0.7

v2.207.1.0BETAPATCH

SeymourAug 2, 2026

F7 In-Live v2: multi-column DIFF (presets + BASE + AUTO + WEAK + RESIST + ABSORB multi-select), numeric input, HP up to 10x, Music with Preview/real names/Save/Reset, black-screen fix, LabMenu → F6

DIFF redesigned (multi-column): presets became prominent chips on top (Off/Hunter/Sombra de Sin/True Nightmare); side-by-side columns BASE STATUS (HP..LCK — 9 stats, ACC/EVA/LCK now editable too) / AUTO STATUS (25 statuses, multi-select checkboxes) / WEAK / RESIST / ABSORB (5 elements each, multi-select); ACTIONS column (Apply Now/Save/Back); L/R navigates columns and U/D rows; HP range up to 10x (100..10000) and stats up to 5x (100..5000).
Numeric input: Confirm on a BASE stat opens edit mode — type 0-9, Backspace, Confirm applies (clamped), Esc cancels (becomes "custom").
Music: new rows Preview (plays the Music Lock track via lab-proved override+SOUNDCMD), Save (persists f7_inlive.json) and Reset (back to default: no lock/battle/randomizer/fade); confirming on "Music Lock"/"Battle Entry" also previews; real names for the 181 tracks (F7TrackName now delegates to the LabMusicRuntimeName crosswalk: "Battle Theme", "Thunder Plain", "Crisis"...).
Black-screen fix: submenu→hub return now uses the pump path (g_nativeWantSpawn) instead of direct SpawnMenu(); F7_DifficultyApplyNow gained enemy-list validation (range check) + __try/__except — never kills the pump on invalid context (logs SEM-LISTA/LISTA-INVALIDA/EXCECAO).
Legacy LabMenu moved to F6 (was F7/F8 depending on InGameMenu) — F7 is now exclusive to FFX Editor In-Live; F8 is the InGameMenu (plugin switchboard).
New F7InLive APIs: F7_MusicPreview(track), F7_ResetMusic(), F7_StatusName(i) + GetArenaBattleMusicSoundCmdFn() getter in MusicHook.
Build -WithPolyHook -Release PASS; LabDeploy to Steam; RT2 Needs Testing (DIFF columns, numeric edit, audible preview, Apply in battle). ### REVISION

v2.207.0.8

v2.207.2.0BETAPATCH

SeymourAug 1, 2026

Sphere Grid editor: removed what doesn't make sense under the new truths (dead v5 code) + freeze handoff for the Jarvis-HOOK lane

Removed from the editor: SaveSquareToProject() (dead code — lost its only caller in the SUPERMD cleanup; SaveToProject with re-baseline already covers it) + dead dev-path fallback work/nul_ward_pack/command.bin in ResolveCommandBinPath (file doesn't exist; corpus covers it). The Sphere Grid editor area is now 100% free of v5 concepts (hook/manifest/sidecar/square).
docs/ai/HANDOFF_JARVIS-HOOK_SPHEREGRID_V5_FREEZE_2026-08-01.md (new): instruction for the Jarvis-HOOK lane to freeze the v5 stack (SphereGridFullGridCompilerHook.{cpp,h} + SphereGridTrueNewNodeHook.{cpp,h} → legacy/) without breaking the factory of the other hooks; dllmain contact points (includes L49-50, externs L97-98, Enabled L870-876, installs 11900-11931, removes 12168-12169); RT2 criterion (pass → delete; fail → isolated lab); ffx-probe.dll is NOT a hook (keep).
Validation: Release build 0 errors; SphereGrid tests 4/4 PASS (with anchors). Area baseline intact.

v2.207.1.0

v2.207.2.1BETAREVISION

SeymourAug 2, 2026

Sphere Grid lane closure (handoff + PORT_STATUS)

docs/ai/SESSION_HANDOFF.md: lane-closure handoff — the session's 5 commits (SUPERMD cleanup, sphere.bin bits PROVEN, crash forensics, write audit 7 invariants, dead v5 code removal) + state (editor 100% v5-free, game ready for the clean RT2) + pending items (human clean RT2, UI smoke, v5 stack freeze on the Jarvis-HOOK lane) + safe next step.
PORT_STATUS.md: closure update — area status consolidated; clean RT2 Needs Testing. ### PATCH

v2.207.2.0

v2.207.3.0BETAPATCH

SeymourAug 2, 2026

F7 In-Live fixes: AUTO layout (25 statuses visible), tick-based Force (no Sleep), offline RT0 gate

Layout fix: AUTO STATUS column with rowH 0.020 — all 25 statuses now fit on screen (Haste/Slow were clipped).
Force fix: F7_ForceLastBattle now schedules by ticks (g_forceRepeatLeft + ~10 frames between forces, processed in F7_TickMainThread) — the main-thread Sleep(120) (stutter ~1s with repeat 9) is gone.
Offline RT0 gate: RuntimeTools/FfxHooksDll/f7_config_rt0.ps1 — validates the f7_inlive.json contract (24 keys, clamp ranges, status/element masks, key-value round-trip) without launching the game. PASS.
Build PASS + LabDeploy to Steam (together with 2.207.4.0). ### REVISION

v2.207.2.1

v2.207.4.0BETAPATCH

SeymourAug 2, 2026

Sphere Grid hook stack v5 FROZEN (legacy)

Freeze executed (handoff HANDOFF_JARVIS-HOOK_SPHEREGRID_V5_FREEZE_2026-08-01.md): the 4 v5-stack files (SphereGridFullGridCompilerHook.{cpp,h} + SphereGridTrueNewNodeHook.{cpp,h}) moved to RuntimeTools/FfxHooksDll/legacy/spheregrid_v5/; dllmain.cpp cleaned (includes, externs, Enabled(), installs, removes, fault-handler calls) — zero remaining references; vcxproj + build_hooks.ps1 cleaned. Suspect #1 of the 0xc0000374 crash (08-01, hooks active + clean grid) out of the build.
Global fault VEH now always armed (FaultProbe VEH armed (global fault diagnosis)) — crash diagnostics kept, independent of the SG hook.
RT2 criterion kept: clean RT2 (disposable save, counts+1) PASS → delete legacy/spheregrid_v5/ + sg_* flags + manifest; FAIL → back as isolated lab (FFXHOOKS_SG_861_LAB_OVERRIDE).
Build -WithPolyHook -Release PASS; LabDeploy to Steam. ### PATCH

v2.207.3.0

v2.207.5.0BETAPATCH

SeymourAug 2, 2026

DIFF submenu black-screen fix: fake O_COUNT >0 on the native menu object

Root cause (my v2.207.1.0 bug): the multi-column DIFF sets g_f7RowCount = 0 (no 1D rows) and F7Sub_SpawnMenu wrote O_COUNT = 0 on the native menu object — the game's draw tick saw count 0 and never called our draw → submenu "open" but invisible → black screen (forced gate without 3D render and without menu) → only F7 (force close) returned to the game.
Fix: O_COUNT = g_f7RowCount > 0 ? g_f7RowCount : 8 at spawn (fake count 8 for DIFF — our multi-column draw/input don't use O_COUNT).
Extra (log diagnostics): the global VEH captured 2 real AVs at boot (FAULT AV READ pc=0x796B11D7/0x796B3908 accessed=0x10CDCDCD — freed heap; module 0x796B = likely fmodex calling an FFX callback at rva 0x291488) — suspect #1 for the user's idle crash ("game closing randomly while idle"); investigate 0x291488 in IDA next round.
Build PASS + LabDeploy to Steam (15:32→v4). ### PATCH

v2.207.4.0

v2.207.6.0BETAPATCH

SeymourAug 2, 2026

F7 DIFF: true 2D spatial navigation (presets with L/R, Down to BASE, Up on row 0 back) + numeric edit from scratch + Custom chip

Navigation fixed (user's mental map): PRESETS now navigate with L/R (horizontal chips) and Down goes to the BASE column; on data columns, L/R switches column and U/D moves rows; Up on BASE row 0 returns to presets. Before: L/R switched columns even on presets (you had to go sideways to "go down").
Numeric edit fixed: enters with the field zeroed (type the NEW value from scratch — before it accumulated over the current value: typing '0' became 10000/max); no digits + Confirm = keeps current; >> value _ placeholder shows current until typing; contextual footer ("type 0-9 / Backspace / X apply / Esc cancel").
"Custom" chip (5th): visible and navigable — becomes ACTIVE on any manual tweak (toggle/edit) (before: no chip lit = confusing). Selecting it keeps current values. Off (vals[0]=0) = disabled; custom (4) = enabled on commit.
Build PASS + LabDeploy to Steam. ### PATCH

v2.207.5.0