Autopilot · write-up

Native navigation review and repair status

xenondoc/AUTOPILOT_NAVIGATION_REVIEW_20261005.MD · 49 KB · updated 2026-10-05

The recurring stalls require structural repairs to route execution and ownership. Replacing the span search, widening one waypoint or forcing an input after the planner is insufficient. Several recordings already contain a valid route at the point where the ship stops; their failure lies between route construction and the applied control. The native C pilot remains the gameplay controller.

Responsibilities and contracts

1. Map session: owns current occupancy and topology revision. Embedded terrain seeds the level; snapshot RAM restores mutable geometry; complete renderer observations and explicit destruction events update it during play.
2. Mission: chooses a reachable region and owns one retained connector. Its cursor admits the next leg only after the current leg is reached. Acquisition and completion have separate predicates; a required retreat cannot release the mission merely because it crossed its acquisition boundary.
3. Ship forecast: executes the routed axis order with actual ship steps, sprite hulls, wall collision and camera limits. A graph cell being free is not proof that the next input or the complete connector is executable.
4. Candidate search: rejects actual contacts and searches checked turns when direct steering fails. Terrain travel measures progress through reachable anchor space. A checked delay-and-crossing sequence must advance across observations instead of restarting its delay on every refresh.
5. Input authority: applies the checked winner. A later steering override can invalidate both its safety certificate and its progress result. Such overrides require independent validation or conversion into mission goals.

Relevant implementation: xenon_autopilot_map_session.c, xenon_autopilot_map_state.c, xenon_autopilot_mission.c, xenon_autopilot_routes.c, xenon_autopilot_maneuver.c, xenon_autopilot_planner.c, xenon_autopilot_decision.c, and xenon_autopilot_driver.c under src/autopilot.

Confirmed defects and repairs

Route validity disagreed with its execution

Level 3 retained a legal down-then-left route, but tested retention against the blocked diagonal shortcut. Camera drift therefore rebuilt the route, reinstated the previous corner and cancelled the retreat. Retention now accepts a legal dogleg under the same axis-order rules as execution. Fixtures test both orders and a blocked alternative. Full R408 clears all Level 3 gates without a stall; its four combat hits remain unresolved.

Geometric proximity was mistaken for route progress

A folded maze places future route segments beside earlier ones. Scoring the nearest segment permitted skipping mandatory retreats; the R400 experiment lost two lives and was removed. The fallback metric now measures the active waypoint, including when there is no terrain field. Level 3 terrain travel uses a cached graph-owned distance flood within camera bounds, so a necessary backward step can count as forward route progress. The collision forecast still checks actual movement; the field grants no permission to cross a wall.

The field uses persistent C buffers and remains valid across ordinary connector queries. Prefix scores account only for newly appended frames. Tests cover a required bottom detour, folded routes, disconnected components, camera limits, off-grid starts, query reuse, narrow-shaft taps and retained progress. Fields are currently enabled for Level 3 map travel, Level 4 entry/post-shop connectors, and Level 5 routed travel before active boss combat; they have not been globally applied to authored boss-pocket sequences.

A delayed escape repeatedly restarted instead of travelling

R389's Level 5 launcher stall has a clear forecast to its firing station, but the winner begins with eight neutral inputs. The launcher was outside the route-progress mode, so the ordinary short refresh restarted that wait. Its approach now uses the existing progressing-suffix contract and terrain field. Each suffix is still re-evaluated against current hazards. R424 passes this approach and the subsequent chamber/tank without stalls or life loss, but takes 16 damage later. Restricting this contract to launchers restored the same prefix-restart failure at a gate approach in R436. Level 5 routed approaches also need checked turn order: finish a retreat before crossing a wing and hold the lower world row while moving sideways. Full R442 passes all gates and the dormant-tank approach without reported stalls or life loss. Combat and reward acceptance are separate: it takes 18 damage and misses four ship coins.

A topology consumer waited for an object already filtered out

Level 4's main-head destruction is an explicit captured event. Observation correctly removes it from live hazards, but the map previously waited to see its unlink procedure among those live tracks. An offscreen boss wall therefore remained solid and its completion predicate suppressed central reward collection.

The map now queries the existing sorted destruction buffer by the retained head identity. This does not infer destruction from visibility loss and does not duplicate event storage. A fixture verifies unrelated destruction leaves the wall closed, while the filtered head death opens all 80 offscreen cells. R423 clears the boss, takes no damage and collects all 10 cash drops.

Acquisition range also released a valuable moving pickup

A Level 4 Side Shot survived a dodge but fell below the ordinary targeting band. The mission immediately reacquired the boss. Retained equipment now releases on retirement, rather than leaving the acquisition range. Current-orbit chasing still missed the item; that experiment was rejected. The accepted candidate uses Level 4's existing short-contact/final-drop interception routine. R421 and full-level R422 collect it. This policy is local to Level 4 equipment.

A later full-entry test exposed another mismatch: a screen station at the bottom edge was already satisfied by neutral input, although interception required moving backward in world coordinates. The mission now preserves its finite world retreat. When Side Shot is missing, Level 4 reserves the predictable visible drop before selecting the boss bypass, using the existing interception forecast once. R428 collects it with zero damage and all ten boss coins.

The applied input contradicted the checked entry route

Level 4's old post-planner entry helper replaced a checked UP with DOWN/LEFT. That override is removed. The mission owns a checked corridor retreat and retains it beyond its X acquisition boundary until its connector is reached. Tests compare applied movement to the actual C winner and exercise release with a competing wall gun. Full R429 takes 4 damage, loses no life, collects the useful equipment, and takes all 10/10 and 20/20 boss coins. The final boss still has one projectile hit and a long pause; those are separate open defects.

A clipped destroyed gate remained closed in the persistent map

R434 destroys Level 5 gate 10 at f44962. The following RAM checkpoint contains zero in all four tile words, but the persistent map still targets the gate: its lower row is outside the full viewport observations required to open it. This is a topology-event problem, not evidence that span search is broken.

The map now retains terrain-controller identities. On a retained controller's unlink/death, the emulator borrows current RAM and records the same tile-map update before the corresponding frame. It imports actual words rather than opening tiles on death: original $510A2 also culls controllers without clearing their tiles. Ordinary frames do not import RAM. Replays use the existing tile-map record; no protocol change or Python gameplay driver is introduced. The fixture also covers offscreen disappearance, culling with intact tile words, and clone isolation. Full R442 passes the previously stuck gates. That is not proof that every gate retirement imported RAM: the fixture covers the qualifying event, and a future capture must verify it at a clipped destruction as well.

The dormant tank route projected back into its own pocket

Before activation, an unreachable flank firing station repeatedly replaced travel. The fallback now connects to a reachable forward region and preserves its checked detour until it reveals the tank. Full R442 passes that transition. No frame-number rule or unchecked input is used to activate the encounter.

A preferred tank firing station was enforced as a hard refuge

The tank pulse station set the hard-refuge flag. This rejected useful lateral movement before projectile validation and held the ship in the aimed-fire lane. It is now a preferred station; the actual collision evaluator admits dodges. The tank also uses the existing bounded multi-turn contact search. This differs from the rejected R431 experiment, which retained the hard-refuge rejection.

Final-ship reward movement lost both input authority and topology

R442 f49094 chooses DOWN but a later cash helper applies LEFT. R445 removes that helper and retains the checked winner. It collects 17/20 rather than establishing complete reward acceptance. Subsequent probes show that legal collection moves still fail wall validation: RAM has zero tile words at the stern, while the native map retains solid cells.

Final-ship mutability previously ended as soon as its controller disappeared. The map now retains the terrain-owner identity through retirement so the emulator imports and records actual tile words at cleanup. The final arena remains RAM-owned during reward collection, including cold restores with no boss object. All 39 arena rows are eligible for reconciliation. Retirement alone does not open terrain; a fixture leaves an intact tile solid until the authoritative zero word arrives.

R446 repeats R445's pre-death checkpoint, takes no damage, defeats the ship and collects 20/20 coins, 1500 cash. Full R447 instead stops at another gate; the separate geometry-cache defect below explains that failure.

Solid tile replacements did not invalidate the retained collision raster

Full R447 stops at world (49,3388) after destroying the left directional barrier at (32,3360). Its map route points upward, but the retained raster blocks that connector. A cold checkpoint probe chooses a different, clear connector; this difference alone does not identify a mission-state bug.

inspect_native_decision.py replays all lifecycle, tile-map and frame records through the authoritative C decoder. Before the repair it reproduces 4586/4586 live decisions through f44282. A freshly constructed raster from the same canonical map differs from the driver's cached raster across world pixel rows 3360..3391. The retirement import is present at f41189; the data was not missing.

The geometry revision counted solid/open changes but omitted changes to a solid cell's sprite and source-row offset. RAM reconciliation also skipped nonzero to different-nonzero words. C now treats those image changes as geometry changes, without changing solid-cell totals or destruction evidence. Repeated identical draws/imports remain cache hits. The existing revision invalidates raster, navigation graphs and route caches together; no per-frame fresh raster is added.

After the repair, replaying R447 through f41301 yields zero cached/fresh raster differences and a connector through (44,3340). Its changed controls are expected; parity with the defective build is not an acceptance criterion. Live gate and full-level regression checks are tracked in the incident ledger.

Prediction and collision geometry needed independent verification

The Level 5 missile handler $4FA1E aims before compensating its Y for the preceding camera movement. C compared coordinates from different camera phases; one pixel could reverse an octant-boundary turn. C now uses the original phase. Its collision header also follows the eight sprite directions at $4F9DE; the former constant box and anticipated cannon-sized box were incorrect.

validate_level5_missile_model.py exercises the public C candidate evaluator against captured pre/post updates. R444 has 2446 checked live updates, zero motion mismatches and zero bounds mismatches. Its focused tank fight still takes 8 damage. Future allocations have random initial age 0..31 ($4F8FC / $4F902 / $4F906); C's nominal age-one anticipation does not model this uncertainty. Observed objects use their captured age. That future-shot limitation remains open and must not be confused with validated observed movement.

Static gate animation repeatedly discarded an executable crossing

R449's later diagonal entrance failure has current geometry: complete-history replay matches live input and its cached/fresh rasters agree. Gate transit incorrectly marked its exit as a hard refuge, rejecting a LEFT/DOWN escape from the side pocket. R450 removes that constraint and takes no damage but still stalls, so constraint removal alone is not an accepted navigation fix.

The approach station also resets on every image revision or 64-frame refresh. Animation need not invalidate a still-clear connector to a static gate. Each replacement moves the firing station upward with the camera, eventually losing its required lower crossing. Gate lateral legs also preserved world Y only near the bottom screen band, even though camera compensation is necessary at any screen row of a mandatory crossing.

Level 5 authored gates now retain a static connector while all remaining legs are collision-clear and camera-reachable. Image revisions trigger actual validity checks, rather than automatic station replacement. New walls or lost camera reach reject the connector. Its lateral row is preserved independently of screen posture. Moving-target and other-level retention policies remain unchanged by this gate repair.

R451 crosses, defeats the tank and collects all ten tank coins with no damage, lives lost or stalls. Full R452 completes without lives/stalls, but takes 26 damage and misses the tank cash. Gate navigation acceptance must remain separate from these unresolved combat/reward incidents.

Reward jobs also need a complete terrain connector

R452's tank cash goal is correctly active at f42963..43040. The ship at X276 cannot move straight to the central lane because the right wall lip blocks LEFT. Direct coin steering selects neutral; the cash expires. This is neither missing reward priority nor evidence of wrong coin motion.

The tank reward approach now connects to its collection band through the existing C graph, including a short required world-space retreat. The checked route owns movement until direct interception is clear. No boss cash input override or Python driving code is added. R453 starts from R452's pre-death checkpoint, defeats the tank, takes no additional damage and collects 10/10 coins, 750 cash. Full-level/campaign reward regressions remain to be run.

Remaining defects and constraints

Ordered progress must reach the active bend

The full Level 3 R455 test stalls in the maze at world (200,1140). Its active bend is (176,1140), but the terrain flood was priced against the final destination (168,752). Repeated small camera movements improved that price without reaching the mandatory bend. Complete-history inspection found no cached/fresh raster difference; this was a progress contract error.

The flood now ends at the active route waypoint. Only the mission owner can advance that waypoint after checking the next leg. The new folded-route fixture requires the retreat first, even when the final destination is near the current position. R456 passes the maze and the rest of Level 3 without stalls/lost lives, with one 4-point projectile hit. Full R457 also passes the maze but loses a life at the carrier: the focused pass alone was not enough to accept the change.

Collision revisions also distinguish tile colour animation from changed collision pixels. Canonical artwork still updates; equivalent generated row masks preserve geometry caches. Unknown masks invalidate conservatively. Twenty targeted map/environment fixtures pass, including both equivalent artwork and genuinely changed solid collision images.

A refuge is a time-bounded safety promise

R457's carrier goal repeatedly returns to the low-left station although the predicted collapsed carrier sweeps through it. At f17690 every local escape is already blocked; body hits f17706/17707 consume the remaining shield, and the life is lost at f17724. The carrier's steering is a checked goal, not a post-planner raw-input override. The wrong goal is the problem.

The encounter now checks the low refuge through the time required to climb to its established upper route, plus eight frames of reaction allowance. A threatened low refuge starts that upper route early. No canonical game frame or replay-specific coordinate is a trigger. R458 starts before the carrier, defeats both cores, collects 10/10 coins (750), and takes zero damage/lost lives/stalls. Clear and threatened refuges have separate fixtures. The uninterrupted Level 3 regression remains the acceptance check. R460 passes this carrier arrival but loses a life during a final wave. R467, with later shared search corrections, exposes another carrier arrival: its emitter and main body hit the ship at f18580..18582. carrier_station_threat omitted both of those real collision bodies. It also allowed attacking until only 8..12 frames remained, although retreat and climb require much longer. The local admission check now includes the main body, emitters and spent core, and measures a sequential retreat/climb interval using the actual speed level. R468's focused live run takes no damage, defeats the carrier, and collects all 10 observed reward coins (750). Full R469 also passes the carrier without damage. Its remaining damage is in the maze, so the carrier repair is accepted locally.

Timed escapes must advance, and the frontier must preserve an exit

R463 f26885 selects a complete safe trajectory with 22 initial waiting inputs. The eight-frame refresh restarts that delay before movement begins. The forecasted worm curve agrees with captured motion; the controller never executes the promised escape. The existing finite commitment rule now also retains a checked CONTACT escape containing actual movement. Every remaining frame is reevaluated against the new observation; a new threat still rejects it. R465 passes that first wave but loses a life in the next one.

At R465 f27470 contact is already forecast 34 frames ahead. Greedy frontier ranking keeps nearby low-cost positions in the same corner and discards the early retreat. Increasing the work budget would not correct that admission policy. CONTACT search now keeps the best branch and safe spatial extremes, within the same six-parent frontier and 4096-transition budget. PROGRESS search retains its ordered-waypoint objective. The frontier array also accommodates all possible wall-tap retries; previously its allocation covered held actions only despite the larger retry loop.

R466 starts from the same pre-wave checkpoint, defeats the final waves, collects 20/20 coins (1500), and reaches Level 4 with zero damage/lost lives/stalls. Full R467 still loses a life at the carrier and takes another projectile hit: the focused final-wave pass does not certify the whole level.

Prepare shared evidence before acquiring a job, then give its route an owner

R469's G1 approach repeatedly alternates between formation staging and gate egress before the incoming wave is allocated. The later wave preparation used the rollout horizon, which could be capped to two frames at an imminent birth. Those three path points are insufficient evidence for admitting a waiting bay. Preparing the same shared pending paths before mission selection removes that truncation and the later route rewrite. The standalone mission API and public ABI remain unchanged; the resident driver supplies pending paths internally.

The focused R474 run clears G1/G2 with no damage, but full R475 exposes a different failure before the carrier. It takes no damage and never reaches the maze. At f30000 the route's active destination is (152,3388), 97 pixels above the ship; the retained forecast starts with 19 Down inputs. The route is statically clear and the fresh/cached rasters agree. FORMATION_HOLD was excluded from the driver's route-progress mode even when it owned a connector, so a safe retreat could be retained without executing that connector. Routed formation staging now uses the ordered-waypoint evaluator. R476 advances but takes two body hits (24 damage), so that test rejects route-progress alone as sufficient encounter protection.

The station must admit a pending wave without activating a second dormant row. Its climb is now bounded by the captured spawn trigger and the original expanding controller's 32px activation distance, with the ship's upper hull included. The retained station is rechecked against that admission predicate when new controller evidence appears. R477 passes the two former body hits; its later maze projectile hit remains. Full R478 completes with 24 damage, no lives/stalls, and all 30 boss coins; it is not a clean run.

A transition fixture also exposes goal Y being passed as the connector's minimum Y. A ship above a safe lower bay was excluded from the search domain before it could retreat to that bay. The connector now uses the actual camera minimum; the station rectangle independently constrains its endpoint. Full R479 completes with 8 damage, no lives/stalls, and all 30 boss coins. The prior four projectile hits do not recur, but the one expanding-formation hit is still open.

Shared pending paths remain long enough for admission. Candidate evaluation now ends at the earliest captured allocation boundary for every Level 3 mission, rather than only routes requiring backscroll. At the next capture, live targets provide collision and damage state. This removes long control commitments against unborn, non-damageable placeholders without removing their staging evidence. R480 takes zero damage, but it is stopped for a persistent stall at f23344. This is not a short-horizon stall: at f23200 there are no pending allocations and the selected forecast covers 56 frames. Fresh and retained terrain agree. The next section records that separate actuator/search failure.

A connected graph route is not an executable sequence of ship inputs

R480 reaches (237,2065) before the next bend at (240,2064). A held Right input moves the ship nine pixels and hits the wall immediately. The following route segment is also blocked from the current hull, so skipping the bend is not legal. Up and Down are initially safe, but the chosen complete forecast cycles vertically without changing X. The six-parent progress frontier has discarded the temporary retreat needed before turning.

Applying safe endpoint diversity to every PROGRESS search clears that bend in focused R481, but full R482 exposes regressions: an early body hit and a carrier life loss. The broad policy is rejected. R481's later four-point projectile hit also prevents calling its focused result clean.

The retained correction applies PROGRESS diversity only to an arrived bend whose onward line is blocked from the actual hull. This uses the same 8px per-axis arrival region as mission waypoint advancement, and requires an active next route leg and a terrain graph. CONTACT search retains its established escape diversity. The best ranked branch and distinct X/Y extremes share the same six slots and 4096-transition budget; ordinary approaches retain their former ranking. No input is forced and no blocked waypoint is skipped. Focused R483 clears the bend and reaches Level 4 without lost lives/stalls, but takes projectile hits at f23421, f23998 and f24145 (four each). Full R484 completes with eight projectile damage and no lives/stalls. Recomputing the original trapped pose still produces a vertical cycle, so these two successes do not establish that the trapped state itself is recoverable.

The deeper mismatch is between scoring and waypoint advancement. The latter accepts a nearby pose only when its onward line is clear; the former rewards being close to the nominal point on its unusable side. At blocked bends the terrain field now floods from nearby admissible departure anchors, using the same arrival tolerance and onward-line check as the mission. Its lookup uses the mission's rounded anchor and actual arrival interval, preventing interpolation toward a neighboring seed from falsely scoring arrival. Safe search prefers an admitted departure before time/distance, retains both sides of that transition when grouping nearby endpoints, and can try a single vertical input when held inputs overshoot a turning row. The six-parent and 4096-transition limits remain unchanged. Ordinary route fields and approach ranking retain their prior behavior.

The captured geometry fixture test_data/native_blocked_bend.json exercises 12 neighboring starting poses at two ship speeds. Each observation calls the C mission goal, executes one C forecast input, and retains/rechecks the C plan until the mission actually advances its cursor. All twelve pass. This catches both a promising forecast tail that never executes and a pose close to the goal which cannot depart. The bend-admission check is cached once per decision; the flood is reused while target, next leg, camera domain and geometry agree. Eighty-nine targeted native tests pass; five historical mission tests also fail against a separately compiled HEAD baseline and remain separate maintenance items rather than silently changed expectations.

Focused R485, before the final rounded-anchor/tap refinements, takes zero damage, loses no lives, reports no stalls and collects all 20 final coins. Full R486 completes with three four-point projectile hits at f22101, f22102 and f24263, without lost lives/stalls. R487's focused check of the final matrix-tested version also completes with zero damage/lives/stalls and 20/20 final cash. Full R488 loses two lives in the final waves; the navigation change is not accepted as a clean full-level repair. R489 also exposes an older Level 2 spider entry which overrides checked steering after Side Shot is missed.

Preferred clearance erased a safe retained escape

The first R488 fatal escape has an accurately predicted worm path but discards its complete safe suffix at f26025: its 3.1px clearance misses the preferred 4px reserve. The retained trial was neither immediately accepted nor admitted to the fallback comparison. A shorter new route then returns toward the worm. Search can keep a fully checked, non-contacting retained trial as a fallback while searching for greater clearance. It still rejects contacting/incomplete suffixes, and prefers a new route with sufficient reserve. Native tests cover all three cases. R490's focused replay passes the previously fatal waves with zero additional damage/lives/stalls. Applying this policy everywhere is rejected: full R491 takes 67 damage and loses a life at f17375 before the carrier clear. The explicit retained mode now enables that fallback only in the Level 3 final wave encounter (scroll <= 208); earlier searches preserve their established admission behavior. Full R492 clears Level 3 with no lives/stalls and no final wave damage. Its earlier four-point projectile hit at f23482 remains open.

A pickup approach needs consistent ownership and coordinates

R489 misses Level 2 Side Shot at f12829..12896, then reaches the dormant spider without that attachment and stalls. Its pickup station climbs to a fixed screen row while homing staging repeatedly reclaims the job. For missing Side Shot in the lower corridor, the local intercept now meets its falling path near the ship's current row (clamped to screen 112..176), and retains pickup priority over homing staging. Existing collision checks and candidate validation still apply; an installed Side Shot preserves the former staging priority. The native test checks both cases. R493 collects it at f12885 and defeats the spider without lost lives/stalls, but takes 12 projectile damage and collects only 2/20 boss coins. It is pickup acceptance, not a clean boss pass.

R489's Level 1 Cannon miss has a separate retention error: the selected direct orbit goal clears the cruise band but never marks the goal reactive. A complete old forecast to the drop station therefore keeps winning before the new intercept executes. That local Cannon goal now uses the existing reactive invalidation contract. R494 collects Cannon at f5071 and reaches the Level 1 shop with zero damage/lives/stalls, but uninterrupted R496 still misses it. The reactive flag does reach the C planner. A retained safe path still waits without collecting the reward; matching the goal alone is insufficient. Collection now has a separate completion contract, tested with warm retained state. Neither change modifies the deferred cannon firing model. Live acceptance remains pending.

R493's spider loses its front phase when the arena timer becomes negative. ReVa /mydumpat0, $50DE6/$50FFA..$51012, confirms the negative timer also occurs during live motion between world Y=96 and 192. Simply retaining front mode through that timer cycle is rejected: R495 stalls with the head out of view and a requested world-Y goal above the camera-reachable maximum (goal 468..476 against maximum 464 at f19800). That experiment is removed. Any future phase repair must admit a visible target and a reachable firing station together, not equate a retained phase flag with a usable attack. R496 checks the accepted changes uninterrupted from game start: the spider takes 59 damage and one life, and collects only 1/20 coins. Its normally collected primary is Double Shot; the hardcoded X=192 firing station was derived from a different mounted Cannon.

• Some encounter overrides remain. The unchecked Level 4 entry replacement and Level 5 cash replacements are removed. Several Level 2 encounter overrides still remain; they must be audited against their successful boss tests before removal.
• Optional combat approaches can compete with travel. A valid static firing station can be unreachable under current threats, and fallback travel can then reacquire the same source. Instrument acquisition/release and the first rejected leg rather than reacting to the eventual stall-monitor frame.
• Clearance and contact are different. A safe passage may lack the preferred reserve. Lowering that reserve globally is not an accepted repair: earlier crossing experiments caused hits while sources remained alive. Suppress sources or stage earlier when no complete safe crossing exists.
• A successful checkpoint changes encounter timing. Cold mission state, loadout, camera allowance and source lifetime can differ from an uninterrupted run. R417's focused success did not predict R418's full-level failure. Test both and preserve exact source/binary identities.

No new raw terrain steering override or frame-number-based gameplay rule is part of these repairs. Full Level 3 combat, Level 4 final-projectile incidents, Level 5 full acceptance and repeated complete campaigns remain open.

Evidence and acceptance

October 5: separate route lifetime from retained movement lifetime

Connector renumbering no longer creates a new mission job. An ordinary retained travel plan is nevertheless refreshed if that job's active goal rectangle changes. A checked maneuver/repair retains its finite wait and turns, then undergoes current-scene collision validation. Actual reached-bend advancement and route disappearance still create a new job. The decision tests cover both ordinary-goal replacement and escape retention, including repeated execution.

The full R517 Level 3 run reaches Level 4 with no lost lives or stalls, one four-point projectile hit at f23475, and all 10 carrier/20 final-boss coins. R515, before active-goal refresh, has two four-point hits. Broad dogleg retention across mask revisions was rejected in R513/R514 and is not enabled at this stage; its pending tests remain a documented open navigation contract.

R518 separately admits safe sub-reserve suffixes at the last maze gates. This increases damage to eight points (f23453/f23455), despite no lives/stalls and complete boss rewards, so that scope expansion is removed. The existing final-wave-only fallback remains. Clearance admission is not a substitute for correct mission lifetime, source prediction or encounter staging.

The R516 POWERUP timing fix also exposes a missing future allocation, rather than a failure of the existing worm trajectory: the last old left follower is shot away at f9688 and its replacement train is allocated at f9690. R519's replacement envelope passes that one checkpoint, but R520 exposes a stall and 24 damage from other starts. Narrowing the envelope in R521 still produces 16/32 damage. Both envelope experiments are removed: conservatively covering all possible births also blocks useful escape paths. There is no replacement envelope allocation or preparation cost in the current pilot.

R522 instead pauses fire after the incoming right leader has been cleared, until the outgoing left train provides a checked launch. This preserves that train's deterministic script rather than accelerating another allocation. The f8918/f9088 tests clear without damage, but f8593 loses a life at f10472..10494 during the later middle-eye descent. Its unchecked outer-lane input replacement erases the evaluated escape. R523 tests collision-checked movement authority for that phase; acceptance remains pending.

Recordings use E:/xenon_runs/<basename>.validation/<basename>.x2events: level3-full-active-leg-20261005-r517-1, level3-full-tight-suffix-20261005-r518-1, level2-replacement-worm-20261005-r519-f8918. The current targeted native subset contains 64 passing tests. Full campaign and cross-level navigation acceptance remain incomplete.

The detailed run ledger and full filenames are in CAMPAIGN_INCIDENT_FIXES_20261004.MD. Every live run uses the visible resident C pilot, official PowerShell build workflow, matching replay DLL, paired AVIs and periodic checkpoints. Python tools inspect captures and coordinate runs; they do not supply gameplay input.

The latest targeted set contains 89 passing tests covering native routes, decision retention, planner escapes, maneuver geometry, map state/event flow, linked predictions and affected missions. This is not a claim that every historical Python test or every live level is clean.

Departure predicates and camera reanchoring

R523's middle-eye correction removes an unchecked post-planner input authority. R525 additionally reacquires an incoming right leader if a different wave arrives while the crossing is blocked. R526 then reveals a distinct permanent wait from f8423: the launch predicate insists that an outgoing survivor still occupy X<80, screen Y>=120. Its deterministic path has already left that rectangle; the predicate rejects departure without consulting the complete route forecast. Current-DLL replay agrees with all 2,261 recorded native statuses through f10685.

R527 replaces that stale position predicate with the actual requirement: a live outgoing train, no still-delayed members, and a completely checked crossing. Four targeted native tests distinguish a departed survivor, delayed tail, body contact and a replacement incoming right leader. The previously stalled f8423 start clears at f10391 with zero damage/lost lives/stalls and 10/10 coins (750). R528 repeats the other starts; final acceptance is recorded in the incident ledger. No elapsed-frame escape or relaxed collision check is used.

A second ownership defect is independent of worm avoidance. In R523 the boss dies at f10854; the camera changes from 2880 to 2543 on f10855. Session reset discards the completed encounter's collection job along with its stale geometry. Generic pickup chasing then climbs to screen Y=91 and misses a falling 50-value coin at f10923. Preserve semantic reward ownership across this verified camera reanchor, but discard routes, retained maneuvers and wall recovery. A life loss, new level or restored run must still perform its ordinary full reset. This fix is enabled separately in R529. Both formerly missing-cash starts collect all 750; R530's uninterrupted Level 2 has zero damage/lives/stalls, POWERUP/Zapper/ Side Shot and complete 750/1500 boss rewards. Ordinary camera jumps and life loss still reset; this does not broadly preserve stale encounter routes.

Recordings use the filename convention above, with basenames level2-current-worm-matrix-20261005-r526-f8423, level2-departed-train-route-20261005-r527-f8423, and level2-middle-eye-checked-descent-20261005-r523-f8593.

Last-gate waiting and animated projectile contact

R531 enables the shared whole-route validator for Level 3 gate retention, after the earlier active-goal/mission-identity fixes. All gates pass, but a subsequent formation wait takes 12 damage at f24747. Current-DLL history matches every recorded status before contact. This is a failed combined acceptance run.

That wait occurs before the scroll-Y208 final-wave boundary. Its actual job is already post-gate formation waiting, with no remaining gate connector. R532 extends the real ship hull and checked contact escape to that semantic job; the 12-point contact disappears, but four damage remains at f25056.

The latter is a demonstrated geometry omission: the radial bullet's sequence at Level 3 $4F69E cycles $5F12C/$5F1DC/$5F278/$5F300 every two ticks. $4180 calls $34C2 before movement and $3D58 collision preparation. Their draw origins differ, so freezing the current rectangle misses the next frame's one-pixel growth. The native animation-envelope table now includes that sequence, regenerated by xenon_tools/generate_native_envelope_data.py. Preparation retains both endpoint hulls and each sequence's actual duration. No velocity or player-cannon model changes are part of this fix.

R533 repeats the late passage from f23844: zero damage/lives/stalls and 20/20 boss coins, 1500/1500. R534 replays the full level from its established entry save: zero lives/stalls, complete 750/1500 rewards, but four damage at f24384. This earlier gate approach correctly predicts the projectile direction. R535 tests keeping a progressing escape as a fallback while searching for greater clearance. Its focused test still takes four damage; full R536 increases loss to 16 at f23858/f23911/f24686. The broad fallback is removed. The small wall bullet cycles tall/middle/short/middle collision headers at $50E9C; rechecking a frozen short header cannot certify the future taller frame. Do not call a route physically safe solely because that incomplete model reports no contact.

The user now accepts four shield lost per level. R534 meets that limit without stalls, lives lost or missed boss rewards; the untested follow-up geometry work is set aside and Level 4 validation proceeds from R534's final save. This does not accept the R536 regression or reopen broad fallback policy experiments.

Recording basenames: level3-shared-gate-retention-20261005-r531-1, level3-post-gate-reaction-20261005-r532-1, level3-radial-animation-20261005-r533-1, level3-full-radial-animation-20261005-r534-1, level3-progressing-suffix-20261005-r535-1.

Level 5 R541 loses a life below the final right laser, not during the spaceship fight. The native scripted swarm forecast matches its later captured position. The beam's open/closed mission switch replaces a safe waiting route with an approach from inside the lower pipe pocket. R542 tests a local ordered connector for tile (13,26): find a clear lower row in the actual physical graph, cross below the pipes, then climb the gate column. Keep that station across beam animation revisions while its complete route remains camera/terrain-valid. No collision or input-authority rule is bypassed. Focused R542 completes without damage/lives/stalls and with all 1500 final cash; full R543 passes the laser but stalls later in a different final-side attack job.

R544/R545 keep a consistent flank station, yet the side planner still abandons its safe descent. Its retain condition requires predicted mounted damage and immediate movement, so the checked approach is restarted before reaching the firing row. Input/ship/camera telemetry passes all 431 checked R545 transitions; the wall raster matches freshly prepared geometry. R546 preserves a fully rechecked suffix that closes the firing-row gap even before weapon damage is predicted. It does not preserve a non-progressing wait. From R543's pre-stall f48647 checkpoint it completes without damage/lives/stalls and collects 1500/1500. Earlier-start and full-level validation remain separate acceptance gates.

Train approach: retain the connector while keeping reaction room

R550's train approach reaches screen Y17 while trying to attain the distant authored row. R551's replacement camera-relative station lies behind terrain and stalls; that experiment is removed. R552 keeps the destination, route and cursor. When the active leg goes forward beyond screen Y140, it may temporarily end at Y140..144 only if the actual physical graph certifies a straight segment from the current ship. Nonclear legs and required bends keep their original order. The clipped goal receives a new proposal instead of retaining the old upward input. This rule is local to the train approach.

Focused R552 crosses that chamber without damage. Full R553 completes Level 5 with no lives lost or reported stalls, all tank/final-ship cash (750/1500), and 37/39 final shield: fourteen damage minus twelve paid shop repair. Current-DLL replay matches all 9637 decisions/statuses. This is an accepted full-level result under the user's recovery budget. Subsequent R554 campaign repeats all fail an earlier Level 2 wall connector; they do not validate the complete campaign.

Recording: E:/xenon_runs/level5-full-train-recovery-20261005-r553-1.validation/level5-full-train-recovery-20261005-r553-1.x2events. Its original/sprite AVIs and 150-frame checkpoints are retained alongside it.

R554: an admitted escape does not imply an executable game update

All three full-game repeats reproduce the same Level 2 stall near (181,2965). At f9520, C wall-motion admission reports five initial forecast updates as clear while the same query reports their anchors occupied. The escape exception only requires its approximate escape distance not to increase. The original game rolls the ship back at the first colliding update, so it never reaches the sixth actually free position. Recovery then marks every direction blocked and retains the same connector. An endpoint or six-frame forecast cannot certify this job if its individual game updates are not physically executable.

The C environment also derives its wall footprint from the current animated player sprite. Original $387C uses a fixed footprint from $3515C; raw RAM comparison shows all 25 rows differ at the captured neutral pose. This shared geometry issue must be corrected separately from steering/mission preferences. The unchanged map raster and exact native replay parity rule out a stale DLL or cache as the explanation for this particular failure.

Full prefix tests also miss the Level 1 Cannon, changing the loadout seen by later encounters. Saved-checkpoint success does not certify the approaches and equipment acquisition leading to that checkpoint. The next repair must address collision admission and route execution, then prove it from the full prefix as well as neighboring pre-failure checkpoints. Investigation and complete recording paths are in CAMPAIGN_INCIDENT_FIXES_20261004.MD.

Fixed wall geometry and executable connectors (R555–R562)

The native environment now uses the original 25-row ship wall mask from $3515C, generated on demand from assets/stram.bin. The generator checks all 16 shifted copies against the unshifted shape. Animated collision sprites remain captured for object interactions and inspection, but no longer select wall geometry. One immutable environment is cached per map revision, bounds, level and reserve; snapshot readers retain that environment. The redundant animated-footprint cache and separately reference-counted raster are removed. The changed public environment signatures require native ABI 106.

Wall admission now checks the endpoint of each individual game update. It rejects an occupied hold or destination instead of allowing several occupied updates on a decreasing approximate escape distance. Span navigation continues to certify complete route segments. Ending actual wall-history replay expires the failed connector once, retaining the encounter and target. Recovery no longer permanently blacklists all four directions. No extra graph search is added to ordinary frames, and escape-distance ring searches are removed from the driving wall-motion path.

A separate route-execution conflict appears in the full prefix. The initial eye approach is C tactic BOSS_EYE (6), even when the replay labels it boss_refuge; short Level 2 guards overwrite its checked retreat. That actual approach now shares the transfer's existing bounded planner authority. Ordered waypoint feedback also uses the next camera origin and the actual world-Y interval: the firing deadzone otherwise stops the retreat three pixels before the connector's turning row. Search budgets are not increased.

Do not extend this authority simply because an eye phase retains route storage. R560 did so during WAIT_LEFT_REFUGE while the current output was FORMATION_HOLD, and lost both remaining lives to worm segments. That experiment is removed. Travel eligibility requires an actual eye/refuge route output and the approach/transfer phase; other combat and waiting guards remain in place.

R555 passes the original lip from an earlier checkpoint without damage. R556 and R558 fresh prefixes still stall because the initial approach did not receive that steering ownership. R559 passes the complete eye encounter with zero damage/lives lost and all 750 cash, but reports a temporary wall stall at f10559 before recovering. These focused results do not establish campaign acceptance.

R561 starts at assets/xenonplay.sav, reaches Level 3, and reports no stalls or lives lost. Level 1 takes no damage; Level 2 takes two earlier 16-point hits at f7617/f7991 and restores 20 at the shop plus 12 from a health pickup at f12686. The eye encounter adds no damage and collects 750/750 reward cash. It still misses the Level 1 Cannon and all 1500 spider cash at f14936: navigation completion is not complete campaign acceptance. These equipment/reward failures need their own diagnosis. The cannon model remains deliberately unchanged.

Fifty targeted environment, wall, maneuver, driver and session checks pass; all eight generated assets reproduce. The larger 196-test mission suite retains four existing pickup/old-eye-strategy expectation failures. Native replay matches all 16,371 recorded live statuses in R561, with zero rejected frames. Its final stopped-input frame differs after the pilot is stopped; this is not an active-play parity failure. Mean native replay preparation and decision time is 2.06 ms/recorded frame on this desktop, not a phone benchmark or a claimed speedup percentage. No WASM profiling is performed.

Recordings and both AVIs use these prefixes under E:/xenon_runs/:

• level2-fixed-wall-model-20261005-r555-1
• campaign-fixed-wall-model-20261005-r556-1 (failed prefix)
• campaign-checked-connectors-20261005-r558-1 (failed prefix)
• level2-prefix-connector-20261005-r559-1
• level2-route-owner-20261005-r560-1 (rejected broad change)
• campaign-executable-navigation-20261005-r561-1
• campaign-navigation-continuation-20261005-r562-1 (remaining levels; final completion f48915, no stalls or lives lost)

For example the full-prefix recording is E:/xenon_runs/campaign-executable-navigation-20261005-r561-1.validation/campaign-executable-navigation-20261005-r561-1.x2events.

R562 completes the remaining levels with no reported stalls or lives lost. Levels 3/4/5 take 20/32/28 damage and restore those amounts through health and shops; each ends with 39 shield. Both Level 5 bosses yield all their cash. There remain two smaller reward misses in Levels 3/4 and the earlier Cannon/ spider failures. All 32,546 native live statuses and 32,545 applied inputs match replay, with zero rejected frames; mean replay cost is 1.37 ms/frame. The local web-replay WASM and bundle are rebuilt from these tested sources. Full recording paths and incident frames are in NAVIGATION_FIX_VALIDATION_20261005.MD.