Autopilot · write-up

Sequential campaign incident repairs — 2026-10-04

xenondoc/CAMPAIGN_INCIDENT_FIXES_20261004.MD · 77 KB · updated 2026-10-05

Baseline: FULL_NATIVE_CAMPAIGN_THREE_20261004.MD, identical r306-1/2/3 starts. Resident C drives all live runs. Official hatari_dev.ps1 builds Hatari Release and the current Python-inspection DLL; visible fast-forward, paired AVIs, 150-frame checkpoint interval. Python audits captures without running its old policy.

1. Navigation ownership and the Level 4 second-part bend

The late stalled state cannot simply move left: at frame 34856, the physical hull graph joins the two passages at world Y=1992, while captured camera reach ends at Y=1987. The inflated travel graph joins at Y=2004. A recovery that ignores these limits promises an impossible escape. Earlier, f33738 has a complete connector through the bend; optional cash targeting drags the ship into the right pocket before that connector is acquired.

The old implementation also has three competing route authorities: the mission connector, an independent level4_lower_exit_recovery input rewrite, and xap_level4_second_bend_action after safety scoring. Removed both bend input rewrites. The Level 4 mission now acquires the full connector from the post-shop approach and retains legal route legs through ordinary timer expiry. Shared advance routing keeps legal retreats, invalidates camera-unreachable/blocked legs, and searches a reachable forward area when the preferred central anchor is terrain. A failed search produces an explicit hold rather than inventing an upward waypoint. This is a navigation contract repair, accompanied by an area-specific route priority; it is not a fixed-frame unsticking input.

Forward reaction posture is retained during the bend climb. Only a mandatory retreat or the short lateral handoff disables that posture. The first candidate disabled posture for the whole connector and caused a new collision; it was rejected.

New navigation fixtures verify forward-region selection, early bend ownership before optional cash, and retention of a legal retreat past 64 frames. Existing rounded-anchor handoff remains supported. Routes/navigation/driver/session and new mission fixtures: 33 passed. Full mission suite has four old Level 2 failures; an isolated pre-change DLL reproduces all four. They are recorded rather than reported as passing or silently disabled.

Full-level regression and rejected candidates

Short bend probes were insufficient. Broadly disabling the cruise posture or enabling new steering across the first boss caused new hits and lost lives. Those versions were rejected. The surviving implementation confines the maze search intent to the second part, keeps the first boss's posture, and distinguishes a backward leg from a lateral leg which must hold its world row as the camera changes. A discrete 9px/5px input is not the straight line between two map points. The route must specify a realizable ordering of its axes.

The final full Level 4 control, including the close Side Shot interception below, is: E:/xenon_runs/level4-navigation-current-20261004-r349-1.validation/level4-navigation-current-20261004-r349-1.x2events. It starts at f27163 and reaches Level 5 at f38169, with zero shield damage, lost lives, or reported stalls. Both boss cash bursts were fully collected: 10/10 at f32402 and 20/20 at f36562. This verifies the whole level for that starting state and loadout, not every possible checkpoint. The original r306 deterministic campaigns all stopped at the bend.

2. Level 2 moving bodies and projectile avoidance

Captured ship movement and projectile increments were checked before changing prediction: 1,975 homing updates and 691 ship/camera/input comparisons agreed with the game model. Straight projectile directions also agreed. The failures were not repaired by rounding the directions differently. Two control defects mattered:

• The old ordinary-corridor safety pass used a 26x35 future box instead of the captured ship pose. It could reject every useful narrow escape. Ordinary corridor forecasts now use the five real steering poses; the established three-eye encounter retains its previous policy.
• Independent constant-input hazard scoring and corridor corrections replaced the shared planner's multi-turn route in the homing/diving passages. Those passages now have a single shared candidate evaluator; a dodge cannot be erased by a later lane preference. Remaining route legs are rejected before they exceed the camera's backward reach.

Current full-Level-2 control: E:/xenon_runs/level2-retention-control-20261004-r348-1.validation/level2-retention-control-20261004-r348-1.x2events. From f7649 it passes the corridors and three-eye boss without damage or stalls, collects Zapper and Side Shot, defeats the spider, and enters Level 3 at f15780. Two spider projectile hits remain, f13879 and f13880, 4 damage each. Both were forecast before contact. The spider's separate constant-input dodge and authored-input overrides still disagree with the shared planner. A spider-front-only ownership change is under test; it is not a validated fix.

Earlier full probes r344 and r347 lost lives and are rejected validation results. A cold C inspection of a checkpoint is diagnostic evidence; it is not equivalent to the resident controller's uninterrupted encounter history.

3. Short useful-pickup interceptions

Level 3 damaged-player health and Level 4 Side Shot can briefly leave the cruise band through normal candidate collision evaluation. Full-shield health is excluded only in those levels. Health must be within 24px Manhattan distance; Side Shot within 48px. A long stationary tail must not veto a short upgrade handoff. Rear Cannon replacement remains excluded.

Level 2 Zapper uses the existing scripted item trajectory. Its old straight prefilter checked hazards after collection, even though Zapper would clear them. Candidate evaluation now owns that check through collection; real contact still rejects the path. The extra clearance reserve is zero for that final interception. The homing passage's Side Shot uses its predicted orbit/drop crossing rather than chasing its present anchor.

• r331: Level 4 Side Shot installed at f30118, zero damage in the focused probe.
• r333: Level 3 health restored shield 31 to 39 at f16325, zero damage in the focused probe.
• r343: Zapper collected, zero damage; exposed the subsequent Side Shot miss.
• r345: Side Shot installed at f12331, zero damage in the focused probe.
• r348: both Level 2 items collected during uninterrupted level play.

A reactive goal flag distinguishes moving interceptions from tactical waypoints. Only reactive goal changes invalidate a checked suffix. Invalidating every OFF/WAYPOINT change altered ordinary encounters and caused regressions; that broader rule was removed. Unit coverage checks both a moving interception and continued tactical retention.

4. Level 1 final boss cash and transition coverage

Retain the defeated boss's cash phase until the last live coin retires. Orbiting coins converge around (160,100); follow the convergence lane and adjust X for a falling coin's arrival. The first complete collection used a bottom row, but the next level's first active frame took damage from an eye object with not-yet-updated collision fields in a reused object slot. The final collection row now stays at screen Y=148..152 on Level 1 only, above the following level's reset ship row at 176. Other boss collection stations are unchanged.

E:/xenon_runs/level1-cash-transition-20261004-r350-1.validation/level1-cash-transition-20261004-r350-1.x2events starts before the Level 1 boss, collects 18/18 cash, 1350 total, passes its shop and reaches active Level 2 at f7294 with zero damage or lost lives. This transition must also be covered by the final full campaign; ending validation at the shop hid the earlier regression.

Remaining acceptance work

No final three-campaign pass has been claimed, and no candidate has been committed in this repair session. The later results below supersede the intermediate r348 baseline.

5. Deeper navigation review and subsequent acceptance tests

Navigation does need a deeper repair. Four mechanisms recur across the failed trials: stale runtime terrain, route/steering disagreement about axis ordering, late input rewrites which replace a checked trajectory, and repeatedly replanning the initial wait of a safe escape. A preferred point or a route overlay alone does not establish that the ship can execute the route.

The decision cache now retains a rechecked progressing suffix through its horizon instead of restarting its delay at every observation. Stationary suffixes do not satisfy progress admission. The spider's front approach uses the shared evaluated trajectory without the separate constant-input scorer and raw diagonal overrides. Stage prerequisites are rechecked after a dodge.

Spider terrain truth

Confirmed at r392 f14137: RAM $5873E row 23 was empty while C retained the captured diagonal web. The old spans reported no connector to (192,385), even with the correct backward camera allowance. The opening exists in the original AVI (work/spider-r392-f14137-original.png).

The correct RAM overlay imported into ReVa is /level2-campaign-20261004/spider-f13600, from r382's checkpoints/f13600-periodic.sav.ram. Spider worm contact $511E6 writes cells from four eight-byte-entry tables: $5151C (12), $5157E (12), $515E0 (10), $51632 (10). Each entry has a construction flag, world X/Y and tile word. These 44 cells can be destroyed and rebuilt. They were omitted from authored destructible groups and therefore treated as permanent walls.

Cold RAM synchronization and two complete live observations now reopen those exact cells. A later nonempty draw restores them. Static neighbors and existing gate ownership stay unchanged. Tests cover all 44 locations, offscreen RAM restore, clipped observations, repeated rebuild/destruction and cloning. The repaired r392 topology has a four-point connector to (192,385).

All five reached the shop and finalized both AVIs. Cash coverage still needs a separate correction. The preliminary active-worm/hatching prediction repairs alone (r390/r391) did not fix navigation and lost a life. r393's phase correction alone took 16 damage and collected no cash. They are not successful validations.

Ordered connector retention

E:/xenon_runs/campaign-navigation-repair-20261004-r397-1.validation/campaign-navigation-repair-20261004-r397-1.x2events passes all of Level 2 with zero damage/lost lives, collects both valuable post-shop weapon pickups, and collects 18/18 Level 1 and 10/10 three-eye rewards. Spider reward collection is 15/20. Level 3 takes 8 damage at f15756 and stalls near (259,3421); monitor reports it at f17717, and recording stops f19840.

At the stall, the ship oscillates between X=250 and 259 and route indices 2/3. Camera drift leaves it above the saved horizontal row Y=3424. Direct diagonal validation rejects the saved leg even though the down-then-left dogleg is clear, rebuilding the previous corner and reinstating its posture band. Retention now checks legal axis legs; axis selection verifies the first leg instead of assuming every retreat is vertical-first. Fixtures cover both orders and a closed alternative.

E:/xenon_runs/level3-ordered-axis-route-20261004-r398-1.validation/level3-ordered-axis-route-20261004-r398-1.x2events starts f16447, passes the formerly stuck corner and reaches the G1 approach by f18573, without damage or monitor stalls. Forty targeted map, route, maneuver and decision tests pass. Full Level 3 r399 subsequently exposed another gate stall; this focused result was not whole-level acceptance.

Terrain distance and subsequent full coverage

Further live tests exposed a missing progress model. Ordered waypoints alone still parked beside a bend because the immediate point was across terrain. Choosing the nearest segment of the whole polyline was worse: a folded maze puts later legs near the ship, but proximity does not authorize skipping its required retreat. r400 tried that and lost two lives; that scoring was removed.

The span graph now owns a cached four-neighbor distance flood to the retained destination, bounded by the current camera rules. Candidates query continuous distance through legal anchor space rather than distance through the wall to the next point. The collision evaluator still checks every actual movement. Blocked off-grid starts use the same short anchor projection as connectors; free but disconnected components remain unreachable. Ordinary connector queries cannot overwrite the flood. Outside the Level 3 terrain field, route scoring uses only the active outgoing edge, never a later nearby edge.

Reaction posture remains a separate score. An initial field experiment accidentally omitted that penalty and was rejected. Beam prefixes accumulate only their new frames' scores. There are no per-candidate flood allocations or Python navigation calls. Targeted route/decision tests cover a mandatory backward detour, folded routes, disconnected camera bounds, query reuse and retained multi-turn progress.

The broad chain-envelope expansion was unvalidated and was withdrawn; the existing collapsed-chain guard remains. A proposed escape-mode scope change was also withdrawn after checking HEAD: that scope already existed. Neither should be reported as a newly demonstrated root cause or accepted fix.

r408's live trace predicts contact before all four hits. At f23962, for example, a projectile reaches the remaining left/down escape in five frames; other directions are already wall-blocked. These are failed earlier positioning or escape choices, not evidence of random projectile direction. Cold-session recomputations are useful diagnostics but do not replace the recorded live mission trace. Further combat acceptance is required.

Spider cash phase after navigation repair

r407 cleared the spider from four checkpoints without damage, but still missed cash. The original twelve-frame upward sweep was removed because an incidental side-shot kill during descent sent the ship back into the rebuilt web. The replacement retains a below-web station and keeps firing.

r409 added falling-coin interception without improving the totals. Its live trace identified why: a few pixels of camera drift restarted the descent gate and temporarily disabled horizontal interception. r410 separates that transition from the station's small Y corrections. Cash acceptance must use the scalar gain as well as the captured coin lifetimes: a coin collected on allocation can be absent from the first active drop observation.

r411 adds a hull-overlap collection interval rather than requiring an exact coin center. In r410's last miss, another 9px LEFT input moved X151 to X142 even though X151 could already collect the preceding coin at X146. That put the ship one input late for the next coin at X174. A +/-8px collection lane prevents this extra correction. The four r411 runs from f13133, f13289, f13446 and f13600 all reached the shop with zero damage/lost lives and 1500 scalar cash gained each. Boss-clear frames were 14543, 14398, 14267 and 14454. Recordings are E:/xenon_runs/level2-spider-cash-overlap-20261004-r411-f<checkpoint>.validation/level2-spider-cash-overlap-20261004-r411-f<checkpoint>.x2events.

Subsequent regression checks: rejected and pending

r412 tried keeping a progressing ordinary escape instead of running the extra maze beam. It reached Level 4 without stalls/life loss, but took 28 damage; the planner condition was restored to r408. r413 tried applying sine-wave bay staging to ordinary formations. It reached Level 4 without stalls/life loss and collected both complete boss rewards, but took 32 damage; that expansion was also removed. Neither experiment is an accepted damage reduction.

r414 starts Level 4 from r408's final save, rather than the older r349 entry save. It missed Side Shot #87421 at f30904-30991 and repeatedly switched between a satellite bypass and ordinary travel around world Y2500. The ship had no Side Shot; this is not sufficient evidence that the terrain-distance field caused the stall (that field is enabled only for Level 3 travel). The first three entry hits occurred at f29192, 29210 and 29223; later hits were during the failed boss approach. The run was stopped gracefully.

r415 admits the nearby Side Shot by hull gap and places its short intercept before boss acquisition. It still dropped the pickup goal after avoidance left its acquisition range. r416 retains the admitted target until it retires, and collects Side Shot #87574 at f30984. It then destroys the satellites but loses three lives entering the central main-head station: the first fatal sequence f32546-32547 includes the contacting face and the main head. The anchor-plus-112px firing station leaves insufficient escape room at the lower camera clamp. r417's complete swept-hull firing floor cleared the first boss without additional damage and collected 10/10 cash. This was focused coverage, not acceptance of the uninterrupted level.

The r414-r417 files are under E:/xenon_runs/<recording-basename>.validation/<recording-basename>.x2events:

Level 4 uninterrupted pickup and destruction-event coverage

R418 repeats the original entry hits (f29192, 29210, 29223), misses the Side Shot, and eventually loses three lives without reaching the shop. At f30989 the admitted pickup leaves the ordinary screen-Y targeting band but remains alive; boss bypass immediately replaces its goal. R419 removes this premature release but still misses the item. R420 tries the earlier-level orbit crossing station; it also fails. Those two tests do not establish a successful intercept.

R421 instead reuses Level 4's existing short-contact/final-drop interception routine. The Side Shot is collected at f30998, the first boss is defeated, and the shop is reached without additional damage. Only 5/10 boss cash items are collected. The subsequent full Level 4 R422 reaches Level 5 without any life loss or persistent stall, but takes 48 damage: the original 28-point entry cluster and five four-point final-boss projectile hits at f36470, 36655, 36815, 36852 and 36893. It collects Side Shot, Temporary Shield and Zapper, skips Rear Shot, and collects 7/10 first-boss and 19/19 observed final-boss cash items.

The first-boss reward problem exposes a confirmed event-flow bug. The map waits to find the head's unlink procedure in the live world, but explicit destruction events filter that object out first. In R421, head #87252 changes $50782 to $E54 at f34331; the canonical live population no longer contains it. At f34370 all 80 boss-wall cells remain solid in the reconstructed map, because they are below the viewport. That stale completion predicate suppresses the central reward tactic. The map now reads the existing sorted destruction event buffer through a C query; it does not infer a kill merely from disappearance or copy a second event list. A fixture covers unrelated destruction followed by the filtered main-head death while its wall is offscreen.

R423 retests from before that death: zero damage/lost lives, boss defeated, 10/10 cash worth 750, shop reached. Recordings:

• E:/xenon_runs/level4-full-equipment-and-head-20261004-r418-1.validation/level4-full-equipment-and-head-20261004-r418-1.x2events
• E:/xenon_runs/level4-side-lifetime-20261004-r419-1.validation/level4-side-lifetime-20261004-r419-1.x2events
• E:/xenon_runs/level4-side-drop-intercept-20261004-r420-1.validation/level4-side-drop-intercept-20261004-r420-1.x2events
• E:/xenon_runs/level4-side-shared-drop-20261004-r421-1.validation/level4-side-shared-drop-20261004-r421-1.x2events
• E:/xenon_runs/level4-full-shared-drop-20261004-r422-1.validation/level4-full-shared-drop-20261004-r422-1.x2events
• E:/xenon_runs/level4-boss-death-topology-20261005-r423-1.validation/level4-boss-death-topology-20261005-r423-1.x2events

Level 5 launcher route contract

At R389 f42650, C can forecast a clear route from (147,4173) to (112,4128), but that route begins with eight neutral inputs. Ordinary contact-escape refresh restarts the wait, repeatedly preventing execution of its later turn. The launcher firing-station approach now uses the same progressing-suffix contract as terrain travel; the Level 5 physical span graph also supplies its distance through terrain. It remains a collision-checked C trajectory.

R424 starts before the original failure at f42105. It clears the formerly stuck approach, lower barriers, diagonal chamber and tank, with no stall/life loss. It takes 16 damage at f43823-43825 in the upper chamber; these are still unresolved combat incidents, not a clean-level result. R425 is the full-level regression. Sixty targeted native route, decision, planner, maneuver, map, linked-body and affected mission tests pass.

E:/xenon_runs/level5-checked-launcher-route-20261005-r424-1.validation/level5-checked-launcher-route-20261005-r424-1.x2events.

Still required

October 5: entry authority, pickup retreat and full Level 4 coverage

R425 completed neither Level 5 nor the campaign: 117 damage and three lives lost, at f41032, 41850 and 54525. It passed the old launcher stall and collected both opening POWERUPs and 10/10 tank cash. Its first fatal sequence is an upper chamber approach, not evidence of erratic projectile motion: at f41002 the native trace already predicts contact in the next update. The later tank and final encounter remain unsafe.

R426 removes the unchecked Level 4 entry DOWN/LEFT override, represents the retreat as a checked corridor connector, and retains ownership until that connector is completed. It avoids the previous entry hits, but its different arrival misses Side Shot and makes the first boss unsafe: 43 damage and one life lost before graceful stop. That is a failed full acceptance run.

R427 preserves the pickup's finite world-space retreat, replacing a screen station already satisfied by neutral input. It still admits the missing weapon too late. R428 additionally reserves the visible, predictable drop when Side Shot is missing, before boss bypass. It collects the equipment at f30848, defeats the first boss, takes zero damage, and collects 10/10 cash, 750.

Full R429 starts at the same Level 4 entry as R422/R426 and reaches Level 5. It takes 4 damage, no lost lives, collects Side Shot and Temporary Shield, skips Rear Shot, and takes 10/10 and 20/20 boss cash (750 and 1500). The remaining projectile hit is f37058. The monitor also flags a long final boss pause at f37904, before the eventual destruction/cash burst at f37914; this is still an unresolved combat delay, not a clean-level result.

Recordings, each with both AVIs and periodic checkpoints:

• E:/xenon_runs/level5-full-route-contract-20261005-r425-1.validation/level5-full-route-contract-20261005-r425-1.x2events
• E:/xenon_runs/level4-checked-entry-retreat-20261005-r426-1.validation/level4-checked-entry-retreat-20261005-r426-1.x2events
• E:/xenon_runs/level4-side-world-retreat-20261005-r427-1.validation/level4-side-world-retreat-20261005-r427-1.x2events
• E:/xenon_runs/level4-side-early-reservation-20261005-r428-1.validation/level4-side-early-reservation-20261005-r428-1.x2events
• E:/xenon_runs/level4-full-entry-and-drop-contract-20261005-r429-1.validation/level4-full-entry-and-drop-contract-20261005-r429-1.x2events

October 5: Level 5 experiments and limits

R430 tests a local lower firing floor for the diagonal chamber's four upper emplacements. It passes the earlier fatal upper approach without damage, but the subsequent tank fight loses its remaining 27 shield and one life. R431's physical-hull/multi-turn tank search does not improve that; it is withdrawn. R432's central-pulse mission preemption loses two lives and is also withdrawn. Neither tank experiment remains in gameplay sources. Existing notes already describe earlier failed pulse-priority changes; a passing mission fixture is insufficient evidence for this coupled encounter.

• E:/xenon_runs/level5-diagonal-source-floor-20261005-r430-1.validation/level5-diagonal-source-floor-20261005-r430-1.x2events
• E:/xenon_runs/level5-tank-checked-escape-20261005-r431-1.validation/level5-tank-checked-escape-20261005-r431-1.x2events
• E:/xenon_runs/level5-tank-pulse-ownership-20261005-r432-1.validation/level5-tank-pulse-ownership-20261005-r432-1.x2events

R433 did not establish full acceptance. Subsequent tests exposed clipped terrain destruction and route-axis execution defects; see the results below.

October 5: Level 5 topology, route execution and combat audit

R434 destroys gate controller #147535 at f44962; by f45007 RAM contains zero in all four group-10 tile words, but the persistent map retains the clipped lower row. Controller retirement now requests actual RAM reconciliation and records the same tile-map import before the frame. The same unlink handler also culls intact controllers, so no tiles are opened merely because it died.

R436 still restarts a delayed crossing. R437's ordered retreat/lateral-row execution passes the gate but reveals a dormant-tank approach loop. R438's full test reaches that loop with only 4 damage. Fallback travel now targets a reachable forward area rather than projecting a blocked firing station into the same pocket. R439 completes the level without a reported terrain stall, but takes 35 damage and loses one life; this is not combat acceptance.

Tank pulse stations were also incorrectly hard refuges. R440 removes that constraint: focused damage falls from 34 to 20. R441 adds the existing checked multi-turn contact search: damage remains 20, though the fight is shorter. Do not credit the search alone with the following model improvement.

Full R442 completes Level 5: 18 damage, zero lives lost, no reported stalls. Hits are f40507 (4), f42465 (4), f47884 (2), f47885 (4), f48306 (4). Tank cash is 10/10; spaceship cash is 16/20. These are residual combat/reward failures despite successful route execution.

Captured missile updates expose two original-game model errors. $4FA1E aims in the pre-compensation camera origin; C previously used the post-compensation origin. Its direction-dependent 7x7 sprite headers at $4F9DE also differed from C's old constant boxes. R443 corrects camera phase; R444 adds the original headers. Both focused tank tests take 8 damage, no life loss/stalls, 10/10 cash, versus R441's 20. R444's remaining hit is f42740 (8), missile #149160. The public-C update audit checks 2446 updates with no motion/bounds mismatch. Future missile allocations nevertheless retain an unmodelled random age 0..31; the captured-object audit does not validate that anticipation.

R445 removes the late unchecked cash steering override. It defeats the ship, takes no new damage and collects 17/20. Probes then prove stale post-death terrain: the RAM stern is clear while C rejects collecting moves as wall contacts. Final-ship mutability had been disabled on controller disappearance. R446 reconciles its retirement from RAM and keeps the 39-row reward arena mutable. From the same checkpoint as R445, it defeats the ship, takes no damage and collects 20/20 cash, 1500. Cold reward restores and retirement with intact words have separate fixtures. Full R447 stops at f44364 in a left gate pocket; its unrelated shared geometry-cache defect is described below.

The detailed navigation contract is documented in AUTOPILOT_NAVIGATION_REVIEW_20261005.MD. Each run below has paired finalized AVIs, incident logs, source patch, build hashes, start/final RAM and 150-frame checkpoint configuration.

Full filenames follow the exact form E:/xenon_runs/<basename>.validation/<basename>.x2events; the matching videos use <basename>-original.avi and <basename>-sprite.avi in that folder.

October 5: confirmed solid-image cache invalidation defect

Recording: E:/xenon_runs/level5-full-repaired-topology-20261005-r447-1.validation/level5-full-repaired-topology-20261005-r447-1.x2events. The first broken connector appears around f41301; the persistent-stall stop is f44364, at world (49,3388). The barrier retires at f41189 and that frame does have a recorded tile-map import.

Complete-history C inspection reproduces 4586/4586 old live decisions through f44282. Its retained raster differs from a fresh raster of its own canonical map at pixel rows 3360..3391. Occupancy-only revisions failed to invalidate a solid tile whose sprite or source-row offset changed. RAM imports also ignored nonzero-to-different-nonzero tile replacements. These are shared map/cache bugs, not a reason to add another Level 5 waypoint override.

C now revises collision geometry for those changes; solid totals are separate. Three new fixtures cover observed sprite/offset changes, RAM replacements and the resulting cached raster/immutable snapshot behavior. The targeted suite has 74 passing tests. Both official native builds are rebuilt. After repair, the same R447 history has no cached/fresh raster differences at f41301.

R448 starts at R447's earlier f40861 checkpoint and records through the tank shop: 8 damage, no lives/stalls, 10/10 tank coins. Its current-DLL C replay matches 2287/2287 live statuses and controls. This is focused validation; full-level/campaign acceptance remains open. Recording: E:/xenon_runs/level5-image-revision-gates-20261005-r448-1.validation/level5-image-revision-gates-20261005-r448-1.x2events.

October 5: static gate traversal is not a hard refuge or moving station

Full R449 passes the repaired earlier gate, then loses a life in the diagonal entrance. At f42941 the raster is current and live replay matches. The gate exit at X156..164 has no complete connector from the left pocket, but its hard refuge flag rejects LEFT and DOWN escapes which first move away from that X. R450 removes that constraint; it takes no damage but still fails to progress. Removing a bad safety constraint alone did not repair the route.

The approach also discards a clear fixed connector on each gate-animation revision or timer expiry. Its new firing station moves upward with the camera, losing the lower crossing. On lateral legs, world-row retention was conditional on screen Y>152 even though camera compensation is needed above that band too.

Level 5 authored gate attacks/transits now retain the chosen static station while every remaining leg is clear and camera-reachable. This does not ignore topology changes: blocked legs and lost camera allowance reject it. It preserves the existing axis-order dogleg and compensates camera movement on a gate's lateral world row, independently of screen posture. The exit stays a transit goal; normal hazard checks own all avoidance. Other levels and moving-target retention policies are unchanged by this gate-specific repair.

R451 starts earlier at R449's f42145 checkpoint, passes the entrance, defeats the tank and collects 10/10 coins with zero damage/lost lives/stalls. The 49 Level 5 mission fixtures pass, including new image/timer retention and new-wall/lost-camera invalidation cases. Full R452 completes with 26 damage, zero lives/stalls, but misses all ten tank coins; it is not a clean pass.

• E:/xenon_runs/level5-full-image-revision-20261005-r449-1.validation/level5-full-image-revision-20261005-r449-1.x2events: failed full-level regression; first damage f42909, pinned repeat hits f42978..43084, life lost f43101.
• E:/xenon_runs/level5-gate-transit-recovery-20261005-r450-1.validation/level5-gate-transit-recovery-20261005-r450-1.x2events: zero damage but prolonged approach stall; rejected as a complete fix.
• E:/xenon_runs/level5-static-crossing-20261005-r451-1.validation/level5-static-crossing-20261005-r451-1.x2events: focused crossing/tank acceptance, zero damage and all tank rewards.
• E:/xenon_runs/level5-full-static-crossings-20261005-r452-1.validation/level5-full-static-crossings-20261005-r452-1.x2events: completion; tank homing hits f42816/42823/42845 (8 each), final-ship projectile f47588 (2), zero lives/stalls. Tank cash 0/10. All 19 observed final-ship drops collected; scalar credit must resolve the possible allocation-frame twentieth coin before claiming 20/20.

October 5: tank cash connector, ordered maze progress and carrier refuge

R452 correctly selects tank cash, but its direct path from X276 to the centre crosses the right wall lip. A C connector now owns the required retreat and crossing before handing off to falling-coin interception. R453 starts at R452's f42934 pre-death checkpoint and collects all 10 coins (750), with zero additional damage/lives/stalls. Full Level 5 reward regression is still open.

The new collision revision check compares generated alpha rows, so colour-only animation updates artwork without rebuilding identical geometry. Unknown or different masks still invalidate. The Level 3 R455 maze stall has current geometry: its field points to the final destination rather than the active bend, rewarding camera oscillation. C now prices the active bend. R456 passes the maze and reaches Level 4, but full R457 exposes a carrier life loss.

Carrier selection repeatedly demands the low-left station despite predicting a sweep through it. The local correction tests that refuge through its escape time and selects the established upper route early when needed. R458 defeats both cores, takes zero damage and collects all ten coins. R459 is a failed launch because the finalized direct-run Hatari instance still held the binary; it produced no gameplay evidence. R460 is the uninterrupted regression.

R463 demonstrates refresh restarting a 22-frame waiting prefix before its escape executes. R465 demonstrates greedy frontier pruning of early retreats despite contact forecast 34 frames ahead. Finite, rechecked CONTACT commitments and spatially diverse safe parents address those mechanisms without increasing the six-parent frontier or transition budget. R466 passes the focused wave; R467 prevents claiming full-level acceptance. Its carrier threat helper omitted the main body and emitters which inflicted the actual damage. The next local carrier test includes all live contact parts and a speed-derived retreat/climb interval. Player cannon modelling is still explicitly deferred.

The full filenames use the same basename convention above. Current sources have not completed the final three-campaign regression. Focused clean tests are reported separately from full failures.

October 5: shared admission and blocked-bend execution

Carrier admission now includes its body and emitters over the speed-derived retreat/climb interval. R468's focused clear takes no damage and collects all ten coins; later full R479 also passes the carrier. Pending wave preparation moves before mission selection, retaining full admission paths while candidate control stops at known allocation boundaries. Routed formation staging owns travel progress until arrival. Dormant expanding rows constrain station height; new evidence invalidates a retained bay, and its connector uses the actual camera domain rather than the goal's endpoint interval.

Each full recording path is E:/xenon_runs/<basename>.validation/<basename>.x2events, alongside both finalized AVIs, trace, source patch, binary identities and periodic checkpoints. R480's stalled f23200 decision has a 56-frame horizon and no pending spawns; cached/fresh terrain agrees. Right hits a wall immediately; the selected safe plan cycles vertically. This is frontier admission at an actuator-constrained bend, not missing map updates or a bad scripted worm prediction. The narrowed repair preserves detours only when waypoint arrival is insufficient to admit the onward terrain line. Further fixture checks expose a scoring/admission mismatch even though an earlier checkpoint now passes: price admissible departure anchors and the actual rounded cell, preserve both sides of that transition in parent grouping, and test short vertical taps at the blocked bend. Twelve closed-loop poses at two speeds pass using C mission advancement, C decision, C movement and retained state. All 89 native contract tests pass. Five other mission tests also fail on a separately compiled committed HEAD baseline; their expectations are preserved and they are not counted as passes. Full and cross-level acceptance remain open.

R488's fatal first escape abandons a completely checked retained route at f26025 when clearance drops to 3.1px, below the preferred 4px reserve. Search previously omitted that safe retained trial from fallback candidates. R490 keeps it eligible while looking for greater clearance, so actual contact ranks behind the retained safe escape. All four search tests (including three cases of the new contract) and eight planner tests pass; the old 300-scenario oracle also continues to pass. No worm-path or player-cannon change is made here. Full R491 rejects applying the policy globally. The explicit safe-fallback mode is now selected only for Level 3's final waves (scroll <= 208). Full R492 preserves the earlier prefix, clears those waves without damage, and reports no lives or stalls. Its earlier four-point projectile hit remains unresolved. Reward scalar reconciliation is still needed for the final allocation-tick coin.

Remaining acceptance work (current)

October 5: control ownership, retirement, rewards and actual mounts

The five earlier three-eye starts f8423/f8593/f8748/f8918/f9088 now clear without shield damage, lost lives or stalls. R502 owns worm-clearing movement with the collision-checked candidate; R503 verifies the other four starts. This does not certify POWERUP collection: the later cold f9088 R507 test misses it. Its current-orbit goal is separate from the accepted crossing.

R504 preserves one contact-bearing retirement observation for homing bodies. Their original collision check precedes unlinking, so immediately classifying the unlink frame as harmless hid the actual collision. The focused continuation from f11947 has zero damage/lives/stalls and collects Zapper and Side Shot. Native tests cover both the Level 2 enemy and Level 5 curved missile lifetime.

R505's optional cash detours are rejected (one of 18 Level 1 coins missed). R506 uses a reactive falling-cash station without optional orbit pursuit: 18/18 observed Level 1 boss coins, 1350/1350, zero damage/lives/stalls. R507 verifies the analogous three-eye reward: 10/10 boss coins, 750/750, zero damage/lives/stalls, but its POWERUP miss remains open.

Spider timer sign is insufficient phase evidence. ReVa $50DE6 restores the 288px camera floor on every update; a negative timer occurs during live return motion and during the subsequent rearmed wait. The latter disables shot bounds at X=1000 and needs player world Y<=176 to reactivate. R508's fixed world-Y station passes one checkpoint, but R509 exposes rearmed-wait stalls. R510 reactivates correctly, yet takes four projectile damage and misses all cash. R511's laser preference changes nothing in the live checkpoint: it has Double Shot and a Cannon, but no laser. Do not infer loadout from a synthetic fixture. R512 aims the installed auxiliary Cannon at the actual player-shot bounds X=152..167, before using the nominal split-primary center. Its f13094 test clears the boss, takes zero damage and collects 20/20 coins (1500/1500). The additional f13262/f13414/f13580/f13737 matrix also passes: zero damage, lives or stalls and 1500 cash in each test. All five starts defeat the spider with the captured loadout. This remains distinct from full Level 2 acceptance. Cannon projectile physics remains unchanged.

All recordings above use E:/xenon_runs/<basename>.validation/<basename>.x2events, with finalized original/sprite AVIs, C traces and periodic checkpoints.

Route numbering is not job identity

R492 f23470 has a completely checked directional-projectile escape. At f23471 a connector rebuild changes route_index from 2 to 1 without changing the gate target or destination. Mission identity nevertheless increments, invalidating the escape. The Level 3 gate retainer also rejects clear ordered doglegs using a stricter diagonal-only check, and reconnects on any map revision. This is a navigation contract defect, not inaccurate projectile velocity. New tests distinguish actual reached-bend advancement from incidental renumbering. Semantic identity and ordinary active-goal refresh are enabled: full R517 reaches Level 4 with one four-point hit at f23475, no lives/stalls and complete carrier/final-boss cash. The broader gate dogleg retainer remains disabled after R513/R514 regressions; its isolated repair and acceptance are still open.

POWERUP changes the worm cycle; one passing start is insufficient

R516 collects POWERUP but f8918 loses a life when stronger fire removes the outgoing left train and immediately schedules another. Captured script paths for the existing bodies remain accurate. Replacement envelopes in R519/R521 pass individual starts but fail the broader matrices and are removed.

R522 pauses fire only between clearing the incoming right leader and admitting the upper crossover. f8918/f9088 clear without damage; f8593 loses a life in the subsequent middle-eye descent (f10472..10494). R523 removes that phase's independent steering authority by using the checked candidate. No acceptance claim is made until its checkpoint matrix and uninterrupted level pass.

Cash audits now also publish scalar credits during each reward window. R519 has nine observed coins worth 700 plus an allocation-time credit of 50, for 750 total. R516 f9088 receives only 650, despite clearing without damage; its one missed 100 coin must not be reported as complete reward collection.

Three-eye transfer control contract

R499's first three worm contacts are not unexplained motion prediction errors. At f9750 the C forecast matches the observed incoming train through contact, and the evaluated candidate reports the future collision. A later input rewrite nevertheless restores RIGHT after checking only a short prefix. A safe eight-frame launch does not establish that the complete crossing can be finished safely. The transfer now requires a clear complete route and its checked candidate owns movement, including waits and turns. No worm script or cannon physics changed. R500 is a focused success, not broad acceptance.

The earlier-checkpoint matrix R501 already exposes another body contact at f9972 in the worm-clearing phase. Its trace again shows independent movement arbitration after evaluation. The transfer-only repair is therefore incomplete; the remaining encounter phases need the same control-contract review. Cash collection also remains a separate acceptance item. All matrix recordings have the basename level2-transfer-admission-matrix-20261005-r501-f<checkpoint>.

Reduce the remaining full Level 3 contact incidents without reviving stalls; validate the retained Level 4 fixes with the corrected shared navigation; repair Level 5's approach under full campaign loadouts. The earlier focused r385 shelf pass did not establish a clean full level: r389 lost a life on the entry passage and later stalled. Broad coasting and terrain-input overrides (r383/r387/r388) were rejected and removed. Complete boss cash coverage and the final repeated campaigns remain acceptance requirements.

October 5: current crossing, reward reset and full Level 2 acceptance

R526's f8423 start stalls because an already departed left survivor no longer occupies the launch predicate's screen rectangle. The complete route forecast is never consulted. R527 checks live outgoing-train ownership, no delayed members and the complete timed route instead; R528 tests the other four starts. All five clear with zero damage/lost lives/stalls. This does not hide cash failures: f8593 collects 650/750 and f8748 collects 700/750.

R529 fixes a separate semantic reset. The post-eye camera reposition invalidates retained movement, but must not discard the completed encounter's reward job. The reanchor drops all routes, retained decisions and recovery movement while preserving that verified job. Life loss, new level/run and ordinary camera jumps retain full-reset behavior. Five targeted session tests and 37 native navigation/decision/driver tests pass. Both previously missing-cash starts now collect 10/10 and 750/750, with no damage/lives/stalls.

R530 starts from the Level 2 entry save f7033 and reaches active Level 3 at f15610. It has zero shield damage, lost lives and reported stalls. POWERUP raises the primary at f9298; Side Shot replaces Rear Shot at f12576. Zapper is collected. Three-eye reward is 750/750; spider reward is 1500/1500 (19 captured active coins worth 1450, plus 50 credited during allocation). The first shop spends nothing; the second buys Laser for 4000 at f14879. Both AVIs finalize. This accepts the current Level 2 repairs for an uninterrupted entry/loadout as well as the earlier checkpoint matrix; final cross-level campaigns remain open.

R531 next tests only the Level 3 gate-retention contract: reuse the shared whole-route camera/terrain validator, including clear ordered doglegs, rather than reject a route on any mask revision or a blocked diagonal shortcut. Forty-one targeted tests pass. R531 passes all gates but takes 12 damage after the last gate: it is a failed combined acceptance result. R532 repairs the post-gate wait's real-hull/contact escape scope; the original contact disappears, but four damage remains from an animated radial bullet at f25056.

R533 adds that verified two-tick sprite sequence to generated C envelopes. Its focused continuation has zero damage/lives/stalls and 1500/1500 boss reward. R534's full Level 3 has one four-point hit at f24384, zero lives/stalls, and complete 750/1500 rewards. R535/R536 test a broader progressing-escape fallback; the focused run still takes four damage and the full run regresses to 16 at f23858/f23911/f24686. That change is removed. A current-scene safety claim is only as accurate as its geometry: the small wall bullet also changes collision header across tall/middle/short/middle animation. Its four-point incident is deferred rather than broadening route retention again.

The user accepts up to four shield lost per level (2026-10-05), with useful health collection compensating where feasible. R534 is accepted under that criterion; life loss, stalls, missed valuable equipment and boss cash remain failures. R537 continues from R534's final Level-4-entry save with the restored validated sources, rebuilding both Hatari and its matching diagnostic DLL.

The acceptance rule also permits larger shield losses if same-level health recovery actually restores them. A pickup's disappearance alone is not evidence of recovery. The audit now records positive shield deltas separately, excluding respawns and level resets, and retains initial/final shield for each level.

R537 completes Level 4 with no lives lost/stalls, complete boss cash (750/1500) and valuable equipment, but takes 12 damage at f29584/f36776/f36892. Health is collected before these hits: shield ends at 27 from 39, so this loss is not compensated. The last two hits involve the final eye's next projectile allocation, which was absent from the evaluated candidate scene. Level 4 $4FF3C aims at the player, maps that compass direction through $500C8/$500D0, and allocates on carry of its captured byte timer (+6). Birth offsets and alternating sprite headers also differ by direction. The captured dump agrees with the Level-4 ReVa program.

R538 reserves all four legal directions as independent hazards. It is rejected: 35 damage at f37061/f37062 and a life lost at f37079. That conservative fan diverts the ship into the actual tongue and projectile. R539 instead prepares one timed shot per live eye, chooses its mapped aim from each candidate's future ship position, and checks its extracted birth offsets/collision shape. The shared seed uses the head's exact clock-driven bob without expanding an eye trajectory. The four-direction path preparation is removed. Seventy-six targeted native tests pass. Focused R539 clears without shield loss/lives/stalls and collects 1500/1500. Full R540 has eight damage (f29584/f36821), no lives/stalls, and both complete rewards. Its final shop repairs all eight points (31 to 39 at f38572), meeting the user's recovery criterion. This is a paid repair, not a gameplay health pickup. R541 continues Level 5 from that full run's final save.

R541 completes Level 5 but fails acceptance: 41 damage, one life lost f45976, all tank cash (750), and final ship reward 1400/1500. Damage frames are f41185 (4), f41895/f41911 (8 each, homing bodies), f45441/f45955 (2 each), f45958/f45959 (8/7 swarm contact) and f47578 (2). No recovery occurs; the respawn reset to 39 is explicitly excluded. Both opening POWERUPs are collected. HEALTH POWER 2 disappears beside the ship while shield is already full. Homing Missile f41912 is intentionally excluded to preserve the installed Side Shot; the two missed Side Shots were already at maximum upgrade power.

The fatal swarm contact is before the final spaceship fight, below the right laser at authored tile (13,26). Native replay matches all 6624 recorded decisions through f45957. The f45920 C script forecast predicts swarm #148732 at (140,563) after 37 updates; that is its captured position at f45957. The path is not a linear-fit omission. Open-beam egress at f45920 selects a safe wait, but the closed-beam clearance goal then demands a diagonal climb from the pipe pocket. Repeated replacements abandon that wait; retreat ends beneath the approaching swarm and the emergency result has an immediate known contact.

R542 tests a local authored-gate approach: select the first terrain/camera-valid lower horizontal crossing row, complete it before climbing the gate column, and retain that connector across beam animation revisions. Native hazard checks still own avoidance; no input override or hard refuge is added. Earlier gates and other levels keep their policy. Thirty-eight focused native routing/decision tests pass. Focused R542 completes from R541's f45415 checkpoint with zero damage/lives/stalls and all 1500 final cash. Full R543 passes this gate without life loss, but exposes a separate final-ship firing-row stall.

R543/R544/R545 stall beside mounted cannon #151197 at world Y249, below its side-firing goal Y263..265. Keeping the goal inside the preferred flank and then fixing one world station do not resolve it. A preferred lane is a scoring term, not a hard movement restriction; claiming its mismatch was the cause without checking planner execution was premature. The canonical terrain raster agrees with a fresh raster. All 431 captured ship/input/camera transitions checked in R545 f49490..49920 match the model, including the boss's renewed backscroll.

The final-side planner retains a path only if it predicts mounted damage and its next input moves (or it is already at the firing row). Safe approaches which reach that row without predicted damage are discarded. Each replacement starts another delayed approach. R546 accepts a fully rechecked suffix if it either damages mounted parts or ends closer to the firing row. Stationary non-progressing suffixes remain ineligible. This is limited to the final spaceship side planner; ordinary navigation/other encounters keep their retention policy. Thirty-five targeted native decision/driver/route tests pass, including repeated decisions which retain a zero-damage approach. From the same f48647 start, R546 destroys the ship at f49455, collects all 20 coins (1500), and completes with zero shield damage, lost lives or reported stalls. R547 tests an earlier pre-gate start.

Recordings: level5-full-after-eye-aim-20261005-r541-1, level5-final-laser-alignment-20261005-r542-1, level5-full-laser-alignment-20261005-r543-1, level5-flank-lane-anchor-20261005-r544-1, level5-fixed-flank-station-20261005-r545-1, level5-flank-retained-approach-20261005-r546-1, level5-earlier-flank-approach-20261005-r547-1.

Filenames follow E:/xenon_runs/<basename>.validation/<basename>.x2events; paired finalized AVIs and source/binary manifests are retained beside them.

Level 5 recovery and missile retirement follow-up

R547 completes the earlier pre-gate restore without stalls/lives lost and collects all 1500 final reward cash, but takes eight damage immediately after that restore (f45431/f45433). It is not a zero-damage validation result.

R548 adds a Level-5 post-tank shop minimum: when shield is <=19, reserve the 500-cost HEALTH POWER 2 before optional Laser upgrades. The generated native recipe is rebuilt with generate_native_shop_data.py; Python gameplay policy is unchanged. Starting before the shop at shield 19, R548 repairs 20 at f42976 and finishes at 27 after 12 later damage (f44354/f44356/f48842/f48843). There are no lost lives/stalls and all 1500 final boss cash is collected. This is a paid repair before those later hits. Including the preceding section's 20 damage, the combined level still has a 12-point deficit; do not confuse a partial-run positive shield balance with full-level recovery.

R541's two eight-point tank hits f41895/f41911 are stored-box contacts after a curved missile has reached age 80. ReVa /level5dump confirms $4FA1E increments age, branches at lifetime word $4F04E (80), and installs $E54 without movement, $CD8 compensation or its normal $EC0 point-collision check. The player scans stored object boxes at $6778/$677C, before movement at $6882, so the retiring box can be hit on the next pre-unlink ship scan.

R549 incorrectly kept the retirement box as an actively updating hazard and checked the ship's new position against it one update too early. It diverges from R541 at f40162 by rejecting a retained route on rollout frame 80; its full run loses a life at f40419 and is rejected. Passing synthetic tests did not establish the original collision order.

R550 preserves the frozen box for the next ship scan, skips the nonexistent retirement post-movement contact and converts its camera origin correctly. The passive original-update validator now includes retirement: 4282 checked updates, including 20 expiry transitions, have zero motion/bounds mismatches. Sixty-seven targeted native/diagnostic tests pass. R550 still fails full-level acceptance: 41 damage, one lost life at f44168 and no shield recovery. The missile model correction does not by itself fix the separate train approach. The first current-DLL divergence from R541 is f40209.

Recordings: level5-tank-shop-recovery-20261005-r548-1, level5-full-missile-unlink-20261005-r549-1, and level5-full-missile-order-20261005-r550-1, under the filename convention above.

Level 5 train approach and completed recovery validation

R550's worst damage is in the train chamber. At f44100 the ordered route still connects through (132,1616) toward the authored station (240,1588), but at f44130 the ship is at screen Y17. The distant world-row goal continually demands an upward approach without leaving reaction room. R551 tries moving the complete station to a camera-relative row; that replacement point is behind terrain and causes another stall. R551 is rejected, and that station change is removed.

R552 retains the original authored destination, route and cursor. Only a clear active upward connector may be temporarily clipped to screen Y140..144. The physical graph must certify the actual ship-to-clipped-point segment; required detours and nonclear connectors retain their original order. The immediate proposal is recomputed for the clipped goal. This is local to the Level 5 train approach, not a global camera or corridor rule. Sixty focused train, candidate, decision, driver and route checks pass. From the same earlier train checkpoint, R552 takes zero damage in that chamber and finishes without lives lost/stalls, collecting all 1500 final cash. Ten damage later in the level remains separate.

The Level 5 post-tank shop rule is then changed from shield <=19 to shield <39: reserve the 500-cost HEALTH POWER 2 before optional Laser spending whenever any shield is missing. Other shop recipes retain their existing thresholds. Thirteen shop/report/pickup checks pass. Both Hatari and the diagnostic DLL are rebuilt through the official build script before full R553.

R553 completes the full level with 14 damage, 12 actually restored, final shield 37/39, three lives retained and no reported stalls. The restoration is a paid shop repair, not the early gameplay health drop or a respawn reset.

The already-maximal Side Shot drops remain uncollected; Homing Missile is intentionally excluded to preserve Side Shot. Ordinary cash collection remains 2850/5100 overall, including both complete boss rewards; do not describe this as collection of every cash drop in the level. The gameplay health drop near f40631 is collected while shield is full and restores nothing.

Current-DLL native replay matches all 9637/9637 decisions and live statuses with zero rejected frames. Both paired AVIs are finalized. The live Hatari SHA256 matches the current executable: 69ea24c875444d274daacf41c4e910c2248a5372533f646fd884543d3eee9197. This establishes the full-level recovery result. The subsequent three full-game repeats are recorded below; they fail an earlier Level 2 navigation job.

Recordings: level5-train-visible-stage-20261005-r551-1 (rejected), level5-train-connector-reaction-20261005-r552-1 (focused train proof), and level5-full-train-recovery-20261005-r553-1 (accepted full level), under the filename convention above. R553's paired AVIs use the same basename with -original.avi and -sprite.avi suffixes.

R554: full-game repeats expose shared wall-validation defects

All three R554 repeats start at assets/xenonplay.sav with the unchanged R553 executable, visible fast-forward, paired AVIs and 150-frame checkpoints. All three pass Level 1 without damage, then take four damage at f8373 in Level 2 and stop at the same persistent stall. They do not reach later levels. This is a repeatable prefix failure, not evidence that the accepted focused Level 5 repair has changed its own encounter behavior.

Recordings, all finalized:

• E:/xenon_runs/campaign-final-recovery-20261005-r554-1.validation/campaign-final-recovery-20261005-r554-1.x2events
• E:/xenon_runs/campaign-final-recovery-20261005-r554-2.validation/campaign-final-recovery-20261005-r554-2.x2events
• E:/xenon_runs/campaign-final-recovery-20261005-r554-3.validation/campaign-final-recovery-20261005-r554-3.x2events

The Cannon at f5001..5064 is also missed in every Level 1 prefix. It was collected in the earlier accepted Level 1 checkpoint validation. Do not assume that the loadout entering a later saved checkpoint matches a newly executed campaign.

At f9513 the Level 2 ship is near world (181,2965), below the three-eye arena. Its route requests retreat to (180,2980), then a left crossing toward the left approach station (36,2916). A wall stall is reported at f9662; the generic no-progress incident is f10365, referring back to f9466. All runs end with 35 shield, three lives, no shield recovery and this route still active.

The current-DLL f9520 replay matches all 9520 recorded statuses before that decision. Cached terrain pixels agree with a fresh raster of the canonical map. The decisive error is in the wall-motion admission rule, not a stale cache: the forecast labels its first five positions as wall_free=1, although direct anchor tests in that same C wall query return free=0 for each. The forecast positions are (181,2964), (181,2963), (181,2964), (181,2965), (181,2966). Only the sixth position (181,2967) is actually free. xap_wall_motion_is_free() allows these overlapping positions because its approximate escape distance does not increase. Original $387C contact causes history replay before the ship can execute the proposed six-frame escape. A geometrically closer point still inside terrain is not a successfully executed game step.

There is a second independently demonstrated shared geometry error. Native session preparation passes memory.collision_sprite to the environment; that is the current animated player sprite captured from its object. ReVa /xenon-level2/boss-live confirms $387C uses the separate fixed mask table at $3515C, independent of steering, while $3582/$35E8 build the live tile bitmap. At the saved pose, the cropped sprite $208EA differs from the original fixed footprint in all 25 rows. The original fixed footprint matches the one in assets/stram.bin, so it can be regenerated reproducibly. At that pose both footprints overlap the live RAM terrain; changing the footprint alone is not proof that the admitted multi-step escape will become executable.

Driver recovery subsequently accumulates wall_blocked_mask=0x0f, cancels movement during history replay and keeps the same mission connector. This explains the permanent loop. The repair needs the original fixed wall footprint, per-update collision admission consistent with original rollback, and route recovery which repairs the failed connector instead of retaining phantom progress. No further global policy change is implemented in this investigation; the three campaign failures remain unresolved.

The local web replay WASM module and TypeScript bundle are rebuilt via the official script from the R553 C sources. This is a local build, not deployment.

R561/R562: shared wall and execution repair completes all levels

The R554 diagnosis is implemented and validated using the original fixed wall mask, per-game-update occupied-endpoint rejection, one immutable map environment, rollback-triggered connector repair and corrected initial-eye travel ownership. Escape-distance ring searches are removed from wall-motion admission; search budgets are not increased. A broad all-eye-phase experiment R560 is rejected because a formation hold can retain stale route storage.

R561 starts at the beginning and reaches Level 3; R562 resumes that save and reaches final completion at f48915. Both have zero reported stalls and zero lives lost, with the same native executable and paired AVIs finalized. Every level finishes with 39 shield after recorded health/paid-shop restoration. This does not resolve the missed Level 1 Cannon, all spider cash, or two smaller boss reward misses. See NAVIGATION_FIX_VALIDATION_20261005.MD for full paths, all damage frames, cost, checks and reproduction commands.