Memory and Allocation Map

Memory and allocation map

Existing Inventory audio diagnostic extent (2026-10-08): snapshot-confirmed, no new allocation. Diagnostic file 1A occupies ROM [0x1816000,0x1819C00) / runtime [0x801AF820,0x801B3420). Failure helper [0x801B33BC,0x801B3408) and log [0x801B3408,0x801B3420) consume the remaining tail; floor stays 0x801B3420. Both supplied states retain cursor 0x8028C538, HUD 0x801FEBA0 and Fortress anchor 0x801FFDA8. This is endpoint lifetime/headroom, not peak safety or free instrumentation space. Upstream audio report.

PR #156 allocation audit (2026-10-08), candidate scope only. Supplied production v02 transports file 0x1A through [0x01816000,0x01819B9C) / [0x801AF820,0x801B33BC), below unchanged floor 0x801B3420. Its original rich runtime and 0x1200 HUD allocation remain unchanged. The decoded state has 74 coherent surviving arena links and current nominal margin 0x4458; this is not a historical peak guarantee. No new allocation is authorized by this finding. See resident resources and bounded conditional placement.

Powers-as-pickups OFF earned-XP persistence (2026-10-06): Runtime-confirmed bounded; no allocation change. The OFF persistence wrapper deliberately uses only the existing XP-owned Runtime-V2 interval [0x801AF620,0x801AF700) / physical [0x1AF620,0x1AF700) and existing MKSV persistent-XP word +0x44. It does not extend into optional runtime tail [0x801AF700,0x801AF7D0), so rainbow ownership remains intact. Lifecycle-v06 storage/allocation is unchanged.

In-Inventory box-switch production ownership (2026-10-06): the Runtime-confirmed v03 switch module owns RDRAM [0x801B2DF0,0x801B2F44) (physical [0x1B2DF0,0x1B2F44)) inside the existing 16 KiB expansion-pool reservation. Because the current shared file-0x1A source ends exactly at fixed Toasty audio ROM 0x00F6B5D0, production does not extend that source in place. It copies the exact final 0x35D0-byte file-0x1A prefix into generated-output transport capacity [0x01816000,0x01819C00), appends the 0x154-byte switch module, and repoints file entry 0x1A to the resulting 0x3724-byte raw payload. The unused 0x4DC bytes remain reserved capacity of that owner, not generic free space. Runtime proof v03 SHA-256 14feee5d6a0a79a20359781364eb6a9ef77ffffad3f2c0bee94760b9c2074f7e.

Inventory-HUD v20 ownership (2026-10-05): no new allocation range is introduced. Existing permanent span [0x800742B8,0x800743A8) remains owned by detail/shared/TEST LAB trampolines, lazy HUD-data helper, and backing-ID resolver. v20 changes only ROM 0x00074F08 / VA 0x80074308 from NOP to addiu a0,zero,0x1200. The lazy block remains 0x1200 bytes from the native arena (0x1208 cursor consumption including bookkeeping), pointer 0xA01B2DE0, source ROM 0x01814000. Runtime-confirmed bounded: the correction fixes the TEST LAB Inventory hang. 0x802ECE20 is the scheduler current-controller slot, not a permanent child-manager identity. Correct stage resource slot is 0x802E82B8 (lui 0x802F plus signed 0x82B8). See TEST LAB Inventory diagnosis.

2026-10-01 lifecycle production update: accepted v06 promotes the existing MKSV bytes 0x801AF7E4..0x801AF7EF (+0x14..+0x1F) for HP/reason/current-resource snapshots and production helper ownership [0x801B0A60,0x801B0FF4) / ROM [0xF69240,0xF697D4). The helper is exactly 0x594 bytes, leaving 0x0C bytes before Toasty at 0x801B1000; that residual is not separately declared free. 0x801AF81C (+0x4C) remains the GAME SETTINGS transient editor. Final reset preserves all five durable preference bits (0x3E00) at 0x800A60E8.

Scope: This page is the canonical owner for continuous literal-space ownership in the supported 16 MiB MKMSZ USA Rev. 0 ROM and its physical 4 MiB RDRAM. It records exact bounded intervals, aliases, lifecycle, ownership, evidence, production safety, and known conflicts.

It does not replace the patch-site registry for individual guarded edits, the function registry for function semantics, the ROM/overlay/resource map for loader/resource grammar, or the separate decomp-readiness view. Unknown space remains unknown.

The supported clean input is the 16 MiB big-endian USA Rev. 0 ROM, SHA-256 9c18254abf6722b95aa782fcd310bd95f6bcf147da66beb77ce32ca90673ffc6.

Missile proof ownership clarification: exact v75/v80–v85 use file-0x87 fixed projectile texture slot 0x24; helper 0x80060A3C allocates a separate dynamic texture slot in 0x200..0x2FF and constructs two independently listed actors. Palette acquisition returns a handle whose selector is handle minus 0x80; fixed selector zero does not own the resident player Sektor TLUT. Helper cleanup frees its dynamic texture and actors, with no traced palette release. These are native runtime resources, not new free ROM/RDRAM ranges. v85 suppresses insertion on normal straight flight and is statically rejected; it does not change the proof cave allocations or make them production-owned.

Coordinate conventions

All bounded intervals on this page are end-exclusive: [start, end_exclusive). Size is therefore end_exclusive - start.

ROM

• Canonical clean input ROM space is 0x00000000..0x01000000 (16 MiB). Approved PR #137 generated-output architecture may expand the patched image to 32 MiB; appended bytes are a separate generated-output ownership space and do not reclassify any stock input byte as free.
• A ROM offset is never silently treated as a runtime VA.
• File-relative, overlay-relative, decoded-resource, and proof-artifact offsets are different coordinate spaces and must be labeled as such.
• A ROM↔VA relationship is displayed only where that mapping is established for that specific global segment or object.

RDRAM and aliases

Canonical RDRAM records use physical addresses 0x000000..0x400000 (4 MiB).

For a physical address P in that range:

• cached KSEG0 alias = 0x80000000 + P;
• uncached KSEG1 alias = 0xA0000000 + P.

KSEG0 and KSEG1 are two views of the same physical bytes. They are not two allocations and must never be counted twice.

A stage-overlay VA is not globally unique ownership. Overlay records must include the loaded stage/source identity because the same VA can hold mutually exclusive stage content.

Classification legend

Class	Meaning
stock-known	Bounded stock code/data/resource ownership is established. It is protected unless deliberately patched.
stock-unknown	A bounded stock region is known to exist but ownership/meaning is not sufficiently decoded. Protected, not free.
production	Current MKMSZR browser/CLI composition owns the interval.
confirmed-free	Reference/lifecycle evidence establishes that the exact interval is reusable for the stated lifecycle.
candidate-free	Incomplete reference/lifecycle evidence suggests possible reuse. Not production-safe.
dynamic	Allocator/loader-owned runtime space; a fixed reusable interval is not implied.
proof-only	A disposable proof used the interval. This never establishes current production ownership or free space.
rejected/conflict	A tested or analyzed use conflicts with live stock data or current production ownership.
alias/view	A displayed coordinate alias only; never an independent allocation row.

No current interval is promoted to reusable confirmed-free status in this first map. Several places that were historically described as free tails/caves are now production-owned or were disproven. That is intentional.

The following are never sufficient evidence for confirmed-free:

• bytes read as 00;
• bytes read as FF;
• one proof ROM happened to work there;
• one stage overlay did not use the address;
• a proof file was able to extend into a ROM tail.

Canonical interval-record schema

Every future structured record must preserve these fields one-to-one.

Field	Required meaning
region_id	Stable identifier. Renaming requires an explicit migration.
space	rom, rdram-physical, overlay-rom, file-relative, or decoded-resource.
start	Inclusive start in the declared coordinate space.
end_exclusive	Exclusive end in the same space.
display_aliases	Proven alternate views such as KSEG0/KSEG1 or a specific ROM/VA mapping. Never a second allocation.
class	One classification from the legend above.
owner	Stock subsystem, MKMSZR feature/module, file, or proof artifact that owns the bytes.
scope	Global, frontend, gameplay, stage/overlay identity, proof ROM, generated output, etc.
lifecycle	When the ownership or availability statement is valid.
evidence	Project evidence label plus the bounded route/limit when relevant.
production_safe	yes, no, or conditional for the documented owner/use. yes never means free for another owner.
guard_or_reference	Expected-byte guard, file-table entry, allocator trace, source constant/test, or reference analysis.
conflicts_with	Other region_id values or named proof uses that cannot coexist.
canonical_source	This page for continuous interval ownership; supporting domain/code references go in guard_or_reference.
notes	Only caveats needed to interpret the record safely.

Lifecycle and scope rules

1. Production ownership is compositional. A range proven in isolation does not become production-safe until it composes with the current pipeline.
2. Availability is lifecycle-qualified. Frontend-only, stage-init, gameplay, transition, and stage-specific observations do not automatically transfer to one another.
3. Overlay identity is mandatory. A stage-overlay VA without stage/source identity is incomplete evidence.
4. Dynamic allocation is not a cave. A known arena base, allocator result, high-water mark, or allocation size does not imply that the surrounding address space is reusable.
5. Proof scope is artifact-specific. Two proof ROMs may intentionally use overlapping ROM offsets because they are mutually exclusive artifacts; neither becomes a production allocation.
6. Production-reserved tails remain owned. Unfilled capacity inside a production reservation is not confirmed-free.
7. Exact patch sites stay in the patch registry. This page records continuous ownership ranges; isolated hooks/words are linked rather than copied into a second patch-site database.

ROM ownership and allocation

The table below records only bounded intervals supported by current evidence. It is not a partition of the ROM.

production_safe=yes means the current documented owner is accepted in the current composition. It does not authorize reuse by another feature.

region_id	[start, end_exclusive)	Class	Owner	Scope	Lifecycle	Evidence	Production safe	Guard / reference	Conflicts / notes
rom.production.safe_selector_move_helper	[0x0000E27C, 0x0000E2B0)	production	Safe Stage Select movement-SFX helper	Global frontend code	Native selector frontend	Runtime-confirmed v03a; Static-confirmed clean unreachable compiler epilogue and no direct branch/jump/JAL targets into span; implementation guards exact clean bytes	yes	stage_selector.py; Patch-site registry	Plays only title MOVE descriptor 0x1FC for valid Up/Down edges. Does not own or imply a confirmation hook. Rejected v01/v02 confirmation experiments must not be composed into this owner.
rom.production.inventory_action_cave	[0x0008F6E8, 0x0008F750)	production	Four-box action routine	Global code	Gameplay	Runtime-confirmed behavior; Implementation/CI-confirmed bounds	yes	inventory_boxes.py; Patch-site registry	Historical Prison-key callback entered at 0x8F6EC; proof body is not a reusable allocation.
rom.production.inventory_helper_cave	[0x0009A6C8, 0x0009A758)	production	Four-box switch/mask helper composition	Global code	Gameplay / transition	Runtime-confirmed behavior; Implementation/CI-confirmed 0x90 reservation	yes	inventory_boxes.py; tests assert SELECTOR_CAVE_SIZE == 0x90	Toasty visual v06 used [0x9A720,0x9A754) and is rejected for that route; this tail is now production-owned.
rom.production.bootstrap_composite	[0x0009AD84, 0x0009AF20)	production	Native bootstrap + pickup persistence + relocated selector/flow data	Global code/data	Stage init / gameplay	Runtime-confirmed composition; Implementation/CI-confirmed capacity 0x19C	yes	native_payload.py, pickup_persistence.py, inventory_boxes.py, flow_bypass.py	Conflicts with rejected title wrapper at 0x9ADE0 and Sektor v62 proof record [0x9AD90,0x9ADA0). Final four bytes are reserved capacity, not free.
rom.production.shared_file_entry_1a	[0x000A5148, 0x000A5154)	production	Shared TURN/controls/Toasty expansion file-table entry 0x1A	Global file table	Stage init	TURN production composition Runtime-confirmed; CI guards/bounds	yes	game_settings_turn.py, toasty.py	TURN owns the mandatory prefix; controls occupy the low extension and optional Toasty the high extension. Frontend does not load this file.
rom.production.turn_shared_prefix	[0x00F68000, 0x00F68404)	production	TURN native control module / shared file-0x1A prefix	Global high ROM	Stage init / gameplay	Runtime-confirmed production composition; CI-confirmed 0x404-byte module	yes	game_settings_turn.py, tests/test_game_settings_turn.py	Mandatory prefix of shared file 0x1A. Padding through Toasty source offset remains reserved by the shared transport when Toasty is present.
rom.production.controls_extension	[0x00F68410, 0x00F69060)	production	Guarded modern Attack/Specials/Jump/Run helpers; loaded file-0x1A extension	Global high ROM	Stage init / gameplay	Runtime-confirmed in accepted v02 composition; builder parity confirmed	yes	controls_production.py	Helpers start at runtime 0x801AFC30 and end below 0x801B0880; ROM alignment gaps remain inside the shared file.
rom.production.rainbow_loader_wrapper	[0x00F69060, 0x00F690B8)	production	Optional compact-rainbow file-0x87 loader wrapper in shared file 0x1A	Global high ROM	Stage resource load	Runtime-confirmed by compact-tail all-stage proof; CI guards/bounds	conditional	rainbow_palette.py; Patch-site registry	Runtime mirror is [0x801B0880,0x801B08D8); wrapper extends file 0x1A only when needed and remains below the Temple special-check module.
rom.production.temple_special_check	[0x00F690C0, 0x00F69150)	production	Temple scripted-check re-entry + award helpers in shared file 0x1A	Global high ROM	Temple gameplay / re-entry	v02 Runtime-confirmed mechanism; branch integration guarded by CI	yes	temple_special_check.py, tests/test_temple_special_check.py	Runtime mirror [0x801B08E0,0x801B0970); deliberately starts after the optional rainbow wrapper and ends 0x690 bytes before Toasty.
rom.production.toasty_module	[0x00F697E0, 0x00F6A912)	production	Packed Toasty code/TLUT/tables/state/native RLE decoder + compressed CI4 source	Global high ROM	Stage init / gameplay	Compact proof v01 Runtime-confirmed; CI guards/bounds	conditional	toasty.py, toasty_codegen.py, tests/test_toasty.py	Runtime mirror starts at 0x801B1000. The following ROM gap before the fixed Toasty audio sample is not promoted to confirmed-free.
rom.production.progression_flash	[0x00F6A940, 0x00F6AAF0)	production	128-byte stock-eel white palette + nonblocking Power Upgrade flash helper + 4-byte active flag	Global high ROM / shared file 0x1A	Pickup progression feedback	v23 Runtime-confirmed architecture; production relocation guarded/tested	conditional on Powers as pickups	progression_presentation.py, tests/test_progression_presentation.py	Runtime mirror [0x801B2160,0x801B2310). Helper [0x801B21E0,0x801B230C); flag word 0x801B230C. Allocation size/end unchanged; no overlap with materializer/Toasty.
rom.production.global_materializer_helper	[0x00F6AAF0, 0x00F6B0D0)	production	Global destination-aware award / re-mask / Prison reconstruction helper in shared file 0x1A	Global high ROM / shared file 0x1A	Pickup award / stage-state composition	Wrapper semantics Runtime-confirmed bounded; relocated composition Implementation/CI-confirmed pending representative runtime	yes	global_materialization.py, tests/test_global_materialization.py	Runtime mirror [0x801B2310,0x801B28F0). Anchored immediately after progression flash and ends 0x500 bytes before fixed Toasty audio at 0xF6B5D0. Supersedes overlapping [0xF6B140,0xF6B6A0).
rom.production.inventory_hud_runtime	[0x00F6B0D0, 0x00F6B5D0)	production	Native randomizer Inventory HUD helpers/state in shared file 0x1A	Global high ROM / shared file 0x1A	Inventory render/open	v21 Runtime-confirmed proof architecture; production guards/tests	global output	inventory_hud.py, tests/test_inventory_hud.py	Runtime mirror [0x801B28F0,0x801B2DF0); fills the exact former materializer→Toasty gap and ends at fixed Toasty audio ROM start.
rom.production.inventory_hud_portraits	[0x01800000, 0x01808DC0)	generated-output	21 clean-ROM-derived 36×48 CI8 credential portrait payloads	32 MiB generated output	Inventory selected-item preview	v21 Runtime-confirmed proof architecture; build-time extraction/guards	global output	inventory_hud.py	No ROM-derived asset bytes are stored in source.
rom.production.inventory_hud_common_package	[0x01809000, 0x01814000) capacity	generated-output	Relocated common file 0x5D with one shared sprite 0x46C	32 MiB generated output	Inventory portrait carrier	package append/LZW round-trip guarded	global output	inventory_hud.py	Actual compressed end is build-derived and must remain below 0x01814000.
rom.production.inventory_hud_data	[0x01814000, 0x01815200)	generated-output	Labels, real titles, stage table, recolored font descriptors and status strings	32 MiB generated output	Inventory render	v21 Runtime-confirmed proof architecture; fixed-size guard	global output	inventory_hud.py	Lazily DMA-loaded into one exact 0x1200-byte arena allocation per stage lifecycle.
rom.production.inventory_menu_switch_transport	[0x01816000, 0x01819C00) capacity	generated-output	Relocated final shared file 0x1A plus in-Inventory switch and native legend modules	32 MiB generated output	Stage init / Inventory navigation/presentation	switch v03 + legend v01 Runtime-confirmed bounded; implementation guards exact prefix, FF capacity, file entry and emitted bounds	yes	inventory_menu_switch.py, inventory_legend.py, focused tests	Runtime prefix 0x35D0 + switch 0x154 + 0x0C alignment + legend 0x196; legend begins ROM 0x01819730 / K0 0x801B2F50. Remaining capacity stays owner-reserved, not free.
rom.production.temple_intro_audio_sample	[0x00F6BDF0, 0x00F6D810)	production	One seed-selected MKT Temple-intro encoded sample; maximum reserved size 0x1A20	Global high ROM	Temple intro	Runtime-confirmed bounded production composition in v06; static/CI guards cover reservation and overlap checks	conditional	temple_intro_audio.py	Enabled only with valid MKT Rev. 2 donor. Clean supported ROM is FF throughout the reservation and file-table overlap is guarded. v06 seed TEMPLE-PROD-CARRIER selected Friendship and played correctly; only the selected sample is written.
rom.stock.false_zero_cave	[0x000A1308, 0x000A1544)	stock-known	Stock action/dispatch record area	Global stock data	Gameplay/input dispatch	Static-confirmed; Runtime-confirmed failure/correction in Sektor v08	no	Core runtime; MKT compatibility	Required negative example: zero-filled semantic records were mistaken for a cave; overwriting them caused input-specific hangs.
rom.production.file_entry_1b	[0x000A5154, 0x000A5160)	production	Global file-table entry 0x1B	Global file table	Stage init	Runtime-confirmed load/execute; Implementation/CI-confirmed guard	yes	addresses.py, native_payload.py	Points to current payload source [0xF10000,0xF10300).
rom.production.file_entry_5e	[0x000A5478, 0x000A5484)	production	Global file-table entry 0x5E	Global file table	Frontend/title	Earlier title route Runtime-confirmed; new end-pointer update Static/implementation-confirmed, runtime Pending	yes	title_branding.py; ROM/overlay/resource map	Keeps stock start/flag; updates the end pointer to the in-place compressed package length.
rom.production.key_stage_table	[0x000A6BE4, 0x000A6C0C)	production	Four-box key-to-stage map	Global data	Gameplay / transition	Runtime-confirmed masking behavior; Implementation/CI-confirmed 40-byte table	yes	inventory_boxes.py	Reuses the obsolete stock default-inventory template after loader replacement.
rom.production.live_inventory_initializer	[0x000A6C0C, 0x000A6C34)	production	Ten-word live-inventory initializer	Global data	Run init / inventory	Runtime-confirmed four-box system; Implementation/CI-confirmed 40 bytes	yes	inventory_boxes.py	Runtime authoritative live window is mapped separately in RDRAM.
rom.production.four_box_data	[0x000A6C48, 0x000A6CF0)	production	Four backing boxes + state + MKBX magic	Global data	Run init / gameplay / transition	Runtime-confirmed boxes; Implementation/CI-confirmed 0xA8 bytes	yes	inventory_boxes.py; tests assert exact size	Gap [0xA6C34,0xA6C48) is deliberately unknown, not absorbed into this owner.
rom.stock.xp_cap_table	[0x000A6FFC, 0x000A7010)	stock-known	Signed XP-cap halfword table	Global data	Gameplay	Static-confirmed table; current main-stage edits Implementation/CI-confirmed	conditional	addresses.py, xp_progression.py	Current production changes only native stage IDs 0,1,2,3,4,5,8,9; the bounded stock table remains protected as a whole.
rom.production.boot_branding_text	[0x000AF998, 0x000AFA24)	production	MKMSZR legal/boot branding strings	Frontend	Boot/legal screen	Runtime-confirmed	yes	boot_branding.py exact bounds and guards	Adjacent to, but distinct from, HUD wrapper allocation.
rom.production.box_indicator	[0x000AFA24, 0x000AFA98)	production	Native BOX n OF 4 wrapper + text	Global code/data	Gameplay HUD	Runtime-confirmed	yes	box_indicator.py exact 0x74-byte region	Entire region is owned even where emitted bytes are zero padding.
rom.production.license_text	[0x000AFA98, 0x000AFABC)	production	MKMSZR license line	Frontend	Boot/legal screen	Runtime-confirmed	yes	boot_branding.py exact bounds and guard	Do not merge trailing bytes outside 0xAFABC without evidence.
rom.stock.stage_resource.bridge	[0x00296140, 0x0029A470)	stock-known	Bridge stage resource file	Stage 8 resource	Bridge load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	Resource ownership does not make unused-looking selector/data bytes free.
rom.stock.stage_resource.fire	[0x00388260, 0x0038A790)	stock-known	Fire stage resource file	Stage 5 resource	Fire load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	A separate disposable proof relocation exists below.
rom.stock.stage_resource.fortress	[0x003B9700, 0x003BCD20)	stock-known	Fortress stage resource file	Stage 9 resource	Fortress load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	No gap/capacity inference is made.
rom.stock.stage_resource.prison	[0x0041C680, 0x00420F70)	stock-known	Prison stage resource file	Stage 4 resource	Prison load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	Extension-selector proofs relocate/expand a copy; stock bytes remain protected.
rom.production.file_5e_title	[0x004E3060, 0x00512440)	production	In-place compressed title package, file 0x5E; trailing stock bytes retained	Frontend/title resource	Title load	New typeset image Static/implementation-confirmed; runtime Pending	yes	title_branding.py clean-package SHA-256 guard; ROM/overlay/resource map	Migrated from rom.stock.file_5e_title: generated SUB-ZERO end is 0x0051058E (size 0x2D52E); [0x0051058E,0x00512440) remains protected stock tail, not free.
rom.stock.stage_resource.temple	[0x00513710, 0x00523370)	stock-known	Temple stage resource file	Stage 0 resource	Temple load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	No gap/capacity inference is made.
rom.stock.stage_resource.water	[0x00611780, 0x00617C60)	stock-known	Water stage resource file	Stage 2 resource	Water load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	No gap/capacity inference is made.
rom.stock.stage_resource.wind	[0x00698680, 0x0069A820)	stock-known	Wind stage resource file	Stage 1 resource	Wind load/gameplay	Static-confirmed; runtime base matched	no	ROM/overlay/resource map	No gap/capacity inference is made.
rom.stock.stage_resource.earth_pickups	[0x00305A30, 0x0030AA00)	stock-known	Earth ordinary-pickup resource, global file 0x30	Stage 3 ordinary pickup visuals	Earth load/gameplay	Static-confirmed from file table and stage setup; cross-stage use Runtime-confirmed in TEST LAB v38	no	Stage catalog — Earth	Stage setup publishes its allocation through 0x802E82B8. Empty selectors are logical capacity only.
rom.stock.file_88_monk1	[0x006BAEC0, 0x006DD470)	stock-known	Earth MONK1 fighter resource, global file 0x88	Fighter type 0x00	Earth enemy construction/gameplay	Static-confirmed; prior live capture matched this file at 0x802434B8	no	Enemy randomization, Stage catalog — Earth	Supersedes the former mislabel as Earth ordinary-pickup resource. Do not use selectors from this file as pickup visuals.
rom.stock.file_87_subzero	[0x00748920, 0x0078E300)	stock-known	Stock Sub-Zero fighter resource, file 0x87	Global fighter resource	Gameplay	Static-confirmed; repeatedly used as donor-proof baseline	no	Sektor mapping	Optional outfit recolor edits a guarded palette subset inside this owned file; that does not make other bytes free.
rom.production.lifecycle_v06	[0x00F69240,0x00F697D4)	production	Runtime-confirmed lifecycle v06 helper blob in shared file 0x1A	Global lifecycle code	Pause Quit / death / reconstruction / stage completion / constructor / Game Over	Runtime-confirmed bounded v06; Implementation/CI-confirmed exact 0x594-byte blob	yes	run_lifecycle.py; Persistence/inventory/lifecycle	Runtime aliases KSEG0 [0x801B0A60,0x801B0FF4), KSEG1 [0xA01B0A60,0xA01B0FF4); starts exactly after materializer helper and ends 12 bytes before Toasty.
rom.production.payload_source	[0x00F10000,0x00F103B0)	production	MKMSZR Runtime V2 reloadable code payload	Generated ROM output	Stage init reload; runtime code	Runtime-confirmed through the rainbow full-composition proof; Implementation/CI-confirmed exactly 0x3B0 bytes	yes	native_payload.py, runtime_v2.py, xp_progression.py, rainbow_palette.py	File 0x1B points here. Source bytes being FF in the clean ROM are only a guard, not the reason this ownership is accepted.
rom.production.rainbow_bank	[0x00F20000,0x00F22000)	production	Optional 64-phase rainbow palette bank, raw file 0x92	Generated ROM output	Rainbow gameplay only	Runtime-confirmed in compact-tail all-stage proof v01	conditional	rainbow_palette.py; guarded zero file-0x92 entry, exact 0x2000 bank, and all 15 stock file-0x87 loader pairs	Stock file 0x87 remains at retail ROM and is not duplicated or repointed. This supersedes the former [0xF20000,0xF679E0) relocated-file owner.
rom.stock.title_former_high	[0x00F90000, 0x00FC1000)	stock-unknown	Former title relocation allocation; current title no longer writes it	Global high ROM	No current title lifecycle	Earlier title composition Runtime-confirmed; new in-place static integration	no	title_branding.py; historical rom.production.title_high	Retired title-owner interval; clean FF bytes and former reservation do not by themselves certify another owner or free space.
rom.production.global_stage_resources	[0x01000000,0x01800000)	production	PR #137 generated global-item destination resource backing	Generated 32 MiB output only; outside clean input	Stage resource load/gameplay	Runtime-confirmed bounded Temple >16 MiB relocation proof v01; full eight-stage global composition Runtime Pending	conditional	resource_materialization.py; eight 1 MiB slots for stages 0,1,2,3,4,5,8,9	User-approved architecture. Temple v01 confirms the loader accepts the appended address range; full eight-stage globally shuffled composition remains the next runtime gate. Clean input remains 16 MiB and untouched.
rom.generated.unassigned_tail	[0x01800000,0x02000000)	stock-unknown	Unassigned appended generated-output capacity	Generated 32 MiB output only	None	No owner/use established	no	PR #137 output-size policy	Padding capacity only; not automatically free for future features without an explicit owner/allocation decision.

Production bootstrap composite sublayout

rom.production.bootstrap_composite is one ownership interval but has multiple current sub-owners. These subranges are descriptive containment, not additional top-level allocations.

ROM subrange	Current content
[0x9AD84,0x9ADD8)	Native loader/call stub (0x54 bytes in current V2 composition)
[0x9ADD8,0x9ADE8)	Pickup-restore trampoline
[0x9ADE8,0x9AE18)	Shared file-0x1A stage-init loader in the production TURN composition
[0x9AE18,0x9AE28)	Pickup-capture trampoline; the check-v01 disposable composition retargets this owned stub through a capture/event dispatcher without writing outside the owner
[0x9AE28,0x9AE58)	TURN decision, release, and action trampolines (three 16-byte entries)
[0x9AE58,0x9AEC0)	Frontend GAME SETTINGS wrapper
[0x9AEC0,0x9AEE8)	Ten-entry stage descriptor table
[0x9AEE8,0x9AEFC)	Fire manager-ordinal translation table
[0x9AEFC,0x9AF1C)	Relocated compact selector mapper + selector-only save-bypass write
[0x9AF1C,0x9AF20)	Reserved tail inside the production 0x19C bootstrap capacity; not free

Proof-only ROM footprints

These rows describe specific disposable artifacts. They do not classify the same bytes as free in the clean ROM or in current production.

region_id	[start, end_exclusive)	Class	Owner/scope	Evidence	Production safe	Conflicts / limit
rom.proof.fire_resource_relocation	[0x00F00000,0x00F02BE8)	proof-only	Foreign Prison-key-in-Fire resource proof	Runtime-confirmed bounded proof	no	Architecture evidence only. The location is not a production allocation promise.
rom.proof.sektor_v62_file_87	[0x00F40000,0x00F8E3FC)	proof-only	Sektor v62 relocated fighter file 0x87	Runtime-confirmed bounded combo route	no	Does not overlap current title allocation, but larger historical Sektor proof footprints crossed into the later title-owned high-ROM area; proof-history bounds remain artifact-specific.
rom.proof.sektor_v70_file_87	[0x00F40000,0x00F8E790)	proof-only	Sektor v70 chest + straight-missile fighter file 0x87	Partially Runtime-confirmed missile presentation/flight route	no	File size 0x4E790 is 0x24C above the Runtime-confirmed v49 Fortress-working footprint. Fortress/Prison allocation safety was not revalidated; do not promote this as a new safe envelope.
rom.proof.sektor_v75_file_87	[0x00F40000,0x00F8E790)	proof-only	Sektor v75 relocated fighter file 0x87	Runtime-confirmed bounded missile-flight route; endpoint verified in exact v75 file entry	no	Same file size as v70; no Fortress/Prison allocation-safety promotion. Its projectile helper code uses proof ROM [0x9ADA0,0x9AF20) inside current production bootstrap ownership, so the proof cannot be combined with production as-is.
rom.proof.control_facing_v02_module	[0x00F72000,0x00F72268)	proof-only	616-byte direction-facing expansion module backing file 0x1A	Runtime-confirmed on the bounded v02 control route	no	Source lies in a clean-ROM FF gap but is proof-only ownership, not a reusable free-space declaration.
rom.proof.attack_modern_check_v01_low_extension	[0x00F68404,0x00F68600)	proof-only	ATTACK helper/dispatch code and aligned gaps after production TURN inside shared file 0x1A	User-reported Runtime-confirmed disposable full-composition check; builder guards/bounds statically checked	no	Loaded to cached [0x801AFC24,0x801AFE20); starts with TURN-owned prefix intact and ends before Toasty source 0x00F687E0 / runtime 0x801B0000. The low transport gap is owned, not generally free.
rom.proof.attack_modern_check_v01_owned_stubs	[0x000775D0,0x000775DC), [0x00077688,0x00077694), [0x0009AE18,0x0009AE28)	proof-only	Combo and Block stubs inside existing production GAME SETTINGS regions; retargeted capture stub inside production bootstrap composite	User-reported Runtime-confirmed disposable full-composition check	no	All three are guarded edits within existing owners for this artifact. In normal production the frontend tails remain padding and the capture stub still targets capture directly. The conflicting 0x9AEC0 proof trampoline is untouched.
rom.proof.toasty_v43_feature	[0x00F73000,0x00F73780)	proof-only	Toasty v43 compact feature file 0x12	Implementation/static-confirmed; runtime Pending	no	Loads 0x780 bytes into the production-reserved expansion pool. The proof also retains v42's separate ROM-backed CI8 source files and v03 disposable audio-host edits; this interval is artifact-specific, not a production allocation.

Known rejected/conflicting ROM uses

Use	Exact known footprint	Conflict / conclusion
Sektor v01-v07 “zero cave” helper	[0xA1308,0xA1544)	Rejected / failed. Overwrote live stock action/dispatch records. Restoring stock bytes in v08 removed the input-specific hangs.
Toasty visual v06 selector-cave tail	[0x9A720,0x9A754)	Rejected / failed on that route. The interval now also lies inside rom.production.inventory_helper_cave.
Sektor v62 standalone combo continuation	[0x9AD90,0x9ADA0)	Runtime-valid proof semantics, but allocation conflicts with rom.production.bootstrap_composite. Must be relocated before integration.
Toasty v43 reaction trampoline	small proof trampoline begins at 0x9ADD4 inside rom.production.bootstrap_composite	Proof-only/conflicting. The trigger semantics/hook are statically validated, but this trampoline location is already production-owned and must be reallocated/composed before product integration.

| Sektor v65-v70 missile helper code | known entry begins at 0x9ADA0 inside rom.production.bootstrap_composite; full historical extent is not promoted here | Proof-only/conflicting. Runtime results validate bounded chest/projectile semantics, not this allocation. Reallocate before any integration. | | Old title executable wrapper | starts at 0x9ADE0; full historical extent is not promoted here | Rejected / failed composition. Its entry lies inside rom.production.bootstrap_composite; current title implementation is data-only. | | Prison-key award callback proof | entry at 0x8F6EC; full proof body is not promoted here | Runtime-confirmed proof result, but its entry lies inside rom.production.inventory_action_cave; not reusable without reallocation/revalidation. |

The intentionally incomplete extents above remain incomplete. A conflict can be established from a known entry point inside a current owner without inventing the rest of an old proof allocation.

16 KiB audio-risk review (2026-10-09): a new literal audit of the supplied supported clean ROM and exact populated-Fortress/trace v01 diagnostic ROM confirms that the existing file-0x1A raw payload occupies RDRAM [0x801AF820,0x801B3420) and ends exactly at the patched arena floor; the expected two stock floor constructors are replaced/absorbed by the guarded arena/bootstrap path. The full named suballocation layout (including draft PR #156 and its 0x64-byte debug tail) has no inter-owner fixed-range overlap. This is not proof of no wild writes, no missed computed references or peak dynamic arena safety. Earlier all-stage 16 KiB profiler measured high-water cursor 0x802893E8 (margin 0x75A8); later accelerated Fortress snapshot cursor 0x8028C538 (margin 0x4458) against upper bound 0x80290990. Different conditions/compositions prevent interpreting that difference as a defect or additive pressure from one named module. The unchecked native allocator and separately verified stale-HUD pointer lifetime gap remain distinct unresolved risks. Existing runtime ranges previously documented only as ROM mirrors have now been added explicitly to the RDRAM table; draft/proof slices remain non-production.

RDRAM ownership and allocation

The canonical coordinate in this table is the physical interval. display_aliases lists KSEG0/KSEG1 views of those same bytes.

region_id	Physical [start, end_exclusive)	display_aliases	Class	Owner	Scope	Lifecycle	Evidence	Production safe	Guard / reference	Conflicts / notes
rdram.production.inventory_action_cave	[0x08EAE8,0x08EB50)	KSEG0 [0x8008EAE8,0x8008EB50); KSEG1 [0xA008EAE8,0xA008EB50)	production	Four-box action routine	Global code	Gameplay	Runtime-confirmed behavior; CI-confirmed bounds	yes	inventory_boxes.py	Same physical bytes as the displayed aliases; count once.
rdram.production.inventory_helper_cave	[0x099AC8,0x099B58)	KSEG0 [0x80099AC8,0x80099B58); KSEG1 [0xA0099AC8,0xA0099B58)	production	Four-box helper composition	Global code	Gameplay / transition	Runtime-confirmed behavior; CI-confirmed bounds	yes	inventory_boxes.py	Historical proof tail use is not reusable.
rdram.production.bootstrap_composite	[0x09A184,0x09A320)	KSEG0 [0x8009A184,0x8009A320); KSEG1 [0xA009A184,0xA009A320)	production	Bootstrap/persistence/selector composite	Global code/data	Stage init / gameplay	Runtime-confirmed composition; CI-confirmed 0x19C capacity	yes	native_payload.py, pickup_persistence.py, inventory_boxes.py	Mirrors the current global-code ROM owner rom.production.bootstrap_composite; this is not a ROM=VA assumption but an established segment mapping.
rdram.stock.false_zero_cave	[0x0A0708,0x0A0944)	KSEG0 [0x800A0708,0x800A0944); KSEG1 [0xA00A0708,0xA00A0944)	stock-known	Stock action/dispatch data	Global data	Gameplay/input dispatch	Static-confirmed; Runtime-confirmed negative control	no	MKT compatibility	Zero-filled records are semantic live data, not padding.
rdram.production.file_entry_1b	[0x0A4554,0x0A4560)	KSEG0 [0x800A4554,0x800A4560); KSEG1 [0xA00A4554,0xA00A4560)	production	Runtime global file-table entry 0x1B	Global data	Stage init	Runtime-confirmed loader path	yes	Global table base 0x800A4410, 12-byte entries	Alias of one physical table entry, not a separate allocation.
rdram.production.file_entry_5e	[0x0A4878,0x0A4884)	KSEG0 [0x800A4878,0x800A4884); KSEG1 [0xA00A4878,0xA00A4884)	production	Runtime global file-table entry 0x5E	Global data	Frontend/title load	Runtime-confirmed title route	yes	Global table base 0x800A4410, 12-byte entries	Runtime table reflects the patched file descriptor.
rdram.production.key_stage_table	[0x0A5FE4,0x0A600C)	KSEG0 [0x800A5FE4,0x800A600C); KSEG1 [0xA00A5FE4,0xA00A600C)	production	Key-to-stage map	Global data	Gameplay / transition	Runtime-confirmed masking; CI-confirmed 40 bytes	yes	inventory_boxes.py	Directly precedes live inventory but is a separate owner.
rdram.production.live_inventory	[0x0A600C,0x0A6034)	KSEG0 [0x800A600C,0x800A6034); KSEG1 [0xA00A600C,0xA00A6034)	production	Native ten-slot live inventory window	Global mutable data	Gameplay / inventory	Runtime-confirmed	yes	inventory_boxes.py; Persistence/inventory	Live window is not authoritative across box switching; backing boxes are.
rdram.production.four_boxes	[0x0A6048,0x0A60E8)	KSEG0 [0x800A6048,0x800A60E8); KSEG1 [0xA00A6048,0xA00A60E8)	production	Four authoritative ten-word backing boxes	Global mutable data	Run gameplay / transitions	Runtime-confirmed	yes	inventory_boxes.py	Gap [0x0A6034,0x0A6048) remains unknown.
rdram.production.box_state	[0x0A60E8,0x0A60EC)	KSEG0 0x800A60E8; KSEG1 0xA00A60E8	production	Active-box index/latch + durable TURN preference	Global mutable data	Frontend / gameplay / transition	Runtime-confirmed production composition	yes	inventory_boxes.py, game_settings_turn.py	Bits 0..1 active index; 0x100 switch latch; 0x0200 means TURN=LOCK. Box switching preserves the setting bit.
rdram.production.box_magic	[0x0A60EC,0x0A60F0)	KSEG0 0x800A60EC; KSEG1 0xA00A60EC	production	MKBX magic	Global mutable data	Run initialization / reconstruction	Implementation/CI-confirmed; exercised by runtime system	yes	inventory_boxes.py	Magic 0x4D4B4258.
rdram.stock.xp_cap_table	[0x0A63FC,0x0A6410)	KSEG0 [0x800A63FC,0x800A6410); KSEG1 [0xA00A63FC,0xA00A6410)	stock-known	Signed XP-cap table with production main-stage edits	Global data	Gameplay	Static-confirmed; production writes Implementation/CI-confirmed	conditional	addresses.py, xp_progression.py	Only selected halfwords are production-edited.
rdram.production.boot_branding_text	[0x0AED98,0x0AEE24)	KSEG0 [0x800AED98,0x800AEE24); KSEG1 [0xA00AED98,0xA00AEE24)	production	MKMSZR legal/boot strings	Global data	Boot/legal screen	Runtime-confirmed	yes	boot_branding.py pointer targets	Established global-segment mapping; count physical bytes once.
rdram.production.box_indicator	[0x0AEE24,0x0AEE98)	KSEG0 [0x800AEE24,0x800AEE98); KSEG1 [0xA00AEE24,0xA00AEE98)	production	Native box HUD wrapper/text	Global code/data	Gameplay HUD	Runtime-confirmed	yes	box_indicator.py	Exact region mirrors ROM owner.
rdram.production.license_text	[0x0AEE98,0x0AEEBC)	KSEG0 [0x800AEE98,0x800AEEBC); KSEG1 [0xA00AEE98,0xA00AEEBC)	production	MKMSZR license string	Global data	Boot/legal screen	Runtime-confirmed	yes	boot_branding.py	Exact bounded string storage.
rdram.stock.current_xp	[0x11200C,0x112010)	KSEG0 0x8011200C; KSEG1 0xA011200C	stock-known	Native current-XP word used by production progression	Global mutable data	Gameplay / stage transition	Static-confirmed and Runtime-confirmed on progression routes	conditional	addresses.py; XP/progression	Production owns behavior around the stock variable, not surrounding words.
rdram.production.runtime_core	[0x1AF420,0x1AF5F4)	KSEG0 [0x801AF420,0x801AF5F4); KSEG1 [0xA01AF420,0xA01AF5F4)	production	Runtime V2 init + pickup-persistence code through actual +0x1D4 core end	Reserved MKMSZR block	Reloaded at stage init; executes during init/gameplay hooks	Runtime-confirmed; exact emitted size CI-confirmed	yes	runtime_v2.py, pickup_persistence.py; actual persistence core size 0x1D4	Subrange of the 1 KiB reservation.
rdram.production.inventory_payload	[0x1AF5F4,0x1AF620)	KSEG0 [0x801AF5F4,0x801AF620); KSEG1 [0xA01AF5F4,0xA01AF620)	production	Four-box filtered-save helper	Reserved MKMSZR block	Gameplay / transition	Runtime-confirmed composition; CI-confirmed bounds	yes	inventory_boxes.py payload +0x1D4..+0x200	Reuses the production payload tail intentionally.
rdram.production.xp_payload	[0x1AF620,0x1AF700)	KSEG0 [0x801AF620,0x801AF700); KSEG1 [0xA01AF620,0xA01AF700)	production	XP progression callback, threshold table, restore helper, and bounded padding	Reserved MKMSZR block	Pickup / stage transition	Runtime-confirmed Diagnostic B behavior; CI-confirmed meaningful content stays below +0x2E0	yes	xp_progression.py	The formerly zero [+0x2E0,+0x300) tail is intentionally released to the optional runtime-feature region below.
rdram.production.optional_runtime_tail	[0x1AF700,0x1AF7D0)	KSEG0 [0x801AF700,0x801AF7D0); KSEG1 [0xA01AF700,0xA01AF7D0)	production	Optional Runtime V2 feature code tail	Reserved MKMSZR block	Gameplay	Runtime-confirmed by compact rainbow v01; CI-confirmed bounds	yes	runtime_v2.py, rainbow_palette.py	Rainbow owns the full 0xD0-byte tail in rainbow builds; the compact helper adds the proof-validated defensive phase mask. In non-rainbow builds the interval remains reserved/zero.
rdram.production.state_header	[0x1AF7D0,0x1AF7F0)	KSEG0 [0x801AF7D0,0x801AF7F0); KSEG1 [0xA01AF7D0,0xA01AF7F0)	production	MKSV V2 state header; flags bit 0x0001 owns Temple scripted-check collection	Persistent MKMSZR state	Survives payload reload / normal stage lifecycle	Header Runtime-confirmed through production compositions; Temple flag Runtime-confirmed in v02	yes	runtime_v2.py, temple_special_check.py	Header validates magic/version/size/header-size; total state size is 0x50. Temple special state is intentionally outside the ordinary pickup words.
rdram.production.pickup_state	[0x1AF7F0,0x1AF810)	KSEG0 [0x801AF7F0,0x801AF810); KSEG1 [0xA01AF7F0,0xA01AF810)	production	Eight stage ordinary-pickup bitset words	Persistent MKMSZR state	Run lifecycle until reset boundary	Runtime-confirmed representative persistence in all eight stages and in the rainbow full composition	yes	pickup_persistence.py descriptors use state offsets +0x20..+0x3C	Scripted/special mechanisms are outside these bitsets.
rdram.production.xp_state	[0x1AF810,0x1AF818)	KSEG0 [0x801AF810,0x801AF818); KSEG1 [0xA01AF810,0xA01AF818)	production	Progression acquired-count + persistent-XP words	Persistent MKMSZR state	Run lifecycle / stage transition	Runtime-confirmed on bounded Diagnostic B routes and rainbow full composition	yes	xp_progression.py state +0x40/+0x44	Full nine-tier run remains a validation limit, not an allocation ambiguity.
rdram.production.rainbow_phase	[0x1AF818,0x1AF81C)	KSEG0 0x801AF818; KSEG1 0xA01AF818	production	Optional rainbow phase word	Persistent MKMSZR state	Rainbow gameplay	Runtime-confirmed in full-composition v01	conditional	rainbow_palette.py state offset +0x48	Used only in rainbow mode; initialized by the common V2 state initializer.
rdram.production.state_reserved_tail	[0x1AF81C,0x1AF820)	KSEG0 [0x801AF81C,0x801AF820); KSEG1 [0xA01AF81C,0xA01AF820)	production	Runtime V2 reserved final word; transient TURN editor halfword use	Reserved MKMSZR state	Frontend editor / run lifecycle	Runtime-confirmed production composition for transient editor use; CI-confirmed reservation boundary	yes	runtime_v2.py, game_settings_turn.py	GAME SETTINGS uses KSEG1 0xA01AF81C transiently while open. Durable TURN ownership is 0x800A60E8 bit 0x0200. Not free.
rdram.production.expansion_pool	[0x1AF820,0x1B3420)	KSEG0 [0x801AF820,0x801B3420); KSEG1 [0xA01AF820,0xA01B3420)	production	MKMSZR native expansion pool parent reservation	Reserved MKMSZR block	Global reservation; feature slices are build-time assigned	16 KiB arena-floor proof Runtime-confirmed across all eight safe stage loads; allocator/bounds Implementation/CI-confirmed	yes	addresses.py, allocations.py, tests/test_expansion_allocations.py	Parent owner remains reserved. TURN and modern controls own low named suballocations; Toasty conditionally owns the high named suballocation.
rdram.production.turn_module	[0x1AF820,0x1AFC24)	KSEG0 [0x801AF820,0x801AFC24); KSEG1 [0xA01AF820,0xA01AFC24)	production	TURN v10/v06 native control module	Expansion-pool suballocation	Stage init / gameplay	Runtime-confirmed production composition; CI-confirmed 0x404-byte allocation	yes	game_settings_turn.py, tests/test_game_settings_turn.py	Loaded only at stage init through shared file 0x1A; never loaded from frontend.
rdram.production.controls_extension	[0x1AFC30,0x1B0880)	KSEG0 [0x801AFC30,0x801B0880); KSEG1 [0xA01AFC30,0xA01B0880)	production	Modern controls helpers/state	Expansion-pool suballocation	Stage init / gameplay	Accepted v02 Runtime-confirmed; shared-builder byte parity	yes	controls_production.py	Ends 0x780 bytes before optional CI4 Toasty at 0x801B1000.
rdram.production.rainbow_loader_wrapper	[0x1B0880,0x1B08D8)	KSEG0 [0x801B0880,0x801B08D8); KSEG1 [0xA01B0880,0xA01B08D8)	production	Optional compact-rainbow file-0x87 loader wrapper	Expansion-pool suballocation	Stage resource load	Runtime-confirmed by compact-tail all-stage proof; CI guards/bounds	conditional	rainbow_palette.py	Uses only the start of the established controls→Toasty gap.
rdram.production.temple_special_check	[0x1B08E0,0x1B0970)	KSEG0 [0x801B08E0,0x801B0970); KSEG1 [0xA01B08E0,0xA01B0970)	production	Temple scripted-check check/award helpers	Expansion-pool suballocation	Temple gameplay / title-stage re-entry	v02 Runtime-confirmed mechanism; CI guards/bounds	yes	temple_special_check.py	0x90 bytes. Leaves the remainder of the gap untouched; Toasty remains fixed at 0x801B1000.
rdram.production.run_lifecycle	[0x1B0A60,0x1B0FF4)	KSEG0 [0x801B0A60,0x801B0FF4); KSEG1 [0xA01B0A60,0xA01B0FF4)	production	Lifecycle v06 teardown/re-entry/HP helper (size 0x594)	Expansion-pool suballocation	Pause / death / Continue / stage re-entry	Runtime-confirmed bounded lifecycle v06; exact ROM bytes + guards	yes	run_lifecycle.py; Lifecycle static closure	Mirrors ROM [0xF69240,0xF697D4); ends 0x0C below Toasty start. This was an existing ROM owner omitted from the RDRAM interval table, not a new allocation.
rdram.production.toasty_module	[0x1B1000,0x1B2132)	KSEG0 [0x801B1000,0x801B2132); KSEG1 [0xA01B1000,0xA01B2132)	production	Toasty packed native module	Reserved MKMSZR expansion pool	Compact proof v01 Runtime-confirmed; CI guards/bounds	conditional	toasty_codegen.py, tests/test_toasty.py	Size 0x1132 = 4,402 B. Leaves 0x12EE bytes before 0x1B3420; reclaimed bytes remain inside the reserved MKMSZR pool and are not globally confirmed-free.
rdram.production.progression_flash	[0x1B2160,0x1B2310)	KSEG0 [0x801B2160,0x801B2310); KSEG1 [0xA01B2160,0xA01B2310)	production	Power Upgrade white-pulse palette/helper	Expansion-pool suballocation	Pickup progression feedback	TEST LAB v02 Runtime-confirmed; CI guards/bounds	conditional on Powers as pickups	progression_presentation.py	Exactly 0x1B0 bytes; starts after compact Toasty and ends 0x1110 bytes before arena floor 0x801B3420.
rdram.production.global_materializer	[0x1B2310,0x1B28F0)	KSEG0 [0x801B2310,0x801B28F0); KSEG1 [0xA01B2310,0xA01B28F0)	production	Destination-safe global pickup award, re-mask and reconstruction (size 0x5E0)	Expansion-pool suballocation	Pickup / stage resources	Runtime-confirmed bounded wrapper; composition implementation/CI-confirmed	yes	global_materialization.py; Global items	Mirrors ROM [0xF6AAF0,0xF6B0D0); earlier overlapping high-tail placement was rejected. Existing ROM owner now mirrored in this RDRAM table.
rdram.production.rich_inventory_hud_runtime	[0x1B28F0,0x1B2DF0)	KSEG0 [0x801B28F0,0x801B2DF0); KSEG1 [0xA01B28F0,0xA01B2DF0)	production	Native rich Inventory runtime helpers, dispatch and pointer/cache state (size 0x500)	Expansion-pool suballocation	Inventory open/render/preview	v21 Runtime-confirmed bounded core; guarded implementation	yes	inventory_hud.py; Native HUD	Mirrors ROM [0xF6B0D0,0xF6B5D0). Separate lazy 0x1200-byte dynamic arena block is not within this fixed interval.
rdram.production.inventory_menu_switch	[0x1B2DF0,0x1B2F44)	KSEG0 [0x801B2DF0,0x801B2F44); KSEG1 [0xA01B2DF0,0xA01B2F44)	production	Items-mode in-Inventory four-box switch helper	Expansion-pool suballocation	Inventory open / Items mode	v03 Runtime-confirmed bounded in full production composition; module-byte parity and bounds tests	yes	inventory_menu_switch.py, tests/test_inventory_menu_switch.py	Exact module size 0x154; begins immediately after Inventory HUD runtime end 0x801B2DF0. Parent pool remains reserved through 0x801B3420.
rdram.production.inventory_legend	[0x1B2F50,0x1B30E6)	KSEG0 [0x801B2F50,0x801B30E6); KSEG1 [0xA01B2F50,0xA01B30E6)	production	Native Inventory legend and four-box label module (0x196 bytes)	Expansion-pool suballocation	Inventory presentation	Focused legend v01 Runtime-confirmed bounded	yes	inventory_legend.py; Native HUD	Relocated shared file 0x1A transport, ROM source beginning 0x01819730. The 0x0C-byte gap before this entry remains owner-reserved.
rdram.proof.toasty_v43_feature	[0x1AF820,0x1AFFA0)	KSEG0 [0x801AF820,0x801AFFA0); KSEG1 [0xA01AF820,0xA01AFFA0)	proof-only	Toasty v43 loaded feature slice	Gameplay HUD / reaction trigger	Stage init -> gameplay	v42 presentation sublayout Runtime-confirmed; added 176-byte reaction wrapper Implementation/static-confirmed; v43 runtime Pending	no	Toasty visual research	Artifact-specific suballocation of the production-reserved pool: v42-owned content remains through 0x1AFEEF; v43 wrapper is [0x1AFEF0,0x1AFFA0). Does not convert this slice into a production feature allocation.
rdram.proof.inventory_rich_materialized_v01	[0x1B30F0,0x1B33BC)	KSEG0 [0x801B30F0,0x801B33BC); KSEG1 [0xA01B30F0,0xA01B33BC)	proof-only / draft PR #156	Preload, empty-Powers recovery and materialized strings/status (total 0x2CC bytes)	Candidate composed build, not main	Fortress / Inventory	Accepted bounded standalone visual/interactions proof; accelerated audio on later production composition	no (pending audio gate)	inventory_materialized.py on draft #156; upstream investigation	Runtime source ROM [0x018198D0,0x01819B9C); leaves final 0x64 bytes in the reserved pool; do not treat as current-main production owner.
rdram.proof.inventory_audio_trace_v01	[0x1B33BC,0x1B3420)	KSEG0 [0x801B33BC,0x801B3420); KSEG1 [0xA01B33BC,0xA01B3420)	proof-only	Trace v01 rejected-enqueue helper/log (size 0x64)	Diagnostic ROM only	Audio proof sessions	Exact diagnostic SHA/ROM boundaries Static-confirmed, rejection Runtime-confirmed	no	upstream investigation	Deliberately follows PR #156 materialized tail to arena floor, and belongs only to the instrumented ROM, not standard production.

| rdram.stock.pickup_context_pointer | [0x2ECE20,0x2ECE24) | KSEG0 0x802ECE20; KSEG1 0xA02ECE20 | stock-known | Current running process/controller pointer slot (pickup context only while its manager runs) | Stage runtime | Process scheduler/gameplay | Static-confirmed; runtime use confirmed by persistence | conditional | addresses.py, pickup_persistence.py | Corrects superseded 0x802FCE20; surrounding overlay/runtime space is not inferred from this word. |

Display slices within the modern-controls extension

These four contiguous slices partition the existing rdram.production.controls_extension owner for the Atlas RDRAM capacity view. Their boundaries follow the emission order in controls_production.py; they are views, not additional or independent allocations. Alignment bytes within each slice remain reserved by the parent. The parent ROM owner rom.production.controls_extension and its bounds also remain unchanged.

View	Physical RDRAM half-open interval	KSEG0 half-open interval	ROM half-open interval	Size	Contents at the boundaries
ATTACK	[0x1AFC30,0x1AFE90)	[0x801AFC30,0x801AFE90)	[0x00F68410,0x00F68670)	608 B	Event, attack wrapper, combo, steady-block helpers; the event helper is shared.
SPECIALS	[0x1AFE90,0x1B0310)	[0x801AFE90,0x801B0310)	[0x00F68670,0x00F68AF0)	1,152 B	Specials helper and following alignment.
JUMP	[0x1B0310,0x1B0690)	[0x801B0310,0x801B0690)	[0x00F68AF0,0x00F68E70)	896 B	Standing and moving Jump, block-start and ledge helpers; block-start also serves Attack.
RUN	[0x1B0690,0x1B0880)	[0x801B0690,0x801B0880)	[0x00F68E70,0x00F69060)	496 B	Run decision/capture/loop, Run state and dispatcher, then shared capture/event dispatch.

The sizes sum to 0xC50 = 3,152 bytes, exactly the combined controls owner. The labels indicate where the builder emits code, not exclusive feature ownership: in particular, the shared event helper appears in ATTACK's view and shared capture/event dispatch in RUN's view. TURN remains its separate rdram.production.turn_module allocation.

The 16 KiB reservation and arena boundary

The production reservation is exactly physical [0x1AF420,0x1B3420), KSEG0 [0x801AF420,0x801B3420), KSEG1 [0xA01AF420,0xA01B3420). The established first 1 KiB [0x1AF420,0x1AF820) remains fully accounted for by the Runtime V2 code/state sub-owners above. The additional [0x1AF820,0x1B3420) 15 KiB is the production expansion-pool owner and is deliberately unassigned to features until a build-time allocation is made.

The game originally constructed its main arena at KSEG0 0x801AF420. Production now moves the arena floor to KSEG0 0x801B3420. The arena-address constructions are guarded as full instruction pairs; exact patch behavior belongs to the patch-site registry. 0x801B3420 is the stock-arena anchor after reservation, not a claim that later RDRAM is reusable.

Static tracing distinguishes the arena's persistent/reset floor from its transient cursor. 0x800EECD0 is the persistent/reset arena base, while 0x80111ECC is the live bump cursor. Helper 0x80066390 copies the base into the cursor. The statically confirmed bump boundary is 0x80290990; immediately adjacent fixed state begins at 0x80290998. These are dynamic address/function facts, not reusable fixed intervals on this page.

Dynamic and overlay-qualified runtime facts

These facts are important to allocation safety but are not promoted into bounded reusable intervals.

Region/fact	Class	Established fact	What remains unknown
Main arena after 0x801B3420	dynamic	Production moves the reset/base floor to 0x801B3420. The base is held at 0x800EECD0, live bump cursor at 0x80111ECC, and the Static-confirmed bump boundary is 0x80290990. Allocator 0x8006643C has no internal bounds check.	Current/peak cursor and therefore real headroom vary with stage/resources/lifecycle. The 16 KiB reservation has bounded runtime evidence, but later feature allocations can still change pressure and require composition-aware validation.
Historical enemy-import headroom observation	proof-only / dynamic	In one Fire allocation chain, appending Temple fighter file 0x89 would advance the cursor to 0x80293A28, exceeding the now-Static-confirmed 0x80290990 boundary by 0x3098; replacing Fire file 0x20 instead ended at 0x802728C0, leaving 0x1E0D0.	The boundary is global allocator architecture; the observed cursor/headroom values are proof-specific and do not establish worst-case free capacity across stages/lifecycles.
Exact allocator-profiler runtime observations	proof-only / dynamic	A disposable 1 KiB-reservation proof recorded global peak 0x802857E8, leaving 0xB1A8 = 45,480 bytes = 44.41 KiB. A follow-up proof moved the arena floor to 0x801B3420, reserving 16 KiB total; all eight safe stages loaded and global peak reached 0x802893E8, leaving 0x75A8 = 30,120 bytes = 29.41 KiB. The peak increase is exactly 0x3C00 (15 KiB), equal to the additional reservation.	Runtime-confirmed only for the exercised proof compositions/routes. These are measured headroom values, not confirmed-free. The exact 0x802893E8 high-water value comes from the disposable profiler proof; the same 16 KiB floor is now current production ownership after the bounded full-production validation. Per-stage attribution uses the current-stage field, which changes before some preload/transition work completes; global peak is the stronger measurement.
User-supplied Water enemy-pair observation	proof-only / dynamic	Water peak cursor 0x80284940 leaves 0xC050 below 0x80290990. Replacing two native fighter payloads totaling 0x284D0 gives an observed-route replacement ceiling 0x34520, assuming unchanged later allocations and no new auxiliary allocation.	User-reported runtime capture; no emulator run in the 2026-09-28 static audit. Route/composition identity and worst-case applicability remain bounded. The conditional 0x40B90 GRUNT pair still exceeds this ceiling by 0xC670. Static Slide collision closure now certifies file-0x22 root 0x1E live for ordinary GRUNTs; it certifies no extra removable bytes. See Enemy randomization.
Native ordinary-enemy family paging	dynamic / stage-overlay-qualified	Static direct-call census: Water overlay 0xA1 has zero calls to 0x80066478; Prison 0x9F has three, Bridge 0x9B two, Fortress 0x9E two. Prison uses rewinds to alternate resource families including 0x8F+0x8E, file 0x22, and 0x90+0x8E; Bridge swaps a special 0x2D allocation against ordinary 0x8E+0x91; Fortress swaps its ordinary GRUNT tail against Assassin resources and restores 0x22+0x23.	This proves native stack-like encounter/section paging exists, not that a foreign destination may rewind the same lifetime boundary. Randomizer use requires destination-specific proof that no surviving process/actor/pointer references the discarded tail and must include transient projectile/effect allocations in peak accounting. See Enemy randomization.
PRIS GRUNT 16-color dry-repack sizing	proof-only / static-offline	Codec-valid dry pack of Water candidate files 0x8E+0x8F reduces resident raw pair from 0x3B520 to 0x321FC, saving 0x9324 = 37,668 B; all 253 Type-5 frames round-trip to the selected 16-color/exact-secondary target buffers with zero mismatches. Against the user-supplied Water observed-route pair ceiling 0x34520, this leaves 0x2324 = 8,996 B. A separate Bridge-native 0x8E+0x91 dry pack reduces 0x32DB0 to 0x2B14C, saving 0x7C64 = 31,844 B.	Static sizing only. Type-5 decode backing remains dimension-sized and transient projectile/effect/actor pressure is not included, so neither residual Water margin nor Bridge payload reduction is certified runtime headroom/performance improvement. See Enemy randomization.
PRIS GRUNT accepted compact runtime footprint	proof-only / Runtime-confirmed bounded composition	Accepted v04 keeps the conservative runtime-proof sizes 0x8E=0x1B0B8, 0x8F=0x17A04, 0x91=0x1080C. Water pair 0x8E+0x8F = 0x32ABC = 207,548 B, saving 0x8A64 = 35,428 B and sitting 0x1A64 = 6,756 B below the user-supplied observed-route pair ceiling 0x34520. Bridge pair 0x8E+0x91 = 0x2B8C4 = 178,372 B, saving 0x74EC = 29,932 B.	Water v01/v04 demonstrate that this compact resident-file strategy can run the imported staff-grunt family on the exercised route; this does not convert the 6.60-KiB residual into certified universal free space. Bridge's approximately 29-KiB resident reduction did not visibly improve the tested stock slowdown. See Enemy randomization.
Water × PRIS GRUNT4 stock-pair proof	proof-only / Implementation-confirmed, runtime Pending	Disposable Water proof replaces native 0x8C+0x8D residency with stock 0x8E+0x91 = 0x32DB0 and all nine ordinary Water types with 0x17. Against the user-supplied observed-route Water replacement ceiling 0x34520, resident fighter payload leaves only 0x1770 = 6,000 B = 5.86 KiB before transient pressure.	This is deliberately narrower than the accepted compact 0x8E+0x91 = 0x2B8C4 control. No Water rewind is introduced; stock Water still has zero direct 0x80066478 calls. Runtime validation must cover projectile firing, hit reaction, disarm/detached weapon, terminal cleanup, and stage continuation.
Water × raw FAST MONK proof v01	proof-only / Runtime-confirmed bounded composition	Water replaces the first native fighter allocation/load (0x8C) with untouched stock file 0x20 in FAST MONK slot 0x800C2560; stock 0x8D remains loaded to preserve the native allocation sequence. Resident fighter payload is 0x20+0x8D = 0x2B4D0.	Against user-measured Water ceiling 0x34520, leaves 0x9050 = 36.08 KiB before transient pressure. No compaction and no new rewind. Proof SHA-256 e01e8ece94f642411afb9150b8a1ee9f74b7871945bcf029a469dcb9349c774f. User manual validation passed spawn/AI, attacks, hit reactions, kill, full death/despawn, additional encounters, and continued Water progression. This remains bounded to the tested all-0x0A roster and does not certify universal transient headroom.
Water × compact PRIS GRUNT3 proof v01	proof-only / Runtime-confirmed bounded composition	Compact 0x8E = 0x1A148 (8-byte aligned) plus compact 0x90 = 0x16AC0; pair 0x30C08, saving 0xB558 = 46,424 B (45.34 KiB) versus stock 0x3C160. File 0x90 keeps all 17 native 4-bpp cannon/projectile frames exact and keeps the 16-color projectile palette byte-exact at a relocated offset.	Against the user-measured Water replacement ceiling 0x34520, the pair leaves 0x3918 = 14,616 B = 14.27 KiB before transient projectile/effect pressure. Finished-ROM post-build audit decodes all 217 compact Type-5 frames successfully. Proof SHA-256 665bf98d6c457853a30f66de00680e6de761d3773ce7108598a3050c856c7bed. User manual validation passed cannon fire, projectile hit/reaction, disarm/detached weapon, kill, full death/despawn, and continued Water progression.
Water × raw HULK MONK proof v01	proof-only / Runtime-confirmed bounded composition	Water redirects the first native fighter transaction from 0x8C to untouched stock file 0x25 and stores it at exact HULK MONK slot 0x801AE578; the now-unused second 0x8D transaction at ROM 0xB58D8..0xB58F8 is NOPed. Resident fighter payload is only 0x2C210.	Against user-measured Water ceiling 0x34520, leaves 0x8310 = 32.77 KiB before transient pressure. No compaction and no new rewind. Proof SHA-256 90e6ae1f97934d42ededeb0b861caa577bc86870f1df7b27be7dc49b5f6ed4c7. User manual validation passed spawn/AI, ordinary attacks, hit reactions, kill, full death/despawn, continued Water progression, and additional encounters.
Water mixed PRIS 0x14+0x16 proof v01	proof-only / Runtime-confirmed bounded mixed roster	Reuses the already Runtime-confirmed compact 0x8E+0x90 = 0x30C08 residency and all loader/palette rebasing from the Water × 0x16 proof; only ordinary Water type records change to an alternating 0x14/0x16 roster.	User manual validation passed coexistence of base 0x14 and armed 0x16, cannon/projectile behavior, 0x16 -> 0x14 disarm while native-spawned 0x14 actors also exist, terminal cleanup, and continued Water progression. Proof SHA-256 57d92254e24e644f9f26b6a43d3410562081e3f66daa9db613bc25a3ece95d50.
Main stage overlay base 0x802ECE30	dynamic	Main stage overlays load at this VA and are mutually exclusive by stage/source.	Overlay extent and owner at any subrange require the exact stage/source artifact. No global owner is assigned merely from the VA.
Current stage resource-file base slot 0x802E82B8	dynamic	Stage-loading code stores the current resource-file base used by ordinary-pickup selector lookup.	The pointed-to allocation address/extent depends on the loaded stage/resource file.
Toasty dynamic texture proof	proof-only / dynamic	The proven CI8 path requested a dynamic 78x85 texture with 96-byte stride, 0x1FE0 image bytes.	Returned backing address and production lifetime are not a fixed reusable allocation; final feature integration remains pending.
Direction-facing v02 expansion slice	proof-only / reserved-pool suballocation	Build-time allocator assigns [0x801AF820,0x801AFA88), 616 bytes, inside rdram.production.expansion_pool. File 0x1A raw-loads the module there and control hooks enter its KSEG1 alias.	Runtime-confirmed only for the tested v02 control route. This is a proof suballocation, not a current production feature owner; the parent 15 KiB expansion pool remains the production owner until product integration is separately approved/validated.
Materializer composition v02 helper slice	proof-only / reserved-pool suballocation; Runtime-confirmed bounded composition	Corrected materializer v02 places its generic award + immediate acquisition-remask helper at KSEG0 [0x801B0900,0x801B09F0) inside the 16-KiB production expansion pool, after current controls runtime end 0x801B0880 and below fixed Toasty base 0x801B1000. It is transported through the established shared file-0x1A bootstrap-load architecture; no second pickup-manager stage-init raw load is used.	User runtime validation passed stage entry and the representative Fire -> Wind -> Fortress composition. This certifies the bounded placement/transport composition, not a permanent independent owner: shared patch-pipeline integration must allocate/guard this slice against the complete optional-feature composition before promotion.
Materializer shared-core candidate	integration-candidate / reserved-pool suballocation	PR #126 relocates the same generic-award + acquisition-remask module to KSEG0 [0x801B2960,0x801B2EC0), ROM mirror [0x00F69150,0x00F69240), immediately after production Temple special-check ownership and below Toasty. Shared file 0x1A remains the transport.	Runtime-confirmed bounded v03 + Implementation/CI-confirmed. The relocation resolves the Temple-module overlap discovered during rebase; the user reported the requested co-resident Temple/materializer composition working as expected. This remains a branch/PR allocation candidate until PR #126 is explicitly merged; do not treat unmerged branch ownership as current main production ownership.

TEST LAB cross-stage materialization stress evidence

The 2026-09-28 TEST LAB line provides bounded runtime composition evidence, not new production allocations. Detailed chronology belongs to TEST LAB proof history.

Proof-local high-ROM resource relocation used 0x00F00000 as disposable backing in the successful Fire-resource experiments. This address remains proof-only; the clean 0xFF contents used by those builders do not establish production ownership.

Important runtime observations:

• v27's ten-key native-Fire-file composition entered successfully;
• v28's all-21 composition with resource size about 0x8F0C progressed to an emulator-core SI/PIF DMA error and is Rejected as memory-unsafe;
• v29's all-21 low-RAM resource was only 0x4634, yet still hung at Mission Objective and later exhibited music-speed corruption;
• v31 kept the same low-RAM resource family with 15 live non-Earth actors and entered successfully;
• v33's recognizable 15-live non-Earth proof used a resource size of 0x4BE4.

These observations reject a simple rule of the form resource bytes < historical arena headroom => safe. The loaded stage resource, live pickup actors/processes, dynamic textures, render allocations, stage-entry temporaries, and other arena consumers compose at runtime.

No universal safe pickup-count threshold follows from the current data. Ten and fifteen have successful bounded routes; the rejected 21-item routes differ in more than count, and Earth remained a confound in v30.

Production materialization must therefore use explicit composition budgets and failure bounds rather than promoting any disposable TEST LAB size/count as a global limit.

Confirmed-free status

Reusable confirmed-free intervals currently exposed by this map: none.

This is not evidence that the ROM or RDRAM has no free bytes. It means the current evidence reviewed for this task does not justify promoting an unowned interval to production-reusable confirmed-free under the required lifecycle/reference standard.

Notable examples:

• the former selector cave/tail is now part of rom.production.inventory_helper_cave;
• the bootstrap cave is fully reserved through 0x9AF20;
• the former high-ROM title reservation [0xF90000,0xFC1000) is retired by the in-place typeset title; it is not promoted to confirmed-free merely because the title no longer writes it;
• clean FF tails used by disposable fighter/resource proofs remain proof evidence only;
• the 0xA1308..0xA1544 zero-filled area is positively known not to be free.

Overlap and validation rules

A future structured representation should fail validation when:

• an interval is outside the declared address-space bounds;
• end_exclusive <= start;
• a declared size disagrees with end_exclusive - start;
• two simultaneously live production owners overlap without an explicit containment/composition relationship;
• KSEG0 and KSEG1 aliases are represented as independent RDRAM allocations;
• an overlay VA lacks stage/source identity;
• confirmed-free lacks explicit lifecycle and evidence;
• a proof-only interval is marked production-safe without a separately validated production composition;
• a ROM offset and runtime VA are related without a declared proven mapping;
• a current owner lacks a canonical page/module/reference.

Expected containment such as the V2 sub-owners inside the first 1 KiB of the 16 KiB reservation is documented explicitly rather than represented as duplicate top-level coverage.

Initial coverage and deliberate unknowns

Coverage here means only the union of the bounded current stock/protected/production interval rows above. It is not a claim that everything outside those rows is unused.

• ROM bounded current coverage: 0xF18E0 bytes (989,408 bytes), about 5.90% of the 16 MiB image. The compact-rainbow change removes 0x459E0 bytes of duplicated fighter data and adds only the 0x58-byte shared-file loader wrapper outside the 8 KiB bank, for a net bounded-coverage reduction of 0x45988 bytes.
• RDRAM bounded fixed coverage: 0x4720 physical bytes (18,208 bytes), about 0.434% of 4 MiB.
• Additional proof-only ROM footprints listed separately: 0x50FE4 bytes across the two bounded examples; these are excluded from current ownership coverage.

The low percentages are intentional. Large parts of both spaces remain unclassified/unknown because this task does not infer ownership from byte patterns or missing references.

In particular, this first map deliberately leaves unclassified:

• all ROM gaps not covered by an established interval above;
• all RDRAM gaps between the fixed records above;
• arena/heap contents after the established arena-start anchor;
• stage-overlay subranges without exact stage/source identity;
• per-stage dynamic resource allocations beyond established file/source sizes;
• historical proof extents whose exact bounds were not preserved well enough to promote;
• sparse individual patch sites that are already canonically guarded by the patch-site registry.

Relationship to MKMSZR Project Atlas

Allocation ownership and decomp/readiness answer different questions.

• Decompiled or well-understood stock bytes are still owned.
• Unknown/black decomp space is still protected; unknown does not mean free.
• A confirmed-free allocation claim, if one is added later, does not imply decompilation completeness.
• A production cave/allocation is an ownership overlay, not a decomp-readiness score.
• Overlay reuse remains stage-qualified.

MKMSZR Project Atlas is a derivative visualization of this page and other canonical Wiki owners. Its ROM/RDRAM views snapshot bounded intervals from this page and retain the source commit for provenance; the Wiki remains authoritative. Atlas updates must not infer free space from gaps, padding, or unclassified cells.

Related canonical references

• Project status — current production/proof/pending dashboard.
• Core runtime and address database — bootstrap/payload mechanism and runtime design.
• Address and patch-site registry — exact guarded edits and expected bytes.
• ROM, overlay, and resource map — file table, overlay/resource loading, and stage resource grammar.
• Address quick reference — derivative orientation-only lookup.
• Persistence, inventory and lifecycle — four-box and run-lifecycle behavior.
• XP and progression — progression semantics and runtime evidence.
• Sub-Zero to Sektor animation mapping — canonical slot mapping/current coverage.
• Sektor takeover proof history — fighter proof footprints, versioned allocation-boundary evidence, and supersession.
• Experiments, failures and superseded findings — failure index and proof/production conflict history.