Repository navigation
Production Rich Inventory Music Static Investigation
Historical evidence correction, not a new causal finding. The recovered October 3 chat places a maintainer-reported music speedup in the key-labels/HUD TEST LAB v09, before production HUD integration, Fortress HUD preloading, and in-Inventory box switching. It supersedes any description of preload v01 as the earliest recovered rich-HUD music report. Earlier, separate historical speedups remain separate incidents. The maintainer's current clarification is that the current music issue became noticeable with the HUD changes; selector presentation was a suspected contributor, not an established introduction point. Neither this recollection nor the v09 report identifies the first defective instruction or proves that all historical audio symptoms share today's traced FIFO mechanism.
The following identifiers are message role plus absolute UTC timestamp, recovered through conversation-history retrieval on 2026-10-11. The provider returned conversational summaries, not a complete raw transcript. No original chat URL, conversation UUID/title, savestate filename or original state bytes were recovered for v09 in this bounded retrieval. Do not invent a verbatim quotation or treat the timestamp as the precise symptom-onset time. UYT is UTC minus three hours.
| Chat message | Recovered observation | Evidence quality |
|---|---|---|
| User, 2026-10-03T16:53:53Z (13:53:53 UYT) | Asked for inspection of a savestate after music sped up, with the ROM to be treated as v09. | Maintainer runtime observation recovered as a conversational paraphrase. Exact route, elapsed time/onset, emulator/version/settings and repeatability are not recovered. |
| User, 2026-10-03T16:57:58Z | Clarified that the visible thumbnail issue covered WIND1 through WATER3. | Separate visual report; not proof of the cause of the audio symptom. |
| Assistant, 2026-10-03T17:20:06Z (14:20:06 UYT) | Reported the savestate/ROM match to v09 SHA-256 d9fd4da4d26fba0762f244fbcc559c43ce2ee2af8130a745182c0eb259830d05, with sane QPM/PPQ, DAC rate, AI timer, module and arena snapshot; music cause remained pending. |
Prior assistant analysis recovered from history. The archived v09 ROM identity was independently hashed in the October 11 boundary audit; the original savestate match and snapshot checks were not independently repeated. Snapshot negatives cannot exclude earlier/transient corruption or establish audio causation. |
Pinned composition boundary, reusing the completed audit: MKMSZR_inventory-key-labels_test-lab_v08.z64, SHA-256 3546f709330a64b5d72262a26dc63156d255015bbd843081ea5124008a7ab011, already had colored stage/crystal labels, native paper titles and thumbnails. MKMSZR_inventory-key-labels_test-lab_v09.z64, SHA-256 above, added live STG CHECKS KEYS stage-table/status rendering and REQ. POWERS X-8 / CHKS ZZ-85, but also nine TEST LAB Power pickups, synchronous Fire resource/manager initialization and XP-cap changes. Thus v08/v09 is not a HUD-only comparison; initialization and resource work can begin before gameplay. No recovered v08 music result establishes it as healthy, and the maintainer could not recall whether acceleration was already noticeable in v08. Production rich HUD, later resource preloading, later rich-render bypass and box switching must not be collapsed into this one boundary. Full existing byte/resource comparison: Library MKMSZR_HUD_observation_boundary_20261011.md (libfile_336d177d9db88191abbb7a5ac1a3004e). No new static analysis or runtime test was performed to add this entry.
| Exact archived ROM | Existing completed runtime report | Limits and attribution |
|---|---|---|
MKMSZR_inventory-hud-preload_fortress_proof_v01.z64; SHA-256 b51dcb80377b426bf485f1ecdf581bcf71bf2db7c7079b126e30139e2138b390
|
User, 2026-10-07T05:02:52Z: opened Inventory before Kia, fought Kia, then opened Inventory during the big-door/loading transition; reported that it worked, clearing the previously reported Kia-door hang on that attempt. User, 2026-10-07T05:06:13Z: while in Inventory after saving a state, music suddenly accelerated. User handoff, 2026-10-07T05:07:55Z: retained hang-fix/speedup results and rejected production approval. | Hang improvement and later audible failure are maintainer observations, not a demonstrated corruption writer or audio/HUD shared cause. Duration and repeated-cycle counts are not reported. Existing Library static manifest libfile_2c804a5d01cc8191b1b3e6041f991c35 independently pins the supplied preload ROM and state; its snapshot cannot exclude transient corruption. |
MKMSZR_inventory-hud-preload_no-rich-render_fortress_proof_v02.z64; SHA-256 d98b32062a77166c25c69b1d316ad0bfabefe8ea80e8553cc861c176b84d6810
|
User, 2026-10-07T14:27:06Z: reported that it was working so far and could be accepted. Assistant, 2026-10-07T14:27:27Z: accepted v02 only as a bounded diagnostic, not a production fix. Assistant, 2026-10-07T14:27:53Z: interpreted the result as preload coexisting with the post-Kia route and music not reproducing with rich row/paper/status bypassed. | The user's recovered reply supplies no explicit route, duration, cycle count, box count or separate hang/audio measurements. The detailed route/no-speedup interpretation belongs to the prior assistant, not an independently recovered detailed user test log. The proposed ~60-second, 10-cycle, four-box/prior-speedup sequence is a test plan, not proof it was completed. Acceptance is bounded non-reproduction, not a healthy-build certificate. |
Additional direct maintainer handoff: the supplied project-history excerpt titled Inventory Static Analysis, 2026-10-07 11:51 UYT / 14:51 UTC (minute precision only), begins with the user's explicit statement that the current v02 runtime result is accepted: Fortress preload remains, bypassing rich item-row/paper-scroll/status renderers eliminates the observed instability so far, and portraits, legend and four-box switching remain active. This supports the bounded non-reproduction interpretation with a user-authored summary, beyond the brief 14:27:06Z reply. It still does not supply a measured duration, route log, repetition count or causal trace; no original chat URL/UUID was provided for that excerpt.
What that already answered: preload v01 improved the door/loading hang but did not eliminate the later reported acceleration. The v02 acceptance and subsequent explicit maintainer handoff supply a useful, limited negative control for bypassing rich rendering while keeping preload/resource residency. Reuse the prior exact-ROM comparison: v01/v02 differ in 18 bytes across five runs, at the row route and the paper/status entry points; preload, resources, portraits, legend and four-box switching remain present. It supports investigating render participation separately from retained resource allocation, but does not prove a particular renderer defect, exclude timing perturbations or transient corruption, or establish that preload is harmless on every route. A single non-reproduction cannot close music causality. This comparison was already performed; no repeat run is requested.
Checkpoint after quota reset: v09 is now the earlier recovered rich-HUD audio observation, with the exact chat timestamps and identity above; introduction between v08/v09 remains unproved and composition is not isolated. HP01/HR02 already have the bounded runtime results above; do not request them again. Cursor repair lineage and unsupported Toasty null-check branches remain closed absent contradictory evidence. QUESO's older webapp-ROM music plus delayed vanilla-HUD corruption remains a separate, retrospective incident with no proven shared FIFO cause. Selector comparison stays a plan-only fallback. Resume from the current upstream audio investigation and its documented uncertainty; no new suspect expansion, ROM build, emulator run, fix or broad gameplay request is authorized by this checkpoint. No ROM bytes are included in this documentation update.
Scope: Five complete v05 captures already archived (one selector failure, four non-reproductions), pinned RMG v0.9.0 rsp_core.c, rsp_core.h, interrupt.c and ParaLLEl RSP parallel.cpp, verified clean MKMSZ ROM and living MKMSZ-Ghidra metadata. No new emulator run/ROM output/source change. Full event chronology, limitations, falsifiers and ranking in Library MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v05-Stage-Select-Four-Negative-Controls-2026-10-10/MKMSZR_selector_rsp_upstream_static_investigation_20261011.md.
Earliest matched local RSP fork: all four heavy-input captures (including the failing one) at VI index 2165 show RSP 0x30 first execution and 0x31 running status 0x40 at VI+6,976 Count. RMG do_SP_Task() calls ParaLLEl RSP's DoRspCycles(first_run); plugin returns the requested 1 cycle rather than measured execution work, and RMG divides by 2, scheduling RSP_TSK_EVT with zero modeled delay. The second 0x31 finishing status 0x243 (=HALT|BROKE|INTR_BREAK|TASKDONE) is at VI+7,376 in failing run, versus +7,720/+7,990/+7,950 in Down/Fast Down/Random; 0x32 SP interrupt at +7,396 versus +7,732/+7,998/+7,966. AI_LEN at +8,266 failing versus +7,594 in controls; RMG read quantization 1,344 versus 1,352 bytes changes next VI's output from 1,408 to 1,472B. Minimal-input healthy run itself has continuation +7,010, SP_INT +7,018, AI_LEN +8,242 and remains healthy. RSP 0x32 rsp_wait=0x9 means halted+pending interrupt-on-break, not evidence of a memory-corrupting RSP crash.
Static guest route vs dynamically missing identity: native 0x80000E24 VI scheduler promotes prior fresh audio at 0x80000E3C; audio-first dispatcher 0x80000F4C calls OSTask load/start through 0x800011F0 → 0x8008A5A0 / 0x8008A7AC. AudioInfo +8 holds OSTask type 2, and at this feedback phase each trace records active task 0x8013BE28 (record 0x8013BE20+8), making an audio RSP task strong static inference. RMG host RSP_TSK_EVT routes via gen_interrupt to rsp_task_event and do_SP_Task; SP_INT invokes rsp_interrupt_event, which raises MI_INTR_SP. Native SP-completion handler 0x80000B6C is identified statically in Ghidra; eventual scheduler dispatch is not directly logged. Native feedback PC owner is 0x8007D4F0 → AI_LEN MMIO wrapper 0x8008A3C0; prior PCM submission 0x8007D4E8 → 0x8008A500; builder 0x8007D4A8 synthesizes next output afterward. No v05 channel logs executed OSTask type/DMEM, guest launch PC, EPC/interrupt PC or RSP_TSK_EVT queue due/dequeue fields, so neither the exact executed task type nor whether the guest scheduler handled SP before AI_LEN may be labeled Trace-confirmed. Host RSP event ordering is not itself guest instruction ordering.
Wider falsifier: across active feedback services, SP 0x32 before AI_LEN occurs 982/3,081 failing, 3,368/3,831 minimal healthy, 997/3,673 Down, 853/3,510 fast Down, 1,611/5,117 random-rapid. Only 193/299 native FULL services in failing run have pre-read SP event; none of three isolated healthy FULL services do. With same active head 1,536B and AI_LEN 1,344B, the random-input healthy control outputs 1,472B both with SP before read (21 cases) and without (21 cases). Thus SP-before-read is neither necessary nor sufficient for a 1,472B output or a FIFO reject. It strongly tracks >8,000 Count late reads in the previously audited 490-service subwindows but cannot be promoted to a faulty operation. A failing-only pre-read SP split already occurs at VI #601 while next output stays 1,472B; the first differences in raw RSP/AI_LEN across unmatched runs occur near VI #294/#295, long before the shared PCM-size fork at attempt #1872. Independent routes do not permit a unique earliest causal cross-run divergence.
Bounded corruption audit and prevention ordering: Verified clean input SHA256 9c18254a…73ffc6. Selector hook ROM 0xDD70, helper [0xE27C,0xE2B0), and palette [0xB21D8,0xB2212) are disjoint from native audio code [0x7E0A8,0x7E350) and [0x8B100,0x8B1D0). Existing production file-1A runtime [0x801AF820,0x801B3420) is separate from 3 AudioInfo records at 0x8013A780/0x8013B2D0/0x8013BE20. Guards/owners do not establish no computed writes, correct ABI/lifetime under all routes, full dynamic heap bounds, or ROM identity of these five trace inputs. MOVE helper overwrites callee-saved S0 as a local return-address carrier; stock 0x8000D178..0x8000D1AC does not read S0 before replacing it, and prior Trace (11) S0-preserving alternative did not cure the audio; global correctness is not thereby proven. Existing stale HUD/unchecked allocator risks remain independently Pending. Prevention strategies ranked for investigation: verify guest task scheduling/order first if an actual policy violation emerges (portable but high task/yield risk); then consider a guarded phase-safe native producer only with proven cadence and corruption invariants (portable but high masking risk); retain RMG fractional AI duration or task-event modifications as opt-in diagnostics only (not portable, no proven recovery). No speculative patch or FIFO retry. 1.0 audio gate BLOCKED.
Single smallest potential subsequent discriminator, not executed or requested now: observe just RSP_TSK_EVT schedule/deliver Count, true OSTask type plus SP PC, and guest PC/EPC at continuation, aligned with existing AI_LEN sample and exact ROM identity. No general emulator run, clock modification or broader stress test is authorized by this result.
Trace-confirmed earliest PCM-size fork, source-confirmed arithmetic; specific instruction/trigger Pending. After the four new selector no-runaway negative controls, align the earlier 299-rejection capture with all four ZIPs by the zero-based native AI 0x10 enqueue-attempt index, not by host wall-clock time. The failing run and all three heavy-input controls emit identical first 1,872 PCM lengths (indices 0..1871). At index 1872 failing request is 1,472 bytes, Down/Fast Down/Random-rapid request 1,408 bytes, and minimal-input request also 1,408B but diverged earlier at index 1848. This is an unmatched input route comparison: identical PCM sizes do not mean equal sample payload, device configuration/ROM identity, or equal virtual Count phase. Each stream passes checksum/sequence/zero-overwrite checks. Auditable SHA-256s, per-record CPU Counts, following AI_END deadlines and source formulas: Library MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v05-Stage-Select-Four-Negative-Controls-2026-10-10/MKMSZR_v05_five-selector_first-buffer-divergence_findings_v01.md; accompanying JSON audit was generated in the conversation (Library upload Pending).
At the native read which sizes PCM attempt #1872, the pinned RMG v0.9.0 C get_remaining_dma_length() uses ((remaining_dma_count * fifo_head.length / fifo_head.duration) & ~7). Head is 1,536B / 846,336 Count. The deadline and read Count imply 1,351.728 unrounded bytes → 1,344 in failing trace, versus 1,353.789 / 1,353.132 / 1,353.053 unrounded bytes → 1,352 in Down/Fast Down/Random-rapid respectively. Stock native audio frame builder VA 0x8007D4A8 calculates max(352, (((368 - (AI_LEN >> 2) + 320) & ~15) + 16)) sample frames: AI_LEN 1,344 → 368 frames/1,472B; AI_LEN 1,352 → 352 frames/1,408B. This double 8B→64B quantization is sufficient to explain this exact next-output-size difference without assuming a corrupted sample-count field; it does not establish that all memory/lifetime state was intact or identify the original initiating operation.
At that decision the failing AI_LEN observation is 8,266 CP0 Count after its VI versus 7,594 in all three heavy-input controls (+672 Count). Each recording has its own AI completion deadline, and healthy captures also contain occasional ~672-Count late-service excursions, so claiming this is a unique cursor helper invocation or an ABI violation would be unjustified. This establishes a very specific earlier native read-phase/quantization discriminator, not a fully matched instruction/cause test. RMG's AI_LEN read calls cp0_update_count() and calculates the head remainder from the scheduled AI_INT; the producer reads it after its previous PCM submission. No observed extra whole-VI callback or unknown producer data write is required by the recorded arithmetic.
Guardrail for RMG opt-in rational-duration PR #161: the proposed alternative yields 812,306 Count for 1,472B versus 811,072 with pinned integer truncation, an increase of 1,234 Count. Holding an already failing schedule fixed, this cannot make the offending 1,472B DMA complete earlier; a cold-start A/B would change the whole trajectory, so neither success nor failure can be asserted without the bounded manual test. Do not promote it as a fix, silently patch emulator behavior, spin-retry rejected enqueue, delete MKMSZR features, or declare memory corruption excluded. Audio 1.0 release gate BLOCKED pending verified upstream cause or verified prevention with cross-emulator and memory/lifecycle safety validation.
Maintainer Runtime-observed: Repeated selector input attempts did not audibly reproduce the earlier crunch/speedup. Four newly uploaded ZIPs were decoded directly, without running the ROM or emulator: mkmszr-lminimal_inputs.zip, mkmszr-many_inputs_down.zip, mkmszr-many_inputs_fast_down.zip, mkmszr-many_random_rapid_inputs.zip. Across all 24 binary v05 observer streams (AI/VI/RSP/phase/PIF/SDL), format/sequence/time/length checks pass and all rings have saved=total, overwritten=0. Reports and original byte-for-byte ZIPs are preserved in Library MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v05-Stage-Select-Four-Negative-Controls-2026-10-10/. Detailed capture provenance, timestamps, native event pairs, all stream SHA-256s, and per-ten-second windows are in the generated machine audit MKMSZR_v05_four-selector-negative-controls_audit_v01.json (available from this investigation conversation; its Library upload was not confirmed).
| Run | Time observed | Guest-visible vertical press edges | Native PCM rejects | First stage 9 |
|---|---|---|---|---|
| Earlier failing selector | recurrent rejection t36.496–56.364 | 95 Up + 150 Down (245) | 299, sustained | t47.696 |
| Minimal-inputs | 71.237 s | 1 Up | 0 | t61.333 |
| Many-Down | 66.249 s | 239 Down | 1 at t36.762 | t54.812 |
| Fast-Down | 63.509 s | 335 Down | 1 at t37.170 | t53.854 |
| Random-rapid | 90.365 s | 327 Up + 231 Down (558) | 1 at t72.448 | not entered |
Precise three recovered FULL events (Trace-confirmed): Each isolated reject consists of two diagnostic FULL reads for one native skipped enqueue, active FIFO head 1,536B, queued tail 1,408B. DMA of the queued tail completes 30,336 / 31,064 / 31,044 CP0 Count BEFORE the next native audio service for the Down / Fast Down / Random-rapid runs respectively; the status at that next service is AI_STATUS=0 (EMPTY), so native PCM submissions resume with no rejection train. The earlier failing capture instead has active 1,600B, tail 1,472B completing 4,746 Count AFTER next audio service, selecting high-supply recurrence. The three healthy controls all reach AI_LEN=1216 and at least one accepted 1,600B buffer, refuting their sufficiency. The immediate accepted sizes near their FULL event are 1,536 → 1,600 → 1,536 → 1,408B, whereas the earlier failing run is 1,472 → 1,600 → 1,600 → 1,472B. The earliest useful comparison is therefore native PCM sample-count selection and AI_LEN feedback in the few services immediately before the deadline fork, not total button count or the mere presence of a FULL event. These are the observed outcomes, not an identified guest instruction or justified correction.
Other negative checks: All new runs have zero host SDL queue threshold drops or failed pushes (32,247 successful SDL pushes combined). Every native first-status service maps to consecutive active VIs (first service at VI index 294 and ~t4.94–5.01 in all four), with no missing whole-frame service. Every measured synth-clock delta equals prior AudioInfo frame count (exact 3,831/3,831, 3,673/3,673, 3,509/3,509, 5,116/5,116 steps); captured DAC divisor remains 2207. The random-rapid capture never entered a gameplay stage; the other isolated rejects occurred before entering Fortress. The negative results do not retract the earlier 299-loss selector trace or establish that any patch feature is harmless; both healthy and failing phase histories are possible while using the selector. PIF reply timestamps are not native input-consumption PCs, and no waveform, per-voice SFX allocator data, or guaranteed cross-run ROM identity was captured.
Updated decision: Reject simple rapid-input/SFX-count and single-FULL-causation theories. Favor a phase-sensitive PCM buffer-size/deadline fork as the proximate discriminator (already known downstream); which upstream native/emulator event selects it remains Pending. Do not automatically request more button-mashing, perform a new ROM/emulator test, promote production patches, modify clocks, retry full FIFO, or remove accepted blue cursor/MOVE SFX/Inventory. Only a narrowly bounded producer-count/voice-work trace around the documented 1216B feedback transition could materially improve upstream attribution. Release audio gate BLOCKED.
Maintainer Runtime-observed: rapid Up/Down in Safe Stage Select produces crunch before Start selects a stage, with no stage music. New independent trace-confirmed finding: The six v05 streams from the exact archived selector run reproduce the same native PCM FIFO rejection feedback class as the earlier Inventory failures, already active while the selector is on screen. Raw ZIP and SHA provenance are in Library MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v05-Stage-Select-Prestage-2026-10-10/, alongside new reproducible audit MKMSZR_v05_selector_prestage_audio_audit_v01.json and full report MKMSZR_v05_selector_prestage_audio_findings_v01.md. All six binary hashes match original manifest; magic/version/record sizes, sequences and timestamps are valid; every stream has saved=total, overwritten=0. Counts: VI 13,500 (3,375 callbacks), RSP 20,196, phase 3,085 (3,082 AI_LEN), input 1,610 valid port-0 PIF responses, SDL 11,720, AI 17,588.
Input/transition chronology, host time from first VI: 95 Up / 150 Down rising edges, five A, one Start. First Up t8.480; 201 vertical presses before first rejection. First native AI_LEN=1216 at t36.430223, first accepted 1,600B at t36.446341, first FULL/PCM reject at t36.496208. A previous Up PIF edge at t36.414951 is a correlation, not a traced native SFX call. Last vertical press/release t46.682757/46.815207; Start press 47.615107; first sampled native stage 9 at t47.696288 (raw stage field 0 and selector cycling before this, not a precise transition PC). Last button release t50.002043; rejection persists until t56.363740. This new selector recording is distinct from earlier A–E Fortress/savestate captures; E is healthy, not a failing comparator.
Loss classification: 598 raw AI_STATUS FULL reads = 299 actual failed native PCM submission services, two status records per failure, alongside 2,782 accepted AI writes. Rejections recur about every four VIs (median period 0.066975 seconds), 169 before the first stage-9 snapshot and 130 after, 144 after last vertical release, 96 after all button release. All 5,860 SDL fragments had successful pushes; zero host SDL queue threshold drops and zero push failures. The observer lacks waveform/voice allocator telemetry, so it cannot rule out simultaneous SFX-source trouble or pinpoint a listener's precise onset; the measured repeated loss is native rejected PCM, not SDL overflow alone.
Exact first deadline: at first rejection AI head/tail is 1,600/1,472B. First following AI END occurs at CP0 Count 1,785,329,220, promoting 1,472B tail lasting 811,072 Count; next native service Count 1,786,135,546, so the queued tail finishes 4,746 Count AFTER that service. A 1,408B tail counterfactual finishes 30,518 Count BEFORE. This matches earlier high-supply FIFO deadline bifurcation before entering any gameplay stage. The counterfactual does not prove why the real tail took 1,472B. First AI_LEN=1216 and a 1,600B output are immediate precursors, not sufficient causes; they also occurred without acceleration in earlier healthy v05 stress control.
VI/synthesis audit: 3,081/3,081 native first-status audio services map one-to-one to consecutive active VIs (first at VI index 294; CP0 Count offset min/median/max 7,294/7,516/8,540). All 3,081/3,081 phase sample-clock deltas equal the current snapshot's previous AudioInfo sample frames. During the 1,193 service intervals from first failure phase sample to last captured phase sample, synth advances 544,272 frames vs 439,024 for 368 each: surplus 105,248 = 299 × 352, consistent with synthesis continuing while all 299 minimum-sized PCM submissions are lost. No missed whole-VI audio service or SDL threshold-drop mechanism is necessary for this captured feedback regime.
Causal boundaries and exact selector edits: Current stage_selector.py replaces ONLY the guarded 29-entry BGR555 selector-local cursor palette ROM 0xB21D8..0xB2211 with title source ROM 0xB32E8, retaining file-0x5F cursor frames and stock rendering code. A separate movement hook JAL at 0xDD70 enters the 13-instruction helper at 0xE27C..0xE2AF, with conditional native SFX JAL to descriptor 0x1FC at ROM 0xE29C; the helper restores draw arguments. Prior Trace 9 bypassed entire helper but retained blue cursor (bounded healthy); Trace 10 NOPed only actual SFX call and still had 352 native rejects; Trace 11 additionally changed s0 return preservation and still accelerated. The menu-only failure therefore rules out needing Fortress/Inventory for this native FIFO failure, but does NOT prove either the palette, helper instruction count, played sound, or register ABI as initiator. This is phase-sensitive and existing healthy traces also had intensive navigation. No speculative causality promotion to Ghidra.
Next discriminator only if needed: one guarded, bounded manual menu-only same-composition comparison with only ROM 0xDD70 restored to the stock draw instruction (blue palette retained; Trace 9 strategy), capturing the same six channels and exact ROM identity. A single negative is not causal proof; compare first audio phase/deadline divergence and PIF edges under matched route. Do not redo downstream FIFO replay; no AI retry, emulator clock production fix, feature removal, ROM build or automated emulator run is justified by this analysis. Original frontend operation remains Pending and 1.0 audio gate BLOCKED.
Maintainer Runtime-observed: ~10-minute Fortress test involving walking, fighting without killing the enemy, consuming a healing item from another Inventory box, vigorous Up/Down navigation, and multiple box switches did not cause sustained speedup, though some brief crunch/skip was heard. The off-screen Grunt may or may not independently chase the player depending on aggro/AI behavior: this is the maintainer's observation, not an actor-state trace.
Trace-confirmed native comparison: Six new RMG v05 streams accompany this independent stress run. Integrity limitation: only AI (213,789 events), input (9,766 PIF replies) and RSP (191,216) are complete; bounded VI, phase and host SDL rings have overwritten 12,668 / 2,877 / 11,422 events respectively, preserving only their final ~546s of data. File total must never be mistaken for saved=total. Timestamp origin is first captured PIF reply, not first VI (lost) or Inventory-open event. 35,641 native first-status→AI_LEN services are recoverable from lossless AI trace, 35,623 accepted PCM submissions, 18 unique rejected submissions (36 raw FULL readings occur in doubled pairs from diagnostic logger). Largest clustered rejection episode is only 5 over 0.266s (t510.379–510.645), unlike the prior fast v05's 86 rejections over 5.734s. In retained host SDL tail there are at least 59 queue-threshold drops; these and isolated native failures could explain some brief crunching, but no waveform/time-stamped listening trace permits assigning any single audible event. SDL 59 is a retained-tail lower bound, not proven whole-run total.
Strong negative control against cursor-activity sufficiency: Guest PIF samples show 264 D-up rising edges, 348 D-down, plus left/right, Z, A, R, C inputs; 9,766 PIF replies are all port-0, without response errors. That exceeds the fast v05's 34 Up/39 Down presses before its rejection burst, but never enters sustained accelerated sound. Last nonzero controller reply is t430.829; then inputs remain entirely neutral for 167.38s. Ten of the 18 native FIFO rejections and 23 of the 59 retained SDL queue drops happen after that last press. The five-reject episode near t510 occurs ~79.55–79.82s after the last input. These are recoverable audio-loss events without recent cursor movement.
More decisive low-AI_LEN drift counterexample: Three long 1,472-byte/368-frame-only accepted-PCM plateaus: 2,688 consecutive writes t199.891–244.676 (44.785s, 26 Up/Down press edges); 2,401 writes t317.927–357.927 (40.000s, 45 Up/Down edges); and 2,310 writes t358.777–397.261 (38.484s, zero button presses or held input at all). In each, native feedback AI_LEN steps through 1,344→1,336→1,328→1,320→1,312→1,304→1,296→1,288 despite no runaway. The entirely neutral-input plateau shows that ongoing cursor movement is not necessary for the staircase, consistent with established intrinsic emulated VI/DMA 368-buffer near-resonance (~20 Count per VI). Further, AI_LEN=1,216 (suspected precursor in previous failing v05) occurs 29 times during this healthy stress run, and there are 30 accepted 1,600-byte PCM submissions; neither reading nor packet size is a sufficient cause by itself. The eventual queued-tail/next-service phase and resulting feedback recurrence must be compared, not threshold presence alone.
Structural/scheduler negative: Among 32,768 retained VI callbacks, each has a native first-status audio service; 18 additionally contain doubled FULL logger reads. The observed VI→service offset median is 7,774 Count (range 7,338–9,350). All 32,767 retained consecutive synth-clock steps match previous AudioInfo samples exactly. Across the retained phase tail, Fortress stage ID 9, manager/work-enable flags, DAC 0x89F, target/minimum and synth pointer remain stable. These do not exonerate every unmonitored actor/allocator write. RSP task events remain a general rendering/task chronology, not enemy AI state or actor identity.
Grunt interpretation, explicitly Hypothesis: The canonical enemy owner identifies native GRUNT1 0x0E and GRUNT2 0x0F ordinary Fortress stream records (6 and 7 respective spawn records). It is plausible that an off-screen Grunt's variable aggro, activation, animations or SFX changes guest work/order, and may perturb an audio deadline marginally in a near-resonant system. However v05 captures no actor position, aggro/AI state, RNG draws, attack start, enemy SFX or actual Inventory-open flag. Nor does it prove that a Grunt was updating while Inventory paused. No Grunt-to-FIFO causal link is observed. The native staircase and short losses appear even without recent player input, and the high-input stressed capture remains globally healthy. Do not automatically attribute the audio bug to RNG/Grunt; also do not assert it is ruled out.
Decision: This is a useful negative control, not a fix. Abandon simple "more cursor movement → faster audio" and "any AI_LEN=1216 → runaway" causal claims. If a future narrowly bounded experiment is genuinely required, instrument (after consulting living Ghidra metadata and canonical Function Registry) one specific off-screen actor's activity/aggro plus authoritative Inventory-open state alongside next-service PCM phase. Do not indiscriminately disable enemies, remove accepted Inventory features or retry full FIFO. No fresh broad stress run needed. Durable raw evidence/report/manifest in MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v05-Stress-Negative-Control-2026-10-10/ (see Library provenance index).
Maintainer Runtime-observed: music speeds up and clips after moving the Inventory cursor, before one minute of Inventory use. Trace-confirmed: six RMG v05 streams (mkmszr-ai/vi/rsp/host-audio/phase/input-trace) are complete, all saved=total, overwritten=0. The capture is 71.078 seconds relative to first VI, has 4,257 VI callbacks, 3,963 phase/AI_LEN samples, 3,962 complete native first-status→AI_LEN services, and 1,594 actual PIF controller-read responses (port 0 only). No missing native service VI within the active window; audio startup occurs after 294 VIs. Full SHA-256, recording identities and raw evidence are in Library MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v05-PIF-Audio-2026-10-10/, reports MKMSZR_v05_input_audio_correlation_findings_v01.md and ...audit_v01.json. The trace itself does not carry ROM SHA, exact Inventory-open PC, input-consumption PC or a sound waveform. The maintainer's test ROM/route are user-reported, not independently encoded.
Guest PIF response chronology, aligned by same-process host monotonic time to VI and native AI. Port 0 0x0004=D-pad Down, 0x0008=Up, 0x0020=Z according to pinned RMG button union; all 1,594 replies are nonerror and analog stick X/Y remain 0. Stage 9 first observed t13.127s; Z response at t38.786s plausibly opened Inventory but is not a verified opened-Inventory flag. Repeated Up/Down input starts t39.711s. Prior to the first failed native enqueue, the capture has 39 Down + 34 Up presses, with interleaved releases and no PCM rejection for ~22.83s of navigation. Native feedback first reaches AI_LEN=1,216 at t62.093997s, then an Up PIF response occurs 0.535ms later at t62.094532: that particular later button response cannot have caused the already-completed AI_LEN read, though earlier actions cannot be excluded. The first 1,600-byte PCM submission follows at t62.111061. The last Up press before failure is t62.428875; it is released at t62.495108, 48.991ms before first native FULL.
First FIFO fork is quantitatively the same as v04 speedup: At t62.544099, first native FIFO FULL sees active head 1,600B and queued tail 1,472B, rejecting submission. AI END at CP0=3053065767 occurs 4,214 Count after the FULL poll, promoting the 1,472B tail. The next native service at CP0=3053872783 is 4,056 Count before the queued tail's predicted 811,072-Count DMA completion. Counterfactual 1,408B tail would have finished 31,208 Count before that service. Previous v04 speedup measured −4,126 Count: a 70-Count difference between independent failure margins. This supports the same native FIFO-deadline regime, not identical gameplay trigger.
Observed downstream failure: 86 rejected native PCM submissions, t62.544099–68.278095 (5.734 seconds), most recurring once per four services and not 86 consecutive failed services. Over 345 services in that interval, 259 accepted + 86 rejected; previous AudioInfo totals 156,848 frames vs nominal 126,960 at 368 per service (+29,888 / +23.541% synthesized time), without direct measurement of acoustic pitch. A total 3,961/3,961 previous-AI_LEN→next-frame size predictions exactly match recorded phase buffers; 3,962/3,962 synth-clock increments match generated frames; no missing whole-frame audio services or changed native DAC divisor 0x89F, target/min/capacity, managed AudioInfo pointers or synth pointer in these snapshots. No SDL threshold drops in the whole run; host queue median 8,656B during navigation and 10,324B during burst, below 17,637B threshold. This independently shows native guest PCM omission can accompany audible clipping without SDL queue overflow, unlike earlier v04 saturation cases.
Crucial post-input negative control inside the same trace: The last recorded Up/Down button release is t63.394941, and every PIF reply remains neutral through ~t71.044. The FIFO-rejection regime continues until t68.278, i.e. 4.883 seconds after all input stopped. Continuing cursor movement is therefore not needed to sustain the already-running native feedback fault. It does not rule out input as an earlier perturbation.
VI-granular input/audio ordering: The first Inventory-navigation PIF response maps to VI callback #2,374 (zero-based from first VI), initial feedback AI_LEN=1,216 maps to VI #3,717 at CP0 offset +8,286, and the immediately following Up PIF response occurs within the same VI #3,717 at Count offset +279,044 (270,758 Count after the feedback). The first 1,600-byte output is VI #3,718, first rejected FIFO is VI #3,744, final Up/Down button release is VI #3,795, and last FIFO rejection is VI #4,088. These are precise logged observer VI event ordinals, not MKMSZ internal gameplay-frame numbers or the actual host physical-button arrival instants. The full table with Z/open and releases, input offsets and SHA provenance is in the preserved local findings report.\n\nEarlier phase precursor (new): The recurring low-AI_LEN feedback band was 1,256B through the long t14–39s stage period. After likely Inventory entry and navigation, the first descending 8-byte thresholds occur at t42.877878→1,248, t47.878046→1,240, t52.378185→1,232, t57.493866→1,224, t62.093989→1,216. Mean 4.804s per 8-byte step, corresponding to ~15.29 Count/VI at the pinned 551 Count/byte and ~60 VI/s. This is consistent with the earlier healthy 368-frame DMA/VI resonance drift (~14–15 Count/VI), and places the audio feedback staircase several seconds after Inventory activity rather than at the rejected enqueue itself. However, opening Inventory (Z) and repeated movement start close together, and we have no otherwise identical idle-only control: the earliest game operation that selects the phase remains Pending. We cannot assign causality to cursor SFX, renderer, allocation or direct controller callback from PIF proximity alone. Per-active-VI native first-status median stays ~7,673 Count before movement, ~7,592 during navigation, and ~7,604 during rejection—no large scheduler timing jump.
Decision: v05 input recording succeeded and resolved the chronology gap, but did not justify any production code patch or emulator clock change. Keep rich Inventory and all accepted features; avoid rejected native enqueue retry. The next bounded analysis should distinguish Inventory-open versus cursor-navigation effects on the slow quantized AI_LEN drift, and only escalate to a targeted native action/renderer/SFX call-site tracer after consulting existing Ghidra metadata and the canonical function/patch registries. No immediate request for another unstructured emulator test.
Historical diagnostic design — now followed by the runtime-tested v05 evidence above. In the latest v04 speedup, the maintainer reports that accelerated/clipping music appeared approximately 5–10 seconds after resuming Inventory cursor movement near ~3:30 of the run. Previous five v04 streams recorded native audio/DMA phases and producer pointers but no controller button values or exact per-poll input chronology. That input-to-audio proximity is a compelling hypothesis to test, not confirmation that a cursor operation, SFX or renderer caused a FIFO fault; different controller routes and stage times prevent retroactive input reconstruction.
A strictly opt-in, host-only extension is staged in draft RMG input PR #165, based on the proven v04 observer code rather than PR #161's alternate AI clock. It hooks pinned RMG v0.9.0's PIF update_pif_ram after netplay_update_input, copying the original response to guest JCMD_CONTROLLER_READ=0x01 (four actual button/stick bytes, port, response/error flags), not querying SDL or the controller plugin a second time. The new independent mkmszr-input-trace.bin ring uses existing 56-byte records with host CLOCK_MONOTONIC and unmodified guest CP0 Count snapshot. Its events can be assigned to the preceding recorded VI by the shared host monotonic clock and compared to native AI rejection/service chronology. Input values are guest-visible PIF reply bytes, not physical event arrival timestamps or the MKMSZ Inventory callback's consumed button/cursor-change PC; CP0 Count is not advanced for this observation and may precede a pending core Count update. No game/RDRAM/PIF writes, emulator enqueue retry, clock change, accepted gameplay alteration or ROM modification.
Activation is separate: MKMSZR_TRACE_INPUT=1 plus existing MKMSZR_TRACE=1 (and optional _MEM=1, _PHASE=1). With input flag absent, no new input records. New decoder joins VI and original AI traces and emits per-VI controller transition CSV and raw samples in ten seconds before severe FIFO rejection. It cannot retrospectively annotate the three October 10 v04 ZIPs. A small opt-out runtime/parity check plus one bounded cold-boot same-ROM stationary→Up/Down sweep→stationary route is the gate after the pinned build passes; only if that distinguishes a first phase divergence do we propose a next corrective action. New feature remains draft/unmerged pending C/Flatpak compile and maintainer observation.
Evidence labels: user-reported cursor timing Runtime-observed but uninstrumented, PIF hook reading path core-source static-confirmed, diagnostic integration implementation staged; actual aligned input/audio causal result Pending. The audio 1.0 release blocker remains.
Trace-confirmed in three complete maintainer RMG v04 captures. Original upstream game operation still Pending. The native oscillator's observed VI.delay is 811,092 guest CP0 Count, whereas the pinned emulator's accepted PCM DMA duration is exactly 551 Count/byte. A 1,472-byte/368-frame output therefore lasts 811,072 Count, just 20 shorter than one VI. Its 1,408-byte/352-frame neighbor lasts 775,808 Count, 35,284 shorter; a 1,536-byte/384-frame buffer lasts 846,336 Count, 35,244 longer. Merely changing the queued tail by 64 bytes moves its deadline 35,264 Count. This is a real integer-timebase resonance in the recorded core, not a changed game's DAC divisor.
| Observed boundary | Slowdown v04 | Speedup v04 |
|---|---|---|
| First relevant FULL first-status read (CP0 Count) |
734490199 at t191.417525s |
120258428 at t267.046551s |
| AI END promotes queued tail |
734490209, only 10 Count after FULL poll
|
120262948, 4,520 Count after FULL poll |
| Queued tail and corresponding duration | 1,408B / 775,808 Count | 1,472B / 811,072 Count |
| Next service (Count) | 735301597 |
121069894 |
| Next service minus tail-end deadline | +35,580 Count (already empty) | −4,126 Count (still BUSY) |
| Counterfactual 64B larger/smaller queued tail | 1,472B gives +316 Count | 1,408B gives +31,138 Count |
| Recorded self-maintaining state | ~38.37s accepted-only 352-frame minimum output; AI_LEN=1400
|
81 failed native enqueues across ~5.33s, roughly one every four audio services with intervening successes |
Corrected run-length terminology: The slowdown has one accepted 1,408B write at t191.400671, then an intervening rejected service at t191.417525, followed by 2,303 consecutive accepted 1,408B writes from t191.434721 to t229.801232. It is therefore 2,304 accepted 352-frame writes total in the wider interval, not 2,304 adjacent successful audio services. The previously stated 36,864 fewer synthesized samples is the correct comparison for those 2,304 accepted outputs versus 2,304 hypothetical 368-frame outputs; that descriptive comparison excludes the separate rejected synthesis event. The sustained low-output period's median idle gap from DMA END until next native AI_STATUS poll is 35,226 Count (25th–75th percentile ~35,026–35,416), versus no empty FIFO before the service during healthy 368-only output.
Measured healthy 368-only drift, not a defect by itself: The clean run's 2,387 consecutive accepted 1,472B writes (t101.740–141.508) have mean guest service separation 811,091.99 Count, while contiguous 1,472B-head DMA completions average 811,077.40 Count. The slowdown run has another healthy earlier 2,435-accepted-output plateau (t78.816–119.384), with service mean 811,092.34 and DMA completions mean 811,077.75 Count. Emulated AI DMA END delivery adds typically a few Count over the nominal 811,072 scheduled duration; thus head/service phase shifts about 14–15 Count per VI. Over ~2,400 VIs this accumulates ~35,000 Count and moves the head-only AI_LEN feedback staircase from 1,344 toward 1,280 bytes, without a new illegal writer or future bad sound being necessary. The clean plateau contains no serious reported audible acceleration. Do not treat all-368 as sufficient or necessary for failure.
Critical distinction: The speedup's 81 uninterrupted successive rejection events do not mean 81 consecutive audio services failed. There are 240 successful writes between/around those failures within the 321-service burst, and the rejection recurs roughly every fourth native service as larger synthesized buffers feed back through FULL. The synthesized sample-clock advances +23.8% above nominal in that bounded burst; audible pitch was not instrumentally measured. All three traces still have one native audio service per active VI with similar VI→status offsets (e.g. median ~7,676 Count just before slowdown vs ~7,760 Count in its 352 lock; ~7,692 before speedup vs ~7,800 during the burst), far smaller than one VI. The original upstream input/workload phase difference remains unknown: no controller log, matched per-frame gameplay route or emulator-independent proof establishes a faulty original instruction. Do not change production, suppress accepted HUD/sounds or install rejected enqueue retry.
Reproducible read-only calculation is staged in diagnostic PR #162, with raw v04 ZIPs and precise derived report/manifest in Library MKMSZR Research/07 - RAM Diffs and Experiment Data/RMG-v04-Audio-Phase-2026-10-10/. This is an explanation of the bifurcating FIFO feedback given actual recorded deadlines, not a demonstrated safe causal fix or proof that native RAM is globally intact.
New maintainer Runtime-confirmed audible outcomes; read-only trace-confirmed opposite PCM production regimes. The original upstream initiator remains Pending. Three cold-boot user uploads use the same requested prefilled Fortress composition with RMG v04 phase-provenance opt-in (underlying ROM hash not embedded in traces): mkmszr-cleanaudio.zip, mkmszr-slowdown.zip, mkmszr-speedup.zip. Each ZIP has five streams (AI, VI, RSP, host-audio, phase); all 15 traces are complete with 0 overwritten records. Duration from first VI / first Fortress-stage-9 observation: clean 379.61s / 21.379s; slowdown 229.80s / 14.721s; speedup 277.60s / 14.081s. No controller-event or precise Inventory-open instrumentation exists; reported renewed cursor movement ~5–10s before speedup is a temporal observation, not established cause.
| Capture | Guest-native rejected PCM enqueues | Longest rejection run | Distinct sustained PCM size behavior | SDL queue-threshold drops during entire recording |
|---|---|---|---|---|
| Clean | 5 | 3 | Usual 352/368/384; 2,387 × 368 from t101.740–141.508 (~39.77s), no audible major symptom | 31 |
| Slower + clips | 5, all isolated | 1 | 2,303 consecutive accepted 352-frame / 1,408-byte submissions t191.43472–229.80123 after one rejected service (plus an earlier accepted 1,408B output at t191.40067) | 9; none inside sustained 352-only window |
| Faster + clips | 87 | 81 rejection events recurring about every four audio services t267.04655–272.38070 (~5.334s), plus six isolated | Larger 704/688/416 etc during FULL feedback with skipped guest PCM submissions | 28; four during 81-rejection burst |
Previously unknown slow fixed point, including exact upstream FIFO decision boundary: Slowdown stays at 352 frames/VI with near-full-length AI_LEN=1400 on 2,304/2,305 samples over its sustained final interval, with FIFO normally only BUSY and no recurrent FULL. At the one preceding rejected service, first FIFO-status read sees FULL at guest CP0 734490199; AI END fires 10 Count later at 734490209; extra diagnostic logger status read at 734490853 sees BUSY; actual AI_LEN feedback at 734490891 reads 1,400. The next service arrives after the 1,408-byte head has drained; it starts a fresh 1,408-byte DMA, reads AI_LEN≈1400, and repeats the 352-frame minimum until exit. As with Trace 11's 18-Count mid-enqueue interrupt, this is one rejected guest submission, not two. 2,304 accepted buffers synthesize 811,008 sample frames vs 847,872 for equal accepted-buffer count at 368 target: 36,864 fewer (−4.348%). At nominal 60 VI/s this represents only 21,120 frames/s versus 22,080 target in native synthesis, consistent with slower-sounding music; no raw audio waveform or exact acoustic pitch measurement exists. At the host queue, p05/median/p95 occupancy is only 28/504/9,146 bytes, with overflow limit 17,637 bytes and zero threshold drops during plateau. This is strong evidence of undersupply/near-empty queue, not a measured SDL underrun counter.
Fast opposite fixed point: First severe FIFO FULL is queued head/tail 1,600/1,472 bytes near t267.047; guest rejects 81 submissions interleaved with successful services and synthesis continues. Across the inclusive 321-previous-AudioInfo phase samples over the ~5.334s burst, recorded producer time advances 146,272 frames instead of 118,128 at 368 target (+28,144, +23.825%), while only 240 native PCM writes are accepted. This is quantitatively compatible with perceived speedup and crunching but not a direct waveform measurement. Host queue occupancy during same interval is p05/median/p95 15,428/16,600/17,460 bytes near 17,637 threshold; four separate SDL threshold drops overlap the guest FIFO burst. Native guest FULL and SDL host drops remain independent channels.
Highly important correction: A ~40-second uninterrupted 368-only output phase is not sufficient to predict impending accelerated music: the clean audio run itself contains one lasting 39.77s, and the slowdown run contains another lasting 40.57s earlier (t78.816–119.384), without a sustained guest FIFO FULL burst. Prior descriptions of the 368-only phase as a distinctive necessary failure precursor must be qualified; Traces 10/11 had already shown it is not necessary. It may occur during healthy or failing compositions.
What the new upstream snapshot rules out in these bounded observations: Across 22,475 clean + 13,487 slower + 16,354 faster = 52,316 AI_LEN/phase snapshots, manager-ready/work-enable stay 1 after normal enable. DAC divisor 0x89F, AI control 1, bitrate 0xF, TV NTSC/crystal, host 22,047Hz, native 352/368/704/320 buffer params, all three AudioInfo addresses, both command list addresses, and synthesis pointer remain unaltered. Three output Info records cycle normally; command index toggles; native frame counter increments once per service. Across 52,313 consecutive sample-clock steps, synthesized sample-clock delta matches the newly recorded previous AudioInfo sample count exactly, zero mismatches, including full 352-only and FULL-burst episodes. First ten submitted PCM lengths are identical across all runs (2816,1408,1472,1536,1536,1472,1408,1408,1472,1536 bytes). Tiny AI_LEN value differences appear earlier (clean vs fast index 4; clean vs slow index 32) before output-size quantization diverges around accepted-write indexes 2,309/2,328 (~43.5–43.8s); user routes differ, so not a matched initiating CPU instruction. The three fixed rich-HUD/legend/helper code hashes remain constant throughout sampled stable Fortress, with valid arena cursor/HUD pointer. These are meaningful negative snapshots, not proof that transient or unmonitored memory could not be corrupted.
Causal classification: The AI_LEN-feedback/AI DMA event supports both a low-supply 352-only attractor and a high-supply rejected-overflow attractor without a changed native DAC/clock, producer pointer, frame index or whole-frame scheduler gap. The actual earlier input, microphase or producer/workload perturbation that selects one basin is still Pending. The healthy 368-only plateau and isolated host drops further demonstrate that sound symptoms cannot be inferred from a single FIFO/SDL indicator. No production correction, ROM patch, runtime emulator automation or enqueue retry is authorized. No immediate further user test needed: analyze the first phase/deadline crossing already recorded, not a fresh broad FIFO teardown. Existing draft diagnostic PRs #162, #163 and v04 #164 and Ghidra PR #7 remain independent/pending.
Provenance: Original five v04 binary streams in each of three user ZIPs, zero-lost validated. Full local evidence report MKMSZR_v04_three-run_audio_phase_findings_v01.md; structured SHA/quantitative manifest MKMSZR_v04_three-run_audio_phase_audit_v01.json. These filenames are conversation-side archives, not checked-in ROM bytes. Absolute times are relative to first VI, not Inventory-open timestamps.
2026-10-09. Trace (5) now reproduces a bounded 80-rejection native audio burst after the maintainer swept a populated Inventory cursor; upstream cursor-operation causality and permanent correction remain Pending. PR #156 stays draft/unmerged. The guarded prefilled Fortress ROM enters Inventory and allows navigation in the observed tests; exhaustive item presentation is not yet validated. No emulator automation, AI retry, or production integration was performed.
The new pair proves 135 additional rejected PCM submissions. Audio work and VI callbacks both advance by 4,934, while synthesis advances 47,616 sample frames beyond the 368-per-service target. This is close to the 47,520-sample minimum represented by those rejected buffers. Omission of synthesized musical time is therefore a strong explanation for accumulated tempo drift. The pair does not identify the Inventory operation that causes the imbalance or establish that guest rejection explains the entire audible symptom.
The earliest verified unsuccessful operation is native full-FIFO enqueue 0x8008A500; its caller ignores failure and advances synthesis. This establishes the downstream loss path. No upstream operation X or condition Y has yet been causally identified. Closure needs service/AI/task chronology immediately before rejection, followed by a matched rendering control.
ROM 0x0008B158, 1440000A → 1440FFFD, is explicitly rejected for this investigation. It remains an untested mitigation. Retrying can change scheduler timing and hang if AI stops draining. Nothing in the new counter evidence promotes it to a root-cause fix.
New read-only, trace-confirmed finding; first size divergence occurs long after the native output epoch. Work's separately staged static audio-init assessment identifies normal work-enable at 0x80001510 before frontend logos; this comparison uses the already existing complete RMG Observer v02 Traces (6)–(11), not a new emulator run. Each capture's initial AI 0x10 FIFO-push record is matched against its preceding VI 0x20 record using guest CP0 Count (wrap-corrected), not host wall clock. Each trace's first PCM DMA submission is exactly 2,816 bytes (704 frames), and the first ten submitted sizes are byte-for-byte the same sequence: 2816, 1408, 1472, 1536, 1536, 1472, 1408, 1408, 1472, 1536.
| Capture | Preceding VI callback index (zero-based) | First PCM write after VI (guest Count) | Earliest AI_LEN disagreement vs failing Trace 7 (service index) | First submitted PCM size disagreement vs Trace 7 (write index) |
|---|---|---|---|---|
| Trace 6, modified | 294 | +7,726 | 3 (1280 vs 1272) | 2,184 (~41.41 s Trace-7 epoch) |
| Trace 7, failing modified | 294 | +7,682 | Reference | Reference |
| Trace 8, clean vanilla/password route | 295 | +7,722 | 256 | 1,874 (~36.245 s) |
| Trace 9, entire selector MOVE helper bypassed | 294 | +7,722 | 260 | 2,203 (~41.728 s) |
| Trace 10, helper active / SFX call NOP | 294 | +7,722 | 258 | 2,201 (~41.695 s) |
Trace 11, helper active / s0→t9
|
294 | +7,682 | 260 | 2,203 (~41.728 s) |
These are output-buffer length sequences, not PCM payload equality. The first guest AI_LEN feedback readings can differ earlier by only eight bytes because they sample a current DMA deadline at a slightly different Count without immediately crossing the game's 16-frame size-quantization band. Vanilla differs in menus/route and is not an input-frame-matched control. The common first PCM length and first-VI-relative submission offsets of just 7,682..7,726 Count compared with ~811,092 Count/VI weaken a theory of wholly different startup audio rates or a gross audio-initialization offset, but do not establish identical first-DMA sub-frame phase, native synthesis/voice state, or the exact later triggering operation. A 40-Count initial jitter can still matter near a narrow DMA-completion boundary.
Diagnostic implication: Work's proposed opt-in host snapshot of native producer/DAC state is still potentially useful, but the first DMA submission Count, initial length and initial buffer-size prefix are already measured. The next diagnostic must discriminate the earliest state/phase divergence during frontend/stage/Inventory execution, not just reproduce startup settings or the known FIFO rejection loop. The static Work report is staged in draft PR #163, Ghidra metadata draft PR #7; neither is merged or production-authorized. A review comment in #163 clarifies the correct selector hook VA 0x8000D170 versus actual MOVE helper entry VA 0x8000D67C and requests avoiding redundant instrumentation. No ROM, game, or emulator modification was performed in this comparison.
New read-only trace-confirmed control, no new emulator/ROM execution. To test whether upstream MKMSZR Inventory/selector edits delay the native audio generator by one or more frames, pair each emulated VI callback (host observer event 0x20) with the following first native AI_STATUS read (0x13) before the next AI_LEN read (0x12). Only the first status read in an audio service counts: the rejection logger's later 0x13 is not a new audio-frame service. Compare the two emulated guest CP0 Count values with signed 32-bit wrap handling; do not use host-monotonic milliseconds as emulated CPU delay. Verify no VI interval receives two native services.
| Trace (ROM variant) | VI events | Native first-status services | VI callbacks preceding first audio service | CP0 Count from VI to service: median (p05..p95) | Min..max | Guest rejects |
|---|---|---|---|---|---|---|
| (7) full sound + helper, accelerated | 7,798 | 7,503 | 294 | 7,662 (7,406..8,064) | 7,294..9,100 | 74 |
| (8) unmodified vanilla, no sustained symptom | 19,279 | 18,983 | 295 | 7,722 (7,418..8,198) | 7,338..9,272 | 5 |
| (9) movement helper bypassed, healthy | 15,095 | 14,800 | 294 | 7,722 (7,418..8,206) | 7,318..9,394 | 2 |
| (10) helper active, SFX-call NOP, ongoing acceleration | 3,930 | 3,635 | 294 | 7,652 (7,398..7,972) | 7,294..9,402 | 352 |
(11) helper active, SFX-call NOP and s0→t9, 5s failure |
14,858 | 14,563 | 294 | 7,722 (7,418..8,212) | 7,294..9,490 | 80 |
All 59,484 observed native first-status services fall in unique VI intervals, including the entire pathological 352-failure run (10); no duplicate/missed active VI audio service is evident. The first audio service follows 294 VI callbacks in MKMSZR variants and 295 in vanilla; each capture also ends with one unmatched VI callback. There are no missing services between first and last active VI in any capture. For comparison, the pinned RMG VI interval is 811,092 Count; the entire observed ~7.3–9.5k Count VI-relative service timing range is a fraction of one frame. The central difference of the healthy-versus-failing variants is only ~60–70 Count, not a full-frame delay. The traces therefore disfavor a simplistic inventory-renderer multi-frame starvation/dropped audio service mechanism and support investigating the evolution of prior queued AI DMA deadlines and output-buffer sizes.
Boundaries: The timestamp is first AI_STATUS poll within the native enqueue call, not the instant the scheduler receives VI or begins audio_frame_work; the scheduler is already statically mapped in the original native task tracing section. It cannot establish that every producer instruction executes at the same Count, does not record controller input, title SFX events or precise Inventory-open state, and says nothing about earlier phase offsets accumulated before stage entry. A stable VI→service offset does not prove the upstream game compositional trigger is an emulator bug or that all memory is valid. RMG's DMA deadline and guest scheduling are distinct timing domains; pending work remains to identify why the audio FIFO queued tail is 1,472 rather than 1,408 bytes at the critical first failure. This also means another broad Ghidra scheduler discovery trace is redundant; the Ghidra metadata already records scheduler_vi_service 0x80000E24, audio_frame_work 0x8007D3FC, audio_frame_build 0x8007D4A8, scheduler_task_dispatch 0x80000F4C and rsp_task_submit 0x800011F0.
Reproduction inputs: use existing attached Traces 7/8/9/10/11; local read-only companion report MKMSZR_audio_vi_service_phase_audit_v01.json and script mkmszr_audio_vi_service_phase_audit_v01.py. No new user run, production edit or ROM diff. Evidence label Trace-confirmed, causation Pending.
Trace-confirmed full bounded playback accounting, not a production correction or proof that no memory corruption can exist. A fresh read-only analysis of all complete audio/VI streams (original failed MKMSZR, vanilla, entire MOVE helper disabled, SFX call only disabled, return-register change) reconstructs the pinned RMG v0.9.0 emulated AI_LEN feedback from nothing except observed DMA starts/completions, each queued head's length/duration, and the recorded CP0 Count of the read. After independent head start or promotion from tail, predict:
remaining_count = max(0, (dma_head_end_count - AI_LEN_read_count) mod 2^32)
AI_LEN = floor(remaining_count * dma_head_length / dma_head_duration) & ~7
The model handles interrupt Count wraparound and keeps the original full event chronology rather than inferring playback from wall clock. All 59,489 measured AI_LEN reads match to the byte, without exception. The established native ROM frame-size recurrence (unchanged by the controlled selector variants) is:
frames = clamp(352, 704, (((368 - (previous_AI_LEN >> 2) + 320) & ~15) + 16))
That rule also predicts all 58,971 actually submitted PCM buffer sizes, without an exception, plus 352-frame minimum-size attempts for all 513 native rejected submissions across those captures. For a rejected submission, the synthesized sample size is inferred from the previous feedback, not observed as an AI DMA write (the write is omitted by definition). This dramatically expands the prior three-second post-failure partial replay: it covers the complete recorded histories of these five independent runs, from first audio generation, across the first failure, through recoveries or shutdown. It validates internal event/length consistency, not the correctness of each recorded guest audio synthesis sample, work scheduling or N64 hardware timing.
| Capture | AI_LEN exact | Accepted PCM size exact | Reject attempts | Native outcome |
|---|---|---|---|---|
| Trace 7, MOVE helper+SFX on | 7,504/7,504 | 7,429/7,429 | 74 | one isolated, later 73 burst |
| Trace 8, clean vanilla | 18,984/18,984 | 18,978/18,978 | 5 | isolated + 3 + isolated |
| Trace 9, entire MOVE helper off | 14,801/14,801 | 14,798/14,798 | 2 | only isolated; no audible acceleration |
| Trace 10, helper on / no SFX wrapper | 3,636/3,636 | 3,283/3,283 | 352 | continuous to shutdown |
| Trace 11, helper on / no SFX wrapper / return in t9 | 14,564/14,564 | 14,483/14,483 | 80 | isolated + 79 burst; recovery |
| Total | 59,489/59,489 | 58,971/58,971 | 513 | No unexplained feedback or size transition |
For each first rejection in a burst, calculate the end deadline of its queued tail from the first following AI END event and promoted queued duration (0x14/0x15); subtract this deadline from the next native audio service's CP0 Count. Negative means service arrives before the tail ends, positive after:
| Capture/episode | First rejected head/tail | Next service relative to tail end | Subsequent behavior |
|---|---|---|---|
| Trace 7 isolated | 1,536/1,408 bytes | +31,468 Count | Recovers immediately |
| Trace 7 severe | 1,600/1,472 | −4,246 Count | 73 consecutive rejects |
| Vanilla Trace 8 three-event burst | 1,600/1,472 | −4,134 Count | Three rejects, then tail changes to 1,408 and recovers |
| Trace 9 first/second isolated | 1,536/1,408 | +31,714 / +30,816 Count | Both recover immediately |
| Trace 10 severe | 1,600/1,472 | −4,486 Count | 352 consecutive rejects; still failing at stop |
| Trace 11 isolated | 1,536/1,408 | +31,186 Count | Recovers immediately |
| Trace 11 severe | 1,600/1,472 | −3,784 Count | 79 consecutive rejects then recovers |
The original emulator 551 Count/PCM byte agrees with all data. A 64-byte tail shortening (1,472→1,408) removes 35,264 Count from the FIFO deadline, enough to switch the result from ~−4,000 to ~+31,000 even when the audio service cadence is unchanged. This is a concrete emulated-buffer/clock threshold. The clean vanilla control can briefly enter the same negative-deadline state as the modified ROM; therefore the immediate FIFO fault is not proof of bad MKMSZR code or RAM, while the modified compositions reproducibly spend more time in a trap. The canonical question remains why the whole composition/route preferentially lands in and maintains that phase, not whether the individual AI_LEN result was spontaneously corrupted.
The initial all-reads exactness check consumed recorded 0x11/0x15 head lengths/durations as model inputs. A second, strictly stronger offline replay consumes only the event chronology of native audio services (first 0x13 status-read events), AI buffer-write markers (0x10/0x11) and emulated AI DMA completion/promotion markers (0x14/0x15), together with their recorded CP0 Count timestamps. Crucially, it does not use the observed FIFO BUSY/FULL bits, recorded FIFO head/tail sizes, AI_LEN values, generated buffer sizes or accepted-vs-rejected decisions as state inputs. It instead predicts:
- Whether each service sees a full FIFO and should skip its write;
- The next native synthesis buffer size from previously predicted AI_LEN;
- Whether an actual AI-buffer write marker should occur;
- FIFO head/tail length/duration and deadline after that predicted enqueue/AI END;
- Every intermediate native/diagnostic status read and AI_LEN value, including the 18-Count DMA END interleaving.
The only external timing inputs are the previously recorded event schedule, including accepted-write timestamps and AI interrupt-delivery timestamps. In each of Traces 7/8/9/10/11, this replay reproduced every one of 59,992 observed status reads, 59,489 AI_LEN reads, 58,971 accepted native buffer sizes and all 513 failed-vs-accepted enqueue decisions, with zero discrepancy. No later observed buffer length or FIFO status is fed back into the model. This is an independent consistency check that the entire host-visible guest audio FIFO feedback evolution can be accounted for using timing and original/native buffer-selection rules, and that no arbitrary corrupted AI status/length value is needed to explain the recorded failures.
Limitations and open upstream cause remain important: The replay uses observed successful DMA-start/AI-END event times as exogenous; it does not independently predict how initial controller input, frontend patch composition, RSP scheduling or host CPU execution timing created those events. It therefore cannot certify that deleting a menu helper or changing RMG duration would repair production; it neither models unobserved guest-memory writes nor tests actual hardware behavior. The diagnostic rejection logger itself adds instructions and may perturb phase. The earliest causal operation that drives the modified game toward the unfavorable FIFO deadline remains Pending. Do not substitute this full replay for a corrective runtime gate or a production patch.
Reproducibility: complete read-only five-trace analysis and JSON report generated in the same task, with a reusable tool and synthetic tests staged in draft diagnostic PR #162 (no ROMs/traces committed). An earlier project tool tools/inventory_audio_phase_compare.py is narrower and assumes adjacent double-FULL logging; this stronger replay does not depend on that assumption and handles Trace 11's FULL → AI_END → BUSY logger interleaving. Synthetic CI parity is separate from actual hardware/runtime confirmation.
At the last of 79 consecutive rejections in Trace 11, the native enqueue routine's first AI_STATUS read (CP0 3,355,939,791) sees FULL|BUSY. A scheduled emulated AI END fires at CP0 3,355,939,809: only 18 Count later. The diagnostic rejection logger's additional status read occurs at 3,355,940,445 and sees BUSY only, then the native feedback AI_LEN read at 3,355,940,483 sees 1,464 bytes remaining on the promoted 1,472-byte head. The core's two 0x13 observations are NOT two independent native enqueue decisions. One genuine native rejected submission has already happened because the first read saw FULL. Interruption and DMA promotion between these reads changes the subsequent feedback and the next frame is only 352 samples, permitting normal audio cadence to resume. This is exactly recorded by 0x13 → 0x14/0x15 → 0x13 → 0x12 in one service. The incidental diagnostic logger adds guest instructions, so its phase can affect the exact recovery and must not be generalized byte-for-byte to an uninstrumented production ROM.
This establishes a second escape mechanism without shortening the 1,472-byte tail: the emulator's AI END event crosses the guest enqueue/feedback read boundary. For comparison Trace 7 recovers when the queued tail finishes ~650 Count before the next service, whereas at the first severe reject the same buffer's deadline is 4,246 Count after the next service. Both are sensitive to differences much smaller than one 60Hz frame; neither requires an invalid AI_LEN value or new memory overwrite in the loop. This is a proven mechanism for recovery and self-maintaining feedback, not proof of the upstream earliest perturbing operation or root-cause fix.
Research decision: Stop selector-s0 experiments (rejected by Trace 11) and do not remove the accepted movement SFX on a single healthy Trace 9. Do not start a PCM FIFO retry or alter the accepted rich HUD. An emulated-AI fractional-duration experiment (#161) remains a diagnostic, not a guaranteed cure; because it makes a 368-frame DMA longer (812,306 vs 811,072 Count), it may actually increase FIFO pressure even while reducing SDL queue drift. A real fix requires identifying an earlier native production scheduling/deadline condition and verifying it under representative ROM/audio backends, potentially including hardware-independent controls. No emulator or ROM was executed or changed for this read-only audit.
Trace (11): selector helper with SFX muted and s0 preserved still produces bounded FIFO runaway (2026-10-09)
Maintainer Runtime-confirmed audible short accelerated-music episode on second run; trace-confirmed 80 guest FIFO rejections, 79 contiguous across ~5.2 seconds; no root-cause repair established. The exact disposable ROM is MKMSZR_selector-move-abi-preserve_fortress_proof_v01.z64 SHA-256 73d8e64b078ff6211b9e059e6f46bdb90f2bef9bd829c2a7e52f41392b77fc68 (the Trace 10 native sound-wrapper call stays NOP, the helper stays active, and two register-only instruction encodings change s0→t9 for the saved helper return address at ROM 0xE290/0xE2A8, with N64 CRC recomputed). This is the s0 preservation control, not the movement-SFX-disabled entire-helper control.
| Observable | Helper fully OFF Trace (9) | Helper ON/SFX call NOP Trace (10) | Helper ON/SFX call NOP/s0 preserved Trace (11) |
|---|---|---|---|
| Recorded duration from first VI | 251.722s | 65.657s | 247.770s |
| Stage 9 first visible | 13.158s | 13.378s | 12.124s |
| Native guest FIFO-full unsuccessful submission | 2 isolated | 352 consecutive | 80 total: isolated t=162.671s, then 79 successive t=240.087..245.288s |
| Longest 368-sample-only output run | 9 | 3 | 7 |
| Native accepted DMA duration/byte | 551 Count | 551 Count | 551 Count (14,483 writes) |
| Distinct host SDL queue drops | 22 | 0 | 22, 19,312 bytes total; 1 of them at t=244.255s overlaps the native burst |
| User heard accelerated music | No | Yes, sustained to shutdown | Yes, second run brief, ~5 seconds; first run heard prolonged episode but produced no evidence |
Trace (11) integrity: AI 87,137 records SHA-256 8eb9a713696c7490c9fa116f797eaa48d0a2f16804487d5380f089d2c4677891; VI 59,432 records SHA-256 28ddd39d06ae87ecc72840fd1c9c763ec274d0fc5e9930a47e38eaed9e37408c; RSP 77,727 records SHA-256 2ff123c801d5c5fad57758650f4f8e2ea3bb919e5663ae51675c43b007468c9a; host-audio 57,930 records SHA-256 70d08ea5fa06ae163ed994bfb7b7bbed006c28601d45dbdeab310abe076dc997. All are 56-byte records with expected v01 header, saved=total and overwritten=0. The native FULL logger reads appear twice per rejected PCM generation except the last reject (one FULL read followed by a non-FULL read within the same service); count unique attempted submissions, not 159 FULL readings. Rejection burst output cycles 704/368/400-frame accepted buffers, like the earlier Trace (7) pathway; earlier isolated rejected episode at 162.671s recovered. Stable ordinary output alternates 352/368/384 frames instead of any long fixed-368 precursor. The ~40-second all-368 run is NOT a necessary prerequisite for the audio symptom.
Memory negative: 14,858 complete VI+memory sample pairs, stage 9 for 14,139 samples, arena floor 0x801B3420, maximum observed cursor 0x8028CD48 (15,432-byte sampled headroom to 0x80290990), resident cursor 0x8028C538, cached HUD pointer 0x801FEBA0, loaded HUD/legend/helper FNV32 21E410DE/2298F9CB/09615F1E stable after initial payload load. Memory flag 31 in production stage indicates the probe's expected book-keeping flags, not a newly observed corruption. VI-once sampling cannot rule out unobserved or transient writes.
Crucial bounded static register/liveness check: The retained helper at ROM 0xE27C..0xE2AF with SFX JAL 0xE29C NOP has no memory load/store instructions; it runs input bit tests, branches, sets argument registers, saves ra in t9, then jr t9. It reconstructs the original a0=0x50,a1=0x14 arguments and the following vanilla selector draw call at ROM 0xDD7C immediately overwrites a2=1 in its JAL delay slot. The analyzed following selector loop [0xDD70,0xDE60) does not read t0/t9, and its s0 is set at 0xDDA8 before drawing. ra is saved/reloaded by selector prologue/epilogue. Thus this specific muted/helper-preserved variant lacks an identified persistent register or memory mutation capable of directly corrupting the music engine; a phase/timing interaction is a stronger inference, not a deterministic proven causal mechanism.
First attempted run / RMG Shutdown: Maintainer reports RMG's usual Shutdown action (normally returns to ROM list) unexpectedly exited the entire GUI after approximately 20 seconds of perceived accelerated music; no new trace files were produced for that first run. This is a separate observed unexpected host-application exit on Shutdown, not evidence that the ROM crashed or that native game memory corrupted RMG. The observer source writes traces through atexit(mkmszr_trace_dump), not per-ROM shutdown; an abnormal process termination may bypass dumping. There are no process logs or core dumps to identify the actual crash/close cause. Second run shut down/exported normally. Do not describe first attempt as an emulated guest crash.
Conclusion/gate: s0-specific ABI preservation failed to prevent accelerated FIFO feedback and is not a candidate sufficient correction. The movement SFX itself is not necessary (Traces 10/11 are silent); bypassing entire frontend helper in Trace 9 produces one long healthy run but may shift emulator native-AI initial phase. The dramatic variation in symptom onset across near-identical silent-helper builds (~42s in Trace 10 vs ~240s in Trace 11) reinforces phase-sensitive feedback but does not prove whether a static scheduling composition issue or unobserved guest write initiates it. Avoid making a production patch on the basis of this control. Next technical investigation is comparative host AI/RSP/VI clock chronology and replay under small initial-phase perturbations, optionally using the existing strictly opt-in fractional RMG diagnostic PR #161 after ensuring a faithful user environment. No additional manual reproductions demanded solely to confirm acceleration; no enqueue retry or feature deletion authorized.
Trace (10): Sound-call NOP alone does NOT cure the selector-helper-associated FIFO runaway (2026-10-09)
Maintainer Runtime-confirmed audible acceleration and clipping; independent trace-confirmed prolonged native FIFO rejection; exact upstream trigger Pending. The attached ROM is the guarded sound-call-only NOP variant MKMSZR_selector-move-call-off_fortress_proof_v01.z64 (SHA 7ef2ce16bddcc5716df8aa030c5eaf367363a3bbdf882f6b63ceee2ba73bb25e). Against original failing prefilled Fortress Trace (7) input SHA 13346ae68efd99fb9d07929d2d1016eba1fd5d065170d58235522fd9a6e505b1, the only gameplay code change is ROM 0xE29C: 0C019306 (native MOVE SFX wrapper JAL 0x80064C18) → 00000000, with N64 CRC recomputed. The Safe Stage Select helper 0x8000D67C is still reached via 0xDD70, including input-edge logic, register manipulation, and fixed instruction count; no sound plays. No emulator replacement or production changes.
| Measurement | Sound+helper ON, Trace 7 | Entire helper OFF, Trace 9 | Helper ON, SFX JAL NOP, Trace 10 |
|---|---|---|---|
| First-VI-relative capture | 130.062 s | 251.722 s | 65.657 s (user stopped after ongoing audible failure) |
| Stage 9 first observed | t=10.284s | t=13.158s | t=13.378s |
| Native FIFO FULL paired failures | 74 | 2 isolated | 352 consecutive, t=42.206744..65.607132s (last just before recording ends) |
| Longest all-368-frame output run | 2,383 (~39.7s) | 9 | 3 |
| In-burst accepted frame sizes | 704/368/400 mix | No sustained burst | 688/416/368 repeating |
| Separate SDL threshold drops | 4 | 22 | 0 |
| Accepted AI DMA duration | 551 Count/byte | 551 Count/byte | 551 Count/byte |
| Sampled arena max | 0x8028CD48 |
0x8028CD48 |
0x8028CD48 |
| HUD data pointer / resident cursor |
0x801FEBA0 / 0x8028C538
|
identical | identical |
| Static rich/legend/helper code FNV32 | 21E410DE/2298F9CB/09615F1E |
identical | identical |
Trace 10 consists of 20,753 AI, 15,720 VI (3,930 complete memory sample pairs), 20,410 RSP, 13,832 host-audio records, with saved=total and lost=0. SHA-256: AI 020f821caaa52e25b7488550ddaf32cf99969ab0b1314fbf3d5e7eed49f9ecab; VI ae011752d45b33938249cb2c3d6f7cfd8d8f515204bf54477765146fb505f426; RSP 3906781c297b96caa361564ca33bc5699f057fd23198ee6acf8dd040dcf1e508; host 9d1107ad39ee7d5a9a8597ed9b594635dee26412b344f8b3d1ca98c65766318f. Each failed native service gives two observed FULL reads in the instrumentation, not two guest enqueue attempts; 704 FULL reads → 352 failures, with ~15 attempts/second throughout continuous episode. All three monitored code hashes remain constant in stage 9; memory sampling does not rule out transient or unobserved writes. Native RSP task cadence is ~75/s within the burst, and SDL queue-threshold did not drop an audio fragment in this capture.
Interpretation: The effect of playing descriptor 0x1FC is not necessary for a sustained accelerated-music cycle in this production composition, contrary to the leading sound-voice-lifetime explanation after Trace (9). The common change between failing Traces 7/10 and the long healthy Trace 9 is executing the selector movement helper, or the CPU/audio timing/phase resulting from executing it. The particular 39.7s 368-only precursor is not necessary for runaway (it is absent in Trace 10). The old rejected confirmation-chime v02 remains a separate unproven historical incident. This refines the suspected upstream condition to frontend helper register/ABI vs clock phase, without proving the helper changes RAM illegally or that RMG is solely responsible.
Static check of actual helper: ROM 0xE290 / runtime 0x8000D690: addu s0,ra,zero is reached on the helper call's branch-delay path even for no movement; ROM 0xE2A8 / runtime 0x8000D6A8: jr s0 uses it for return. Because s0 is callee-saved, this is an ABI-preservation concern, although the frontend selector itself saves s0 in its prologue and reloads it later in the draw loop, so actual misuse/invariant break is NOT proven. A more discriminating two-instruction register-only proof was built from the failed Trace 10 ROM, with the native SFX call still NOPed: MKMSZR_selector-move-abi-preserve_fortress_proof_v01.z64 SHA 73d8e64b078ff6211b9e059e6f46bdb90f2bef9bd829c2a7e52f41392b77fc68. Its only gameplay differences are ROM E290:03E08021→03E0C821 (preserve return in caller-saved t9) and ROM E2A8:02000008→03200008 (jr t9), plus recalculated CIC6102 CRC1/2 2A85E778/8D9A6F0A. This keeps helper logic, instruction count, SFX call disabled, and stage/Inventory/test options unchanged. The native selector itself does not reference t9 in statically scanned [0xDCB8,0xDE60), and the no-call helper has no nested clobber of t9. Guarded SHA/expected-word and precise diff tests pass. No runtime test yet; do not call this a correction.
Next closure gate (only if maintainer wants another brief manual run): use the exact v02 host observer and same prefilled Fortress/Box 1 route, cold boot the s0-preserving disposable proof, and compare guest FIFO FULLs/accepted buffer shapes with Trace 10. If it still fails, s0 alone isn't the culprit on that route; concentrated work should move to frontend helper timing/initial audio phase and an emulator-independent control. If it stays stable, replicate before treating s0 as causal because 60Hz/AI DMA phase makes short-lived negative outcomes nondeterministic. No guest retry patch, new cave ownership, or production merge authorized.
User Runtime-confirmed absence of audible accelerated music in this route; trace-confirmed absence of sustained FIFO rejection / long fixed-buffer phase; cause not finally established. Input ROM MKMSZR_selector-move-sfx-off_fortress_proof_v01.z64, SHA256 3988da00cc1fda37d314f4b20452ac678ae17cc1bc2d078c9e0dc12a857dd98f, differs from the exact Trace (7) failure ROM 13346ae68efd99fb9d07929d2d1016eba1fd5d065170d58235522fd9a6e505b1 only by reverting ROM 0xDD70 from 0C00359F (JAL selector movement helper) to stock 24040050 (drawing parameter), and changed CIC6102 header CRC bytes. All other original prefilled Fortress production + rejection logger bytes remain identical. No other feature removed.
The new Trace (9) captures 251.722s (Fortress selected and begins at first-VI-relative t=13.158s), compared with 130.062s in failing Trace (7) (Fortress starts t=10.284s). All four Trace (9) observer streams have no overwritten records: AI 707543354fe8e7faab77a1028a177420177b262ca511cc301d9c82c7f5d0ed08, VI 65643baa1666ada3fde1484a29b207ea879254db2d351a79869b8c19cbe0c478, RSP 5f1ea257b6bebb392dc4d2c087169e8a58be093bcda1e91c43f984faacd9b36a, host a7e3a31f927f95387f6a0175bbc7f4968b74a937bc65a48af9c886640b6b98c1.
| Event | Baseline Sound-ON Trace (7) | MOVE-helper-OFF Trace (9) |
|---|---|---|
| User reports audible speed-up | Yes | No |
| Native FIFO rejected submissions (two logger FULL reads each) | 74 | 2 isolated (t=123.288, 158.605s), no cluster |
| Longest uninterrupted 368-frame output | 2,383 / ~39.70s | 9 / 0.15s |
| Host SDL threshold drops | 4 (2,832 bytes) | 22 (21,520 bytes); independent host queue channel |
| Sampled stage-9 highwater / static bound headroom |
0x8028CD48 / 15,432 bytes |
identical |
| HUD data pointer | 0x801FEBA0 |
identical |
| HUD/legend/materialized fixed-code region hashes | 21E410DE/2298F9CB/09615F1E |
identical |
| Sampled arena reset base, cursor/HUD coherence | No observed violations | No observed violations |
Both runs have the identical RMG AI duration rule 551 Count/byte; Trace (9) accepted 14,798 submissions. Its two actual FULL attempts were isolated and recovered, similar to the clean-ROM Trace (8) behavior. Eliminating the selector MOVE helper changes the full audio regime before the failure, not only its audibility. This is our strongest isolated feature-composition control so far. It weakens a purely emulator-clock-only or always-on rich-HUD explanation, but does not prove the 0x1FC sound playback itself is defective: bypassing the helper also bypasses its edge logic, callee call, register/return handling and instruction-time cost; routes were not input-cycle matched; a single benign run cannot rule out stochastic phase.
Next staged control, no gameplay change: additional disposable MKMSZR_selector-move-call-off_fortress_proof_v01.z64, SHA 7ef2ce16bddcc5716df8aa030c5eaf367363a3bbdf882f6b63ceee2ba73bb25e, retains the original selector JAL helper at 0xDD70 and all helper logic (including s0 save/return) but replaces exactly its native sound wrapper JAL 0x80064C18 at ROM 0xE29C:0C019306 with 00000000, leaving delay slot 0xE2A0 intact; CRC1/2 recalculated 2A85F778/A8B71C2A. Static byte-/checksum guards passed, runtime Pending. When tested with same unmodified RMG v02 prefilled Fortress route, if stable while helper still runs it points toward native SFX playback/voice-lifetime/audio-phase, rather than helper instructions alone; if repeated runaway persists without playback, focus on helper ABI/return state/instruction timing. This is a request for a bounded single differential test, not an approved removal of selector SFX from production. No production ROM modification, no CI/emulator run and no merge.
Historical reason to test; no new runtime causal attribution. The canonical Stage Flow and Selector records rejected confirmation-SFX v02: native title confirm descriptor 0x1FD erroneously played on A (which does not commit a debug-stage choice), followed by delayed crunchy/choppy in-stage audio. Accepted selector v03a removed confirmation entirely but retained one newly pressed Up/Down MOVE 0x1FC, and tested normal post-load audio on one bounded route. MOVE has not been independently exonerated on the intermittent newer full-production composition, but the sound descriptor/callpath and prior failure are not the same.
A one-site SFX-disabled diagnostic ROM now isolates this without modifying game audio producers, modern controls, Toasty, stage mapping, Inventory, emulator or its logging. Exact base: populated Fortress proof SHA 13346ae68efd99fb9d07929d2d1016eba1fd5d065170d58235522fd9a6e505b1; generated output MKMSZR_selector-move-sfx-off_fortress_proof_v01.z64, SHA 3988da00cc1fda37d314f4b20452ac678ae17cc1bc2d078c9e0dc12a857dd98f, 32 MiB. Guarded ROM 0xDD70: 0C00359F (JAL MOVE helper 0x8000D67C) becomes the exact stock selector draw argument 24040050; 0xDD74:24050014 remains untouched. Only other differences: CRC1/CRC2 at ROM 0x10..17, recalculated CIC6102 6A853F7E/EFDDCE9E. Existing dead-epilogue helper bytes remain mapped but are no longer called by the selector, and all other production/diagnostic bytes are identical. Static/guard success only. Clean USA Rev.0 ROM was verified but never modified. No emulator run or production PR.
A/B interpretation: A single cold-boot run using this output and the same RMG v02 observer route as failed Trace (7) (Safe Stage Select -> prefilled Fortress -> Inventory Box1 sweep -> brief idle) tests whether the sound hook is necessary to reproduce a sustained FIFO-full burst. If it still fails, the menu MOVE sound is not necessary for that failure. If it stays healthy, do not call the hook proven corrupting: removing an SFX also changes clock/voice initial phase, and intermittent threshold behavior remains. A repeated matched control, FIFO precursor comparison and native sound-lifetime trace would be needed before deleting the accepted movement feature from product. This is a separate product-neutral proof, not a replacement for the draft emulator timebase test #161. Release blocker stays open.
Maintainer reports NO audible acceleration in clean vanilla Fortress. That observation is valid, but 'vanilla audio FIFO never rejects' is false. After cold boot and password-based direct Fortress access with the same separate RMG v02 host observer, the user supplied four complete binary streams (zero overwrite). Guest-memory 0x40/0x41 MKMSZR markers must not be treated as valid game invariants in the unmodified ROM. Time origins below are each file set's first VI, not Inventory-open timestamps; input and precise Inventory idle time are unrecorded. This is a real control, but not a matched script/controller workload.
| Metric | Clean vanilla Trace (8) | Full MKMSZR Trace (7) |
|---|---|---|
| Recorded span from first VI | 321.460 s | 130.062 s |
Sampled Fortress stage 9 begins |
t=53.379 s | t=10.284 s |
| Native AI enqueue attempts | 18,978 | 7,429 |
| FULL-derived rejected attempts | 5 | 74 |
| Largest consecutive failed cluster | 3 (t=124.558, 124.624, 124.691 s) | 73 (t=118.729..123.529 s) |
| Longest uninterrupted 368-frame PCM sequence | 4 native outputs (0.05 s) | 2,383 native outputs (~39.70 s) |
| Other MKMSZR 368-frame-only control (Trace 6) | N/A | 2,369 outputs (~39.47 s) |
| Observed DMA duration ratio | exactly 551 Count/byte for all 18,978 accepted submissions | exactly 551 Count/byte for all 7,429 accepted submissions |
| Host SDL-threshold drops | 40, total 30,944 bytes | 4, total 2,832 bytes |
| Audible sustained acceleration | Not reproduced | Maintainer-confirmed |
Vanilla FIFO FULL chronology: one isolated event at t=36.473 s occurs before Fortress entry in the title/password/menu state. During Fortress, three events occur t=124.558..124.691 s, then a single isolated event at t=175.859 s. Stock 0x13 FULL is emitted once per failure, whereas the debug-instrumented MKMSZR ROM has a second read 34 guest Count later; de-duplicate only the verified paired reads. All five vanilla FULL events are real and not artifacts of the modified game/diagnostic rejection logger. The healthy absence of audible sustained acceleration remains a bounded runtime negative, not proof of zero guest audio omissions or zero clipping.
Precise divergence within the three-event failed cluster (head and tail buffer lengths, in bytes):
| Event ordinal | Vanilla Trace 8 at t≈124.558s | MKMSZR Trace 7 at t≈118.729s |
|---|---|---|
| #1 | head 1600, tail 1472 | head 1600, tail 1472 |
| #2 | head 2816, tail 1472 | head 2816, tail 1472 |
| #3 | head 1600, tail 1408 | head 1600, tail 1472 |
| #4 | No FIFO FULL | head 2816, tail 1472 and subsequent alternating loop |
The two workloads enter the same initial two observable FIFO-failure sizes. Vanilla's third queued tail is 64 bytes shorter, plausibly bringing FIFO occupancy below FULL before the next service, and the episode recovers; modified Trace (7) retains the longer tail and remains in 73 rejections. The record establishes the first observed difference, not which earlier game operation or timer transition creates it. Distinct inputs/configuration and emulator wall-time jitter remain possible confounders.
Crucial pre-failure difference: vanilla shows a repeating native 352/368/384 output rhythm for most of its ~5.3-minute capture and never exhibits MKMSZR's approximately 40-second, 368-only run. This indicates that while a FIFO FULL and the early-truncated 551 Count/byte emulator timing exist without MKMSZR, that integer timing rule alone is not sufficient to force the prolonged 368-only precursor or sustained audible failure in all workloads. MKMSZR's composed code/workload/timing interaction is a stronger suspect for remaining trapped, but it does not identify invalid RAM/cave ownership, a corrupting write, or the rich HUD as sole origin. Conversely, vanilla's 40 SDL discards corroborate a distinct common host playback-queue pressure mechanism even in the absence of reported audible acceleration.
Trace 8 file identities (SHA-256): AI cf0e82b0916a1f0c5215c0a62c89b703141939104ab815719c017c85f054e19e; VI d6c11a5f5821c228a1f03fb551a51a71ea000d76e40ecd5d396443e72085fc01; RSP 63afa258f6177c1c2ab4d6fe5c091bdf0f8df4b37a779967b9a352ed6cdf19ae; host-audio 9bef85e55fc7b67bb13b124bd126d00a5b33e6db53caaefbbe754722b500c898. Decoded spans/record counts/zero-lost assertions checked for all four against prior Trace 6 and 7. The read-only comparison is reproducible from observer binary structs (=8sIIQQQ header; =QQ10I records), unique event 0x13 FULL readings, head a/tail b and 0x10 output sizes.
Next experiment, if needed: a strict opt-in RMG AI rational-duration A/B using already drafted emulator-only PR #161 with the same prefilled MKMSZR ROM, comparable controller route and original 100% SDL playback can discriminate whether the common 551-Count precision loss is sufficient to create the 40-second regime. Do not interpret clean vanilla not accelerating as proof that the 16 KiB fixed reservation is invalid, and do not permanently depend on a modified emulator without careful backend/portability review. No guest enqueue retry, rich-HUD feature drop, allocation reset or production patch is justified by this evidence alone. Release gate remains BLOCKED.
New static + trace-confirmed evidence, not yet runtime-corrected. The rejected-synthesis mechanism is already known, and Trace (7)'s memory observation weakens arena/HUD corruption as the proximate cause. Reanalyzing entire precursor windows in independent Trace (6) and Trace (7) finds unexpectedly reproducible long 368-frame-only output regimes, ending near the first isolated FIFO rejections:
| Signal | Trace (6) | Trace (7) |
|---|---|---|
| 368-frame-only run (start/end from first VI epoch) | t=82.4559..121.9227s | t=42.0450..81.7458s |
| Exact consecutive output count | 2,369 | 2,383 |
| Head AI_LEN at beginning → end | 1,344→1,280 bytes | 1,344→1,280 bytes |
| Linear AI_LEN slope per output (bytes/VI) | −0.026245 | −0.026007 |
| R² of fit (quantized steps) | 0.98389 | 0.98386 |
| First subsequent rejected PCM submission | t=122.4563s | t=82.1117s |
Both sequences complete a similar slow countdown and then transition through 352/368/384/400-sized outputs; independent Trace (7)'s monitored cursor, stage state and fixed code hashes were stable during the final stages of that drift, and its key-portrait cache had not changed since 55.73 seconds. This repetition strongly favors a native AI_LEN / FIFO timing mechanism over a random concurrent fixed-code overwrite at the instant of rejection. It does not establish that no earlier patch or memory fault influenced when the regime began. The normal-items-only control recorded no rejection in 110s, so the vulnerability is phase/composition-dependent rather than guaranteed each run.
Verified unchanged native audio producer: compare byte-for-byte clean USA Rev.0 ROM SHA 9c18254abf6722b95aa782fcd310bd95f6bcf147da66beb77ce32ca90673ffc6 against prefilled diagnostic SHA 13346ae68efd99fb9d07929d2d1016eba1fd5d065170d58235522fd9a6e505b1: ROM [0x7E0A8,0x7E350) containing the native frame builder/synthesis scheduling is identical. The audio enqueuer's only differences in checked [0x8B100,0x8B1D0) are the previously documented diagnostic rejection logger branch/stub at 0x8B15B and 0x8B198..0x8B19B. Thus this is not explained by a direct patch overwriting the native synth implementation. No computed-pointer or earlier feature side effects are excluded.
Pinned RMG v0.9.0 emulator timebase precision loss (Static-confirmed source and all trace submissions): Source/3rdParty/mupen64plus-core/src/device/rcp/ai/ai_controller.c:get_dma_duration() calculates:
return ai->regs[AI_LEN_REG] *
(cpu_counts_per_sec / (bytes_per_sample * samples_per_sec));The integer division is performed before multiplication by the requested length. With NTSC VI clock 48,681,812, host sample-rate observation 22,047Hz (consistent with AI_DACRATE+1=2,208), observed VI_delay=811,092 Count, expected_refresh_rate=60, and 4-byte stereo frames, cpu_counts_per_sec=48,665,520, so this calculation discards the fractional part of 48,665,520 / 88,188 = 551.838345... Count/PCM byte and uses exactly 551 instead. All 7,429 Trace (7) accepted DMA durations, 12,851 Trace (6) accepted durations, 2,670 Trace (5) accepted durations, and 6,314 ordinary-control accepted durations independently record exactly 551 Count/byte.
Consequences in the pinned emulator's measured configuration: one nominal 368-frame output lasts 811,072 Count while VI runs at ~811,092 Count, a near-resonance with only 20 Count/VI nominal separation. The DMA rate is 48,665,520/(4×551)≈22,080.54 frames/s while the separate SDL playback sample rate is 22,047; the expected persistent host queue accumulation is ~134.18 bytes/s, closely matching the independently measured pre-drop ~132–133 bytes/s from normal-items/full-sweep controls. This explains the independent host audio queue buildup/clipping channel in RMG without any ROM corruption. The quantized FIFO head feedback's near-resonance and 40-second slow drift may also create guest FIFO state changes, but the observed linear AI_LEN slope ~−0.0261 B/VI is not exactly the naive −20/551≈−0.0363 B/VI value: interrupt dispatch/event bookkeeping, actual VI Count jitter and FIFO feedback must be accounted for. Do not advertise the scalar calculation alone as a proven complete guest FIFO root cause or claim actual N64 hardware timing from the host emulator's arithmetic.
Focused A/B emulator-only experiment, no production behavior: isolated draft PR #161 builds on optional observer #160/#157 and adds an opt-in MKMSZR_AI_RATIONAL_DIAG=1 variant that calculates (uint64_t)AI_LEN * cpu_counts_per_sec / ((uint64_t)4 * sample_rate), carrying the fractional Count across each DMA instead of truncating per byte. Original expression executes when the flag is absent. A 368-frame request is 812,306 Count, versus stock 811,072 Count. Native game code, output samples, inventory and FIFO enqueue/rejection logic remain unaltered. Synthetic C opt-out parity/opt-in arithmetic tests are staged in GitHub CI; pinned Flatpak compilation and manual same-ROM/backend A/B testing are pending verification. This is a deliberate emulator timing intervention, not a universally accepted timing fix, and might change gameplay audio cadence or move the system into a different bad regime; inspect both guest reject counts and actual audio output before promoting any result. Do not merge diagnostics or ship a modified emulator as an implicit MKMSZR 1.0 dependency.
Decision criterion: If A/B removes the 40s AI_LEN countdown and subsequent PCM FIFO rejections while preserving 100% playback, audio sample rate/pitch, game speed and renderer/gameplay, the pinned Mupen AI timing precision becomes the leading test-supported upstream target; follow with clean-ROM control and upstream/core compatibility review, not a blind native-game patch. If it does not, use the paired traces and native control/release/PI telemetry to locate the remaining cause. Historical accelerated-audio symptoms tied to other faulty MKMSZR patches remain valid as separate incidents.
Trace (7): RMG v02 memory observer catches severe audio failure with intact monitored arena and code (2026-10-09)
Maintainer Runtime-confirmed audio symptom, trace-confirmed producer/consumer behavior, and bounded negative memory observations. Upstream root cause and any production fix remain Pending. The maintainer cold-booted the guarded prefilled-Fortress diagnostic ROM, followed the short Inventory sweep/idle route, heard accelerated music before the intended idle duration, exited normally and provided all four opt-in v02 RMG observer outputs. The trace epoch below is first VI event, not stage entry or Inventory opening. The sampled stage indicator becomes Fortress 9 at t=10.284s. The recording ends t=130.062s; all saved/total records match with zero lost events, and the VI ring includes paired 0x40/0x41 memory samples on all 7,798 VIs.
| Stream | Records | SHA-256 |
|---|---|---|
| VI + memory | 31,192 | 8271f8b57785814c27d0225a768c7676be5334ca3e749d579cc915a049618973 |
| Native AI | 44,795 | 777cff787d92e0d8844bb38becb9dca188b8b83cc190926029cfa692cf5df3f3 |
| RSP | 40,657 | 534ec641260cea5cbe259d3484e790fdefab60c49a0ae97caa5bab9659361c29 |
| Host audio | 29,714 | 19982ab8effddf1a50ea915c5e01ac2a89a6ae941be1d0845a76096dd80a4d43 |
Guest failure chronology: 0x13 AI_STATUS.FULL occurs in exactly 148 reads/74 paired failed submissions. One isolated failure at t=82.111702s has 1,536-byte head / 1,408-byte queued tail; tail drains 31,412 Count before next native service; a 704-sample output starts as a new head and feedback recovers. The later burst comprises 73 paired failures from t=118.729034 through 123.5292s, beginning with a 1,600-byte head / 1,472-byte tail; its tail ends 4,264 Count after the next service, causing the same head-only feedback state and recurrent rejection pattern established in Trace (5). Every rejected generated buffer reconstructs as 352 samples from the previous native AI_LEN; 73 sustained rejects omit 25,696 sample frames (~1.166s at 22,047Hz), plus 352 samples from the earlier isolated rejection. In the central burst there are repeating 704/368/400 accepted sizes with missing 352-sample outputs, not evidence of changed SDL playback speed or a new direct overwrite.
Observed memory/lifetime negative checks: The fixed arena floor word 0x800EECD0 stays 0x801B3420; the sampled high-water cursor is 0x8028CD48, leaving 0x3C48=15,432 bytes below the established bump upper boundary 0x80290990. The cursor settles to 0x8028C538 at t=15.630s and remains at that value during both failures. The HUD dynamic 0x1200-byte data pointer becomes 0x801FEBA0 at t=12.032s, stays below the current cursor and within bounded arena region; no invalid HUD-pointer flags are sampled. Code/hash regions remain unchanged after the initial global payload load at t=0.229s, and actual RDRAM hash values exactly equal the expected big-endian source words in the supplied SHA-pinned prefilled ROM, not just their previous snapshots:
| Traced fixed runtime range | Expected and observed FNV32 | Stable samples after initial load |
|---|---|---|
Rich HUD [0x801B28F0,0x801B2DE0)
|
0x21E410DE |
7,784/7,784 |
Inventory legend [0x801B2F50,0x801B30E4)
|
0x2298F9CB |
7,784/7,784 |
Materialized helper [0x801B30F0,0x801B33BC)
|
0x09615F1E |
7,784/7,784 |
No observed fixed-code corruption, arena-boundary crossing, or stale HUD pointer in these bounded sampled fields. The first 14 samples precede payload loading, so their differing hashes are not corruption. The selected key-portrait preview cache, a much narrower signal than all Inventory selection activity, last changes at t=55.729645s, more than 63 seconds before the sustained burst. This weakens a synchronous key-portrait-change trigger for the second burst; ordinary slot selection, CPU writes/PI DMA and asynchronous effects are not logged.
Stable overall scheduling: Native audio generation frame counter increments by one per active VI (7,504 consecutive one-step advances; 293 pre-audio zero advances). RSP first-run/task-event cadence remains nominal ~75/s across the failure window (for example 360 first-run tasks over ~4.8s), not an aggregate task-collapse or massive VI duplication. Both fails arise while monitored code/arena are stable. The separate SDL queue guard drops four host fragments totaling 2,832 bytes, at t=109.562, 120.112, 120.912 and 122.297s; the first host drop predates the severe guest rejection burst by over nine seconds. Host drop and native FIFO rejection remain independent loss paths; these timestamps do not acoustically identify the precise audible-onset event.
Pre-burst cadence change: Across t=56..76s, all 1,200 accepted guest output buffers are exactly 368 sample frames and match 1,200 VI callbacks, with no memory-state or stage change. Shortly before first isolated failure at 82.112s and severe first rejection at 118.729s, accepted lengths transition through 352/368/384 into 400-sample buffers, followed by the established FIFO phase boundary. This makes the native head-only AI_LEN feedback and the long-term PCM-vs-VI Count quantization a higher-priority mechanism to examine, but is not proof that the emulator is wrong or that all historical MKMSZR accelerated audio had one origin. Other accumulated production patches, resource writes, and unmonitored guest memory are still possible original inputs.
Diagnostic scope and next closure gate: v02 is a once-per-VI read-only observer, not a full memory writer/heap allocator trace. A zero-alert result cannot detect transient allocations/writes between VIs, corruption present before source hash first becomes stable, unmonitored code or structures, heap metadata damage, or PI/audio-buffer ownership errors. Do not certify full 16 KiB production safety, delete Toasty/modern controls, silently change production audio semantics or apply the rejected FIFO retry. The best next static step is to derive the first pre-rejection audio service/AI_LEN phase transition from the complete Trace (7) and compare to the unchanged stock native audio code and pinned emulator timing, then select one narrow instrumented upstream proof (e.g., head/tail or allocation caller/target) only if required. No further blind manual sweeps needed solely to prove the symptom.
Causal reproduction of the sustaining feedback loop only, not initial upstream trigger. A deterministic, read-only replay began at the exact first Trace (5) FULL read with host-observed FIFO head 1,600 bytes, queued tail 1,472 bytes, head completion 4,258 Count later and the reconstructed rejected 352-sample PCM output. It used native feedback formula max(352,min(704,((368-(AI_LEN>>2)+320)&~15)+16)), pinned RMG duration 551 Count/byte, and recorded service/write/AI_LEN instruction Count timestamps as exogenous scheduling input. Crucially, it used no subsequent observed buffer sizes to advance its simulated PCM producer and modeled no guest-memory writes. The following 181 service decisions in the first 3.0s were exactly matched: 46/46 rejected FIFO enqueues, 135/135 accepted writes, every submitted size and AI_LEN. This independently supports a self-sustaining FIFO/AI_LEN bifurcation once the captured initial condition exists. It does not prove memory integrity or identify how the initial head/tail phase was reached.
The replay first departs from the actual AI_LEN outcome around 3.483337s after the first rejection: a predicted nearly-new head would read 2,808 bytes while actual feedback reads zero, despite both predicting an accepted native submission. Such extremely close DMA boundary effects matter; the model thereafter diverges in some FIFO statuses and cannot be presented as a full 5.27s exact replica. A less precise fixed-offset version matched the same initial 181 services and failed earlier. Historical runtime correlations between sound and ROM corruption remain genuine project-specific evidence, but the 46 repeated failures within this burst need not each be caused by fresh writes or HUD operations.
Immediate precursor: accepted 400-sample buffers appear at −150, −49.95, −33 milliseconds before first Trace (5) FULL, after minutes of normal 352/368/384 cycling; the isolated Trace (6) first FULL has just one 400-sample precursor at approximately −49.83ms. The observational distinction is stronger than the claim that key portrait DMA always triggers the problem. The first upstream phase deviation can still come from anything in the composed ROM, lifetime/cursor pressure, or scheduling/feedback. Correlate with host read-only RDRAM probes in draft #160 before declaring a culprit.
New implementation/static evidence; runtime Pending. Following the maintainer's reminder that accelerated/crunchy audio has historically accompanied multiple unrelated bad MKMSZR patches, the investigation retains all older composed features, their RAM/caves/ABI/lifetime assumptions, and the unchecked dynamic native arena allocator as possible upstream causes. The earlier Trace (5)/(6) FIFO phase reconstruction is downstream symptom mechanics, not proof of a native-audio or emulator bug. No current static evidence proves that the 16 KiB floor, rich HUD, modern controls or Toasty is invalid.
A new independent draft diagnostic PR #160 is based on the separate PR #157 host observer, not PR #156, and changes no game-ROM or production patches. Exact pinned RMG v0.9.0 source has a read-only physical r4300->rdram->dram word array, allowing guest state sampling at VI without issuing AI/PI/MMIO reads or writes. The optional MKMSZR_TRACE_MEM=1 + MKMSZR_TRACE=1 captures, at each VI, two metadata-only 0x40/0x41 records in the existing VI ring: arena cursor/reset floor, HUD dynamic pointer, stage/MKSV, native audio frame count, sampled high-water, selected owner-code-region hashes and selected UI/audio state words. Neither option enabled means no active memory sampling. Hashes are change indicators only: transitions, unloaded optional modules, and legitimate runtime state changes must be separated before calling corruption. Guest access is host read-only; the observer can still perturb wall-time timing and cannot guarantee any transient write or allocation peak between VIs will be detected.
Synthetic C compilation with warnings-as-errors, exact-source anchor/idempotence checks and an unchanged synthetic 8-MiB RDRAM test passed locally. A separate v02 Flatpak build uses the pinned host-observer workflow, with CI preflight synthetic test. The latest shared repo lint reports inherited EXE001 on unmodified tools/inventory_audio_pair_audit.py, whose SHA matches current main and #157; do not attribute it to v02. A pinned RMG v0.9.0 Flatpak build completed CI successfully on diagnostic commit f6c67e5fbbcb19d759fd5af7becac8e2de5fe078 (Actions run 37899907006, artifact rmg-host-observer-v0.9.0-flatpak, SHA-256 of artifact ZIP 09af8f7e9522a9c578f7d5789f08c765bfdc71f3a47918b1df4a61047ffae4ec). This verifies compilation/package/linkage, not guest runtime correctness. Later draft-branch lint-only updates have independent CI; observer-off parity and real runtime capture remain Pending. The supporting decoder rejects overwritten rings and reports bounds, apparent stale pointer, owner hash changes, headroom and simultaneous FIFO FULL pairs.
Additional earliest observed pre-burst size anomaly: In Trace (5), accepted 400-sample PCM buffers occur at t≈−150ms, −49.95ms and −33ms before the first 80-rejection burst; a matching Trace (6) isolated rejection has one 400-sample buffer at t≈−49.83ms. The four seconds immediately preceding Trace (5) otherwise show the normal 352/368/384 pattern (one second directly preceding includes the three extra 400s). These buffer values are native feedback consequences (AI_LEN/head and synthesis accounting), not validated evidence of a memory write. Distinguish the first feedback phase perturbation from later self-amplified rejections, and correlate it with persistent owner/lifetime changes if the new observer records them.
Decision tree for the next naturally reproduced failure, without new gameplay modifications: (1) Cursor crosses 0x80290990 or dynamic allocation metadata becomes incoherent before audio anomaly → diagnose heap pressure and allocation caller/rewind first; (2) fixed code hashes change unexpectedly within stable stage while audio deteriorates → identify writer/overlay/load owner, not PCM enqueue; (3) HUD pointer violates current cursor or remains stale after rewind → repair lifetime contract; (4) no violations seen → do not certify RAM safe (VI-only sampling misses short corruption), but escalate to bounded targeted PI/allocator-write instrumentation or guest scheduling analysis. Preserve rich Inventory/Toasty/modern controls; do not install rejected FIFO retry or merge PRs prematurely.
Smallest manual check after a verified build: cold-boot the existing prefilled Fortress proof via Safe Stage Select, open Inventory, sweep Box 1 (ordinary/key rows) for ~30 seconds and leave idle until ~90–120 seconds total, then cleanly exit/export both VI and AI plus host/RSP traces. Note the approximate audible onset; no combat or stage progression. Do not ask for lengthy uninstrumented replays if this route does not naturally reproduce. Current release blocker remains open, and this instrument is not a production guard or solution.
Scope correction from maintainer: Accelerated or crunchy audio has historically accompanied multiple unrelated faulty MKMSZR compositions, including misuse of live zero-looking data, out-of-range GAME SETTINGS cursor type/index, stale or overwritten displaced native stores, overlap of proof trampolines/controls, premature lifecycle hooks and excessive resource/arena pressure. Audio changes alone can mask symptoms. The rich HUD is a temporal correlation, not an established sole culprit; consider earlier features and their cumulative interactions. These known histories are indexed in Experiments, failures, and superseded findings. Host SDL queue drops are additionally independently observed and are not proof of corruption.
Read-only current-ROM fixed-owner checks: Locally supplied clean USA Rev. 0 ROM SHA 9c18254abf6722b95aa782fcd310bd95f6bcf147da66beb77ce32ca90673ffc6; exact instrumented full-production-derived trace v01 ROM SHA 9b7c47758be500535ef10a4c0a063667e50cded66ab28a1b101f0182d4be3152; prefilled derivative SHA 13346ae68efd99fb9d07929d2d1016eba1fd5d065170d58235522fd9a6e505b1. All three identities verified. Diagnostic file 0x1A entry points to [0x01816000,0x01819C00), raw size 0x3C00, loading to [0x801AF820,0x801B3420). Patched arena base is 0x801B3420, exactly adjoining—not overlapping—the complete fixed file-1A payload. Stock floor constructions 0x66F60/64 and 0x66FE4/68 are accounted for by the guarded reservation/bootstrap. A conservative permanent-code LUI+ADDIU/ORI literal search finds both stock construction pairs in clean and one patched pair in diagnostic (other is replaced by the bootstrap). This is not a complete computed-reference scan.
Additional selected historical failure guards against this exact instrumented ROM: stock live action/dispatch interval [0x000A1308,0x000A1544) is byte-identical to clean; GAME SETTINGS stale store at 0x00077918 is NOP; current rich-HUD ensure helper sets a0=0x1200 at 0x00074F14 before allocator JAL at 0x00074F18 (the historical v20 source offset 0x74F08 is no longer the same emitted instruction in this later helper layout). The data-only prefill changes 140 bytes wholly within N64 CRC and the explicitly owned ten-slot LIVE plus forty backing inventory words; no code/payload change. These are narrow negative checks, not an assertion that all reused caves, callers or writes are safe.
RDRAM owner reconciliation: Current main's named fixed suballocations (TURN, modern controls, optional rainbow, Temple scripted check, lifecycle-v06, compact Toasty, Power-pickup flash, global materializer, rich HUD, in-Inventory switch, legend) are non-overlapping. Draft PR #156's materialized Inventory tail [0x801B30F0,0x801B33BC) also fits without overlap; the diagnostic rejection logger exclusively owns the final [0x801B33BC,0x801B3420) in trace v01. Small alignment and reserved gaps are not new free caves. The RDRAM Memory Map now explicitly records lifecycle, global materializer, rich HUD and legend owners that already had known ROM intervals, plus separately labelled proof-only #156/logger ranges. Fixed range disjointness does not test wild pointers, incorrect direct stores, overlay state, queue consumers or transient allocator pressure.
Dynamic-heap risk is meaningful but unproven: Native allocator 0x8006643C has no intrinsic bounds check. Previous 16 KiB floor all-stage profiler (different proof composition) recorded peak cursor 0x802893E8, with 0x75A8=30,120 B remaining to confirmed upper limit 0x80290990. Later post-Kia accelerated Fortress paired states (another composition/lifecycle phase) recorded cursor 0x8028C538, only 0x4458=17,496 B from that upper limit. The 0x3150=12,624 B cursor difference is not a measured additional allocation in the same run and cannot be assigned to the HUD, Toasty, global materializer or the 16 KiB floor. Peak load/use/rewind intervals and intervening life-cycle state are absent from the existing host traces. An earlier 16 KiB all-stage runtime proof and accepted full-composition testing mean the fixed reservation has not been disproven, while they do not certify new composed peaks. A prior independently identified rich-HUD stale-pointer-after-rewind invariant remains open but had no stale victim in the failing captured states.
Next priority, not new speculative production behavior: Stop narrowing exclusively to glyphs/portrait and instead audit composed arena high-water, actual allocation size/caller and reset/rewind lifetime, while checking fixed payload/active native hooks and cross-feature boundary invariants. First gather event provenance through an observation-only host extension (rather than changing the ROM) if necessary: read existing guest cursor/reset-floor words at VI; compare memory owner sentinels around shared payload, LIVE/backing and dynamic HUD pointer; capture PI/ROM-DMA and native task generation IDs only if a first violating event points there. Host reads must not add emulated register reads or affect guest scheduler; observer-off parity and a bounded manual runtime gate remain mandatory. No error is yet proved in 16 KiB size or any one feature, so do not remove Toasty/modern controls, shrink reserved RDRAM, add AI FIFO retry, disable rich rendering or merge #156/#157. The 1.0 release gate remains Pending.
Implementation/static-confirmed artifact, runtime Pending; NOT an upstream correction. A bounded data-only derivative of the already documented exact diagnostic trace v01 ROM (source SHA-256 9b7c47758be500535ef10a4c0a063667e50cded66ab28a1b101f0182d4be3152, MD5 62cb2c88a25b622998400cfe8c904188) has been generated as MKMSZR_inventory-audio-prefill_fortress_proof_v01.z64 (SHA-256 13346ae68efd99fb9d07929d2d1016eba1fd5d065170d58235522fd9a6e505b1; CRC1/2 3A85F740/30DDFEC6). The supported clean ROM's SHA-256 was checked and its bytes left unchanged. The exact unfilled control is the existing trace v01 ROM; no extra control variant is required.
Static guard conditions: exact input digest/revision, N64 header/CRC, starter LIVE and forty authoritative backing slots, MKBX and active box state, live rich row/preview and box-switch hooks, stage-key table 800A5FE4, arena floor 801B3420, valid 21-credential multiset 0x0E..0x22, checksum and readback. Only ROM 000A6C0C..000A6C33 (ten-word initial LIVE), 000A6C48..000A6CE7 (four native backing boxes) and header CRC 00000010..00000017 change; 140 changed bytes in total. No audio, RSP, renderer, code-hook, arena, resource, palette or file-table changes. The old 000A6BE4 default template is a stage-key table, not an initialization channel; this proof does not repeat the failed template-seeding method.
Box 1 contains ten ordinary/key/crystal entries; Box 2 ten different entries; Box 3 is wholly empty; Box 4 has nine foreign-stage keys plus one empty slot. All 21 true keys 0x0E..0x22 occur once, and no fake Glass, Map or nonphysical Power Upgrade is prefilled. The accepted presentation reads the authoritative backing identity to show true colored stage labels and portraits, while the unchanged Fortress-stage LIVE mask safely presents out-of-stage credentials as SEALED; crystals 0x20..0x22 remain native. The game starts from Safe Stage Select Fortress without bosses or prerequisite progression, but actual display and stage-entry survival are untested.
Audio discrimination: existing Trace (4) files SHA-match the already documented Trace (3) files in all four streams. They are duplicates, not independent new measurements. The 352-sample floor lock follows mechanically from AI_LEN=1400: max(352, ((368-350+320)&~15)+16)=352, then 352×60=21,120 samples/s, 927/s below measured host playback 22,047. Because this regime persisted through Inventory closure, sustained rich-row rendering is not required to maintain the lock after entry. That does not identify the initial phase perturbation. Separately, 135 additional ignored FIFO-full submissions and extra synthesized frames strongly support omitted PCM as a temporary tempo-shift mechanism, while the upstream initial trigger remains unproven.
Bounded paired manual route (per cold boot; observer/settings unchanged): Fortress direct entry, Inventory closed 20s; Box 1 idle 150s; Right to Box 2 idle 60s; Right to empty Box 3 idle 60s; Right to Box 4 idle 60s; Right to Box 1 idle 30s; move selection down two slots, idle 30s; close for 10s, then exit/export. Repeat identically for the existing unfilled control. Do not use a state from the other ROM, pause, speed-shift or fight; end early if death threatens. Capture audible onset and whether labels/portraits/masking are correct. Compare new failed enqueues per VI, AI_LEN/sample-size transition, Count deadlines, task events and independent SDL host drops, respecting observer ring-overwrite counters. An occupied/empty contrast narrows workload causality but the existing observer does not identify native WESS generation/Inventory-operation provenance. No AI FIFO retry/spin-wait or visual removal is permitted.
Runtime-reproduced symptom and native rejection cycle; source-operation trigger still Pending. The maintainer first ran the new deterministic prefilled-Fortress ROM through the prescribed multi-box idle route plus an extra idle minute, hearing no acceleration, crunch or clipping. They then cold-booted, entered Fortress from Safe Stage Select, opened Inventory, rapidly moved Box 1's selection down the complete list and back up, and heard music accelerate less than a minute after game boot. They stopped and exited after another ~5–10 seconds. They may have stopped at Shield but do not remember exactly. No controller input events, Inventory-open flag, selected item identity or stage marker are recorded by the observer; exact cursor-to-failure causality is not proven by these files.
Read-only decoding of the uploaded mkmszr-*-trace(5).bin files with the v01 MZRHST1 56-byte layout independently validates event counts, timestamps and record continuity. All saved/total counts are equal, with zero overwritten records:
| File | Events | SHA-256 |
|---|---|---|
mkmszr-vi-trace(5).bin |
6,090 (3,045 callback + 3,045 next-due) | f9cc11639872d8a8f58159db8aa0613443321eb23ce98aa3b517c85143e575a6 |
mkmszr-rsp-trace(5).bin |
15,285 | e55ca4fbdf37291e4f08599f8e339e5a02dfcf0450cc4f7cc63cc47b44214da8 |
mkmszr-host-audio-trace(5).bin |
10,678 | 795b68f7d0d368c59c5231af7bd55cd1778ca52ab2d7f80b390d97c8283b27c3 |
mkmszr-ai-trace(5).bin |
16,259 | 66b45ae72fd185b24993bfecfd4874e6301386a0e557062517e87c81754f2d86 |
Host times below are relative to first VI event, not first controller input or Inventory opening. AI and host-audio recording begin at ~t=5s; the full traces cover t=0..50.94s. The first paired AI_STATUS.FULL reads occur t=42.356981/42.357092s, and the final pair at t=47.624001s. There are precisely 160 FULL reads in 80 close pairs, consistent with 80 native full-FIFO rejected enqueue attempts. There are zero SDL queue-threshold drops and zero SDL-push failures in this capture; RMG reports playback 22,047 Hz, speed factor 100%. Host queue during the episode ranges 6,056..9,016 bytes, not a nearly empty queue and below the existing 17,637-byte guard.
First failure chain: immediately before t=42.357, accepted PCM sizes rise into consecutive 1,600-byte (400-sample) buffers. At t=42.356981 native AI_STATUS is BUSY+FULL C0000000: the head is 1,600 bytes and queued tail 1,472 bytes, with first read CP0 Count 2067584573. Its scheduled AI DMA completion occurs at Count 2067588831, only 4,258 Count units later (~0.087 ms). The native AI_LEN read immediately after failure returns zero due to eight-byte rounding of the tiny remaining head. The next audio generation consequently selects a 2,816-byte (704-sample) buffer. This is the same near-boundary, head-only AI_LEN feedback amplification mechanism identified in the earlier Trace (2).
Exact per-generation accounting: for each accepted AI write, apply the established native next-generation formula max(352,((368-(AI_LEN>>2)+320)&~15)+16) to the previous audio service's recorded AI_LEN. All 2,670 of 2,670 accepted writes agree with the resulting 4-byte/sample-frame length. Assigning the same prior service feedback to each close pair of FULL reads identifies 80 rejected 352-sample buffers, or 28,160 skipped sample frames = 1.2773s at 22,047 Hz. These are reconstructed rejected output sizes from the exact static routine and host AI_LEN chronology; failed enqueue attempts have no AI_DRAM/AI_LEN write event themselves.
During the stable central interval t=43..47s, there are 240 VI callbacks, 180 accepted buffers (60 each of 1,472, 1,600, 2,816 bytes) and 60 rejected 352-sample buffers. Accepted frames total 88,320; synthesized frames corresponding to those submissions and rejects total 109,440, a ratio of 1.23913. This is roughly 24% extra sequenced/synthesized sample time relative to delivered sample time if the documented ALSynth/WESS relationship remains intact, not an independently measured audible BPM. In the raw chronology, the accepted-size pattern alternates between groups with two 704-sample buffers and groups with two 400-sample buffers, plus a 368-sample buffer and a lost 352-sample buffer per four-VI group; the 368/400/704/rejected-352 grouping is an average, not one literal repeating four-event order.
The failure self-terminates: final FULL read at t=47.624s, first later accepted AI write at t=47.641s; from t=48..50s there are 120 VI callbacks, 120 accepted writes (40 each at 1,408/1,472/1,536 bytes) and zero further rejections. This is consistent with the maintainer's transient accelerated tempo rather than a permanent playback-rate change.
Scheduler/host discrimination: during t=42.35..47.65, 318 VI callbacks occur; VI delivery is within at most 39 Count units of scheduled due in this interval (measurement based on callback/next-due pairing). Adjacent AI DMA completion events follow the prior head duration with median 6 Count units residual, maximum 56 in this window. Native AI_STATUS read offset from preceding VI due has median 7,597 Count during the burst versus 7,535/7,561 at t=40..42. No grossly late AI consumer completion, VI multiplication, large audio-service phase shift or host SDL drop is established as the immediate cause. RSP first-run count remains about 75/s across t=25..50 but the logger lacks per-task generation, CPU draw cost, controller events and ROM DMA identities.
Focused source lead: Current production src/mkmszr/patches/inventory_hud.py _preview_code caches only the last (stage << 5) + (key ID - 0x0E), and for every change to a real key/crystal selection synchronously invokes ROM_DMA_VA=0x80001530 to stream a 0x6C0-byte portrait to a shared slot. Returning to a previously seen different key triggers another transfer. The _row_code also resolves true backing IDs behind SEALED LIVE entries and renders stage-colored font. This makes key-specific preview DMA/colored row work a testable hypothesis for cursor-sweep sensitivity, not established causal timing: no observed DMA event is aligned to the first FULL pair, and guest audio service remains phase-stable within the measured intervals.
Next lowest-cost manual discriminator (no new ROM required): cold-boot the same prefilled ROM and observer/settings for short (~60–75s) sessions, contrasting (1) stationary Box 1; (2) rapid selection restricted to first four ordinary items (Herbs, Potion, Shield; do not enter any key/crystal); and (3) one rapid full Box 1 sweep through the actual stage keys/crystals, then idle. At minimum repeat the positive full-sweep route once before claiming reproducibility. Match stage/menu/open timing as closely as possible and record approximate sweep seconds. If ordinary-only remains clean while key traversal repeatedly causes FULL bursts, prioritize synchronous portrait ROM DMA/source identity and per-selection frontend. If both sweep types fail, prioritize generic selection/text/navigation CPU effects or background phase. The observer still lacks input/PI markers; a subsequent precise first-event chronology would need a bounded observer-only enhancement. Do not build a rendering deletion or AI enqueue retry, merge either diagnostic PR, or assert a production fix.
Maintainer Runtime-observed: both comparison runs did not reproduce accelerated music. In the normal-items-only experiment, there was no reported speedup or appreciable crunching; in the second/full-item cursor experiment, there was no speedup, and only a few isolated audible clips were reported. Both used the new prefilled Fortress diagnostic and the separate opt-in RMG observer. There are no input/phase/onset markers in the traces: exact cursor action times cannot be reconstructed; do not attribute the few clips to a particular dropped packet.
Read-only input validation: all eight files contain complete MZRHST1 v1 56-byte records, sequential event IDs and monotonic per-ring timestamps, with zero overwritten entries.
| Run | Trace | Events | SHA-256 |
|---|---|---|---|
| Full-sweep retry (6) | VI | 26,300 | 1927d45c517a8088d9cc43ff5ecf149ed05c1d775a0a6c4af15d8f133ec3b32d |
| Full-sweep retry (6) | RSP | 68,450 | 6f89ecafb274b064f114f98a927a2481daffecc1cf0441ea567e631a6ef5cf83 |
| Full-sweep retry (6) | Host audio | 51,404 | 0cce60a890f815a8c167a760709fa3e85d960433323b7355e1c7ac3be9b439f9 |
| Full-sweep retry (6) | AI | 77,117 | c94c1188dececc35261315d9b223e7e29b9cd77eea834f627855cf3e6074ee30 |
| Normal items only | VI | 13,218 | c9e69a25306d9533d3f0611ab8c149c63fef5ed1820d7d43337525cb05abed4a |
| Normal items only | RSP | 34,016 | eaede42430da447a2491e9282afcb3fc78efd48715befb1e128bba6fd1b02194 |
| Normal items only | Host audio | 25,254 | b4d6130271a3c8d946521286bd316e24ee4c9e8beecf2902a0667d4269e36b8d |
| Normal items only | AI | 37,883 | b27aa3788fefc47c47d0227ad92237856ab5077150bca85ad09909c9f20755c0 |
| Measurement | Normal-items-only | Full-sweep retry (6) |
|---|---|---|
| VI host-timestamp span | 110.27s / 6,609 VI callbacks | 219.32s / 13,150 VI callbacks |
| Native AI writes | 6,314 | 12,851 |
| Native AI_STATUS.FULL read pairs | 0 | 4 isolated paired failures |
| RMG SDL host-discard events | 0 | 14 drops / 14,920 bytes |
| SDL push calls returning failure | 0 | 0 |
| Host queue sampled maximum | 17,548 bytes | 17,724 bytes, above the 17,637-byte drop guard |
| Host output frequency / speed | 22,047 Hz / 100% | 22,047 Hz / 100% |
The four isolated full-FIFO rejections in the long run occur at t=122.456, 157.373, 192.207 and 192.323 seconds from the first VI event. They do not start a sustained positive-feedback loop. Their next accepted audio writes include 704- or 688-sample buffers (AI_LEN of 0 or 8 bytes), followed by return to nominal 352/368/384-sample cycling. Their roughly 35-second separation for the first three is compatible with a slowly changing AI/VI feedback phase as a hypothesis, not proof of an oscillator or Inventory event.
More robust independent host-clipping mechanism: RMG starts discarding audio whenever queued bytes reach its roughly 0.2-second threshold (17,637 bytes). In both negative runs, pre-drop queue growth during t=15..95s fits ~133 bytes/host-second (linear fits 132.82 and 133.13 B/s). A nominal 60-VI/s guest output of 368 stereo samples × 4 bytes is 88,320 B/s, versus 22,047 × 4 = 88,188 B/s host playback—132 B/s surplus. This precisely accounts for the observed gradual host-queue saturation without invoking any changed Inventory workload. It is a host producer-versus-playback rate mismatch at this operating point; do not conflate it with the different emulated-Count AI DMA timing. In the normal-only run, its queue reaches 17,548 bytes but the recording ends just before crossing the guard. In the long run, the first recorded SDL fragment drop is at t=111.790s, before the first native FULL pair, and further host drops persist at later times. The 14 dropped chunks total 14,920 bytes = 3,730 stereo frames, ~0.169 seconds at 22,047Hz spread across many events. This is strong evidence for an independent intermittent clipping-risk path, but not direct acoustic attribution of each maintainer-heard clip.
Relation to successful Trace (5): Trace (5)'s 80 rejected submissions in 5.27s and accelerated music remain a genuine runtime reproduction; these negative controls neither refute the feedback rejection mechanism nor establish that cursor movement is necessary or sufficient. Unlike the Trace (5) burst, both negative runs maintain essentially nominal 60Hz VI and accepted native PCM cadence without a runaway failure. The positive/negative comparison weakens a deterministic “key/portrait switch always causes speedup” theory and favors a phase-sensitive guest AI producer/consumer transition as a competing explanation. The rich renderer/portrait ROM DMA can still act as an intermittent phase perturbation, but its actual timing at onset has not been observed. No production correction, RMG patch, retry, emulation automation or new ROM follows.
Recommended next action: Stop blind manual reproductions. First resolve the native AI_LEN/AI FIFO feedback dynamics and how a single rejection tips (or does not tip) the cycle, by analyzing complete pre-failure event intervals against the negative near-boundary cases. If renderer attribution is still needed, extend only the separate opt-in host observer with bounded input/selection/PI-DMA provenance and audio-generation/service timing (no extra guest AI register reads), then collect on a natural failure. Keep PR #156/#157 draft and the upstream root cause Pending.
New focused read-only reconstruction — no emulator, ROM patch or production change. Reprocessed the original untruncated AI and VI host traces using the observer's MZRHST1 56-byte schema and recorded DMA completion Count. The comparison identifies the immediate mechanism determining whether a rejected native PCM buffer leads to more rejections or rapid recovery. It does not identify why the initial dangerous buffer/phase combination arose, nor prove the Inventory/portrait path triggered it.
The first FIFO-full read in Trace (5) is at relative host t=42.356981s; in Trace (6), first isolated failure is at t=122.456338s (all times relative to each run's first VI log event). The audio service's VI-relative Count offset is almost identical at their respective first failures: 7,592 versus 7,596 Count. Thus a large late VI/audio-service dispatch is not needed to explain the different recovery outcomes.
| Directly traced quantity at/after first failure | Severe Trace (5) | Isolated Trace (6) |
|---|---|---|
| FIFO head / queued tail when FULL | 1,600 / 1,472 bytes | 1,536 / 1,408 bytes |
| Head DMA end after first FULL read | +4,258 Count | +4,492 Count |
| Tail DMA end minus next service (positive = still queued) | +4,222 Count | −30,628 Count |
| AI_STATUS at next service |
40000000 = head BUSY |
00000000 = FIFO idle |
| New submission after previous failed output | 704 frames | 704 frames |
| AI_LEN read immediately after that submission | 0 bytes (old head nearly completed) | 2,808 bytes (new 704-frame head) |
| Consequence under native head-only feedback | Next generation may again be 704 frames; overflow loop | Next generation is 352 frames; normal 352/368/384 rhythm resumes |
Mechanism: The native enqueuer at 0x8008A500 fails without an AI write when FIFO FULL, but audio_frame_build at 0x8007D4A8 still calculates a new buffer via its existing AI_LEN head-only feedback. The rejected generation is skipped, the producer continues. Both failing first services see AI_LEN=0 and therefore generate the 704-frame maximum. The next service is the fork: if the old queued 1,472-byte tail has not quite drained, the 704-frame buffer goes into the tail and the following AI_LEN can read zero again; if a 1,408-byte tail has drained, 704 frames enter an empty FIFO as the head, AI_LEN reads nearly 2,816 bytes, and the next synthesis shrinks to its 352-frame minimum. The 64-byte tail difference equals 35,264 Count units at the observed 551 Count/byte. Holding the Trace (5) measured phase fixed, a hypothetical 1,408-byte tail would finish about 31,042 Count units before the next service instead of 4,222 after. This counterfactual explains the branch, not why the original native tail sizes differ.
All four isolated failures in Trace (6) show the same next-service-empty recovery condition: tail completion relative to next service of −30,628, −31,264, −31,194, −34,804 Count, respectively. Their next accepted 704/688-frame buffers are heads with AI_LEN feedback 2,808/2,744 bytes; none enters the repeated rejection cycle. Trace (5) instead records 80 rejections at roughly four-VI intervals. Its repeated cycle eventually loses phase lock: at t≈47.691s an AI DMA completes at CP0 Count 2327134045, 736 Count before the next STATUS/service at 2327134781; the FULL condition clears, subsequent accepted buffers return to 352/368/384, and no further rejects appear before trace end. The event timing proves the crossing, but the source of that submillisecond phase shift remains unlogged.
New near-resonance observation: In both runs, every accepted AI write with a recorded duration follows 551 Count units per PCM byte (2,670/2,670 in Trace 5, 12,851/12,851 in Trace 6); every VI callback reports 811,092 Count as the next VI interval. At stereo 16-bit, a nominal 368-sample buffer consumes 368×4×551=811,072 Count—only 20 Count less than VI. This quantized guest scheduling makes FIFO state near a DMA boundary sensitive to a few thousand Count units (well below 1 ms), without any gross missed AI interrupt. The separate host playback device uses 22,047Hz and has its independently proven queue-threshold discard mechanism; do not equate its nominal playback clock with the guest's quantized 551 Count/byte DMA deadline. The 551 multiplier may reflect the pinned RMG core's integer timing approximation; these traces do not establish that RMG differs incorrectly from console hardware or that guest code is universally defective.
Critical boundary of proof: This closes the local feedback instability/recovery mechanism, not the entire production rich-Inventory upstream attribution. Neither tracer records controller changes, native audio task generation IDs, PI/portrait DMA start/end, Inventory selection/mode, or the rendering workload that might perturb the first phase crossing. The successful/negative cursor tests refute any assertion that cursor motion always triggers acceleration. A corrective proof at feedback sizing, native service release, task ownership, or emulator AI timing must be selected by direct evidence and separately runtime-validated. Do not install an AI enqueue retry/spin-wait, remove rich text, or merge draft #156/#157. Further blind manual repetition is not warranted. Retain the full source trace files outside GitHub; the ROM-free read-only AI/VI feedback comparator can be rerun against the same observer-v1 headers without emulation. Local comparison tests against Trace (5), Trace (6), and normal-only pass; GitHub CI on this new script is not asserted.
Runtime-observed diagnostic operation, not root-cause confirmation. The maintainer used the separate RMG v0.9.0 diagnostic Flatpak from draft PR #157 and uploaded four Trace v02 event files from a roughly 33-second manual smoke run. Read-only binary decoding validated MZRHST1 magic, version 1, 56-byte records, exact byte counts, consecutive sequence numbers, and monotonic timestamps:
| Source | Total/retained events | Overwritten | Observation |
|---|---|---|---|
| AI | 10,043/10,043 | 0 | 1,674 enqueue attempts, 1,674 status reads; zero FULL in either sampled position |
| VI | 3,938/3,938 | 0 | 1,969 callback+due pairs |
| RSP | 10,881/10,881 | 0 | 2,511 task-boundary entries; zero recorded RSP cycles at all 5,022 post-run points (consistent with pinned ParaLLEl RSP source, not independently a failure) |
| Host audio | 6,694/6,694 | 0 | 3,347 SDL push results, all successful; zero host drops |
The host SDL queue sampled 0..7,396 bytes, below the 17,637-byte threshold. These results are healthy-path reference measurements, not a reproduction of accelerated music.
At the measured event rates, the v02 rings retain about 12.2 minutes AI, 18.3 minutes VI, 12.8 minutes RSP, and 9.1 minutes host audio. The canonical eight-minute filled→empty→filled test can fit at similar rates, but host-audio margin is modest; quit normally promptly after its final 30-second closed phase, and always inspect overwritten counters before claiming a complete timeline. Backend rate or stage changes could reduce retention.
This v02 logger observes guest AI register accesses, VI/RSP task boundaries, and host audio submission/drop decisions. It does not itself record full WESS synthesis generations, task PCM record identity, or native audio-service call provenance; further discriminating evidence may still be necessary. No game correction, AI retry, merge, or emulator automation was performed.
R: maintainer heard accelerated music during phase 2, within the first minute of the occupied-box Inventory-open test, and saved accelerated.state while the music was accelerated. The file belongs to diagnostic ROM MD5 62CB2C88A25B622998400CFE8C904188. S: its diagnostic helper at 801B3408 holds 75 native PCM enqueue rejections (AIF1, version 20261008), first/last WESS ticks 0x6174/0x6452, current WESS tick 0x645E, audio frame 0x31E5, and VI callback 0x32FC. The saved state is a during-failure capture, not a post-hoc attribution of the entire musical symptom.
Read-only Trace v02 event files (signature MZRHST1, record size 56 bytes) were structurally validated with the checked-in diagnostics/rmg-host-observer/decode_host_trace.py and a focused host-timestamp/CP0-count alignment. All files cover one observer execution with total timestamp span ~741.82 host seconds; no emulator was run for analysis:
| Trace | Saved/total records | Lost | SHA-256 |
|---|---|---|---|
mkmszr-ai-trace(2).bin |
247,213/247,213 | 0 | cc9d4f20ce8b0c9cbb97ecd30772f48f6412e5874d72416e57a46060d587513c |
mkmszr-vi-trace(2).bin |
83,132/83,132 | 0 | cdb1c448eb797128ddd3e0441177bd732105c1e696133664160a9e36e2b13514 |
mkmszr-rsp-trace(2).bin |
246,414/246,414 | 0 | 0df39f1170b3e7505b688406b90e8db79a27fdd81fa338f6d32203f26fc9f116 |
mkmszr-host-audio-trace(2).bin |
131,072/164,664 | 33,592 | 99e87ea54e46440c8c0d1b4b76eca018944dfc848055d9c28e402753118c6ba7 |
accelerated.state |
gzip M64+SAVE v2; diagnostic counter 75 | n/a | 696e173549a7a51cb1fa1fb2e1d1051130a4b033f80096e4dc60c784e4daa30d |
Host timestamps are monotonic but not emulated time, and the first 146 seconds of host-audio samples were overwritten. Its first retained SDL drop is at ~421.65s, not provably the first in the whole session. No host drop is retained for ~146–421s, including the recorded 305s onset. A total 45 retained host drop records discard 42,200 bytes later. This supports a distinct later playback-queue contribution, not the first guest FIFO-full event.
First captured native failure chain (relative to first VI log event; measured, not a guess about absolute Inventory-opening time):
- Previously healthy cadence near 300–304s was ~60 VI callbacks, ~60 accepted AI writes and ~60 AI DMA-end deliveries per host second. At ~305.2447s and 305.2606s, successive 1,600-byte / 400-sample PCM buffers were submitted, exceeding normal 1,408–1,536-byte / 352–384-sample buffers. The upstream native feedback (
8007D4F0AI head-only remaining-length formula) had just observed 1,216-byte head remainders. This is a precursor, not an independently established original Inventory defect. - At ~305.2777s, native audio submitted a 1,472-byte tail behind an active 1,600-byte AI head. At 305.29473s, the next native AI_STATUS reads saw
0xC0000000(BUSY+FULL) before that active DMA completed, with 4,204 emulated Count units still until its observed AI-end Count1780803589(first status read Count1780799385). The read of AI_LEN at Count1780799463returned zero: ~7.5 head bytes remaining truncate to zero under RMG's eight-byte alignment. It does not mean both guest AI slots were empty. - The established native PCM-size feedback therefore generated a 704-sample maximum-sized buffer next, observed as an accepted 2,816-byte AI submission at ~305.31063s, while the prior failure's PCM had not been enqueued. Subsequent long buffers and FIFO-full status reads form a self-amplifying workload/queue-feedback episode.
- From ~306–309s, ~60 VI callbacks/s continued but only ~45 accepted AI submissions and ~45 AI DMA ends/s occurred, with 30 FULL status reads/s (two native status reads per rejected attempt).
AI_STATUS.FULLappeared 288 times in 144 close read-pairs across the entire capture: 140 read-pairs clustered ~305.295–323.885s (interrupted by a ~9-second wall-time idle gap), then four sporadic pairs later. - The 75th FIFO-full read-pair is at ~310.228s; the native savestate contains a matching 75-failure cumulative counter and a subsequent host-time gap of ~9 seconds precedes read-pair 76 at ~319.575s. This is unusually strong alignment of uploaded guest state and host chronology, but the exact GUI/save timestamp is not embedded as a direct marker.
- On-time AI drain evidence: matching head-start and DMA-end Count records around ~305–324s differ from their scheduled DMA durations by only 0–178 Count units, ordinarily 0–10. There is no gross guest AI-end deadline miss during the initial failure episode. The RSP logger retains stable first-run/task/interrupt patterns around the burst (~80 RSP starts/s during active rendering, reported zero emulated cycles in the pinned ParaLLEl model), without evidence of a missing RSP completion. It lacks native task/PCM generation identities, so cannot prove all task ownership conditions safe.
Causal status: The first observed violated condition is a VI/audio-service enqueue arriving shortly before a still-active FIFO DMA has completed while the tail is also queued. Head-only AI_LEN feedback returning zero and subsequent maximum PCM generation amplify the collision into repeated lost submissions, while sequencing continues. This discriminates against the previously suspected large AI consumer deadline delay as the immediate trigger, but still does not identify the first rich Inventory rendering/resource/scheduler operation that shifts the producer/consumer phase to this boundary. Host SDL drops occur later in the retained interval and are not required for the onset. A correction to PCM enqueue retry is still rejected; no upstream correction is authorized or implemented.
Remaining discriminators: establish the first renderer/Inventory-operation timing shift relative to guest VI/audio release and AI head+tail occupancy on an otherwise matched control. This logger lacks explicit native WESS audio-service/generation IDs and Inventory phase markers; event timing alone cannot attribute the first phase crossing to a particular glyph/palette, rendering, scheduler or resource operation. Ask whether empty-box and closed-Inventory phases suppressed new FIFO rejections (do not equate persisted audible offset with ongoing rejection), and ideally compare the existing occupied-versus-empty segment boundaries to the complete AI history. Savestate loading can reset emulated Count/AI FIFO state; never interpret huge cross-load Count differences as late DMA without excluding load boundaries.
R: The maintainer confirms completing all five phases, performing the specified action before timing each waiting interval. Phase 2: entered Inventory with occupied box 1 and left selection unchanged for approximately three minutes; accelerated.state was saved during the first 40–60 seconds. Phase 3: navigated to empty box 3 and waited ~2 minutes. Phase 4: two D-pad Right presses, box 3→4→1, then waited ~2 minutes on occupied box 1. Phase 5: closed Inventory and waited ~30 seconds. No post-Kia phase restart or savestate reload is reported during these five phases.
The host/RSP trace independently changes from approximately 90 RSP first-run task starts/s with Inventory closed to 80/s at t266.2, returning to 576 are estimates inferred from stated ~180/120/120-second waits plus a ~9-second host-time pause around the in-Inventory savestate. The following windows are therefore descriptive comparisons, not exact input-event timestamps; timestamps are seconds from the first logged VI callback:90/s at t702.0; VI cadence remains 60/s throughout active emulation. This supports the Inventory opening/closing boundaries. Internal box transitions are not instrumented: t456 and t
| Approximate window | Maintainer-controlled state | Native FIFO-full enqueue attempts (two FULL status reads per attempt) | Host SDL drop events | AI writes of PCM size >1,600 bytes |
|---|---|---|---|---|
| 240–266s (sampled) | Phase 1: closed | 0 | 0 | 0 |
| 266–456s | Phase 2: occupied box 1 | 141 | 5 | 213 |
| 456–576s | Phase 3: empty box 3 | 1 | 12 | 1 |
| 576–702s | Phase 4: returned to occupied box 1 | 2 | 16 | 2 |
| 702–742s | Phase 5: closed | 0 | 12 | 0 |
The 140 initial rejections in phase 2 are concentrated at t305.295–323.885s, starting ~39 seconds after the Inventory-open RSP-cadence transition. A 9-second wall-time gap within this period is consistent with user-reported state saving; exact save timestamp remains unmarked. The only subsequent phase-2 rejection is at t421.852s, with none from t324–421s even though box 1 stayed occupied and Inventory remained open. There is then one sporadic failure at t555.853s (estimated empty-box phase) and two at t598.871/598.987s (restored occupied-box phase). No new guest FIFO-full attempts occur in the final closed interval.
The host-audio ring's first 146s were overwritten, but all five analysis windows lie beyond the retained boundary. The first retained host drop is at t421.652s, after the major guest failure episode. Phase 3, phase 4 and even the closed phase 5 contain host SDL drops (12, 16 and 12 respectively), whereas no SDL submission calls returned false. Such subsequent host drops are not specific to the continuously rendered occupied-box rows. They may add audible omission but cannot explain the initial guest FIFO-full episode. Total retained host drops across the route = 45 events / 42,200 bytes.
Interpretation and limits: Severe native audio loss is episodic, not a constant condition throughout occupation of the rich Inventory. The occupied-box state remained unchanged during the initial burst and a long rejection-free continuation. Restoring the same occupied box later did not reproduce a sustained burst. This weakens a simple continuous row-rendering-overload claim; it does not rule out a rare phase-collision, accumulated workload-dependent event, entrance/lifetime transition, resource behavior or timing-sensitive composition. Empty-box mode did not eliminate all rejections. The observed 80 versus 90 RSP-task-start cadence identifies a change in RSP activity associated with Inventory state, not by itself a proved cost/latency or a specific glyph operation. Audio sequencer state already advanced past lost PCM may remain audible as accelerated even after new native rejections cease; no exact audible recovery timeline is encoded here.
Follow-up audible-course clarification (R, 2026-10-08): The maintainer reports the acceleration is transient, roughly 10–15 seconds (uncertain), and music then audibly returns to normal. Further acceleration was not heard for several minutes; whether subsequent box/navigation inputs retrigger a new episode is unknown. This is consistent with the ~19-second dominant rejection burst followed by long rejection-free intervals, but is not timestamp-locked to the first audible onset/recovery. Revise earlier suggestions that the symptom necessarily remains accelerated after the loss event: accumulated omitted PCM can alter sequence phase, but does not establish an indefinitely fast audible tempo. The next proposed manual discriminating test enters Fortress directly, holds Inventory open with no input for three minutes, then switches to empty box 3 for one minute and returns via box 4 to box 1 for another minute (30 seconds closed before and after). Trace files are primary; an accelerated savestate is optional and may perturb timing. This test differs from the post-Kia route, so a negative result alone does not dismiss the existing reproduction.
Remaining gate: a matched instrumentation/production proof that marks Inventory open/box-switch/close and native audio generation/service dispatch in guest Count, allowing the earliest timing-phase shift to be attributed to a concrete operation without changing visual behavior. Do not apply AI enqueue retry or promote PR #156 on this evidence alone.
Direct-entry Fortress no-input test: transient crunching, guest floor lock and host queue (2026-10-08)
Runtime-observed: The maintainer entered Fortress directly through legal screen → title → Safe Stage Select (Phase 0), waited ~30s with Inventory closed (Phase 1), opened occupied box 1 for ~3 minutes without any input (Phase 2), switched to empty box 3 for ~1 minute (Phase 3), returned through box 4 to box 1 for ~1 minute (Phase 4), then added a separate ~1-minute phase moving the selection two slots downward in box 1 before closing Inventory (Phase 4b). Final Inventory-closed phase ended early (~25s) when an enemy killed the idle player. No savestate save/load, pause, or emulator restart occurred during the recording. Unlike the earlier post-Kia run, no music-speedup episode was heard, but the maintainer reported substantial audio crunching only after first navigating to box 3. Audible onset is a subjective observation and not timestamped by host event markers.
Read-only decoded inputs: four Trace v02 host files, RMG v0.9.0 Flatpak observer, 56-byte MZRHST1 event records. All four have validated headers/lengths, sequence continuity and nondecreasing CLOCK_MONOTONIC timestamps, and zero records overwritten. Times below are in seconds from the first VI event (the initial ~5s do not contain host audio/AI events).
| Host trace | Retained/total | Span (seconds) | SHA-256 |
|---|---|---|---|
mkmszr-vi-trace(3).bin |
51,940/51,940 | 432.931 | 1dd5adca71a951d953b57fb800e639f753e48937efec9ab762152e2e51956a9b |
mkmszr-rsp-trace(3).bin |
148,725/148,725 | 432.013 | 71c412a5999fc1132179a1925469c17c06d71f4542f9012ab0f34dac04c950aa |
mkmszr-host-audio-trace(3).bin |
102,686/102,686 | 427.880 | 0391a32466952fb7df24bbb3e58514fa23b385a24904277d70a192894eff5e6d |
mkmszr-ai-trace(3).bin |
154,036/154,036 | 428.030 | 5193f4c1dc70f7afa74f4b77c61985b6026b2d97a058bce807f0f0c3a3b34ebc |
RSP first-run task cadence is ~90/s from ~t13–42, ~80/s t44–405 while Inventory remains open, and ~90/s again at t408–433. VI remains ~60/s. This brackets Inventory opening near t43 and closing near t407; internal box changes are inferred from the maintainer's approximate durations, not recorded input events: empty box 3 ~t223, return to occupied box 1 ~t283, downward selection movement ~t343.
| Estimated state/window (seconds) | FULL AI_STATUS observations | Host SDL discarded fragments (bytes) | Host accepted PCM rate |
|---|---|---|---|
| Phase 0+1, prior to opening, 5–43 | 0 | 0 | ~88,320 B/s in stable part |
| Phase 2: idle occupied box 1, 43–223 | 4 reads, 2 close pairs | 13 / 14,664 B | ~88,230 B/s including drops |
| Phase 3: idle empty box 3, 223–283 | 2 reads, 1 pair | 7 / 8,336 B | ~88,181 B/s including drops |
| Phase 4: returned occupied box 1, 283–343 | 3 reads, 1 pair plus 1 isolated transient read | 1 / 1,296 B | shifts to ~84,480 B/s |
| Phase 4b: selection moved in box 1, 343–403 | 0 | 0 | 84,480 B/s |
| Phase 5: closed Inventory, 403–433 | 0 | 0 | ~84,480 B/s |
The four FULL-status pairs occur at t120.776, t120.893, t257.395 and t291.429, consistent with four native guest FIFO-full enqueue rejections; a single additional FULL read at t291.546 is followed by DMA completion and a non-FULL status before any new AI attempt and must not be automatically counted as a fifth rejection. There is no prolonged guest rejection burst in this recording. Every recorded SDL_PutAudioStreamData call returned success, but the plugin's earlier explicit queue-threshold guard discarded 21 PCM fragments, 24,296 bytes, at t110.859–286.029.
Host producer/consumer finding: Recorded RMG audio DAC sample rate remains 22,047 Hz, speed setting 100%, and the plugin's 0.2-second queue threshold is 17,637 bytes throughout. The queue rises even before Inventory opens: at t10–100, the native source normally produces 368 samples × 60 VI/s = 22,080 samples/s = 88,320 B/s against 22,047 × 4 = 88,188 B/s sink consumption, a nominal 132 B/s surplus (~0.15%). The gradual queue build reaches threshold near t110; dropped fragments recur roughly every ten seconds thereafter, including well before the first user-reported audible crunch at/after the box-3 switch. Their occurrence does not independently establish the rich HUD as cause.
Distinct guest feedback transition: At t291.429, a FULL read-pair occurs with current AI_LEN 8 bytes just before DMA completion. At ~t291.546, another isolated FULL observation coincides with DMA completion and a fresh 1,400-byte remaining-length read. From t291.562 until recording end, every accepted guest AI PCM submission is 1,408 bytes = 352 samples per VI, with persistent AI_LEN read 1,400 bytes and no additional FULL status: before that, regular accepted sizes cycle 1,408/1,472/1,536 bytes (352/368/384 samples; average 368). The native head-only feedback expression then perpetuates the minimum 352-sample choice. This is an observed low-output steady regime, not merely an inference from the sound.
In the low-output regime, native AI DMA duration is 775,808 emulated Count units, versus median VI interval 811,092, leaving a ~35,284-Count (~0.7ms) inter-frame drain gap. Host PCM supply becomes 352×60×4 = 84,480 B/s, 3,708 B/s (~4.2%) below the nominal playback demand of 88,188 B/s. Host queue decreases from ~16 KiB to nearly empty within ~4s around t292–296, and subsequently oscillates ~28–1,436 bytes with zero additional host queue-overflow drops. This establishes a credible sustained underrun/crackling-risk mechanism in addition to the earlier small host queue-overflow losses. Underflow was not directly logged as an SDL device event, so do not claim every audible crunch has been proven to come from host underruns.
Causality and scope: The transition to 352-sample-only output occurs several seconds after the approximate box-3→box-1 return, not precisely at the box-3 switch; RSP cadence stays ~80/s throughout those phases. Both the host queue build and guest FIFO-full observations precede/straddle box 3. The audio remains in the low-output regime through the extra selection movement and Inventory closure. The earlier accelerated-music run had a major transient native rejection burst, whereas this run has four isolated failed-enqueue pairs, recurring host queue overflow, and a long-lived low-supply attractor. These are related parts of the game's adaptive guest audio and RMG host buffering, but this evidence alone does not prove a single upstream rich-Inventory render operation triggers both audible symptoms. A native audio feedback/VI phase stability audit, with a matched no-Inventory or other-stage control and observer-disabled parity if needed, is more justified than removing rich HUD visuals or applying the rejected AI enqueue spin-retry.
No correction/ROM/emulator automation was performed. Keep the accelerated-music release blocker Pending and PR #156 draft/unmerged. Diagnostic PR #157 remains separate.
Evidence labels: C checked native code or primary source; S decoded snapshot; R maintainer runtime report; H inference; U unavailable. Inputs were read-only. Project Status was read first, followed by the Roadmap, previous static owner, Native HUD/UI, Persistence/Inventory/Lifecycle, Memory/Allocation, Patch Registry, Runtime Validation and relevant audio/resource/scheduling/failure records. Living Ghidra metadata was consulted before adding verified entries.
MKMSZR main baseline: 52a1df98defaa1fedd2986cba291375d41ae1ccc. Draft PR #156: head 47a395ba16c7e4cecc0ba9d6de91b8a4310db32e, base 0421f7b3eab54e3c484a19834e3f2230b6adbb05. Later independent main changes do not alter these existing ROM identities. Ghidra baseline: e86bc8ba2fcc20aedaeb7b725905018b72a2f90f.
| Input | SHA-256 |
|---|---|
| Clean USA Rev.0 | 9c18254abf6722b95aa782fcd310bd95f6bcf147da66beb77ce32ca90673ffc6 |
Accepted MKMSZR_inventory-rich-materialized_fortress_proof_v01.z64
|
b73a9cba8c8a2ff0f6b96d9057dd30f36dc5b1e6e0b713d2f9d0eafb3b335c03 |
Failing MKMSZR_inventory-materialized_full-production_build_v02.z64
|
f44e3724a8c883b720d727936cb7f4204f19acc5569ca4b0fc581007ee2b7313 |
Existing MKMSZR_inventory-audio-trace_fortress_proof_v01.z64
|
9b7c47758be500535ef10a4c0a063667e50cded66ab28a1b101f0182d4be3152 |
Normal state, supplied locally as test_musicnormal(1).state
|
43383279333a8820f0faf73a487c710dadd14c4b3b07b9af3f9b0470ef6271cc |
Accelerated state, supplied as test_musicspeedup(1).state
|
db2f9358c9373c9d0079003ff91d5c18afddf99a44ea60c0d6d9994d18f5a66d |
Both states record diagnostic MD5 62cb2c88a25b622998400cfe8c904188. Format is M64+SAVE v2, decompressed size 16,793,412 bytes; 8 MiB RDRAM at offset 0x1BC with bytes reversed within each host word. Its AI block preserves FIFO lengths/durations, not both addresses; loading reconstructs both from the last AI_DRAM register. No state was executed here.
C: v02→diagnostic differs in 115 bytes in five runs: header CRC [0x10,0x18), fail-branch byte 0x8B15B, trampoline [0x8B198,0x8B19C), resource-end descriptor [0xA514E,0xA5150), and appended [0x1819B9C,0x1819C00). Permanent executable changes total five bytes. Entire rich module [0x801B28F0,0x801B2DF0) (size 0x500 = 1,280 bytes, ROM [0x18190D0,0x18195D0)) is identical between v02 and diagnostic. Proof matches its row/preview/table portion through 0x801B2C80; the final status region differs in 268 bytes for Custom/Seed versus Vanilla. It is incorrect to call the whole proof/v02 module identical.
Existing failure-only helper: [0x801B33BC,0x801B3408); six-word log: [0x801B3408,0x801B3420) = count, first tick, last tick, AI status, AIF1, version 0x20261008. Diagnostic file 1A maps ROM [0x1816000,0x1819C00) to runtime [0x801AF820,0x801B3420). Arena floor is unchanged. Logging adds CPU work on failures; it is not perfectly timing-neutral, and could affect later failures. No free guest tail is assumed.
The historical initial manifest preserves the prior musicspeedup3.state teardown, lifetime counterexample, Vanilla correction and superseded retry proposal. Its verified negatives remain valid for those inputs. This investigation uses them without repeating the broad teardown.
C: setup 0x8000060C creates scheduler queue 0x802C1970, backing 0x801AE4C8, capacity 32. Event registrations: SP→message 1 at 0x80000734, DP→2 at 0x80000744, pre-NMI→5 at 0x80000724; osViSetEvent at 0x8000075C sets VI→3 at rate one. Message 4 is software task dispatch. Scheduler thread 0x800B6048, entry 0x80000A70, priority 90; game thread 0x800B46F8 priority 10, PI worker 50, VI manager 150.
| Address | Native operation |
|---|---|
80000A70 |
Blocking message receive and dispatch |
80000E24 |
VI: promote prior fresh audio task, dispatch, framebuffer service, build next audio task |
80000E3C / E44 |
Fresh 8009A534→queued 8009A538; clear fresh |
80000EF4 / F00 |
Call 8007D3FC if audio-enable 8009A530; publish next fresh task |
80000F24 |
Call input/VI callback from 800B43C0 if 80000300 is nonzero |
80015950 / 15998 |
Input/VI callback; increments 802E7DC0
|
80000F4C |
Audio-first task dispatch; defer while active audio exists |
80000B6C |
SP completion/yield handling |
80000C5C |
DP completion/graphics bookkeeping |
800011F0 |
Cache writeback, task load, RSP start |
Both endpoints have 80000300=1, callback 80015950 and the above game/scheduler priorities. Inventory suspends cooperative gameplay lists, not this OS audio scheduler. Cached glyph drawing neither schedules another audio frame nor registers a VI callback. Higher audio priority weakens simple CPU starvation; it does not exclude a blocked operation, delayed interrupt, or service burst. In this configuration the input callback runs on the scheduler after audio service; no traced glyph path enters it. Both endpoint scheduler queues have validCount zero. Prior maximum/backlog is U.
8007D3FC → 8007D4A8 first cleans sample DMA (8007D860; audio frame counter 800A7F60 increments at 8007D98C), then submits previous lastInfo at 8007D4E8 → 8008A500. Enqueue checks full at 8008A550 → 80092E90; full returns -1 without AI writes, accepted writes AI_DRAM/AI_LEN at 8008A57C/580, returns zero. The diagnostic logs the failure and returns through the original epilogue.
At 8007D4F0, enqueue's result is overwritten by a call to AI_LEN getter 8008A3C0. New sample count follows the observed native constants:
max(352, ((368 - (AI_LEN >> 2) + 320) & ~15) + 16)
Assembly uses 16-bit masking/storage. Minimum/target globals are 800BA450/454, reserve 800A8004; configured maximum PCM capacity 800BA458=704. An empty head produces 704. The feedback reads remaining head bytes, not total head+tail occupancy. A late service and subsequent adjacent services can change produced sample counts without increasing aggregate service frequency. This is a competing mechanism, not recovered chronology.
| Ownership structure | Verified layout |
|---|---|
AudioInfo pointer globals 800BA3E8..3F0
|
8013A780, 8013B2D0, 8013BE20
|
| Record stride |
B50: 80-byte header + B00 PCM capacity |
Record +0 / +4
|
PCM=record+50; signed 16-bit sample-frame count |
Record +8
|
64-byte OSTask, type 2 |
Record +38 / +3C
|
Command pointer/byte count, OSTask +30/+34
|
Command globals 800BA3E0/3E4
|
8012A780, 80132780, each capacity 8000
|
800A7F6C / 7F70 |
Three-buffer index / previous lastInfo |
8009A534 / 538 / 53C |
Fresh / queued / active audio task |
Wrapper publishes new lastInfo, rotates three records and alternates two command lists despite previous enqueue failure. Synthesis 8008910C advances ALSynth +20 at 80089270 during command construction, before RSP completion or AI acceptance. ALSynth global is 800A8210, pointing to 800BA3F4 (signed-low-address instructions must not be misread as 800B8210).
Callback 8007DA34 → 80083D38 → 80085C8C advances WESS/sequence and returns 8,333 microseconds, yielding 184 player samples/tick. Tick global 800A8038; ms/fraction 800A803C/8044; increment 85555 in 16.16. Sequence time can advance for synthesized PCM that never reaches AI. Omitting these musical intervals can accelerate progression through the score while leaving sample pitch/DAC unchanged. C establishes the permitted path; the complete audible contribution remains H.
The VI handler queues the prior generated task before producing the next. Dispatcher refuses while active 8009A53C is nonzero, otherwise transfers queued→active at 80000F80, clears queued at F88. Running graphics (800FEC24 >= 0) causes yield flags 800C11E8/800BF35E and request 8008A7E0; audio starts after SP/yield handoff. Completion handler 80000B6C checks osSpTaskYielded (8008A800), clears/completes the appropriate owner, dispatches or resumes graphics.
Conditional static hazards: queued is one pointer. Promotion 80000E3C can replace it if it has not been consumed. Continued synthesis can reuse a PCM record or command list before a delayed generation completes. These conditions are not observed in the pair. Both endpoints have fresh=lastInfo+8, queued=active=0, SP status 243 (halt/broke), and no queued SP/DP task event. That excludes an unfinished task at capture, not a previous replaced generation. Rotating addresses require generation IDs to establish ownership.
R: same session/stage/post-Kia door route. Normal music first; accelerated without pitch rise after Inventory remains open. No wall-time recording or measured tempo factor accompanies the states.
| Measurement | Normal | Accelerated | Change |
|---|---|---|---|
| Rejected submissions | 1 | 136 | 135 |
| WESS ticks | 49,754 | 59,881 | 10,127 |
| Audio frames | 24,873 | 29,807 | 4,934 |
| VI callbacks | 25,152 | 30,086 | 4,934 |
| VI minus audio | 279 | 279 | Unchanged |
| Player sample time | 9,154,736 | 11,018,104 | 1,863,368 = ticks × 184 |
| Synth sample time | 9,154,656 | 11,017,984 | 1,863,328 |
| WESS ms / fraction | 414,616 / 27,106 | 499,008 / 1,885 | Exact tick × 85555
|
| CP0 Count | C19E9D50 |
B0273056 |
Modulo delta 4,001,927,942 |
| Next VI deadline | C1AAFDA2 |
B033909A |
Modulo delta 4,001,927,928 |
| Saved VI period | 811,092 | 811,092 | Delta exactly 4,934 periods |
| AI status | 40000000 |
40000000 |
BUSY; FULL clear |
| Last-written AI_LEN / head length | 580 / 580 |
680 / 680 |
352 / 416 stereo frames |
| Head duration | 775,808 | 916,864 | Length × 551 Count units |
| Counts to next AI event | 708,126 | 854,354 | Unexpired head |
| AI DAC / bit rate | 89F / F |
89F / F |
No endpoint rate change |
FIFO tail length/duration fields are stale when FULL is clear. Do not count them as live occupancy. The saved AI_LEN register is its last write, not an observed current remaining-length read.
First rejection is tick 35,580 in both states, preceding healthy capture 49,754; normal's last rejection is also 35,580. Accelerated's last is 59,874, seven ticks before capture. Thus one rejection is not sufficient for audible acceleration. Assuming no log reset, 135 additional failures occurred during the paired interval, but their distribution/onset is unknown.
At nominal 60 Hz, 4,934 VI periods represent 82.2333 emulated seconds, not wall time. Count/deadlines are modulo 2^32; two endpoints cannot recover additional whole wraps or prove unchanged settings throughout. Independent VI/counter agreement strongly opposes sustained callback multiplication but cannot exclude stalls followed by bursts, compensating extra/lost messages or wall-time pacing changes.
Nominal synthesis: 4934 × 368 = 1,815,712. Actual surplus: 47,616 (2.6224%). WESS advances 259 ticks beyond two/audio frame. This is more sequenced synthesis per service, not more services. Under fixed native 352..704 frame sizes and one attempt per frame, rejected buffers represent 47,520..95,040 samples = 2.1554..4.3108 seconds at integer DAC 22,047 Hz. Surplus exceeds that minimum by 96 samples.
H: the close relationship strongly supports a PCM omission contribution. It is not complete conservation accounting: accepted lengths, initial/final live occupancy, underruns, task completion and host drops are unrecorded. Exact rejected sizes, instantaneous audible tempo, clustering and total loss cannot be reconstructed. The aggregate 2.6% does not quantify how dramatic the perceived onset was.
S: both permanent executables match diagnostic [80000400,8009A000) exactly. The existing static audit was reused to verify all eight complete active Fortress streams, bank/predictors, native ADPCM rounding, DMA lists and populated sample buffers. The earlier broad negatives survive. Active music waves are clean-identical, not the substituted donor Temple/Toasty carriers.
| Rich operation | Entry/shared helper | Repeated work |
|---|---|---|
| Item/credential rows | 80074268 → A01B28F0 |
Native labels/colored true-stage credentials |
| Selected preview | 80073098 → A01B2980 |
Sprite; portrait ROM DMA on selection/stage change |
| Paper title/stage/check table | 800742B8 → A01B2A60 |
Width/title and cached table-row draws |
| Required Powers / checks | 800742C8 → A01B2C80 |
Vanilla XP or Custom/Seed text and cached checks |
| Legend/box indicator | Promoted native legend module | Accepted dynamic box indicator/legend glyphs |
| Inventory loop |
80073588 → 800728B0, sleep 80028794
|
Repeated panel draw; no repeated open prologue |
Materialization removes repeated changing-data computation, not native glyph rendering. New pair has identical LIVE/40 backing words, process state 16, Powers count zero, and byte-identical 1200-byte HUD (SHA 239c4d2d44c1f6b236b11fdce11b26059f241321bf3a91b491c47773aedc5ca8). Box 2 contains one 04; boxes 3/4 are empty. No selection/box change is evident between endpoints.
C: strings 80073E74 → 80073CEC; each non-space glyph calls palette acquire 8001C528(font+4,256,0) then render builder 8001E578, submitting 58-byte nodes through 8001EBB8. Cache hit at 8001C628 increments u16 refs and returns existing handle without conversion/upload. Miss: allocate 8001C81C, convert 8001C6D0, upload 8001D6EC, synchronous flush 8001D7F0. Traced cached paths have no audio calls or interrupt-mask changes; this does not certify all graphics paths.
Release 8001C64C decrements the original owned handle; zero frees via 8001C898. Glyph acquisition has no matching release. Stock text behaves similarly. Acquire wrap does not itself free, and hit validity depends on active/source identity. Retrofitting releases could free a palette still consumed by queued graphics. Full 256-color source spans remain required despite 16 visible colors.
S: 17 active dynamic entries C0..D0, same sources/handles in both; both private palettes convert correctly across all 256 colors. Private source A01FF3B4 refs 6125→17129 (+11004); A01FEBA4 4375→12235 (+7860). These match 1,572 seven/five-glyph repetitions if no releases/rebindings intervened. They support cached repeated rendering, not churn. Stock source 800B1D84 wraps refs 64658→43648, but no failing release/private corruption or exhausted cache is shown.
Graphics builder 8001EC20 traverses buckets; glyph/textured kind 2 dispatches 8001ED00; pipe-sync emitter 80020108 is in this chain. More glyphs mean real CPU command and graphics work. They do not by themselves prove audio/RSP deadline failure.
| Resource | Normal / accelerated |
|---|---|
| Arena floor / cursor |
801B3420 / 8028C538 both; 74 links, nominal headroom 17,496 bytes |
| HUD / Fortress anchor |
801FEBA0 / 801FFDA8 both; HUD end 801FFDA0
|
| Graphics cursor / texture boundary |
803D9F38 / 803FEEC0 both; gap 24F88
|
| Upload queue |
FFFFFFFF both |
| Partial current-frame nodes | 180 / 377 |
| Node cursor |
800C6730 / 800CAAE8 = 800C2950 + count × 58
|
| Both completed display-list sizes |
B538 = 46,392 bytes both; per-buffer capacity 17800
|
Partial node counts capture different phases; 377/180 is not a workload ratio. Earlier audit hardcoded second-bank base 800D8110, valid for its older state. Native setup 8001BA80/84 establishes 800C2950 + bank × 157C0 (1,000 nodes). Both new states use first bank; their older cursor_consistent=false is a decoder assumption. The new decoder accepts both banks. No current node threshold (3E7) overflow, allocation collision or upload backlog appears. Earlier peaks remain unknown.
The independent stale-HUD bug remains: open wrapper [A01B3210,A01B324C) clears P+1198/+119C before ensure validates ownership; ensure's cursor >= P+1200 cannot reject rewind/refill by another owner. The captured resident HUD/anchor protects these Fortress endpoints. No first stale write/audio victim is shown. A lifecycle fix must invalidate at discard before flag writes and account for pointer-keyed palette/queued render consumers; it remains separate from music attribution.
The accepted proof's extensive bounded R result remains valid. It passed pickups, consumables, Combine, empty boxes, Kia/crystal, doors/elevators and Inventory stress. It is not a matched control for full-production v02.
Exact comparison: 125,946 bytes, 4,580 runs. Proof uses Custom/Seed Required Powers, production Vanilla REQ. XP 5100; assignments/power order/enemies and donor Temple sample differ, lives/continues 6/4 versus 5/3. Exact seed strings were not inferred from bytes. Common row/preview/table code and active Fortress score match; status code and resource composition do not. Different text/resource workload can alter timing even with the same algorithm. Endpoint headroom is not a peak-memory comparison.
v01→v02 changes only bytes 1819A9F:5C→38, 1819AC7:F4→D0, correcting Vanilla cached/preparation targets to A01B2D38/A01B2CD0. Vanilla is 24 bytes shorter than Custom/Seed. Earlier targets skipped initialized setup, a concrete stray-glyph defect. Corrected v02 materialization is coherent in both new states. Neither that repair nor unmatched proof success establishes audio causation.
Existing matched workload control: same diagnostic ROM/backend/stage/seed/checks/settings, occupied first Items box versus empty box 3/4. Rich table/status/legend stay present; rows and selected preview change. Exclude transition DMA from steady-state analysis. This isolates a row/preview workload bundle, not an individual glyph/palette function. Closing Inventory controls the entire panel. No new matched ROM should be built unless chronology specifically justifies a narrower status/resource intervention.
R: RMG Flatpak installed through Bazaar, ParaLLEl RDP + ParaLLEl RSP. Exact RMG/core/plugin/Flatpak versions, audio plugin, CPU mode, audio synchronization/latency, speed limiter and per-game settings are U. A compatible state format does not identify those binaries.
Inspected primary implementation: RMG v0.9.0, commit 453f6639734537908c4c2ca35244255bc5424e3d, 2026-06-14. Conclusions below are limited to it until the installed build is pinned.
-
Core AI controller: head/tail FIFO, FULL on tail fill; AI-end promotes/clears FULL or clears BUSY. Consumption is CP0 Count/event scheduled. Duration uses
AI_LEN × floor((VI_delay × refresh)/(4 × DAC_Hz)) × dma_modifier. Saved NTSC delay/DAC give integer 22,047 Hz and 551 Count units/byte, matching both live durations with default 100% modifier. No historical settings proof follows. -
get_remaining_dma_lengthreturns head remainder from its deadline.read_ai_regs(AI_LEN)also sends consumed fragments to the host audio plugin; AI-end sends the remainder. Extra AI_LEN reads change host delivery. Record already computed values rather than adding reads. -
Core RSP calls
rsp.doRspCycles(first_run)/2, schedules SP/DP events and gates on pending/wait state. ParaLLEl RSPDoRspCyclesruns to break/IRQ/exit and returns input cycles (core supplies 1 or 0), giving zero added duration after division. It does not derive task time from command/instruction workload. This weakens a blanket extra-glyphs→longer guest RSP duration claim. -
ParaLLEl RDP SyncFull sets DPC_CLOCK=
viewport width × height × 2, waits for a GPU timeline and raises DP. Its guest timing estimate is viewport-based, not glyph-count-based. GPU wait costs wall time without automatically advancing guest Count. Guest CPU construction/yield/interrupt timing can still matter. -
RMG-Audio
sdl_push_samplesdrops a host fragment when queued bytes reachfrequency × 0.2 × 4. This is independent of guest FIFO rejection. If active, its dropped bytes must be measured; plugin identity/SDL queue are not in the states. It is not assumed to be the user's selected plugin. - Serializer omits both FIFO addresses and reconstructs them on load. Matched runtime controls require cold boot, not cross-plugin state reloads.
Guest AI rejection, guest task scheduling and host playback are distinct. Wall-time graphics slowness alone does not prove virtual AI consumes late: both AI and VI are Count-scheduled. Healthy guest accounting does not prove every host fragment was played. No backend bug is confirmed from these source differences.
| Hypothesis | Support | Contrary evidence / missing discriminator |
|---|---|---|
| Sustained duplicate/excess callbacks | Queue-driven release exists | Audio=VI delta, deadlines exactly 4934 periods; no aggregate runaway. Need service intervals for brief bursts. |
| Service phase/bursts cause feedback overproduction | +47616 synthesis, 135 failures; head-only feedback | AI_LEN/service chronology absent. Need long gap/adjacent release and occupancy before rejection. |
| Guest AI consumption delayed | FULL proven at failures | Endpoints have normal duration/live deadlines. Need scheduled versus delivered AI-end Count. |
| Graphics yield/task replacement/reuse | Shared RSP, single queued slot, rotating buffers | No current pending task; inspected ParaLLEl returns zero work-derived guest delay. Need generations/start/completion/reuse. |
| Palette misses/synchronous upload | Every glyph acquires; miss flush exists | Same 17 entries, intact palettes, stable allocator, idle uploads; hits do not upload. Need actual miss before violation. |
| Ref wrap corrupts ownership | Stock source wraps | Acquire wrap does not free; no failing release/cache/audio victim. Need first invalid consumer. |
| Stale HUD write | Static lifetime counterexample | Resident captured HUD/anchor intact; no audio victim. Independent defect. |
| Vanilla status defect | v01 bad continuation confirmed | v02 targets/strings coherent; proof comparison unmatched. Need otherwise matched status control if chronology points here. |
| Changed music/DAC | Would alter score or rate | Eight streams/bank/active waves exact; DAC/clock relations unchanged. Strongly weakened. |
| Host drop/pacing contribution | Inspected RMG-Audio has fragment omission | Active plugin/settings/queue unknown. Need accepted/dropped host bytes and audio timing. |
No upstream code correction is justified yet. Preserve rich presentation/gameplay while observing the first broken invariant. Select the target from chronology, not survival of another ROM:
| First observed violation | Earliest justified correction target | Required control/invariant |
|---|---|---|
| Blocking render/resource operation→late/bunched service→surplus synthesis | That operation or verified task-release policy before surplus generation | Eliminate measured bursts while preserving input/sequence cadence and all rich text. Text removal alone is not the permanent fix. |
| Queued generation replaced or record/list reused unfinished | Scheduler promotion/reuse ownership fence | No uncompleted replacement, premature AI consumption or AI-owned PCM reuse; normal cadence unchanged. Do not spin/stall the scheduler. |
| AI-end late in Count while VI timely | Pinned core/backend event scheduling | Same ROM/backend settings; correct guest register/deadline behavior and host accounting. No enqueue retry. |
| Host drops explain remaining audible loss | Active backend's measured pacing/drop condition | Bounded latency/queue policy; preserve DAC/resampling semantics; compare unchanged guest behavior. |
| Palette/lifetime failure precedes timing/audio failure | Proven offending resource owner | Balance original handles, retain 256 colors, invalidate at discard, drain queued consumers before reuse. |
The stale-HUD owner defect warrants a separate lifecycle repair, but combining it with this test loses attribution. A future guest modification must guard ROM SHA, original instructions/delay slots, ABI/stack forwarding, file-1A extent, occupied intervals, allocation discard and palette/render lifetimes. Current helper/log ends exactly at floor 801B3420; no free guest instrumentation space is claimed. There is no justified upstream patch address/replacement instruction until the responsible operation is observed.
More endpoint states cannot recover the missing producer/consumer chronology. The minimum useful event sequence spans a healthy period and first recurring rejection:
- VI due/delivery Count; audio service Count and its already computed AI_LEN; frame/WESS/synth counters and rejection-counter change.
- Accepted AI address/length; live FIFO status/head/tail and scheduled versus delivered AI-end Count.
- Audio generation (frame number + rotating record/list), RSP start/yield/return and SP completion Count. Verify PCM completion before AI consumes it and before record/list reuse. Enqueue into a waiting AI tail can overlap RSP work; submission alone is not a violation. Addresses alone are insufficient.
- Active host plugin accepted/dropped byte totals plus short wall-time audio recording/onset markers, to measure the audible loss budget.
Prefer observation-only host hooks in the original RMG build at existing AI_STATUS/AI_LEN accesses, AI writes/end, VI delivery and RSP task/event boundaries. This is a specific diagnostic design, not an implemented build. First pin actual Flatpak/RMG/core/RSP/RDP/audio identities and settings, then verify corresponding source. Gate on exact diagnostic ROM SHA/MD5/code, log signature/version and validated guest pointer ranges/offsets.
Use a fixed host ring, e.g. 32,768 × 64-byte records = 2 MiB, outside guest RAM. Read guest globals using existing host endian helpers. Record already computed register values and hook-local Count; no extra emulated AI_LEN reads, logging-only cp0_update_count, per-instruction breakpoints, glyph tracing or event-time console/file I/O. Count overflow/lost records; incomplete chronology cannot close cause. Export after pause/stop. Host logging still costs wall time: repeat the matched route with observer disabled to check that it did not create/remove failure. No guest ROM patch/allocation or borrowed PCM/task buffer is needed.
One eight-minute manually operated experiment, same existing diagnostic ROM, original ParaLLEl RDP/RSP and audio/settings, cold boot and same post-Kia/door route:
- Inventory closed, 30 seconds: whole-panel baseline.
- Occupied first Items box, fixed selection, 180 seconds; record audible onset if it occurs.
- Empty box 3/4, Inventory still open, 120 seconds; exclude first two seconds after switching (transition resource work).
- Original occupied box and selection, 120 seconds: restoration control against session age alone.
- Close, 30 seconds; stop/export the rolling records and onset audio. Stop early on hang/gameplay regression. Never cross-load another ROM/backend's state.
Compare new rejection rate per VI, service intervals, AI deadline delivery and generation ownership, not merely cumulative counts or immediate musical-position recovery. Accumulated offset can persist after its trigger stops. Empty box preserves table/status/legend and exact seed/composition while changing row/preview workload through accepted gameplay inputs.
On-time AI drain plus late/bunched service supports upstream scheduling; late AI-end in Count supports consumer timing; incomplete/replaced generation identifies ownership; host drops identify additional audible omission. Filled→empty→filled changes in the same first violation and rejection rate link the row/preview bundle to it. They do not individually prove glyph or palette causation. If only closing helps, attribution stays broader. Unchanged rates weaken row/preview cost as a target. A later same-ROM backend A/B can narrow portability, but cannot replace chronology.
Without host observation, this route with boundary states/audio can narrow workload by rejection rates, not close task/deadline cause. No additional diagnostic ROM is recommended until a lower-overhead guest alternative has a specific justified need and exact allocation/patch guards.
Read-only paired decoder, stdlib-only: normal state, accelerated state, pinned existing diagnostic ROM, --output JSON. It emits identities, clocks/events, live FIFO interpretation, AudioInfo/pointer records, memory/render endpoints and limitations; it never launches an emulator or writes ROMs. The existing broad audit was reused for established data/code/DMA negatives. Its second-bank render assumption is superseded only for these new states.
Verified scheduler/audio names/globals/comments are mirrored in living Ghidra metadata; hypothetical causal names are excluded. Validation is supplied-state decoding, native disassembly, exact existing-ROM comparison, primary backend/serializer source checks and metadata schema checks. No copyrighted ROM/RAM/PCM payload is published.
Defensible conclusion: recurring native rejection and extra synthesized musical time coexist with steady aggregate VI/audio service. The ignored failure permits PCM loss. The upstream Inventory trigger and complete audible loss budget remain unobserved. Permanent closure requires the first service/consumer/task ownership violation plus a matched rendering control. PR #156 stays draft/unmerged; no mitigation or production integration follows from these findings.
MKMSZR current documentation · Wiki source: wiki/ · Evidence/archive: ChatGPT Library MKMSZR Research · Product source: smeagol44/MKMSZ-Randomizer
Orientation / Project
- Home
- Contributor start here
- Project status
- 1.0 requirements and roadmap
- Runtime validation status
- Architecture overview
- Research methodology and evidence
- Glossary
Core Technical Reference
- Core runtime and native payload
- Memory and allocation map
- Function registry
- Address and patch-site registry
- Data structures and encodings
- Resource and overlay system
- Address quick reference
- Testing and CI
Randomizer / Product Systems
- Stage flow and selector
- Pickups and stage-local randomization
- Global item materialization and solvability
- Persistence, inventory and lifecycle
- Lifecycle static closure / unbuilt v05
- XP and progression
- Native HUD and UI
- Presentation and branding
- Audio system
- Palette and recoloring
- Web patcher and product
Stage Reference
Gameplay / Enemy / Donor Research
- Enemy randomization
- Player actions and special moves
- MKT compatibility overview
- MKT adapter primitives
- MKT fighter asset translation
- Sub-Zero ↔ Sektor animation mapping
- Sektor takeover proof history
- Toasty audio research
- Toasty visual research
- PS1 research
- N64–PS1 comparison
- N64 -> PS1 port planning and strategy
History / Failures / Superseded Material