Firestaff

Theron original Backup RAM body layout — 2026-09-23

This note records a read-only capture from the authenticated US original runtime. It does not introduce a host save format and does not assign names to fields whose original consumers remain unidentified.

The instrumented Mednafen build mapped physical System Card RAM page $6D only long enough to verify DMS-SG.001 at logical $DE01, dump all 8 KiB, and restore the caller’s MPR6 mapping. The capture never wrote bytes to the emulated machine.

Complete DMS-SG.001 record

The $86 bytes above are the writer-owned body inside a larger original record; they are not the complete file data. The hash-verified US Track 02 file-manager overlay (four MODE1 sectors, MD5 9aa38417c25bd6d1717081d545fdcfa0) supplies the complete contract:

Firestaff therefore preserves and exposes all 409 original bytes and selects only indices 0–2 through the original $0198 → $278C → INY → $42B8 → {0000,0088,0110} route. It does not interpret the two per-slot tail bytes as gameplay state. The independently byte-bound US and JP Stage 2 routines read $88 bytes when transporting one selected slot, then initialize a slot by writing zero to its first byte and using an overlapping TII of length $87 to clear the remaining bytes. The dungeon handoff stores only the selected-slot ordinal; DMS-SG.001 subsequently copies exactly $86 bytes into $267C..$2701. No tail byte reaches the gameplay restore buffer. The final two bytes are therefore transport padding, not an unresolved Continue field.

A fresh ordinal-0 run against the authenticated savestate reproduced the original BRAM MD5 ffabc8d19b0915d4d9632a7ae2e90a97. At the same hook point, the read-only runtime receipt reported MPR1=f8, MPR2=68, $278C=00, $42B7=0f, and $42B8=01, matching the zero-based-to-one-based handoff. The operator-owned stderr receipt is 554 bytes with MD5 ad742d52c5ffb91a08d7ac554d4c2810; it is not committed.

The writer at $DE21..$DED1 constructs the body as follows:

Body offset RAM destination Length Original source expression
$00 $267C 1 campaign byte, low seven bits independently proven
$01 $267D 6 three pairs from $2980+Y and $2984+Y, Y += $10
$07 $2683 7 seven bytes from $2A10+Y, Y += 4
$0E $268A 20 $2A2C+Y, Y += 4
$22 $269E 20 $2A7C+Y, Y += 4
$36 $26B2 20 $2ACC+Y, Y += 4
$4A $26C6 20 $2B1C+Y, Y += 4
$5E $26DA 20 $2B6C+Y, Y += 4
$72 $26EE 20 $2BBC+Y, Y += 4

Every byte in the authentic $86-byte BRAM body matches the corresponding source address in that same-session main-RAM capture. The writer resets the HuC6280 X and Y registers with CLX/CLY between sections; disassemblers that treat opcodes $82 and $C2 as generic no-ops can obscure those loop bounds. The address expressions above therefore record the original machine-code accesses directly, rather than inferred host-side field names.

The access direction is now independently locked as well. After $E04E returns the selected $86-byte body at $267C, this routine reads only $267C: it merges the new campaign bit there and then overwrites every byte from $267D through $2701 from the live-RAM sources listed above. It has no restore read of those 133 bytes. The authenticated 17-sector Stage 2 program does read all $0199 bytes to $7E49, derives the selected slot pointer as $7E49 + $88 × $278C, and patches its slot-local operations to that pointer. That establishes record and slot ownership, but not a gameplay restore meaning for the individual body fields.

The separate restore consumer is now byte-bound in all seven authenticated US dungeon blocks. Each copy begins at block offset $0248 (logical $2248): it rejects a zero campaign byte or a masked value of seven or more, then copies the six-byte section to $2978/$2980 and $297C/$2984, the seven-byte section to $29F4/$2A10, and the six 20-byte columns to $2A2C, $2A7C, $2ACC, $2B1C, $2B6C and $2BBC. This is the exact inverse data direction missing from the writer analysis, including the duplicate destinations in the first two sections.

The corresponding restore consumer is now independently byte-bound against the authenticated JP Track 02 as well. Its seven identical copies begin at user-data offsets $081A45, $0C1A45, $101A45, $141A45, $181A45, $1C1A45 and $201A45 (sector-local offset $0245 in sectors 259, 387, 515, 643, 771, 899 and 1027). The control flow and $267C..$2701 inputs are the same as in the US routine. Every JP live-RAM destination is one byte below its US counterpart: $2977/$297F, $297B/$2983, $29F3/$2A0F, $2A2B, $2A7B, $2ACB, $2B1B, $2B6B and $2BBB. This regional difference is verified directly rather than inferred from US media.

The six final arrays are therefore proven column-major restore inputs for twenty live records in both regions. Their gameplay meanings are still identified by the downstream arithmetic consumers in every regional dungeon copy:

The classifier now exposes this typed projection alongside the unchanged raw address projection. Its real-artifact regression requires the exact restore, clamp, attribute-compare and skill-experience consumer bytes in all seven US and all seven JP dungeon copies, plus each region’s $88-byte Stage 2 slot transport and clear routine. The native transactional restore now applies the campaign byte, initializes Theron’s current and maximum vitals from the saved maxima, restores the seven attributes and preserves all 20 temporary and persistent skill-experience pairs. It requires an authenticated roster-owned THERON in party slot zero and leaves companions, inventory, equipment, position and loaded dungeon media unchanged on both success and rejection. The production startup gate now selects this original Backup RAM route. It accepts either an explicitly supplied .bram path or FIRESTAFF_THERON_BRAM_PATH, and falls back to the authenticated artifact in $HOME/.firestaff/data/theron. The complete container, selected slot, transport-padding proof and body semantics must all pass before the title menu advertises Continue. The explicit action then reclassifies the file and selected ordinal before applying the transactional Theron restore; Firestaff-native .tqsv and synthetic SRM envelopes remain disabled in production.

The checked-in capture hook is scripts/mednafen_1.32.1_theron_save_manager_code_dump.patch. The copyrighted 8 KiB page remains operator-owned data and is not committed to the repository.

Empty selected-slot gate — authentic JP Backup RAM

The original US and JP restore body begins with LDA $267C; BEQ return, then masks the campaign byte with $7F and returns when that value is at least 7. Therefore a structurally valid DMS-SG.001 container is not necessarily a restorable Continue slot. Firestaff now retains the container/body-layout receipt separately from save_body_campaign_valid, and only advertises or applies Continue when the selected byte satisfies that original branch. An explicit invalid FIRESTAFF_THERON_BRAM_PATH is also authoritative and no longer falls through to a different default save.

The negative regression uses the operator’s actual JP Mednafen SRAM file Dungeon Master - Theron's Quest (Japan).0daf24b401cbe8c84e88114eab6a3625.sav (2,048 bytes, MD5 dbdedb0ec809227b289c2bc5b18b9c9d). It has a valid HUBM and DMS-SG.001 record, selected slot 0 and campaign byte 0. The test confirms that classification preserves its valid structural receipt while startup shows no recognized/decoded save, Continue is unavailable and both campaign and Theron-body restore reject it without mutating the world. The regression checks the authentic file’s hash before making a temporary .bram symlink; the save and emulator media remain local and unmodified.

Authenticated completion values outside the restore range

The original completion dispatcher capture separately records $267C values 01, 02, 04, 08, 10, and 20 for bounded ordinals 0 through 5 (docs/source-lock/theron-original-akutuba-completion-capture-2026-08-21.md). The US and JP dungeon restore routines are independently byte-locked above; both reject zero and every value whose low seven bits are at least 7 before copying the remaining 133 body bytes. Consequently the authentic later completion values 08, 10, and 20 are rejected by the currently proven Continue route. This is an observed original-code compatibility limitation, not permission for Firestaff to bypass the gate or reinterpret the campaign field. Continue behavior for later original save states remains unresolved until a real later-progress BRAM capture and its original restore control-flow context are tied together. The BRAM admission regression locks this distinction so a future change cannot accidentally broaden the accepted values.