Castle Master: the source

• Boot and selection (live): the Dualis disk reaches its intro from a hard reset; Space dismisses it. Language 1, Return, character 1, Return reaches WILDERNESS. Captures: reference/original-menu.png and reference/play-settled.png; exact recipe in orientation.md.
• Imported image comparison (byte comparison): the disk-boot menu matches all 27,968 code-typed bytes and all 778 word-typed bytes in the supplied analysis. 57 byte-typed bytes differ. This checks the image relationship, not the descriptions.
• Shared storage (byte comparison): menu and gameplay differ at 3,552 bytes within $87CC–$95DB and at 3,218 bytes within $E000–$FF3F. The database $9D00–$BF8F and interpreter tables $13AE–$13ED are unchanged.
• Vectors (live memory read): menu and play have IRQ $0314=$737F, NMI $0318=$7579, hardware IRQ $FFFE=$FF48, hardware NMI $FFFA=$7579. The port is $35, DDR $2F in the menu snapshot.

• Area database (independent parse): $9D00–$BF8F contains 34 area headers and 546 objects. Every declared record length reaches the next record; every object count lands exactly on its area condition list. Directory words at $9D4F–$9D92 are direct offsets from $9D00, not sorted area IDs.
• Area selection (34 controlled native calls): $76D0 publishes the parsed object count, object pointer, condition pointer, scale, attribute and sky/floor flags for every area, including ID 255. Each copied sixteen-byte name matches $1500 + 16*name_index. Fixtures restore gameplay before each call; they validate the routine, not travel between every area.
• Script structure (independent parse and traced consumers): 177 object residual streams, five global streams and eleven area streams contain 809 tokens in total. All 193 exhaust their declared lengths using $13AE–$13DE. Local type-0 records can contain global-object allowlists; the 21 type-2 records are nine bytes long. Treating every record remainder as FCL is incorrect. Global object records supply four of the type-0 script streams.
• Projection (14 controlled native vertices): $3C05 uses signed integer multiplication and division, with screen centre (60,60) and edge values 0/119. The saturation comparisons use signs of wrapped sixteen-bit sums/differences. The zero-depth shortcut at $3C12 is revisited only until the first nonzero-depth vertex; subsequent loop iterations jump to $3C30. A later (0,0,0) produces (119,119) in the tested sequence, whereas an initial zero-depth vertex produces (60,60). This qualifies the imported blanket centre-on-zero statement. The tests cover integer truncation, both edges, signed extremes and both loop positions; ordinary play reachability of zero-depth vertices is open.
• Music structure (independent parse and traced consumers): split frequency tables at $065A/$06BA contain 96 pitch words. Phrase directory $0D07/$0D3C identifies 51 distinct terminated phrases occupying $071A–$0D06; its two additional entries point back into the directory. Seventeen three-voice root groups at $0D71–$0DD6 identify 42 distinct order starts within $0DD7–$0F14. The supplied orders select phrase indices 0–50. These are authored music streams, including the region formerly named runtime workspace at $0814.
• Mutable operands (instruction tracing): $7417/$7418, $7D92/$7D93, $8433/$8434, $40BD/$40BE and $CB5C name rewritten operands. They are not routine entries. The listing now describes their owners and the producer instructions.

• FCL event selection (six controlled native calls): a sixteen-byte fixture contains four score-add tokens, one for each high-two-bit selector. Event masks 0,1,8,4,2,15 produce score additions 0,1,2,4,8,15 respectively. The interpreter restores its input pointer on return. This confirms selector 0→bit 1, selector 1→bit 8, selector 2→bit 4 and selector 3→bit 2; the gameplay causes of those bits remain traced separately.

• Cold hand-over (live): a hard-reset disk load and BASIC RUN reach the Dualis intro. Space after the intro is visibly steady exits it; execution stops at $476F before its first instruction. work/entry.vsf retains that state. Early Space while loading/unpacking did not dismiss the later intro; captures distinguish those states.
• Changed code bytes (byte comparison and instruction writers): all 65 menu/play differences in code blocks occur in instruction operands; every changed address has a direct native store or read/modify/write producer in the captured instruction stream. Examples of mutable fields are $7417/$7418, $7D92/$7D93, $8433/$8434, $40BD/$40BE and $CB5C; their Source comments identify their owners and producers. To regenerate the full audit, compare the menu and play snapshots named in orientation.md only at code-block addresses, find the containing instruction for each differing byte, and scan listing records for direct STA/STX/STY/INC/DEC/ASL/LSR/ROL/ROR operands targeting that address. The private audit JSON is optional output, not the evidence a checker must retrieve. This accounts for the differences as self-modified fields, rather than new or lost instructions.
• Initial graphics (hand-over comparison): all 3,600 viewport bitmap bytes are zero at entry; all 3,918 nonzero initial bitmap bytes lie outside that footprint. The complete physical bitmap is $E000–$FF3F, with the thirty-byte/eight-raster viewport rows beginning $E528 at 320-byte stride. Initial HUD colours are already loaded at $C400; all 1,000 physical colour-shadow bytes at $D800–$DBE7 match hardware colour RAM's low nibbles at entry. The RAM shadow remains unchanged as colour hardware is updated. The authored HUD and palette are included in coverage; generated viewport pixels and cells are excluded separately.
• Initialized HUD frame (controlled native capture): stopped immediately before menu drawing at $9A44, then parked CPU in a temporary loop with IRQs masked and unchanged $D018 stores. Reconstructing the resulting display from captured video state and memory matches all 104,448 emulator pixels. This tests picture encoding/loaded artwork under the stated setup, rather than running gameplay timing. The trimmed input contains 9,001 RAM bytes and no ROM.
• Packed font (six controlled native calls): space, punctuation, digit zero and letters A/M/Z at $8590 reproduce the independently expanded sixteen-byte bitmap buffer exactly. Four input bytes supply eight four-pixel rows; set bits use pair value one except the first low-nibble row, which keeps pair value three. The table at $231A–$2405 covers characters $20–$5A.
• Instrument parameter windows (eight controlled native calls): $CB58 reads ten-byte windows at default offsets 0,9,18,27,36,45,54,63 from $0F15. All fourteen checked cache fields match for each window. The nine-byte stride deliberately overlaps the ten-byte reads; a disjoint ten-byte record model is incorrect. The mutable $CB5C is the voice base 0/8/16, not an extra constant sixteen.
• Riddle layout (independent parse and traced consumers): all nine pointer-selected panels contain counted layout records. Each uses wrapping horizontal delta, absolute row, length and (for literal text) a leading clear flag followed by exactly that many characters. Length $FF inserts a dynamic caption. Their physical boundaries match the neighbouring records; they are authored text, not generic runtime assets.

• Palette startup (controlled native call): the retained $C200–$C234 is executable code. It copies all 1,024 physical RAM shadow bytes into hardware colour RAM by switching port $38/$37, then jumps to $473B. With hardware colours cleared before the call, every low nibble matches and the shadow is unchanged. The following $C235–$C3FF is captured zero padding.
• Disk save/load (live round trip): the native dispatcher writes EST .CM on device 8 using a private copy of the contributor disk, then loads the same 652 bytes exactly. The payload is 106 state bytes $2406–$246F followed by flags/type byte zero of each of 546 objects in directory order. A separate synthetic payload also restores every byte through the native deserializer. IRQs are masked for the final state comparison to prevent clock updates; tape I/O is untested.

• Coverage scope: 52,770/52,770 tracked bytes have allocation/routine descriptions. The hand-over/play loaded-data audit has no remaining unaccounted stretches. Authored bitmap/colours, localization tails and tables are counted; demonstrated runtime renderer/collision/interpreter buffers are excluded with reasons. Open behavior and unresolved residue/parameter roles remain listed in TODO.md; the ledger alone is not exhaustive behavioral verification.

• Music requests (controlled native progression): all 17 request indices initialize the six-byte directory group and run 25 calls of the native tick routine $C885 without losing the injected return checkpoint. The final voice’s patched order-read operand matches the independently parsed root in every case; voice cache changes are recorded per tick. This checks finite initialization/progression, not audio equivalence or every possible phrase/modulation boundary.

Verification work

Signed rotation, clipping boundary behavior, complete painter output, interpreter opcode effects, exact sustained music playback and tape transfer remain to be checked. The structural parses and controlled calls above do not establish an end-to-end rescue route. The interactive article uses the checked contracts and explicitly separates the remaining open behavior.

Cheats

No newly tested pokes are published. The Source tab exposes the named state fields and their consumers; modifying them is not evidence of a reachable gameplay state.