Docs: public copy, site presentation, release-gate review (D533, D534)

Public-copy language pass, homepage restructure and Documentation rename,
404 page, dead-anchor and permalink fixes, release-gate sign-off, and the
pre-release review fixes of the 2026-10-05 batch (probe-doc drift,
build-path hygiene, verify.sh and capture safety).

Refs: D533 D534

docs/dev/GE-ENV-PROBES.md

@@ -120,6 +120,7 @@ Two classes:
 | `GE_FILESELECT_OVERLAY` | `port/src/frontoptions.c:96` | One-PC-options-UI (D519) test hook: opens the F10 overlay over file select without a click; value `n` > 1 also closes it `n` label-frames later. Replaces the retired front-screen probes (the FRONTOPTIONS_SECTION, FRONTNAVLOG, FRONTOPTS_WIDTHS and FRONTOPTIONS_AUTO probes). | **live** (harness) |
 | `GE_WSPROBE` (+ `GE_WSPROBE_FRONT`, `GE_WSPROBE_RESET`, `GE_WSPROBE_F10FRONT`) | `port/src/watchsettings.c:616,568,512`, `port/src/optionsoverlay.c:1566` | D354 watch-settings probe family: `WSPROBE[=tick]` logs before/after the queued settings commit one tick apart; `_FRONT[=tick]` drives a headless front-end change scenario; `_RESET` prepares an options-reset after 120 front ticks and verifies persistence once the stage drains; `_F10FRONT` fires a one-shot F10→front poll after the file-select save becomes available (avoids the joyDisablePoll deadlock). | **live** (diagnostic) |
 | `GE_ZF` (+ `GE_ZFTOL`, `GE_ZFBOX`) | `port/fast3d/gfx_pc.cpp:1653-1657` | Z-fight grid probe: per tri emit, buckets the centroid cell and flags cells that fight ≥5 times (cap 600 hits); `ZFTOL`=tolerance, `ZFBOX="x0 y0 x1 y1"`=world-box filter. | **live** (diagnostic) |
+| `GE_D526` (+ `GE_D526BOX`, `GE_D526MAX`) | `port/fast3d/gfx_pc.cpp:1895,2024,2032,2034` | D526 per-triangle draw-state census probe (text-only): `GE_D526="lo-hi"` = sim-frame range (same dash syntax as `GE_D75D`); `GE_D526BOX="x0 y0 x1 y1"` = NDC region filter (same syntax as `GE_ZFBOX`, default on-screen); `GE_D526MAX` caps per-triangle lines (default 400). Per emitted in-region tri: frame, NDC bbox, z/w, geometry_mode, other_mode_l/h, combine word, sampled tile tmem/fmt/siz, first_tile_index, prim alpha, vertex alpha min/max, use_alpha/modulate/invisible — plus one per-frame line aggregating in-region tris by (comb, oml, omh, alpha) signature. Retained as a generic transparency/texture triage tool (D195/D266/D268/D273 class); the D526 grate case itself was confirmed faithful N64 behaviour, so no fix shipped. Zero cost unless `GE_D75D`/`GE_ZF`/`GE_D303`/`GE_D526` is set (folded into the D474 `tri_dbg` gate). | **live** (diagnostic) |
 
 ## Dxx diagnostic probes — finding closed unless noted
 

docs/dev/HANDOFF-ARCHIVE.md

@@ -3,7 +3,8 @@
 > **Local machine paths are genericised** in this archive: `<repo>` = this repo's
 > working directory, `<repos>` = the local source-repos root, `<games>` / `<videos>`
 > = the local games / video roots, `<python>` = the local CPython install, `<temp>`
-> = a writable native temp dir. Session facts are unchanged.
+> = a writable native temp dir, `<msys>` = the local MSYS2 install root.
+> Session facts are unchanged.
 
 > **Reference only.** Current state lives in the [README](../../README.md)
 > "Status" section and `docs/dev/LEVEL-STATUS.md`; per-finding detail is in
@@ -6168,3 +6169,217 @@ Run from the **repo root**, not `build-pc/`.
    rating, don't hack it in.
 3. Prefer an **offline sidecar converter** (`tools_pc/d*_emit.py`,
    D43/D69/D88 pattern) over a runtime fixup for a whole ROM-asset format.
+---
+
+# Appended 2026-10-05 (session 07j) — moved verbatim from `docs/HANDOFF.md` (briefs 2026-10-05 (session 07d) → 2026-10-05 (session 07g))
+
+# HANDOFF — 2026-10-05 (session 07d)
+
+## Branch
+`release/v0.4.1` @ `e9cf2ddf` (D530 addendum), tree clean.
+Local-only commits on top of `442eb2ff`: `aa19b354` (site SEO/redundancy),
+`2c378e7e`+`24b084d0` (Known issues), `ada7bbb1` (D530 goldens), `e9cf2ddf`
+(D530 addendum). **Nothing pushed.**
+
+## This session (2026-10-05 (session 07d), user stepped away ~10:45, returns ~14:00 EDT)
+
+1. **HANDOFF 07c item 1 (critical path) — DONE, committed (`ada7bbb1`):**
+   - The X220 P7 re-round had completed on the box 2026-10-05 (tree `442eb2ff`,
+     worktree `~/gh-fullhist-wt-p7`, `~/p7-reround.log` hit `P7 re-round DONE`
+     12:53 EDT, **21/21 levels rc=0** under the canonical `ge007.eep`).
+   - Pulled the 63 PNGs (15 MB tarball → `scratch/p7-pull/`, log →
+     `scratch/p7-reround-pull.log`) and committed them into
+     `tools_pc/golden/<level>/linux/`, replacing the D525 cleared-eep set:
+     **51/63 differ; 12/63 byte-identical** (save-independent scenes,
+     including frigate's first stem 001000 — a D117 stability signal).
+   - **D117 flaky-four first-stem check (D529 never-do 6, first cross-machine
+     test):** dam@1500 worst_cell 1.70 (phash 0), frigate@1000 byte-identical,
+     streets@1000 1.78 (phash 0), jungle@900 5.12 (phash 3) — all in
+     stable-level range, **none red → NO first-stem exclusion/widening**.
+   - Structural tier all `ok` (cradle@40 documented exception; Cuba 26.4%
+     within the documented 23.7–36.3% structural-only range). The `fail` rows
+     in the box report are the expected cross-eep diffs vs the old set.
+   - **Closes D529 never-do 3:** the index/README v0.5.0 "re-based on both
+     platforms (21 levels, 63 frames each)" line now stands on a
+     canonical-eep linux set → linux numbers unblocked (B7 satisfied).
+   - Wrote **D530** (findings.md detail + §F table: D523 now SUPERSEDED-by-
+     D529, D529 row was missing from the table — the 07c CSV had been
+     hand-patched, which is why `gen_findings_index.py --check` drifted;
+     regenerated) + `tools_pc/golden/README.md` linux-set text + History.
+
+2. **DONE: fresh `verify.sh sweep` on the box against the NEW goldens**
+   (shipped the 51 PNGs to `~/gh-fullhist-wt-p7`, box diff = 51 = the
+   tree delta; fired 10:5x EDT, finished ~11:10 EDT): **21/21 PASS, 0
+   FAIL** — but the run was **crash-detect only** (GE_PCDUMP reads black
+   on the box's llvmpipe/WSLg, the D244 note; no pixel gate). So it is a
+   stability re-check; the D117 cross-machine *pixel* evidence remains the
+   re-round capture itself (the D530 first-stem check). Recorded as the
+   D530 addendum (`e9cf2ddf`) with the residual: a pixel-gated box verify
+   needs a working WSLg GPU session (the 10-05 re-round's pixel comparisons
+   ran fine, so one exists).
+   - Log pulled: `scratch/p7-verify-new-pull.log` (tail: `21` PASS, `0`
+     FAIL, `SWEEP DONE`).
+
+3. **DONE (partial, at push time still owed): PII scrub addendum for the 51
+   new golden PNGs** — EXIF/text metadata sweep over all 63 linux PNGs:
+   **0 metadata tags** (PIL); new doc text (D530, golden README) uses
+   "X220" + `~/` paths only — no absolute paths/usernames/private IPs in
+   tracked files (the box LAN address lives only in the gitignored
+   HANDOFF + scratch logs). Addendum appended to
+   `docs/dev/notes/PII-SCRUB-REPORT.md` (gitignored). The full
+   LEGAL-review pass (game-content rule for screenshots) is still owed at
+   push time.
+
+## User to review at ~14:00 EDT
+- Local batch of 5 doc/golden commits (`aa19b354` SEO/redundancy;
+  `2c378e7e`+`24b084d0` Known issues; `ada7bbb1` D530 goldens; `e9cf2ddf`
+  D530 addendum — box sweep 21/21 crash-detect PASS).
+- Then the standing HANDOFF 07c items: 2. maintainer review of the 12-file
+  batch; 3. P12 U2/U5/U6/U7 (deferred light-unit mechanical review);
+  4. re-cut squash → B7/B8/B9 (README linux numbers now unblocked);
+  5. push `release/v0.5.0` + tag.
+
+## Environment
+- Preview: `:8777` (PID may be stale after a reboot — `node
+  scratch/build_preview.mjs site && node scratch/serve_preview.mjs 8777`).
+- Box ssh: `ssh the test box` (Windows→box works; box has no sshd —
+  everything rides the same session's stdin/stdout; pushes via
+  `cat f | ssh ... 'cat > dest'` or tar pipes).
+- 3 parked worktrees (ci/d441/modpatch) untouched.
+
+---
+
+# HANDOFF — 2026-10-05 (session 07e) (D531 + P12 U5)
+
+## Branch
+`release/v0.4.1` @ `164920c6`, tree clean. Three more local-only commits on
+top of `e9cf2ddf`: `4829fd94` (D531 blocker fix + canonical re-capture),
+`d2d75e11` (ROADMAP rows), `164920c6` (D531 addendum). **Nothing pushed.**
+
+## This session (2026-10-05 (session 07e))
+
+**D531 — `capture_p7.sh` canonical-re-pin blocker (P12 U5 review finding),
+fixed + re-captured. AMENDS D530.**
+
+- U5 reviewed `tools_pc/**` (the release-diff unit that owed the P7 merge):
+  small diffs all mechanical/clean; `p7_report.py`, `eep_convert.py`,
+  `abi_ratchet.py`, `docs_budget.py`, `abpad/` clean (list-arg subprocess,
+  raw_decode JSON, no shell, no destructive ops); deletions clean (probe
+  tools + the 433k-line sweep-capture PPM set). **But** `capture_p7.sh`'s
+  D529 adaptation was incomplete: the D524-era per-level re-pin
+  (`cp "$EEP_ORIG" "$EEP"`, restoring the pre-capture LOCAL save) silently
+  overwrote D529's pre-loop canonical install from level 1 — so **the
+  10-05 box re-round (D530) ran under the box-local save, not the
+  canonical eep**. D530's "canonical eep" provenance claim and first-stem
+  table are void as canonical-save evidence (D530 entry + README amended in
+  place; the table's numbers do check out against the 10-05 report).
+  **The win set is unaffected** — `verify.sh`'s `pin_eep` was correct.
+- Fix: the loop now re-pins `cp "$CANON_EEP" "$EEP"` per level (EEP_ORIG
+  kept for the exit-restore only); `cd "$ROOT"` added (the loop's
+  dump/golden paths are root-relative, contradicting the header's
+  "invoked from anywhere" claim).
+- **Re-captured:** shipped the fixed script to the box (sha matched), fresh
+  21-level round with `DISPLAY=:0` → 21/21 rc=0, 63 frames. **47/63 differ
+  from the D530 box-local-save set** (save content demonstrably moves
+  frames), 16 byte-identical. Committed into the linux goldens.
+- **Renderer finding (corrects the 07d item-2 note):** even with
+  `DISPLAY=:0` the box today reports no usable glxinfo renderer (software
+  fallback → black read-backs) — the WSLg GPU display is
+  **session-state-dependent** (the 10-05 re-round's p7_report pixel table
+  proves it was GPU-backed then). Today's `verify.sh sweep` against the new
+  goldens: **21/21 PASS, 0 FAIL, crash-detect only** (log
+  `scratch/p7-verify-pixel-pull.log`). The pixel-gated verdict (incl. the
+  four D117 flaky first stems) is owed for a GPU-display window.
+- Docs: D531 entry + §F row (regenerated CSV, 394 lines, `--check` OK),
+  D530 amended in place, golden README intro + History, ROADMAP Golden
+  baselines row (was still on D523 framing) + new P12 U5 row. PII addendum
+  #2 (63 PNGs, 0 metadata tags).
+
+**U5 should-fixes (rows on the ROADMAP, not yet applied):**
+1. `verify.sh` `pin_ini_640x480 2>/dev/null || true` fails OPEN (pin_eep
+   fails closed) — a failed ini write runs the gate under the user's
+   personal ini → spurious verdicts. Make it abort.
+2. `GOLDEN_SEED="${GE_RSEED:-…}"` lets a stray env var re-seed the gate —
+   warn or hard-pin (capture inherits the same override via its eval out
+   of verify.sh, so gate/capture stay consistent either way).
+3. `audiodebug.ps1` `-AB`/`-Old` are documented dead no-ops (nit).
+
+## User to review at ~14:00 EDT (supersedes the 07d list)
+- 8 local commits: `aa19b354` (site SEO/redundancy), `2c378e7e` +
+  `24b084d0` (Known issues), `ada7bbb1` (D530 goldens — now AMENDED BY
+  D531), `e9cf2ddf` (D530 addendum), `4829fd94` (D531), `d2d75e11`
+  (ROADMAP), `164920c6` (D531 addendum).
+- Preview: `node scratch/build_preview.mjs site` → `scratch/_site/` on :8777.
+
+## Still owed (unchanged, plus)
+- Pixel-gated box verify in a WSLg GPU-display window (never-do 6 applies
+  if the flaky four go red: exclude/widen, do NOT recapture).
+- The three U5 should-fixes above; P12 U2/U6/U7; HANDOFF 07c item 2
+  (maintainer review of the 12-file docs batch); squash → B7/B8/B9; push
+  `release/v0.5.0` + tag.
+- LEGAL review pass at push time (screenshots rule — 47 new linux PNGs are
+  the same class: box-captured, no metadata).
+
+---
+
+# HANDOFF — 2026-10-05 (session 07f) (D532 + squash re-cut + PUSH)
+
+## Pushed (2026-10-05 (session 07e)/f, maintainer approved)
+- **GitHub** `origin`: new branch `release/v0.5.0` (the re-cut squashed
+  chain, 33 commits, tip `f077435a`) + annotated tag `v0.5.0`.
+  **`origin/main` untouched** (`0e8c2ce2`) — main merge + public release
+  wait for the maintainer's playtest.
+- **Forgejo mirror**: `release/v0.5.0-squashed` + tag `v0.5.0`.
+- Squash re-cut: `scratch/p11b-squash.py` (p11 + new tip `4dd1d56d`,
+  assert 488, new group 33 covering D529-D532 + the site/amber pass).
+  Tip tree byte-identical (B7), LAN scrub of intermediate trees
+  re-applied, `pre-squash-v050` -> `4dd1d56d` (B6), tag message in
+  `scratch/tag-msg-v050.txt` (B8), PII/legal addenda on the final tree
+  (B9: clean; 4 pre-existing toolchain-path sites only).
+- **D532** (`4dd1d56d`) landed before the cut: verify.sh fail-closed
+  ini pin + hard-pinned seed (warn on stray `GE_RSEED`), audiodebug
+  dead switches removed. Docs: D532 entry/row, ROADMAP U5 row applied.
+
+## Now owed (in order)
+1. **Maintainer playtest** (C6 list: D511-D514/D519 items) on the
+   `release/v0.5.0` build → then remove the "not yet playtested live"
+   block and cut the `gh release` (C1-C9; bundles built FROM the pushed
+   tree).
+2. **Pixel-gated box verify** in a WSLg GPU-display window (D531; the
+   box worktree `~/gh-fullhist-wt-p7` is still at `442eb2ff` — needs a
+   bundle transfer of the new tip; no LAN route, options per the P7
+   handback §8).
+3. **P12 U2/U6/U7** quick passes (U1/U3/U4/U5 PASS; U6 = build+CI
+   diff, U7 = docs diff — read-only, ROADMAP rows for should-fixes).
+4. CI on the new GitHub branch: first real run of the SLSA
+   build-provenance attestation (ROADMAP "Release build-provenance
+   attestation" row: confirm, then delete).
+5. Box-side parallel: self-gate on the release branch (crash-detect
+   until the GPU window).
+
+## Local state
+`release/v0.4.1` @ `4dd1d56d` (== the pushed squashed tip tree), tree
+clean. `release/v0.5.0` / `release/v0.5.0-squashed` @ `f077435a`.
+`pre-squash-v050` @ `4dd1d56d`. Nothing else pending locally.
+
+---
+
+# HANDOFF — 2026-10-05 (session 07g) (push reverted; held local)
+
+- **GitHub push REVERTED** (branch `release/v0.5.0` + tag `v0.5.0` deleted,
+  verified via `git ls-remote`); backup lives on the private Forgejo mirror
+  (`release/v0.5.0-squashed` + tag `v0.5.0` @ `f077435a`). Local refs:
+  `release/v0.5.0` / `release/v0.5.0-squashed` @ `f077435a`,
+  `pre-squash-v050` @ `4dd1d56d`.
+- **Standing rule (maintainer):** backups → Forgejo, never GitHub; GitHub
+  pushes only after the maintainer approves everything.
+- **Docs finalization owed:** the batch review (`scratch/docs-batch-review.txt`,
+  commit `ba29c558` — 16 text files) and the **PR/SEO language pass**
+  (brief written: `scratch/pr-seo-revise-prompt.md` — tiers T1/T2/T3, voice,
+  SEO parity checklist, hard rules; example fix = the v0.5.0 News tagline
+  leading with "plain-English wording" + the UK/US spelling item demoted to
+  "small stuff").
+- Then: playtest (C6) → `gh release` (C1–C9) → the ONE approved GitHub push
+  (release branch + tag + release) → main.
+
+---

docs/dev/agentic-development.md

@@ -12,8 +12,8 @@ part-time direction. The goal, the setup, the timeline, and an honest read on
 what did and didn't work.*
 
 > *Snapshot as of the v0.3.0 milestone (20 Sep 2026; findings through D321).
-> v0.4.0 (28 Sep) extended the timeline with the options/input work -- the
-> README's Background section carries the final project numbers.*
+> v0.4.0 (28 Sep) extended the timeline with the options/input work — the
+> README's "How it was made" section carries the final project numbers.*
 
 ## Contents
 
@@ -300,25 +300,8 @@ last few weeks), which has driven the most recent work. The local menu:
   **mostly deprecated now**: hand-offs between agents are done by hand for now,
   pending a better parallel-agent handoff system that drops the MCP overhead.
 - **GPT-6 (Sol)** via [OpenRouter](https://openrouter.ai) — a frontier hosted
-  model, **trialed** to see how it held up (not the hardest-work tool). Its
-  code output is still owed a code-quality audit in this doc.
+  model, **trialed** to see how it held up (not the hardest-work tool).
 
 The practical effect: the project stopped depending on any one model or its
 usage limits. The local GPU is now the default path for high-volume work, with
 hosted frontier models reserved for the problems the local models can't close.
-
-**Measurement owed.** Which of these was best on a given task — and each
-model's rough cost-to-performance ratio — has not yet been measured properly;
-attributing individual commits to the model that produced them is still a
-manual pass. That includes a **code-quality audit of the GPT-6 (Sol) trial**.
-All of it is pending and will be added here when it lands.
-
-A concrete reason the commit-date route is unreliable: the `D350` commit
-(`1303c0eb`, "expose watch-backed Bond settings in PC options and F10")
-carries a **27 Sep** timestamp on both its author and committer dates, but
-the session notes place that work on **4 Oct**. Because the two git dates
-agree, this is **not** a rebase artifact (a rebase would have moved the
-committer date while preserving the author date); it is a genuine divergence
-between the recorded commit time and the working session, and resolving it
-takes the session log, not the commit date. This is the class of edge case
-the attribution pass has to walk by hand.

docs/dev/findings-index.csv

@@ -382,14 +382,16 @@ D519,FIXED,"One PC options UI: the file-select ""PC Options"" entry opens the F1
 D520,FIXED,"F10 overlay slider wedge, slider marker and dropdown arrow antialiased (they stepped in whole canvas pixels that grow with the window) —",FIXED (headless before/after capture; by-eye owed)
 D521,PARTIAL,A fixed-frame golden window that overlaps the intro flyby is platform-nondeterministic (cross-platform goldens); verify.sh's linux pixel-gate skip is driver-co…,PARTIAL (rule recorded 2026-10-04; the two residual bands CLOSED 2026-10-05 by D525's box re-round —
 D522,FIXED,The golden window's frame-900 stem is not settled gameplay on several levels —,FIXED 2026-10-05 (recipe-side re-base:
-D523,CLOSED,The golden recipe does not pin save state:,SUPERSEDED by D529 (2026-10-07) —
+D523,CLOSED,The golden recipe does not pin save state:,SUPERSEDED by D529 (2026-10-05) —
 D524,FIXED,The golden tooling was destructive and drift-prone:,FIXED 2026-10-05 (both pins idempotent —
 D525,FIXED,"The whole <level>/linux/ golden set was stale, not just on the six re-based levels —","FIXED 2026-10-05 (21-level box re-round, 63 frames, save pinned present; structural parity 21/21, Archives/Streets bands attributed to save state, not a renderer)"
-D526,CLOSED,P13 Dam-ending grate / edge-railing transparency is faithful N64 behaviour (port == 1964/GEPD); the per-triangle census probe is retained as a generic draw-sta…,"CLOSED — faithful, confirmed on 1964/GEPD (2026-10-07):"
+D526,CLOSED,P13 Dam-ending grate / edge-railing transparency is faithful N64 behaviour (port == 1964/GEPD); the per-triangle census probe is retained as a generic draw-sta…,"CLOSED — faithful, confirmed on 1964/GEPD (2026-10-05):"
 D527,OPEN,GE_PCDUMP written first:last (a colon where the dash belongs) silently dumps EVERY frame —,OPEN (harness documentation; a log-or-fail-closed fix is owed in the port layer)
 D528,OPEN,"GE_STARTMENU skips the EEPROM read, so front-end-only sessions never import the emulator save —",OPEN (harness documentation; the D514 imported-save test must run from a normal boot; a log-or-import fix is owed in the port layer)
-D529,FIXED,The golden gate depends on the save file's CONTENT —,FIXED 2026-10-07 (canonical save in-tree at tools_pc/golden/ge007.eep; verify.sh installs it like the ini pin; all 21 win sets re-captured under it —
-D530,?,The box (X220) linux golden re-round landed —,AMENDED BY D531 (2026-10-07) —
-D531,FIXED,capture_p7.sh's D529 adaptation was incomplete —,"FIXED 2026-10-07 (loop re-pins the canonical save per level + cd ""$ROOT""; fresh 21/21 box re-capture committed —"
-D532,FIXED,The three P12 U5 should-fixes applied —,FIXED 2026-10-07 (tooling-only:
+D529,FIXED,The golden gate depends on the save file's CONTENT —,FIXED 2026-10-05 (canonical save in-tree at tools_pc/golden/ge007.eep; verify.sh installs it like the ini pin; all 21 win sets re-captured under it —
+D530,?,The box (X220) linux golden re-round landed —,AMENDED BY D531 (2026-10-05) —
+D531,FIXED,capture_p7.sh's D529 adaptation was incomplete —,"FIXED 2026-10-05 (loop re-pins the canonical save per level + cd ""$ROOT""; fresh 21/21 box re-capture committed —"
+D532,FIXED,The three P12 U5 should-fixes applied —,FIXED 2026-10-05 (tooling-only:
+D533,FIXED,"The probe-doc drift that would have failed CI, plus three tracked-file accuracy/hygiene fixes (release-sweep spot-check) —",FIXED 2026-10-05 (GE-ENV-PROBES.md missing the GE_D526 family → gen_env_probes.py --check rc 1 = a CI-failing step; build-pc.sh local MSYS2 root in two messages; docs/fidelity.md og line; release-not…
+D534,FIXED,Pre-release review of the 2026-10-05 local batch —,FIXED 2026-10-05 (verify.sh/capture_p7.sh INT/TERM trap; release-notes linux-gate wording; dead security-and-fidelity-status.md links; future-dated 2026-10-07 labels normalised; D526 probe dangling-e…
 D450,FIXED,"Unplugging and replugging a controller was not picked up (user, GameSir-G7 Pro; 2026-09-29).","FIXED — port-only: the render thread's gfx_sdl_handle_events drains the same SDL queue as video.c's host pump but had no case for SDL_CONTROLLERDEVICEADDED/REMOVED, so it usually swallowed them and i…"

docs/dev/findings.md

@@ -790,16 +790,18 @@ covers D24–D69; the log continues in §H (D32 procedure, D70–D121).
 | D520 | **F10 overlay slider wedge, slider marker and dropdown arrow antialiased (they stepped in whole canvas pixels that grow with the window)** — Port-only; D504 follow-up, P4k investigation; full `## D520` entry at file tail | FIXED (headless before/after capture; by-eye owed) |
 | D521 | **A fixed-frame golden window that overlaps the intro flyby is platform-nondeterministic (cross-platform goldens); verify.sh's linux pixel-gate skip is driver-conditional** — Port-only (docs + verify.sh probe); D117 class, P7; full `## D521` entry at the end of this file | PARTIAL (rule recorded 2026-10-04; the two residual bands CLOSED 2026-10-05 by D525's box re-round — save state, not a renderer; cross-platform parity stays informational, the gate is per platform) |
 | D522 | **The golden window's frame-900 stem is not settled gameplay on several levels — the win golden gate is not green (5/21 REGRESSION honest sequential, 7/21 concurrent)** — Golden gate; D117 follow-up; full `## D522` entry at file tail | FIXED 2026-10-05 (recipe-side re-base: per-level windows settled on every level; win gate 21/21 PASS honest sequential; no tol limit raised) |
-| D523 | **The golden recipe does not pin save state: `verify.sh` pins the ini but never touches `data/ge007.eep`, and the goldens were captured with a save present** — Golden gate; D514/D522 follow-up; full `## D523` entry at file tail | SUPERSEDED by D529 (2026-10-07) — the frame depends on the save's *content*, not its presence (the presence claim was only ever measured on Archives); the gate now installs the canonical in-tree save `tools_pc/golden/ge007.eep` |
+| D523 | **The golden recipe does not pin save state: `verify.sh` pins the ini but never touches `data/ge007.eep`, and the goldens were captured with a save present** — Golden gate; D514/D522 follow-up; full `## D523` entry at file tail | SUPERSEDED by D529 (2026-10-05) — the frame depends on the save's *content*, not its presence (the presence claim was only ever measured on Archives); the gate now installs the canonical in-tree save `tools_pc/golden/ge007.eep` |
 | D524 | **The golden tooling was destructive and drift-prone: `verify.sh`'s per-level ini/save pin snapshotted the previous level's game-written file (a sweep overwrites the user's own `data/ge007.ini`), and `capture_p7.sh` hardcoded the pre-D522 windows while deleting the save it captures with** — Golden tooling (U5 review of `tools_pc/**`); D522/D523 follow-up; full `## D524` entry at file tail | FIXED 2026-10-05 (both pins idempotent — first call snapshots the user's files, every level re-pins from that snapshot; `capture_p7.sh` reads the recipe out of `verify.sh` and requires the save present) |
 | D525 | **The whole `<level>/linux/` golden set was stale, not just on the six re-based levels — re-rounding it closes D521's two residual render bands** — Golden gate (P7b, box); D521/D522/D523 follow-up; full `## D525` entry at file tail | FIXED 2026-10-05 (21-level box re-round, 63 frames, save pinned present; structural parity 21/21, Archives/Streets bands attributed to save state, not a renderer) |
-| D526 | **P13 Dam-ending grate / edge-railing transparency is faithful N64 behaviour (port == 1964/GEPD); the per-triangle census probe is retained as a generic draw-state diagnostic** — P13 Dam ending (B1 lead); full `## D526` entry at file tail | CLOSED — faithful, confirmed on 1964/GEPD (2026-10-07): the show-through is in both (port == N64), so no port bug, no fix (D306/D291 class); the per-triangle census probe (GE_D526/GE_D526BOX/GE_D526MAX) is retained as a generic diagnostic |
+| D526 | **P13 Dam-ending grate / edge-railing transparency is faithful N64 behaviour (port == 1964/GEPD); the per-triangle census probe is retained as a generic draw-state diagnostic** — P13 Dam ending (B1 lead); full `## D526` entry at file tail | CLOSED — faithful, confirmed on 1964/GEPD (2026-10-05): the show-through is in both (port == N64), so no port bug, no fix (D306/D291 class); the per-triangle census probe (GE_D526/GE_D526BOX/GE_D526MAX) is retained as a generic diagnostic |
 | D527 | **`GE_PCDUMP` written `first:last` (a colon where the dash belongs) silently dumps EVERY frame** — harness trap (`port/src/video.c`); full `## D527` entry at file tail | OPEN (harness documentation; a log-or-fail-closed fix is owed in the port layer) |
 | D528 | **`GE_STARTMENU` skips the EEPROM read, so front-end-only sessions never import the emulator save** — harness trap; D514 follow-up; full `## D528` entry at file tail | OPEN (harness documentation; the D514 imported-save test must run from a normal boot; a log-or-import fix is owed in the port layer) |
-| D529 | **The golden gate depends on the save file's CONTENT — the D523 "presence, not which save" claim is refuted; the gate must pin a canonical save** — Golden gate; D523 follow-up (D525/D524); full `## D529` entry at file tail | FIXED 2026-10-07 (canonical save in-tree at `tools_pc/golden/ge007.eep`; `verify.sh` installs it like the ini pin; all 21 win sets re-captured under it — three consecutive clean 21/21 sweeps are the valid green record; the no-arg `verify.sh` path now exits 1; the box linux re-round under it landed as D530) |
-| D530 | **The box (X220) linux golden re-round landed — first cross-machine test of the four D117 flaky levels** — Golden gate (P7, box); D529 never-do 3/6 follow-up; full `## D530` entry at file tail | AMENDED BY D531 (2026-10-07) — the "canonical eep" provenance claim was wrong: the re-round ran under the box-LOCAL save (the `capture_p7.sh` per-level re-pin bug); the D531 re-capture under the true canonical eep supersedes this set |
-| D531 | **`capture_p7.sh`'s D529 adaptation was incomplete — the per-level re-pin restored the local save, so the 2026-10-05 box re-round ran under the box-local save; fixed + re-captured under the canonical eep** — Golden gate (P7, box); D529/D530 follow-up, P12 U5 review finding; full `## D531` entry at file tail | FIXED 2026-10-07 (loop re-pins the canonical save per level + `cd "$ROOT"`; fresh 21/21 box re-capture committed — 47/63 frames differ from the box-local-save set; pixel-gated box verify owed for a window with the box's WSLg GPU display active — today's session is on the software fallback, black read-backs) |
-| D532 | **The three P12 U5 should-fixes applied — the gate's ini pin now fails closed, the seed is hard-pinned (stray `GE_RSEED` warns), and `audiodebug.ps1`'s dead A/B switches are gone** — golden gate + tooling; D531/U5 follow-up; full `## D532` entry at file tail | FIXED 2026-10-07 (tooling-only: `pin_ini_640x480` fails closed like `pin_eep`; `GOLDEN_SEED` literal + warning, capture `eval` unaffected; `-AB`/`-Old`/`-OldMode` removed with a note) |
+| D529 | **The golden gate depends on the save file's CONTENT — the D523 "presence, not which save" claim is refuted; the gate must pin a canonical save** — Golden gate; D523 follow-up (D525/D524); full `## D529` entry at file tail | FIXED 2026-10-05 (canonical save in-tree at `tools_pc/golden/ge007.eep`; `verify.sh` installs it like the ini pin; all 21 win sets re-captured under it — three consecutive clean 21/21 sweeps are the valid green record; the no-arg `verify.sh` path now exits 1; the box linux re-round under it landed as D530) |
+| D530 | **The box (X220) linux golden re-round landed — first cross-machine test of the four D117 flaky levels** — Golden gate (P7, box); D529 never-do 3/6 follow-up; full `## D530` entry at file tail | AMENDED BY D531 (2026-10-05) — the "canonical eep" provenance claim was wrong: the re-round ran under the box-LOCAL save (the `capture_p7.sh` per-level re-pin bug); the D531 re-capture under the true canonical eep supersedes this set |
+| D531 | **`capture_p7.sh`'s D529 adaptation was incomplete — the per-level re-pin restored the local save, so the 2026-10-05 box re-round ran under the box-local save; fixed + re-captured under the canonical eep** — Golden gate (P7, box); D529/D530 follow-up, P12 U5 review finding; full `## D531` entry at file tail | FIXED 2026-10-05 (loop re-pins the canonical save per level + `cd "$ROOT"`; fresh 21/21 box re-capture committed — 47/63 frames differ from the box-local-save set; pixel-gated box verify owed for a window with the box's WSLg GPU display active — today's session is on the software fallback, black read-backs) |
+| D532 | **The three P12 U5 should-fixes applied — the gate's ini pin now fails closed, the seed is hard-pinned (stray `GE_RSEED` warns), and `audiodebug.ps1`'s dead A/B switches are gone** — golden gate + tooling; D531/U5 follow-up; full `## D532` entry at file tail | FIXED 2026-10-05 (tooling-only: `pin_ini_640x480` fails closed like `pin_eep`; `GOLDEN_SEED` literal + warning, capture `eval` unaffected; `-AB`/`-Old`/`-OldMode` removed with a note) |
+| D533 | **The probe-doc drift that would have failed CI, plus three tracked-file accuracy/hygiene fixes (release-sweep spot-check)** — release gate (P12 U2/U6/U7 spot-checks); full `## D533` entry at file tail | FIXED 2026-10-05 (`GE-ENV-PROBES.md` missing the `GE_D526` family → `gen_env_probes.py --check` rc 1 = a CI-failing step; `build-pc.sh` local MSYS2 root in two messages; `docs/fidelity.md` og line; release-notes gate paragraph quoted a pre-D531 spread) |
+| D534 | **Pre-release review of the 2026-10-05 local batch — Ctrl-C in the golden gate could leave the user's save replaced, plus doc accuracy fixes** — release gate; full `## D534` entry at file tail | FIXED 2026-10-05 (`verify.sh`/`capture_p7.sh` INT/TERM trap; release-notes linux-gate wording; dead `security-and-fidelity-status.md` links; future-dated `2026-10-07` labels normalised; D526 probe dangling-else; verify.sh usage range) |
 | D407 | **Tanks cannot be boarded/exited on PC — the v0.4.0 use/reload split (D378/D393) removed the B-button tap the engine's tank handlers in `bondview2.c` consume (user report 2026-09-28, Runway/Streets)** — full `## D407` entry at file tail | PARTIAL (fix landed in v0.4.0, port-only): present `GE_CONT_B` on the use (E / pad A) rising edge only while `g_PlayerIsInTank == 1` or `g_BondCanEnterTank != 0`; E keeps its D378 no-reload-fallback semantics elsewhere, N64 layout unaffected. D407(b) same cycle: front PC Options page-edge highlight clamp + mouse-wheel / W-S paging (wheel queue consumed on the menu, D223); its wheel mapping shipped inverted and was fixed to match W/S (wheel up = step up). D407(c): board-animation lockout, menu-accept B gate in tank states, in-tank aim routed through the legacy velocity stick + `Input.TankAimScale` knob. RESOLVED 2026-09-28: all port-only (src/game zero-diff), 10 TANKDBG probes stripped, release binary verified clean, user live tank drive signed off (board + exit OK, aim feel good). |
 | D408 | **`Game.SkipIntro` skips the post-mission failure dossier: with it on, entering a level then aborting (watch Z+A) or dying (KIA) returns straight to the menus — no REPORT / "Mission status: KILLED IN ACTION / ABORTED" screen** (user report 2026-09-28; save/AllUnlocked ruled out) — full `## D408` entry at file tail | OPEN (cosmetic, not root-caused past the handoff site). v0.4.0 decision: SkipIntro stays EXPERIMENTAL / not recommended for regular users — F10 row relabelled "Skip intro (EXPERIMENTAL)". |
 | D450 | **Unplugging and replugging a controller was not picked up (user, GameSir-G7 Pro; 2026-09-29).** — full `## D450` entry at file tail | FIXED — port-only: the render thread's `gfx_sdl_handle_events` drains the same SDL queue as video.c's host pump but had no case for `SDL_CONTROLLERDEVICEADDED/REMOVED`, so it usually swallowed them and `inputRescanPads` never ran. Both pumps now post a request; the rescan runs at the top of `inputUpdate`, on the thread that reads the pads. |
@@ -17155,7 +17157,7 @@ keep: the next `./build-pc.sh` run reconfigures in place and picks up x86_64.
 
 **Fix owed (recipe-side only; no game-code change):** either (a) move the capture window to stems settled on every level (1200–1800:300 is the measured candidate) and re-capture the 63 `win/` PNGs plus the box's linux set, or (b) keep the set and state the gate honestly (structural green + per-pixel marginal at 900) in `golden/README.md`, the ROADMAP row and the known-issues table. Driver: `scratch/sweep-par.sh` (gitignored; mirrors `verify.sh`'s ini pin, `GE_*` recipe, framediff flags and per-level limits, one cwd per level so runs can overlap — parallel verdicts are diagnosis only, the honest numbers come from the `JOBS=1` pass).
 
-## D523: The golden recipe does not pin save state — `verify.sh` pins the ini but never touches `data/ge007.eep` (golden gate; D514/D522 follow-up) — **SUPERSEDED by D529 (2026-10-07): the frame depends on the save's CONTENT, not its presence; the gate now installs the canonical in-tree save**
+## D523: The golden recipe does not pin save state — `verify.sh` pins the ini but never touches `data/ge007.eep` (golden gate; D514/D522 follow-up) — **SUPERSEDED by D529 (2026-10-05): the frame depends on the save's CONTENT, not its presence; the gate now installs the canonical in-tree save**
 
 **FIXED 2026-10-05 — `verify.sh` now pins the save file** (back up + require `data/ge007.eep`, mirroring the ini pin; it exits 2 with a message when a clone has none, rather than silently measuring a different scene), and `tools_pc/golden/README.md` states the pin. The measurements below are the record of why the gap mattered.
 
@@ -17193,7 +17195,7 @@ keep: the next `./build-pc.sh` run reconfigures in place and picks up x86_64.
 
 ## D526: P13 Dam-ending grate / edge-railing transparency is faithful N64 behaviour (port == 1964/GEPD); the per-triangle census probe is retained as a generic draw-state diagnostic
 
-**CLOSED as faithful 2026-10-07 (no port bug; no fix).** The P13 "Dam-ending grate show-through" (2nd POSENDS camera: the area under the grate Bond stands on shows through — the 2D edge-railing/grate texture's between-anchors region) was triaged as a suspected B1 port bug (the grate quad's texture stage taking an alpha/blend path it shouldn't — D195/D268 class). To bucket it, a per-triangle draw-state census probe was built (this D526) and smoke-tested. The 1964/GEPD reference of the same 2nd-POSENDS shot then showed **the port and the N64 look the same** — the show-through is in *both*. So it is the original game's 2D grate/railing texture rendering, reproduced faithfully: a known issue that **closes in the D306/D291 class** (a "bug" that 1964 shows is intended behaviour). There is nothing to fix in `port/fast3d/`.
+**CLOSED as faithful 2026-10-05 (no port bug; no fix).** The P13 "Dam-ending grate show-through" (2nd POSENDS camera: the area under the grate Bond stands on shows through — the 2D edge-railing/grate texture's between-anchors region) was triaged as a suspected B1 port bug (the grate quad's texture stage taking an alpha/blend path it shouldn't — D195/D268 class). To bucket it, a per-triangle draw-state census probe was built (this D526) and smoke-tested. The 1964/GEPD reference of the same 2nd-POSENDS shot then showed **the port and the N64 look the same** — the show-through is in *both*. So it is the original game's 2D grate/railing texture rendering, reproduced faithfully: a known issue that **closes in the D306/D291 class** (a "bug" that 1964 shows is intended behaviour). There is nothing to fix in `port/fast3d/`.
 
 **Probe (retained as a generic tool):** `d526_note_emit()` in `port/fast3d/gfx_pc.cpp`, folded into the D474 `tri_dbg()` gate (zero player cost when off). Env: `GE_D526="lo-hi"` (sim-frame window), `GE_D526BOX="x0 y0 x1 y1"` (NDC region, y-up; default whole screen), `GE_D526MAX=N` (cumulative per-triangle line cap, 400; the per-frame `D526F:` signature aggregate is uncapped). Emits to stderr: per-triangle NDC bbox, z/w, `gm`, `oml`, `omh`, combine mode, first-tile tmem/fmt/siz, prim + vertex alpha, use_alpha/modulate/invisible/2-cycle, plus a per-frame `D526F:` signature map. It is the only per-triangle *draw-state* census (D474/D75D/ZF/D303 are specialized) and is the right tool for the alpha/texture bug class (D195/D266/D268/D273).
 
@@ -17221,7 +17223,7 @@ Decision owed: document it (a NOTE log line when `GE_STARTMENU` is active: "EEPR
 
 ## D529: The golden gate depends on the save file's CONTENT — the D523 "presence, not which save" claim is refuted; the gate must pin a canonical save (golden gate; refines D523; follow-up to D525/D524)
 
-**2026-10-07 (pre-push session).** The D523 pin installed *whichever* local save existed ("presence, not which save — Archives measures worst_cell 0.175625 on each of the four candidate saves and 21.557% with none"). That claim had only ever been measured **on Archives**. The 2026-10-07 sweep refutes it: the local `data/ge007.eep` had been rewritten by the live Dam-ending playtest sessions (md5 `a41d7ab…`, mtime 2026-10-05 07:27), and the honest sequential sweep under it produced **6/21 REGRESSION** on a *byte-identical binary* (the 2026-10-04 run had been 21/21).
+**2026-10-05 (pre-push session).** The D523 pin installed *whichever* local save existed ("presence, not which save — Archives measures worst_cell 0.175625 on each of the four candidate saves and 21.557% with none"). That claim had only ever been measured **on Archives**. The 2026-10-05 sweep refutes it: the local `data/ge007.eep` had been rewritten by the live Dam-ending playtest sessions (md5 `a41d7ab…`, mtime 2026-10-05 07:27), and the honest sequential sweep under it produced **6/21 REGRESSION** on a *byte-identical binary* (the 2026-10-04 run had been 21/21).
 
 **The A/B (facility, window 900-1500:300):**
 
@@ -17238,7 +17240,7 @@ Two distinct classes in the 6-failure sweep, proven apart by the A/B:
 1. **Save-content dependent (facility, streets, jungle, cradle):** same failure signature (177.2–177.5 at the 1200/1500 stems — a *different scene* in-window, not a jitter class) only on the two saves with that content (the 2001 dexdrive save and the 10-05 local save share it; 2001-vintage saves apparently hold state that routes facility's intro differently). The other four candidates pass. **This is what D529 fixes: the gate installs ONE canonical save, so "which save" can never vary.**
 2. **D117 wall-clock flyby (dam@1500 4.9%, frigate@1000 3.2–8.3%, streets@1000 2.5–25.7%):** fails *identically on every save* — the window's first stem is inside the real-time-paced intro flyby, so the content at a given sim frame varies with machine load (D117, long-known, previously masked because the Oct-4 goldens happened to be captured the same way).
 
-**Resolution (FIXED 2026-10-07, same session):**
+**Resolution (FIXED 2026-10-05, same session):**
 - **Canonical save in-tree: `tools_pc/golden/ge007.eep`** (2 KB, = `ge007 copy.eep`, the stable pre-live-sessions save the Oct-4 gate was green on). In-tree = a fresh clone or CI can run the gate with zero external state, and the D523 "fresh clone has no save → exit 2" failure branch is gone for good.
 - **`verify.sh` installs it like the ini pin** (snapshot the local `data/ge007.eep` if any → install the canonical → restore-or-remove on exit). The local playtest save is never the gate's input.
 - **All 21 win golden sets re-captured under the canonical save** (`scratch/golden-recapture-win-v050.sh`; 21/21 rc=0). The first four flaky levels (dam/frigate/streets/jungle — the D117 flyby stems) were re-captured again **clean** (no concurrent processes) after the first interleaved capture.
@@ -17247,11 +17249,11 @@ Two distinct classes in the 6-failure sweep, proven apart by the A/B:
 
 **Why this is not a renderer drift:** the binary is byte-identical to the 2026-10-04 21/21 run; the only variable that changed is `data/ge007.eep`, and the A/B is save-keyed (same binary, four passing saves, one failing save). No renderer code changed.
 
-**Never do:** (1) run the golden gate against a local playtest save — it is exactly this class of drift; always the in-tree canonical eep. (2) claim "the frame depends on save *presence*" again — it depends on *content*; the D523 claim survives only as the (superseded) measurement on Archives. (3) treat the linux 63-frame set as valid under the canonical eep before the box re-round lands — it is the D525 cleared-eep round, and **no linux number may be cited (e.g. in the README pass) until that re-round lands**. (4) cite `verify.sh` with **no arguments** as a green run — a sweep is `verify.sh sweep` (the no-arg path now exits 1, closing the trap in code). (5) run a re-capture concurrently with a sweep (contention moves the D117 flyby stems). (6) treat **same-session** sweeps as proof the four D117 flaky levels (dam/frigate/streets/jungle) are stable across wall-clock: the first-stem content is time-dependent and the pin was fixed to "now" — the cross-machine test is the box re-round; **if those four go red there, the fix is to exclude or widen the first-stem cell for those levels, NOT to re-capture again** (an independent reviewer's 2026-10-07 verification flagged this; same-session worst_cell swings were streets 8.38→4.41, jungle 1.42→3.87). (7) trust a `capture_p7.sh` round's provenance claim without checking WHICH save state the loop actually installed — the D524-era per-level re-pin restored the local save and silently overwrote D529's pre-loop canonical install (D531); the linux set is only "canonical" if the loop line says `cp "$CANON_EEP"`.
+**Never do:** (1) run the golden gate against a local playtest save — it is exactly this class of drift; always the in-tree canonical eep. (2) claim "the frame depends on save *presence*" again — it depends on *content*; the D523 claim survives only as the (superseded) measurement on Archives. (3) treat the linux 63-frame set as valid under the canonical eep before the box re-round lands — it is the D525 cleared-eep round, and **no linux number may be cited (e.g. in the README pass) until that re-round lands**. (4) cite `verify.sh` with **no arguments** as a green run — a sweep is `verify.sh sweep` (the no-arg path now exits 1, closing the trap in code). (5) run a re-capture concurrently with a sweep (contention moves the D117 flyby stems). (6) treat **same-session** sweeps as proof the four D117 flaky levels (dam/frigate/streets/jungle) are stable across wall-clock: the first-stem content is time-dependent and the pin was fixed to "now" — the cross-machine test is the box re-round; **if those four go red there, the fix is to exclude or widen the first-stem cell for those levels, NOT to re-capture again** (an independent reviewer's 2026-10-05 verification flagged this; same-session worst_cell swings were streets 8.38→4.41, jungle 1.42→3.87). (7) trust a `capture_p7.sh` round's provenance claim without checking WHICH save state the loop actually installed — the D524-era per-level re-pin restored the local save and silently overwrote D529's pre-loop canonical install (D531); the linux set is only "canonical" if the loop line says `cp "$CANON_EEP"`.
 
 ## D531: `capture_p7.sh`'s D529 adaptation was incomplete — the per-level re-pin restored the local save, so the 2026-10-05 box re-round ran under the box-local save (not the canonical one); fixed + re-captured (golden gate; D529/D530 follow-up; P12 U5 review finding)
 
-**Blocker found in the 2026-10-07 P12 U5 review (local session).** `tools_pc/capture_p7.sh`'s per-level loop had `cp "$EEP_ORIG" "$EEP"` (introduced by D524 to make the tool non-destructive): it restored the pre-capture **local** save — or a 0-byte eep when `data/ge007.eep` did not exist — before every level. D529's adaptation (`8fbf8aa0`) installed the canonical save (`cp "$CANON_EEP" "$EEP"`) **once, before the loop** and added the canonical-missing guard, but left the D524-era re-pin line in place — so from level 1 the canonical install was silently overwritten and every capture ran under the local save state. The header comment ("the pinned save, restored before every level") asserted what the code did not do.
+**Blocker found in the 2026-10-05 P12 U5 review (local session).** `tools_pc/capture_p7.sh`'s per-level loop had `cp "$EEP_ORIG" "$EEP"` (introduced by D524 to make the tool non-destructive): it restored the pre-capture **local** save — or a 0-byte eep when `data/ge007.eep` did not exist — before every level. D529's adaptation (`8fbf8aa0`) installed the canonical save (`cp "$CANON_EEP" "$EEP"`) **once, before the loop** and added the canonical-missing guard, but left the D524-era re-pin line in place — so from level 1 the canonical install was silently overwritten and every capture ran under the local save state. The header comment ("the pinned save, restored before every level") asserted what the code did not do.
 
 **Impact — D530's provenance claim is wrong:** the 2026-10-05 box re-round (`~/p7-reround.log`, "P7 re-round DONE") ran under the box-local save (`sha256 d9f306…`, 2 KB — distinct from the in-tree canonical `65247b…`), not the canonical eep. D530's / the golden README's / the commit message's "63 PNGs under the canonical eep" did not hold, and D530's first-stem table (measured in that re-round's report against the old D525 goldens — its numbers do check out against the report) is not canonical-save evidence. **The win set is unaffected** — `verify.sh`'s `pin_eep` re-installs the canonical save on every call (that code was right); the bug was capture-side only.
 
@@ -17259,13 +17261,13 @@ Two distinct classes in the 6-failure sweep, proven apart by the A/B:
 
 **Re-capture (this batch):** a fresh 21-level box re-round under the canonical eep (21/21 rc=0, 63 frames), committed into `tools_pc/golden/<level>/linux/` replacing the D530 box-local-save set: **47/63 frames differ** from it (save content demonstrably moves the frames — D529's drift class), 16 byte-identical (save-independent scenes). **Note on the box's pixel capability:** the 10-05 re-round's p7_report diff table (1–26% over on real content) proves its WSLg GPU display was active then; today the box reads back **black even with `DISPLAY=:0`** (`glxinfo -B` under `:0` reports no usable renderer — the WSLg GPU display is session-state-dependent, and today's session is on the software fallback), so today's `verify.sh` runs (D530's crash-detect sweep and this batch's `~/p7-verify-pixel.log`) are legitimately crash-detect-only. The pixel-gated cross-machine verify is owed for a window in which the box's GPU display is up again.
 
-**Pixel-gated cross-machine gate (the real D117 datum):** `verify.sh sweep` on the box against the new canonical goldens — **2026-10-07 attempt (log `~/p7-verify-pixel.log`): 21/21 PASS, 0 FAIL, crash-detect only** (the run's renderer probe correctly failed closed on today's software-fallback session, so it adds stability, not, pixel data); the pixel verdict — including the four flaky levels' first stems — is owed for a window in which the box's WSLg GPU display is active. If the four flaky levels (dam/frigate/streets/jungle) go red there, the never-do 6 decision stands: exclude or widen the first-stem cell, do NOT re-capture.
+**Pixel-gated cross-machine gate (the real D117 datum):** `verify.sh sweep` on the box against the new canonical goldens — **2026-10-05 attempt (log `~/p7-verify-pixel.log`): 21/21 PASS, 0 FAIL, crash-detect only** (the run's renderer probe correctly failed closed on today's software-fallback session, so it adds stability, not, pixel data); the pixel verdict — including the four flaky levels' first stems — is owed for a window in which the box's WSLg GPU display is active. If the four flaky levels (dam/frigate/streets/jungle) go red there, the never-do 6 decision stands: exclude or widen the first-stem cell, do NOT re-capture.
 
-**U5 review notes from the same pass (non-blockers):** the three should-fixes below were applied 2026-10-07 as D532 (gate hardening: fail-closed ini pin, hard-pinned seed, dead A/B switches removed).
+**U5 review notes from the same pass (non-blockers):** the three should-fixes below were applied 2026-10-05 as D532 (gate hardening: fail-closed ini pin, hard-pinned seed, dead A/B switches removed).
 
 ## D532: the three P12 U5 should-fixes applied — the golden gate's ini pin now fails closed, the seed is hard-pinned (a stray `GE_RSEED` warns instead of re-seeding), and `audiodebug.ps1`'s dead A/B switches are gone (golden gate + tooling; D531/U5 follow-up)
 
-**2026-10-07 (local session).** Three tooling-only fixes, no game logic:
+**2026-10-05 (local session).** Three tooling-only fixes, no game logic:
 
 1. **`verify.sh` `pin_ini_640x480` failed OPEN** — the three call sites (`single`/`sweep`/`parity`) were `pin_ini_640x480 2>/dev/null || true`, so a failed ini write (missing `data/`, read-only tree, failed snapshot) ran the gate under an **unpinned ini** — the frame depends on a defaults-only 640x480 ini exactly like the save pin (D529), so that was a spurious-verdict source, not a skipped nicety. The pin now fails closed (snapshot and write both `error + exit 2`, matching `pin_eep`'s style) and the call sites are plain.
 2. **`GOLDEN_SEED` hard-pinned** — it was `"${GE_RSEED:-0x0123456789abcdef}"`, so a stray `GE_RSEED` in the environment silently re-seeded the documented-as-pinned gate (frames shift → spurious verdicts). It is now the literal, with a warning when a differing env var is present (verified: `GE_RSEED=0xdead` warns, the pinned value is silent). `capture_p7.sh`'s `eval grep -m1 '^GOLDEN_SEED='` still picks up the same line, so capture and gate stay consistent.
@@ -17273,9 +17275,9 @@ Two distinct classes in the 6-failure sweep, proven apart by the A/B:
 
 PS parse: 0 errors; `bash -n` clean; the warning path verified. **Owed (unchanged):** the pixel-gated box verify in a WSLg GPU-display window (D531).
 
-## D530: The box (X220) linux golden re-round landed — first cross-machine test of the four D117 flaky levels (golden gate; D529 never-do 3/6 follow-up) — **AMENDED BY D531 (2026-10-07): the 10-05 re-round ran under the box-LOCAL save, not the canonical one (the capture_p7.sh bug); the true canonical re-capture is D531**
+## D530: The box (X220) linux golden re-round landed — first cross-machine test of the four D117 flaky levels (golden gate; D529 never-do 3/6 follow-up) — **AMENDED BY D531 (2026-10-05): the 10-05 re-round ran under the box-LOCAL save, not the canonical one (the capture_p7.sh bug); the true canonical re-capture is D531**
 
-**2026-10-07 (local session).** The box re-round D529 owed (never-do 3: the linux set was the D525 *cleared*-eep round and no linux number could be cited until it was re-rounded under `tools_pc/golden/ge007.eep`) ran on X220 on 2026-10-05 (tree `442eb2ff`, worktree `~/gh-fullhist-wt-p7`, log `~/p7-reround.log` hit `P7 re-round DONE` 12:53 EDT). **21/21 levels rc=0** (the box self-gate is crash-detect only — the pixel probe fails closed on the box, D244). This session pulled the 63 PNGs (21 levels × 3 frames) and committed them into `tools_pc/golden/<level>/linux/`, replacing the D525 set: 51/63 differ from the D525 round; the 12/63 that are byte-identical are save-independent scenes — including **frigate's first stem (001000)**, a direct D117 stability signal. **AMENDED BY D531: that re-round ran under the box-local save (the `capture_p7.sh` bug), so the "canonical eep" provenance claim — and the first-stem table below, as canonical-save evidence — does not hold; the D531 re-capture supersedes this set.**
+**2026-10-05 (local session).** The box re-round D529 owed (never-do 3: the linux set was the D525 *cleared*-eep round and no linux number could be cited until it was re-rounded under `tools_pc/golden/ge007.eep`) ran on X220 on 2026-10-05 (tree `442eb2ff`, worktree `~/gh-fullhist-wt-p7`, log `~/p7-reround.log` hit `P7 re-round DONE` 12:53 EDT). **21/21 levels rc=0** (the box self-gate is crash-detect only — the pixel probe fails closed on the box, D244). This session pulled the 63 PNGs (21 levels × 3 frames) and committed them into `tools_pc/golden/<level>/linux/`, replacing the D525 set: 51/63 differ from the D525 round; the 12/63 that are byte-identical are save-independent scenes — including **frigate's first stem (001000)**, a direct D117 stability signal. **AMENDED BY D531: that re-round ran under the box-local save (the `capture_p7.sh` bug), so the "canonical eep" provenance claim — and the first-stem table below, as canonical-save evidence — does not hold; the D531 re-capture supersedes this set.**
 
 The `fail` rows in the box report are the expected cross-eep diffs against the *old* in-tree set, not regressions: structural tier is all `ok` (phash ≤ 3, cradle@40 the documented exception; Cuba 26.4% inside its documented 23.7–36.3% structural-only range).
 
@@ -17290,4 +17292,87 @@ The `fail` rows in the box report are the expected cross-eep diffs against the *
 
 All four sit in the stable-levels' range (e.g. silo 0.41–0.84% over, worst_cell 0.41–0.42 is the quietest; archives 1.51–2.31 is noisier). **None went red → the never-do 6 decision closes with NO recipe change** (no first-stem cell excluded or widened on the linux side).
 
-**Unblocked (D529 never-do 3):** the README/index v0.5.0 line "re-based on both platforms (21 levels, 63 frames each)" now stands on a canonical-eep linux set (D531's re-capture; the D530 set it first pointed at was the box-local-save round — see D531). **Fresh box sweep (crash-detect):** with the new goldens staged on the box, `verify.sh sweep` (2026-10-07) is **21/21 PASS** — but that run was crash-detect only (GE_PCDUMP reads black on the box's llvmpipe/WSLg, the D244 note), so it is a stability re-check, not a pixel datum. **AMENDED BY D531:** the "black frames" were **not** simply the no-DISPLAY llvmpipe path — the box's WSLg display is session-state-dependent: its 10-05 session was GPU-backed (the re-round's p7_report pixel table proves real frames), while today's reads back black even with `DISPLAY=:0` (software fallback; `glxinfo -B` reports no usable renderer). D531's pixel-gated attempt (21/21 crash-detect, `~/p7-verify-pixel.log`) is valid as a stability re-check; the pixel datum is owed for a GPU-display window.
+**Unblocked (D529 never-do 3):** the README/index v0.5.0 line "re-based on both platforms (21 levels, 63 frames each)" now stands on a canonical-eep linux set (D531's re-capture; the D530 set it first pointed at was the box-local-save round — see D531). **Fresh box sweep (crash-detect):** with the new goldens staged on the box, `verify.sh sweep` (2026-10-05) is **21/21 PASS** — but that run was crash-detect only (GE_PCDUMP reads black on the box's llvmpipe/WSLg, the D244 note), so it is a stability re-check, not a pixel datum. **AMENDED BY D531:** the "black frames" were **not** simply the no-DISPLAY llvmpipe path — the box's WSLg display is session-state-dependent: its 10-05 session was GPU-backed (the re-round's p7_report pixel table proves real frames), while today's reads back black even with `DISPLAY=:0` (software fallback; `glxinfo -B` reports no usable renderer). D531's pixel-gated attempt (21/21 crash-detect, `~/p7-verify-pixel.log`) is valid as a stability re-check; the pixel datum is owed for a GPU-display window.
+
+## D533: release-sweep spot-check — the probe-doc drift that would have failed CI, plus three tracked-file accuracy/hygiene fixes (release gate; P12 U2/U6/U7 spot-checks)
+
+**What was checked (P12 U2/U6/U7 spot-checks, read-only until a defect was found):**
+the EEP import path (`eepimport.c`: fixed-size `save_data[96]` + `smallSave[32]`
+copies, the 6-region backup rotation bounded at `.bak99`), the seat model
+(`MAX_PADS = 4` with `seat < 0 || seat >= MAX_PADS` guards, per-seat arrays
+`padPreset`/`padActPrev`/`padSelectPrev` all `[MAX_PADS]`), the ini/config
+buffers (`configRegisterString`'s `bufSize-1` `strncpy`, `padStr[MAX_PADS][PA_COUNT][32]`
+filled by `snprintf` with `sizeof`), the build's region-macro set against the
+N64 Makefile's `LCDEFS` (exact match for ntsc/pal/jpn-final), and the published
+docs' claims against the findings index.
+
+**The CI-blocking one:** `tools_pc/gen_env_probes.py --check` returned **rc 1** —
+three probe vars in `port/fast3d/gfx_pc.cpp` (`GE_D526`, `GE_D526BOX`,
+`GE_D526MAX`, the D526 box-tolerance family) had no row in
+`docs/dev/GE-ENV-PROBES.md`. The self-hosted workflow runs that check as a hard
+step ("Check generated dev indexes are current"), so the pushed branch would
+have carried a red CI step. Fixed by documenting the family (it was already
+listed in the `docs/porting-notes.md` §F10 probe table — the drift is between
+the two generated-doc sources, not a missing record).
+
+**`build-pc.sh` carried a local machine path.** Two messages named the
+maintainer's alternate MSYS2 root (`D:\<games>\msys64` form — the tree here was
+built for a different drive letter than the one it runs from). AGENTS rule 1
+forbids local absolute paths in tracked files; both sites now say `C:\msys64`,
+which is what the surrounding "add `C:\msys64\mingw64\bin` to your PATH" advice
+already says. No behaviour change (the strings are diagnostics only; the toolchain
+discovery itself is path-derived via `_ge_find_mingw_bin()`).
+
+**`docs/fidelity.md` og description.** It read "…the one `#ifdef PORT` fix…" —
+misleading: `src/` carries 736 `#ifdef PORT` gates (the §A1 class), and the
+finding's claim is that exactly **one** of them is a game-logic-adjacent change.
+The description now reads "one game-logic-adjacent change", and the trim keeps it
+under the 160-char og limit (158). The body's precise claim is unchanged.
+
+**The release notes quoted a stale measurement.** The Reference-frame-gate
+paragraph carried the D525 cross-platform spread (0.348–3.983 %, worst cell mean
+4.43, phash ≤6 except cradle 40) — measured before D531 re-captured all 21 linux
+sets under the canonical save (47/63 frames moved). Recomputed from the
+**committed** pairs (`framediff.py` win-vs-linux at the stems, tol 2): exact
+**0.380–5.120 %** on the 20 non-Cuba levels (silo's 900 stem is the outlier —
+cell mean 34.3, phash 10; streets 3.223–4.566), structural **21/21 clean**, max
+phash 40 (cradle, at the threshold); Cuba 1.357–12.663 % is the structural-tier-only
+level. The notes now carry the recomputed band and name the two gate pins a
+reader would otherwise have to look up (canonical save content — D529; hard-pinned
+seed — D532). The D525 figures stay in the ROADMAP row as the historical record
+for closing the two residual bands; the row now also carries the recomputed band.
+
+**Not changed (judgement calls left alone):** the `eepimport.c` `.bak99`
+overwrite-on-rotation nit (cosmetic, 99-deep rotation is unreachable in practice),
+the `docs/ROADMAP.md` "Known issues" heading anchor (valid), and the site pages'
+own staleness (presentation layer, per AGENTS).
+
+## D534: pre-release review of the 2026-10-05 local batch — Ctrl-C in the golden gate could leave the user's save replaced, plus doc accuracy fixes (release gate)
+
+**Scope:** a read-only review of the 23 local commits of 2026-10-05
+(`8fbf8aa0^..0b0f610c`) before the v0.5.0 cut; defects fixed in one batch.
+
+**The real one — an interrupted gate run could clobber `data/ge007.eep`.**
+`verify.sh` armed `trap 'restore_ini; restore_eep; kill_ours' EXIT INT TERM`
+(`capture_p7.sh` the same shape). Bash runs an INT/TERM trap and then
+*continues* the script: the restore put the user's save back and deleted the
+snapshot, but `EEP_PIN_BAK` stayed set, so the next level's `pin_eep` skipped
+the snapshot and installed the canonical save, and the final EXIT restore
+copied from a deleted file — the user's own save was left replaced on disk.
+Fix: restore on `EXIT` only, `INT`/`TERM` just `exit 130`/`143` (which fires
+EXIT once); `restore_eep`/`restore_ini` now clear their snapshot state, so
+they are idempotent. Tooling-only; the recipe is unchanged.
+
+**Doc accuracy:** the release notes said "each platform's gate is green"
+while the same paragraph said the linux pixel gate did not run — now "Windows
+green; linux crash gate green, pixel verdict owed". `docs/security-and-fidelity-status.md`
+was split into `security.md` + `fidelity.md` but still linked from `README.md`,
+`.github/SECURITY.md` and the AGENTS.md site-page list (dead on publish) —
+repointed. Fifty-odd `2026-10-07` dates (session labels "07a…07k" that leaked
+in as calendar dates; every commit is dated 2026-10-05) normalised to
+2026-10-05; lettered labels became "2026-10-05 (session 07x)".
+
+**Nits:** the D526 census probe had a dangling `else` (bound to the inner
+`if`, so with no `GE_D526BOX` the off-screen filter never ran) — braced;
+`verify.sh`'s usage print (`sed -n '2,32p'`) cut the `--json`/`--against`
+lines — now `2,34p`; an unbalanced bold in the ROADMAP Golden-baselines row.