From 472525b99e5b68a0fcb2baf72761f3e21e57f795 Mon Sep 17 00:00:00 2001
From: Erik <erik.nihlen@gmail.com>
Date: Tue, 11 Aug 2026 08:06:20 +0200
Subject: [PATCH] =?UTF-8?q?fix(ui):=20OP6=20rework=20=E2=80=94=20six=20ran?=
 =?UTF-8?q?ge=20captions,=20un-invert=20Sound=20enabled=20flags,=20five=20?=
 =?UTF-8?q?font=20faces?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes all three MUST-FIX findings from the OP6 REJECT review
(docs/research/2026-08-11-op6-review.md) plus its SHOULD-FIXes and NOTEs.

M1 — the "retail ships zero range captions" claim was a Binary Ninja
constant-folding artifact (the same class the header-string globals a few
lines above already worked around). The six SetSliderLabel call sites
byte-decode to reads of runtime-filled ID_Graphics_Value_* globals, not
immediate zeros (PE-byte-verified against the PDB-paired acclient.exe,
independently re-derived in this session, not just re-asserted from the
review). ConfigOptionsPageController.BuildSliderRow gained optional
rangeLowKey/rangeHighKey parameters wired for all six idx6 sliders (Camera
Stiffness Soft/Hard, Adjustment Speed Slow/Fast, FOV Narrow/Wide, Screen
Brightness Dark/Bright, Graphics Performance Speed/Detail, Degrade Distance
Close/Far) via the same SetRangeLabel mechanism OP5's Chat opacity sliders
already established. Mouse Look Sensitivity (idx3) correctly stays
uncaptioned — the one genuine SetSliderLabel omission. Class doc corrected;
gate-script lines 535/653-equivalent corrected in place.

M2 — the three Sound "Disabled" toggles were semantically inverted:
SoundManager::effect_sounds_enabled/ambient_sounds_enabled/
interface_sounds_enabled are all compiled = 1 in .data, and
UserPreferences::RegisterPreference binds the checkbox's boolean value
DIRECTLY onto those enabled-sense statics — checked-by-default means
enabled-by-default, not disabled. AudioSettings.SfxDisabled/AmbientDisabled/
InterfaceDisabled renamed to SfxEnabled/AmbientEnabled/InterfaceEnabled
(fresh JSON keys — the rejected slice's keys never shipped in an accepted
build); RuntimeSettingsStartupTargets.ApplyAudio now computes effective
volume through the extracted, independently-unit-tested pure function
ComputeEffectiveCategoryVolumes (enabled ? slider : 0f). This closes the
blast radius the review flagged: a missing key in an EXISTING settings.json
now falls back to AudioSettings.Default, which is enabled=true, so a fresh
launch is audible, not muted. AP-199's wording and gate-script step 6
corrected; the enshrined-inversion test rewritten to assert the correct
default and a new SettingsStore test pins the legacy-file fallback path.

M3 — UI_ChatFontFace now ships all five of retail's authored choices
(Arial, CourierNew, PalatinoLinotype, Tahoma, TimesNewRoman — a fixed
compile-time array at gmClient::InitUIPreferences, PE-byte-verified
present verbatim in .rdata, not a per-machine runtime enumeration as the
rejected slice's comment claimed). Default index 2 (PalatinoLinotype) now
indexes a real entry.

S1 — Bind() now emits the sixth trailing AddSeperator retail's own
InitOptions ends with (0x0049E80D), matching retail's 39-item ListBox (6
headers + 6 separators + 27 option-widget-rows) instead of 38.

S2 — Screen Brightness gets its own DisplaySettings.ScreenBrightness field
([-1,1], default 0) instead of overloading Gamma, which has a different
unit system (default 1.0, legacy [0.5,2.0] slider) and its own live
Settings-panel consumer.

S3 — UiScrollbar and UiMenu gained a settable TooltipText surfaced through
GetTooltipText (UiButton's existing pattern). Every slider and menu row's
own interactive widget (not just toggle/trio rows) now carries retail's
"<label>_Help" tooltip, verified as a universal suffix convention across
every AttachPreference site touched by this tab.

S4 — "800x600" added to DisplaySettings.AvailableResolutions: a genuine
retail display mode (Device::ForceDisplayResolution(1,0x320,0x258) at
startup) and the Config tab's own byte-verified Resolution row default, not
an invented preset. Defaults now lands on a highlighted, re-selectable
dropdown entry instead of an orphaned value.

S5 — four new/extended tests: ComputeEffectiveCategoryVolumes gets a
dedicated pure-function value assertion (Theory + a default-profile-is-
audible Fact) in RuntimeSettingsControllerTests, closing the "only event
order was asserted" gap that let M2 ship; a label/choice-key conformance
table in ConfigOptionsPageControllerTests enumerates every key this tab
queries (traced directly from the fixed code paths, not guessed) and fails
on an invented OR a dropped key; a per-row DefaultValue pin asserts every
row's default against the retail literal directly, independent of the
underlying settings-record defaults; and the S1 separator fix gets its own
39-item stacked-ListBox count pin.

NOTEs — AP-198's row count was always ten (its own enumeration never said
nine); the commit-message inconsistency N1 flagged is reconciled in both
the row and the section-summary line, and its Screen Brightness sub-clause
now matches S2. N2: Bind() now reads the scrollbar id from
UiTemplateListBox.ScrollbarElementId (dat property 0x72) instead of a
hardcoded constant. N3 (batch Defaults writes) and N4 (AfterApply on
Config-tab entry, needs no action) are left as recorded — out of this
rework's scope per the review's own disposition.

Full Release suite: 13,125 passed / 4 skipped / 0 failed (baseline
13,117/4/0 — net +8 tests added, 0 regressions, 0 removed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../retail-divergence-register.md             |   6 +-
 .../2026-08-11-campaign-op-test-script.md     |  67 ++--
 .../Settings/RuntimeSettingsTargets.cs        |  38 ++-
 .../UI/Layout/ConfigOptionsPageController.cs  | 316 +++++++++++++-----
 src/AcDream.App/UI/UiMenu.cs                  |  14 +
 src/AcDream.App/UI/UiScrollbar.cs             |  13 +
 .../Panels/Settings/AudioSettings.cs          |  94 ++++--
 .../Panels/Settings/DisplaySettings.cs        |  35 +-
 .../Panels/Settings/SettingsStore.cs          |  21 +-
 .../RuntimeSettingsControllerTests.cs         |  44 +++
 .../ConfigOptionsPageControllerTests.cs       | 294 +++++++++++++++-
 11 files changed, 774 insertions(+), 168 deletions(-)

diff --git a/docs/architecture/retail-divergence-register.md b/docs/architecture/retail-divergence-register.md
index dbd15d23..c512944d 100644
--- a/docs/architecture/retail-divergence-register.md
+++ b/docs/architecture/retail-divergence-register.md
@@ -175,7 +175,7 @@ readiness/requeue adaptation. See
 
 ---
 
-## 3. Documented approximation (AP) — 141 active rows (AP-201 filed 2026-08-11 at the OP5 review-fix round (S2) — `UiScrollablePanel`'s row viewport culls whole rows instead of clipping them (no scissor stack), which OP5's 240-260px filter blocks make user-visible for the first time as a whole-block vanish-then-reappear at certain scroll offsets; see the row below for the full analysis and issue #371; AP-200 filed 2026-08-11 at Campaign OP slice OP6 — the Config tab's Chat Font Face/Size menu rows are store-only, distinct fields from the existing live `ChatSettings.FontSize`; AP-199 filed 2026-08-11 at Campaign OP slice OP6 — the Config tab's Sound Features menu, Interface Sound trio, and Play Sound Only When Active are store-only (the Interface trio cites AP-174's existing "retail's own dead knob" finding); AP-198 filed 2026-08-11 at Campaign OP slice OP6 — the Config tab's nine Graphics/Rendering-Quality-family rows plus Screen Brightness are store-only, the Vulkan+one-aggregate-QualityPreset renderer having no per-feature knobs; AP-197 filed 2026-08-11 at the OP4 review-fix round (SF-1/S4) — Display Timestamps hardcodes retail's constructor-default format string instead of the per-character GenericQualitiesData key-1 override the parser reads and discards; AP-196 filed 2026-08-11 at the OP4 review-fix round (MUST-FIX 3 / blast M2) — the Group-C re-point's observable-default changes (ViewCombatTarget true→false) and the GameplaySettings store retirement (AutoTarget/AutoRepeatAttack/ViewCombatTarget deleted, the other five kept as write-behind mirrors); AP-195 RETIRED 2026-08-11 at Campaign OP slice OP5 — ported both halves left open at OP2 re-review closure: the ALL-set LED media swap (`UiButton.FaceFileOverride`, driven by the block-level `P0x10000082`/`P0x10000083` sprites now threaded through `ElementInfo`/`DatWidgetFactory`) and the `CreateChildren` self-sizing tail (`UiCheckboxBitfield64.Height` grows with `_contentHeight` per row; the ENCLOSING page ListBox reflows around the block's FINAL size via the new `UiTemplateListBox.AddPrebuiltRow`, reusing the ListBox's own stacking exactly as the row's own disposition menu allowed, rather than a third stacking path); AP-194 filed 2026-08-10 at Campaign OP slice OP1 — the GetDefaultOptionValue vs constructor-default disagreement for ConfirmVolatileRareUse/ShowHelm/ShowCloak (see the row below); AP-193 filed 2026-08-10 at Campaign OP slice OP1 — the 0x34 HearPKDeathMessages id/mask mapping is ACE-sourced (see the row below); AP-192 filed 2026-08-10 at the Campaign CH round-5 polish (S2) — authored outline `0x21`/`0x22` now reaches every text-bearing widget, but only at the element's effective-default state; per-STATE outline switching (dialog/character/combat buttons author `0x21` in state `0x3` only) is not ported; AP-191 filed 2026-08-10 at Campaign CH round 4 items 1+2 — the chat transcript's missing tag-colour (`0x1D`, green) and tag-font (`0x1C`) are deferred, needing a per-run tag concept `UiText.Line` does not have yet; AP-184 RETIRED 2026-08-10 at Campaign CH round 4 — the three PARTIAL `/help` group topics (channels/chatting/commands) are now COMPLETE verbatim listings, `ClientCommunicationSystem::HelpStupidChannelHack @0x0056f290` fully decoded (the "vftable slot" operands are the same pooled/mislabeled-data artifact as AP-186's own precedent, not real vtable dispatch — reading the function's own disassembly for the `push imm32` preceding each constructor call resolves them), closing ISSUES.md #364 (full retirement note later in this same list, at its own "AP-184 RETIRED 2026-08-10 at Campaign CH round 4, closing ISSUES.md #364 — filed 2026-08-09..." entry); AP-113 RETIRED 2026-08-10 at the consolidated-review round, SHOULD-FIX 3/1 byproduct — DoLifestone's own bad-args refusal text is now byte-recovered, see its retirement note below; AP-183 and AP-186 RETIRED 2026-08-10 by issue #363's interface-text seam — see their retirement notes below; AP-190 filed 2026-08-10 at Campaign CH slice CH6c — window opacity now fades every RetailWindowManager window on retail's focus-driven Default/Active mechanism, not just ChatInterface-derived ones, and ships gmMainChatUI's 1.0/1.0 default as the ONE shared default across every registered window (fixed from the original 0.5/1.0 base-ChatInterface value, per the row's own REWORDED (2)) instead of applying it only to ChatInterface-derived windows, retiring AP-40 (the prior "opacity is fixed at 0.75, no focus transition" row) in the same commit; AP-189 filed 2026-08-10 at the CH6a/b REJECT-review rework, SHOULD-FIX 5 — acdream's ONE shared 500-entry/200-line-display-tail chat log gives every window a shallower EFFECTIVE per-window scrollback depth than retail's own per-window 10,000-line log, though the accumulate-while-closed and independent-per-window-scroll BEHAVIORS are both correctly reproduced; AP-188 filed 2026-08-10 at Campaign CH slice CH6b — a floating chat window's chat entry always sends on the Say channel because the floaty LayoutDesc authors no talk-focus menu and acdream does not (yet) share the main window's currently-selected channel across all five chat-window instances; AP-187 filed 2026-08-10 at Campaign CH slice CH6b — the four floating chat windows' text-type filters persist in local `settings.json` only (`ChatSettings.ChatWindow1..4Filter`), with no analog to retail's server-side `0x1000008C` GameplayOptions blob, so a character's floaty filter customization does not travel between acdream installs or round-trip to/from a retail client sharing the same character; AP-186 RETIRED 2026-08-10, issue #363's interface-text seam — `ChatVM` now carries an `OnInterfaceText` hook (`Action<string>?`) the App-layer composition wires to `RuntimeCommunicationState.AddText(text, RetailLogTextType.ClientLocal)`, exactly fix shape (a) this row's own filing proposed; `ChatCommandRouter`'s two local-presentation fallbacks (`RetailCommandHelpTable.UnknownCommand` and the degenerate-prefix "Unknown command: {verb}." refusal) now call `ShowInterfaceText` and reach the SpewBox, with a null-fallback into the chat log (still tagged `ClientLocal`) for hosts that never wire the hook (headless has no `ChatVM` at all). Closes ISSUES.md #367; AP-185 filed 2026-08-10 at Campaign CH slice CH6a — the chat window's UiLocked border-art cosmetic swap is unported, see the row for detail; AP-184 RETIRED 2026-08-10 at Campaign CH round 4, closing ISSUES.md #364 — filed 2026-08-09 at Campaign CH user-gate round 2, item 3, recording that three of the seven retail `/help` group-topic listings (channels/chatting/commands) remained PARTIAL because their detail text is built in full or in part by `ClientCommunicationSystem::HelpStupidChannelHack @0x0056f290`, which the filing believed "not decodable with confidence from a static string sweep" because Binary Ninja renders its three internal string operands as dereferences of unrelated vtable slots (`&ClientCommunicationSystem::\`vftable'.RecvNotice_StartBarberNotice` etc.). That belief was WRONG — the same pooled/mislabeled-data artifact this register already documented elsewhere (AP-113's retirement note) applies here too: reading the function's own disassembly for the `push imm32` immediately preceding each `PStringBase::PStringBase` constructor call (rather than trusting BN's line-grouped rendering, which hides the true instruction order) resolves all three operands directly — `"@"` + a one-character tag sliced from a shared wide literal `U"fvpca"`/`U"mh,."` (a wide string read through a narrow `char*` truncates at the first zero high byte, the "hack" retail's own function name calls out) + `" - Sends a broadcast to your "` + `ChannelSystem::GetChannelName`'s own literal switch-table result + `".\n"`. `ChannelsGroupDetail` (entirely 6 such calls), `ChattingGroupDetail` (6 more, plus a `HelpReply@0x00577A50` Summary-branch quirk that unconditionally emits reply+pr+mr together — read directly, not assumed), and `CommandsGroupDetail` (`HelpAllGroup`, a straight-line concatenation of every other group's Detail branch plus a handful of its own short one-liners, including a CONFIRMED retail saveui/loadui duplicate) are now COMPLETE verbatim listings, matching the four (death/status/text/allegiances) the original filing already had. See `RetailCommandHelpTable`'s class remarks and `RetailCommandHelpTableTests` for the full per-line address citations. Round 2 item 2 also deletes `PortalWaitNoticeController` (the dedicated centered-overlay presentation the user reported was the wrong retail surface) and reroutes the portal-space wait-cue notice through the same `AddText`/SpewBox chokepoint every other on-screen interface-text site uses — AP-178's open SpewBox position/extent/font/colour questions now cover this notice too, since its separate controller and consts are gone; no new row was needed for the surface mismatch itself, since it was never separately registered (`PortalWaitNoticeController`'s own doc comment asserted "not a chat message" as an accepted design, not a flagged divergence). AP-150 RETIRED 2026-08-09 at Campaign CH user-gate round 1, item D (#329) — `PortalTunnelPresentation.TickRotation` now emits `"In Portal Space - Please Wait..."` unconditionally on every rotation-segment expiry, exactly matching `gmSmartBoxUI::UseTime`'s `else`-arm at 0x004D6FCD, instead of gating on `_waitCueVisible`, which only ever went true after the invented 5-second `RuntimeWorldTransitState.RetailWaitCueDelay` hold; `RetailWaitCueDelay`/`ObserveWait`/`SetWaitCue` remain as `LocalPlayerTeleportController`'s own hold-delay telemetry (`RuntimePortalSnapshot.WaitCueShown`) but no longer gate the on-screen cue, so they are not a residual of this row — closes issue #329; AP-183 RETIRED 2026-08-10, issue #363 — every named site now routes through the `ChatVM.ShowInterfaceText`/`OnInterfaceText` seam (see AP-186's retirement note) at its correct retail type: `DoStupidChannelHack` ("You must specify the text you wish to say!", newly wired — the six legacy channel verbs previously fell through `ChatInputParser.Parse`'s pure `return null` with no message at all), `DoChannelList`/`On`/`Off` ("Please specify the channel name.", reclassified), `DoAllegiance` ("Please see @help Allegiance...", reclassified), `DoHouseAvailableList` (reclassified AND corrected to retail's own "Please see @help hslist for more information on how to use this command" string, replacing the acdream-synthesized "Usage: /hslist <house type>" fallback — verified `acclient_2013_pseudo_c.txt:381481`/`1029383`), and `DoReply` ("Someone must @tell you first!", newly wired for the message-but-no-last-teller branch only — bare `/r` with no message at all is a separate retail branch, deliberately still unported). `DoSpeaker`/`DoEndurance`/`DoTitle` are untouched, confirmed still correct at `0x00`. The generic bad-args fallback (`ChatCommandRouter.Submit`'s catalog dispatch) now resolves `WeenieErrorMessages.Resolve(0x026u, null)` ("That is not a valid command.", the exact port of `DoCommand @0x0057E46D`'s `HandleFailureEvent(0x26)`) instead of synthesizing a `"Usage: {Usage}"` line — cross-checked against five decompiled handlers (`DoDie` plus the four above), all `0x1A`, confirming the uniform routing decision; AP-182 filed 2026-08-09 at Campaign CH slice CH4, corrected at the CH4 REJECT-review (nit 11) — `@title` is wired to a pure no-op (the value is neither stored nor consumed anywhere) and also omits `DoTitle`'s three local failure messages; recount at the CH3 Opus review corrected a pre-existing off-by-one; AP-181 filed 2026-08-09, Campaign CH slice CH3 — the local chat spam throttle (`IsMessageSpam`) has no acdream port. AP-178 NARROWED 2026-08-09 at the CH2 REJECT-review rework NIT 3, wording corrected at the CH2 re-review nits pass (`docs/plans/2026-08-09-chat-parity-campaign.md`, nits 1/2/6) — the original `dats.Portal` pass used an id source that was not Portal's own (`dats.Portal.GetAllIdsOfType<LayoutDesc>()` is empty for this type), so it established nothing about Portal either way; extending a correctly-paired sweep to `dats.Local` FOUND the SpewBox element there; extent (`450×72`) and `MaxConcurrentItems` (`4`, not the code-default `1`) are now AUTHORED, leaving absolute screen position, colour, AND vertical content flow (now TOP-aligned, acdream's own invention pending measurement) open. AP-180 filed 2026-08-09 at the CH2 REJECT-review rework — `RuntimeCommunicationState.AddText`'s `windowId` parameter is accepted but not consumed, so retail's dual-destination echo (a `0x1A` message with a non-zero `windowId` lands in both the SpewBox and its originating chat window) is unimplemented; latent today since every production caller passes `windowId = 0`. AP-177/AP-178/AP-179 filed 2026-08-09, Campaign CH slice CH2 (interface text / SpewBox) — AP-177 records the invented 5-second SpewBox line lifetime (retail's real timeout is keystone-owned and unmeasured); AP-178's original filing recorded the invented SpewBox screen position/extent/font/colour/MaxConcurrentItems after `SpewBoxLayoutDumpDiagnostic`'s Portal-only sweep found zero elements of class 0x10000016 — see the NARROWED note above for the corrected finding; AP-179 is the OnCombatLine half of the RETIRED AP-176 split out to its own row. AP-176 RETIRED the same day — the WeenieErrorMessages full 344-row `HandleFailureEvent` port (`WeenieErrorMessages.Resolve`) replaces the single-stand-in-`LogTextType` approximation that row recorded for `ChatLog.OnWeenieError`. AP-175 filed 2026-08-09, Campaign CH slice CH1 — PopUpString renders as a chat-log line instead of retail's modal dialog; AP-39 updated the same day — chat coloring is now retail's exact 34-value `LogTextType` table, not a synthetic per-`ChatKind` approximation of it. AP-173 and AP-174 filed 2026-08-08, Campaign A slice A2 — AP-173 expresses retail's ±15 dB DirectSound pan as an OpenAL azimuth by inverting the constant-power pan law, since AL exposes no per-channel gain for a mono source; AP-174 records acdream's extra master volume knob on top of retail's three, folded into retail's single master multiply so the −50 dB cutoff and dB quantisation move with it. AP-172 and AP-171 filed 2026-08-08, #354 spell-bar drag-reorder fix — the favorite-bar reorder gesture defers its own list rebuild for the drag's duration so `UiRoot`'s drag-cancel safety net cannot destroy the in-flight cell, compensating the drop-time target index for the resulting stale sibling numbering; final positions and the wire pair are retail-exact, only the mid-drag visual reflow timing differs. AP-170 filed 2026-08-08, grand-gate finding G3 — an out-of-range vendor Use now arms on arrival instead of sending immediately, because the user's local ACE server polls for the player to actually reach use range before opening the shop panel and a too-early Use is silently lost; AP-169 filed 2026-08-08, grand-gate finding G2 — the vendor toolbar split-slider resolver falls back to the packed shop-supply-count field when the item's own `PublicWeenieDesc._stackSize` is absent, because the user's local ACE server never populates the latter for a browse-list item; AP-167/AP-168 filed 2026-08-09 at the Opus review of `92ea3977` (findings F1/F6) — Buy All's container-vs-item slot classification approximates retail's bitfield/capacity test with `ItemType.Container` [AP-168], and SellSingleItem's non-empty-container refusal branch is not ported [AP-167]; AP-164 RETIRED the same review (finding F4) — BF_RETAINED is now checked end to end; AP-162 NARROWED the same review (finding F1) — Buy All's four client-side pre-send guards are now ported, leaving only the single-item TryBuy path without one; AP-161 gains a REVIEW CORRECTIONS paragraph the same review (findings F1-F13) summarizing the rest as bug fixes to already-claimed behavior, not new divergences. AP-164/AP-165/AP-166 filed 2026-08-09 at Slice 6b/6c (staging+sell arc) — InqAcceptability's non-sellable bitfield is unmodeled [AP-164], the Buy-side stackable-removal-amount test substitutes DescStackSize for retail's _maxStackSize [AP-165], and the Buying/Selling tabs' own purse/count text plus the cross-panel pending-sell inventory highlight are unwired [AP-166]; AP-161 NARROWED the same day — the row's last vendor-specific residual (Buying/Selling tabs render but carry no data binding) CLOSES now that both tabs are fully wired (staging, drag-to-sell, InqAcceptability gating, Sell 0x0060, the X-close confirmation), leaving only the two long-standing PRE-EXISTING residuals (dropdown arrow-cap glyph, alt-currency m_last_sale simplification) plus the three new AP-164/165/166 residuals just filed; AP-162 EXTENDED the same day — the same no-client-pre-check omission now also covers the batched "Buy All" path (TryBuyAll), not just the single-item TryBuy. AP-162/AP-163 filed 2026-08-09 at Slice 6.3 (buy arc) — no client-side Buy affordability/capacity pre-check [AP-162] and the shop-item guid-collision skip-not-clobber policy [AP-163]; AP-161 NARROWED the same day — the private-selection and unwired-examine residuals CLOSE at Slice 6.1/6.2, leaving only the dropdown arrow-cap glyph and the alt-currency `m_last_sale` simplification, plus a confirmed-absent-from-retail note on double-click-to-buy. AP-161 REWRITTEN 2026-08-09 at the Slice 5.4 review (findings F1-F8) — the popup-never-rendered, wrong-quantity-price, no-auto-select, dropped-icon-layer, stale-category-on-vendor-switch, and unguarded-Apply-fanout bugs the review found are fixed (`VendorUiController.cs`, `VendorState.cs`, `GameEventWiring.cs`, `RetailUiRuntime.cs`); the row now records only the four consciously-deferred residuals it still owns (private per-panel selection vs. retail's global `ACCWeenieObject::selectedID`, the unwired shop-item examine route, the dropdown button-face arrow-cap glyph, and the alt-currency held-amount's `m_last_sale`-free simplification). AP-110's "retail-correct per-unit prices" phrasing is corrected the same day to "quantity-correct pricing" — the OLD phrase mischaracterized what retail even shows (a `GetObjectSplitSize`-quantity price, not literally one unit) independent of whether the code was buggy. AP-161 filed 2026-08-09 at Slice 5.4 (vendor browse panel) — the authored "Buying"/"Selling" tabs render and switch pages but carry no data binding, per contract decision 8's required successor to AP-110's narrowing; AP-110 NARROWED the same day — "vendor" is retired from its absent-panels list now that the "Items" browse tab is user-reachable. AP-160 filed 2026-08-07 at Slice 5.3 — the client-local vendor-panel distance watcher closes on plain 3D center distance instead of retail/ACE's cylinder-gap distance, because Runtime has no per-entity collision radius/height source outside the App-layer's Setup-cylinder resolver. AP-158 RETIRED 2026-08-06 by the #333 fix, closing #337 — the `maxReach` distance pre-filter is DELETED rather than re-centred, because retail has none: `CObjCell::find_obj_collisions` @0x0052b750 walks the cell's shadow list and calls `CPhysicsObj::FindObjCollisions` unconditionally. The row's predicted symptom was observed live at Neftet before it was fixed — a tall prop AP-156 had just placed correctly still not blocking, plus jumps sinking into the mesh and corpses falling through. Perf measured, not assumed: at the live-maximum 38 in-cell candidates 10.61 µs → 16.68 µs per resolve. AP-159 filed 2026-08-06 at the #334 fix — the INDOOR half of AP-156’s traversal residual is all that remains of it; the outdoor half is CLOSED by the `find_bbox_cell_list` port, and AP-156’s RISK COLUMN IS CORRECTED at the same commit: it recorded the residual as “extra broadphase candidates, never a missed one”, which generalised the indoor direction to the whole row and is exactly why #334 — a MISSED one, and a user-observed loss of collision on landblock-spanning formations — sat inside it unnoticed. AP-158 filed 2026-08-06 at the AP-156 fix review — the shadow broadphase's `maxReach` distance pre-filter is acdream's own invention with NO retail counterpart, and it measures from the part origin, so it can discard a genuine contact for exactly the off-centre parts AP-156 just placed correctly; issue #333. AP-156 CORRECTED at the same review: its population was understated — 172 is AP-152's DISPATCH population, not AP-156's CONTAINMENT population. AP-155 NARROWED and AP-156/AP-157 filed 2026-08-06 at the AP-152 retail-conformance review. AP-155 bundled two divergences with different code paths, populations and gates under one id; its flood half is now AP-156, **with its direction corrected**. AP-155(b) recorded the BSP flood approximation as OVER-inclusive and used that direction as the reason the residual was safe to defer; measured over the installed DAT it was UNDER-inclusive for 428 of the 530 BSP-bearing Setups (the AP-156 fix review corrected the originally-recorded '170 of 172'), because `BuildFloodSpheres` carried each physics-BSP part's root bounding-sphere RADIUS while discarding that sphere's own ORIGIN and centring it on the part origin. That is the #98/#168 class, and for 43 Setups the post-AP-152 flood was strictly smaller than the pre-AP-152 one. AP-156 records the correction and the fix — `ShadowShape.BoundsCenter`, filled from the same resolver that supplies the radius, plus the retirement of the 10-sphere clamp on a branch where retail has none — and keeps open only the sphere-vs-portal TRAVERSAL approximation. AP-157 is the previously unregistered third-branch substitution: retail floods from one `CPartArray::GetSortingSphere` where acdream floods from every Sphere shape, and acdream's cylinder flood ignores `CylHeight`. AP-152 RETIRED 2026-08-06, one day after it was filed: `ShadowShapeBuilder.FromSetup` now dispatches BSP-first instead of unioning, and `ShadowObjectRegistry.BuildFloodSpheres` now applies `calc_cross_cells`' own BSP → cylsphere → sorting-sphere order. Four statements in the row were false and are corrected in its retirement text — most importantly its predicted symptom, "catching on a doorway sill", which could not have been occurring: `Transition.BspOnlyDispatch` had already made the extra primitive inert at collision-query time since 2026-05-25. The live half was CELL MEMBERSHIP, the #98/#168 symptom class, which had no such guard. AP-153/AP-154/AP-155 filed at that retirement — retail's dispatch flag is cached once at part-array construction where acdream's gate is live [AP-153]; acdream's query-time guard takes a CLIENT-DERIVED flag off the WIRE and never derives it, an undeclared dependency on ACE reading the same DAT bit [AP-154]; and the static publication paths emit a Setup Sphere as a height-capped Cylinder while `BuildFloodSpheres` approximates retail's bounding BOX with bounding SPHERES [AP-155, whose flood-priority half is closed by the same commit]. AP-152 filed 2026-08-06 at the AP-22 retirement — the LIVE collision path emits Setup primitives and per-part physics-BSP shapes additively where retail's `CPhysicsObj::FindObjCollisions` dispatches exclusively; 172 of 5,935 installed Setups are affected, including BSP doors, so it needs its own visual gate and was deliberately not folded into the AP-22 commit; the count is unchanged because AP-22 retired in the same commit. AP-22 RETIRED 2026-08-06 — retail synthesizes no shape for a shapeless object (`CPhysicsObj::FindObjCollisions` 0x0050f050 exits at `0x0050f22f je 0x50f31b` returning the seeded OK_TS, and `CPartArray::GetRadius`/`GetHeight` are absent from its whole call set), so the invented `setup.Radius` cylinder was deleted rather than re-derived; the row's site list named one file that never contained the fallback and omitted the two that did, one of them the headless-only copy, and its "rare decorative props" risk described an unreachable branch — 0 of 5,935 installed Setups can satisfy the guard. AP-150/AP-151 filed 2026-08-06 at the #280 dual review — the wait cue's five-second arming is acdream's own and not retail's trigger [AP-150], and the reveal gate is materially stricter than retail's DAT-residency prefetch predicate on the mesh-build/GPU-upload axis [AP-151], the opposite asymmetry from AP-149; AP-149 filed 2026-08-05 at the #280 portal-prefetch fix — the reveal gate's outer ring accepts terrain-only publication where retail requires LandBlockInfo and every building EnvCell; the fix closes the reveal-window/visible-window ratio, not this residual; AP-148 filed 2026-08-05 at the C5b closeout — acdream's local-player Gate A requires the wire TELEPORT_TS to be EQUAL where retail requires only that it not be OLDER, verified by disassembly against the PDB-paired binary after two review rounds read the Binary Ninja tautology and missed it; AP-147 filed 2026-08-05 at the C5b architecture review, finding D3 — the accepted-Position delta stream's cardinality change and its torn intermediate; AP-138 amended at the same review — C5b staled its route-2 first-submit `CurrentCellId` measurement; AP-131 RETIRED 2026-08-05, C5b, closing #275 — the steady-state merge's `installPlacementFrame: true, clearParent: true` literals no longer exist; `InboundPhysicsStateController.TryApplyPosition` now computes both flags PRE-MERGE from `(disposition, hasAnimations(old))`, which is exactly `RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition`'s own `ApplyPlacementFrameBeforeRouting`/`UnparentBeforeRouting` rows (false/false on the Gate A force row, `!HasAnimations`/true on every accepted non-force route). Retail decides both writes BEFORE `MoveOrTeleport` is consulted — Gate A @0x0045400C returns @0x0045409D ahead of `unset_parent` @0x00454129 and the `HasAnims` `SetPlacementFrame` gate @0x00454137 — so the flags need no route, no player distance and no signature change. The row's predicted symptoms are gone: an animated entity's ordinary Position no longer installs a placement frame retail skips, and a ForcePosition no longer unparents. Evidence: `InboundPhysicsStateControllerTests` — `ApplyOnAnimatedEntity_NeverInstallsTheWirePlacementFrame`, `ApplyOnNonAnimatedEntity_InstallsTheWirePlacementFrame`, `ForcePositionOnParentedLocalPlayer_RetainsTheParentAttachment`, and the 12-row `MergedPrePlacementFieldsMatchTheClassifiedRouteFlags` matrix which uses the production classifier as its oracle rather than re-encoding the table; all four sabotage-verified in both directions. The row's "the legacy caller is deleted at the production cutover" framing was overtaken: the caller was CORRECTED, not deleted, and remains the only production Position wire caller; AP-145 RETIRED 2026-08-05, C5a commit 1, closing #318 — `TryPublishPlace` now publishes the local player's Place through `LocalPlayerShadowSynchronizer.SyncPose`, the same publisher ordinary per-tick movement uses, instead of a direct `LocalPlayerShadowState.Set` that never touched `PhysicsEngine.ShadowObjects`; AP-1 RETIRED 2026-08-05, C5a deletion sweep — `PhysicsEngine.Resolve`/`ResolvePlacement`/`HasCellSurface` deleted outright, zero production callers, so "production zero-delta routes remain on the legacy resolver" is now structurally false; AP-146 filed 2026-08-05, #319 fix — the local player's canonical cell is written only at login/inbound-Position/teleport, not per ordinary-movement tick as retail's SetPositionInternal does; #319's fix makes a player-parented child inherit exactly this coarseness, stale-but-equal to the parent, not a new staleness class; follow-up filed as issue #320; AP-144 filed 2026-08-05, C4 route 3 round 3 (R7) — the portal-arrival movement-event send reuses `UsePositionFromServer` (`autonomy_level != 2`) where retail's actual gate, `SendMovementEvent`, is `autonomy_level != 0`; the two agree everywhere except level 1, which no production caller can reach today; AP-142/AP-143 filed 2026-08-04, C4 route 7 — the parented-child single-field cell model (id/pointer collapse, zero-not-stale removal propagation, same-cell tick-loop subsumption) and the headless parent-realize drive's skipped holding-location validation; AP-141 filed 2026-08-04, C4 route 5, NARROWED 2026-08-04 at the round-2 delta review — the far-branch StopInterpolating clause was wrong for the adopted-body case (it is now ported there) and the row's language now distinguishes "never armed" from "never re-anchored"; CORRECTED 2026-08-04 at the round-3 delta review — the risk column's "would drag the body toward a stale anchor" claim was itself wrong (the leash anchor is write-only; `ConstraintManager::adjust_offset` only brakes, never pulls) and is retracted; every half remains test-gated only, since ACE never sends a missile UpdatePosition; AP-140 filed AND RETIRED 2026-08-04 — filed at the Bug B Opus review because the two accepted-Position routing gates read the client `Airborne` flag, i.e. walkability, where retail's free-flight predicate is CONTACT, and Bug B had just turned "in contact, not on walkable ground" from unreachable into ordinary; retired the same day by pointing both gates at `PhysicsBody.InContact`, retail's literal `transient_state & 1` test at `InterpolationManager::adjust_offset` @0x00555D52 (bit 0 = `CONTACT_TS`, acclient.h:3690), while leaving `Airborne` and all five of its `!Body.OnWalkable` writers untouched — the narrow shape the row itself pinned. A remote sliding on a steep face now interpolates as retail does instead of snapping at UpdatePosition cadence; AP-139 filed 2026-08-04, Bug B remote steep-contact slide — the interpolation-queue clear on the landing edge, carried over from the deleted hand-rolled remote landing block; AP-81 narrowed the same day by that fix, which retired its whole GRAVITY half; AP-87 annotated the same day — its predicted symptom was observed live and then fixed at the source, with the row's own thresholds and conditions deliberately unchanged; AP-138 filed 2026-08-04, C4 route 4b-2 dual Opus review, parts (1) and (2) rewritten the same day at the DELTA review — the far snap's refusable-placement residual: store_position only on the outcomes that never reached the engine, the two quiescence parks made restorable at the source, with the rollback gated on the cell it actually restores into, rather than refused by a pre-flight that structurally cannot see them, and the leash not armed through a superseded incarnation; AP-137 filed 2026-08-04, C4 route 4b-2 and rewritten the same day at that review, `teleport_hook`'s call list completed at the delta review — the acdream-only null/rejected/cell-less leftover arm, what the deleted duplicated 96 m/4 m constant pairs actually computed, and the vacuous headless satisfaction; AP-136 filed 2026-08-04, C4 route 4b-1 review, NARROWED 2026-08-04 at the C4 route 4b-2 delta review and AMENDED 2026-08-04 by the cancelled-park presentation rollback (the row's "restored visible" claim covered only the CANONICAL half; the presentation half was never rolled back, which left a parked-then-cancelled remote that stops moving invisible in the world AND absent from the radar for the rest of the session — a defect, now fixed by the `WithdrawalRestored` receipt, with the selection residual filed as AD-63) — a cancelled lost-cell park re-shows the entity where retail keeps it hidden until cell load, and the rollback's scope now covers the two placement-side quiescence parks whenever the cell it restores into is not itself quiescing — round 4 (2026-08-04) applies that same test a second time at RESTORE time, because a retained park's rollback lands a packet later; AP-135 filed 2026-08-03, C4 route 4a — the airborne no-op's retained acdream bookkeeping; the stated total was 2 rows stale before that filing and is now a literal count of this section; AP-130/AP-131/AP-132 filed 2026-08-02, continuation-executor slice; AP-5 retired 2026-07-31 at Campaign P Slice 2A — every successful `step_down` now performs retail's final `PLACEMENT_INSERT`; AP-3/AP-4 retired 2026-07-31 at Campaign P Slice 1B — `transitional_insert` and `edge_slide` now preserve retail's valid-contact early return and Branch-1-first order; AP-127 retired 2026-07-31 by #268 — the complete augmentation chain is shared by character UI and Runtime movement; AP-30 retired 2026-07-30 by the movement parity audit — retail Frame::is_equal genuinely uses the 0.0002 epsilon [byte-confirmed], so the row recorded a NON-divergence; acdream already matches; AP-129 narrowed 2026-07-30 at the P4 Opus review fix — `CanMoveInto`/`RestrictionDB::IsAllowedIn` are now ported and fed end-to-end (CreateObject HouseOwner/HouseRestrictions/Monarch tail fields + live `House_UpdateRestrictions 0x0248`, resolved through `PhysicsEngine.Objects`), retiring the original "CanMoveInto entirely unmodeled, unconditional fail-closed" gap the row described — the review was triggered by `RestrictionObjPrevalenceInspectionTests` showing 103,766 of 729,888 installed EnvCells (the whole housing estate) carry a baked `RestrictionObj`, so the unconditional fail-closed default would have locked every house for every player including its own owner; AP-10 retired 2026-07-30 at Campaign P Slice P4 — restored retail's 0.1 m dry-corner water sink-in, full suite green proving the sticky-bit no-regression argument; AP-71 retired same slice — `check_entry_restrictions` ported at the head of the indoor `FindEnvCollisions` branch, `CellPhysics.RestrictionObj` wired from the DAT-baked `EnvCell` field in both the dev and production caching paths; AP-128 filed 2026-07-30 at the P3 Opus review — PK-timer clock basis; AP-25 retired 2026-07-30 at Campaign P Slice P1 — the vitae/enchantment-aware run/jump skill chain; AP-7 retired 2026-07-30 at Campaign P Slice P2 — `calc_friction`'s threshold ported to retail's confirmed 0.25f; its still-open cos(10°)-vs-0.99999536f Sledding constant question moved to AD-55)
+## 3. Documented approximation (AP) — 141 active rows (AP-201 filed 2026-08-11 at the OP5 review-fix round (S2) — `UiScrollablePanel`'s row viewport culls whole rows instead of clipping them (no scissor stack), which OP5's 240-260px filter blocks make user-visible for the first time as a whole-block vanish-then-reappear at certain scroll offsets; see the row below for the full analysis and issue #371; AP-200 filed 2026-08-11 at Campaign OP slice OP6 — the Config tab's Chat Font Face/Size menu rows are store-only, distinct fields from the existing live `ChatSettings.FontSize`; AP-199 filed 2026-08-11 at Campaign OP slice OP6 — the Config tab's Sound Features menu, Interface Sound trio, and Play Sound Only When Active are store-only (the Interface trio cites AP-174's existing "retail's own dead knob" finding); AP-198 filed 2026-08-11 at Campaign OP slice OP6, row count reconciled at the OP6 rework round (2026-08-11, review N1) — the Config tab's TEN Graphics/Rendering-Quality-family rows (including Screen Brightness, its own field as of the S2 fix) are store-only, the Vulkan+one-aggregate-QualityPreset renderer having no per-feature knobs; AP-197 filed 2026-08-11 at the OP4 review-fix round (SF-1/S4) — Display Timestamps hardcodes retail's constructor-default format string instead of the per-character GenericQualitiesData key-1 override the parser reads and discards; AP-196 filed 2026-08-11 at the OP4 review-fix round (MUST-FIX 3 / blast M2) — the Group-C re-point's observable-default changes (ViewCombatTarget true→false) and the GameplaySettings store retirement (AutoTarget/AutoRepeatAttack/ViewCombatTarget deleted, the other five kept as write-behind mirrors); AP-195 RETIRED 2026-08-11 at Campaign OP slice OP5 — ported both halves left open at OP2 re-review closure: the ALL-set LED media swap (`UiButton.FaceFileOverride`, driven by the block-level `P0x10000082`/`P0x10000083` sprites now threaded through `ElementInfo`/`DatWidgetFactory`) and the `CreateChildren` self-sizing tail (`UiCheckboxBitfield64.Height` grows with `_contentHeight` per row; the ENCLOSING page ListBox reflows around the block's FINAL size via the new `UiTemplateListBox.AddPrebuiltRow`, reusing the ListBox's own stacking exactly as the row's own disposition menu allowed, rather than a third stacking path); AP-194 filed 2026-08-10 at Campaign OP slice OP1 — the GetDefaultOptionValue vs constructor-default disagreement for ConfirmVolatileRareUse/ShowHelm/ShowCloak (see the row below); AP-193 filed 2026-08-10 at Campaign OP slice OP1 — the 0x34 HearPKDeathMessages id/mask mapping is ACE-sourced (see the row below); AP-192 filed 2026-08-10 at the Campaign CH round-5 polish (S2) — authored outline `0x21`/`0x22` now reaches every text-bearing widget, but only at the element's effective-default state; per-STATE outline switching (dialog/character/combat buttons author `0x21` in state `0x3` only) is not ported; AP-191 filed 2026-08-10 at Campaign CH round 4 items 1+2 — the chat transcript's missing tag-colour (`0x1D`, green) and tag-font (`0x1C`) are deferred, needing a per-run tag concept `UiText.Line` does not have yet; AP-184 RETIRED 2026-08-10 at Campaign CH round 4 — the three PARTIAL `/help` group topics (channels/chatting/commands) are now COMPLETE verbatim listings, `ClientCommunicationSystem::HelpStupidChannelHack @0x0056f290` fully decoded (the "vftable slot" operands are the same pooled/mislabeled-data artifact as AP-186's own precedent, not real vtable dispatch — reading the function's own disassembly for the `push imm32` preceding each constructor call resolves them), closing ISSUES.md #364 (full retirement note later in this same list, at its own "AP-184 RETIRED 2026-08-10 at Campaign CH round 4, closing ISSUES.md #364 — filed 2026-08-09..." entry); AP-113 RETIRED 2026-08-10 at the consolidated-review round, SHOULD-FIX 3/1 byproduct — DoLifestone's own bad-args refusal text is now byte-recovered, see its retirement note below; AP-183 and AP-186 RETIRED 2026-08-10 by issue #363's interface-text seam — see their retirement notes below; AP-190 filed 2026-08-10 at Campaign CH slice CH6c — window opacity now fades every RetailWindowManager window on retail's focus-driven Default/Active mechanism, not just ChatInterface-derived ones, and ships gmMainChatUI's 1.0/1.0 default as the ONE shared default across every registered window (fixed from the original 0.5/1.0 base-ChatInterface value, per the row's own REWORDED (2)) instead of applying it only to ChatInterface-derived windows, retiring AP-40 (the prior "opacity is fixed at 0.75, no focus transition" row) in the same commit; AP-189 filed 2026-08-10 at the CH6a/b REJECT-review rework, SHOULD-FIX 5 — acdream's ONE shared 500-entry/200-line-display-tail chat log gives every window a shallower EFFECTIVE per-window scrollback depth than retail's own per-window 10,000-line log, though the accumulate-while-closed and independent-per-window-scroll BEHAVIORS are both correctly reproduced; AP-188 filed 2026-08-10 at Campaign CH slice CH6b — a floating chat window's chat entry always sends on the Say channel because the floaty LayoutDesc authors no talk-focus menu and acdream does not (yet) share the main window's currently-selected channel across all five chat-window instances; AP-187 filed 2026-08-10 at Campaign CH slice CH6b — the four floating chat windows' text-type filters persist in local `settings.json` only (`ChatSettings.ChatWindow1..4Filter`), with no analog to retail's server-side `0x1000008C` GameplayOptions blob, so a character's floaty filter customization does not travel between acdream installs or round-trip to/from a retail client sharing the same character; AP-186 RETIRED 2026-08-10, issue #363's interface-text seam — `ChatVM` now carries an `OnInterfaceText` hook (`Action<string>?`) the App-layer composition wires to `RuntimeCommunicationState.AddText(text, RetailLogTextType.ClientLocal)`, exactly fix shape (a) this row's own filing proposed; `ChatCommandRouter`'s two local-presentation fallbacks (`RetailCommandHelpTable.UnknownCommand` and the degenerate-prefix "Unknown command: {verb}." refusal) now call `ShowInterfaceText` and reach the SpewBox, with a null-fallback into the chat log (still tagged `ClientLocal`) for hosts that never wire the hook (headless has no `ChatVM` at all). Closes ISSUES.md #367; AP-185 filed 2026-08-10 at Campaign CH slice CH6a — the chat window's UiLocked border-art cosmetic swap is unported, see the row for detail; AP-184 RETIRED 2026-08-10 at Campaign CH round 4, closing ISSUES.md #364 — filed 2026-08-09 at Campaign CH user-gate round 2, item 3, recording that three of the seven retail `/help` group-topic listings (channels/chatting/commands) remained PARTIAL because their detail text is built in full or in part by `ClientCommunicationSystem::HelpStupidChannelHack @0x0056f290`, which the filing believed "not decodable with confidence from a static string sweep" because Binary Ninja renders its three internal string operands as dereferences of unrelated vtable slots (`&ClientCommunicationSystem::\`vftable'.RecvNotice_StartBarberNotice` etc.). That belief was WRONG — the same pooled/mislabeled-data artifact this register already documented elsewhere (AP-113's retirement note) applies here too: reading the function's own disassembly for the `push imm32` immediately preceding each `PStringBase::PStringBase` constructor call (rather than trusting BN's line-grouped rendering, which hides the true instruction order) resolves all three operands directly — `"@"` + a one-character tag sliced from a shared wide literal `U"fvpca"`/`U"mh,."` (a wide string read through a narrow `char*` truncates at the first zero high byte, the "hack" retail's own function name calls out) + `" - Sends a broadcast to your "` + `ChannelSystem::GetChannelName`'s own literal switch-table result + `".\n"`. `ChannelsGroupDetail` (entirely 6 such calls), `ChattingGroupDetail` (6 more, plus a `HelpReply@0x00577A50` Summary-branch quirk that unconditionally emits reply+pr+mr together — read directly, not assumed), and `CommandsGroupDetail` (`HelpAllGroup`, a straight-line concatenation of every other group's Detail branch plus a handful of its own short one-liners, including a CONFIRMED retail saveui/loadui duplicate) are now COMPLETE verbatim listings, matching the four (death/status/text/allegiances) the original filing already had. See `RetailCommandHelpTable`'s class remarks and `RetailCommandHelpTableTests` for the full per-line address citations. Round 2 item 2 also deletes `PortalWaitNoticeController` (the dedicated centered-overlay presentation the user reported was the wrong retail surface) and reroutes the portal-space wait-cue notice through the same `AddText`/SpewBox chokepoint every other on-screen interface-text site uses — AP-178's open SpewBox position/extent/font/colour questions now cover this notice too, since its separate controller and consts are gone; no new row was needed for the surface mismatch itself, since it was never separately registered (`PortalWaitNoticeController`'s own doc comment asserted "not a chat message" as an accepted design, not a flagged divergence). AP-150 RETIRED 2026-08-09 at Campaign CH user-gate round 1, item D (#329) — `PortalTunnelPresentation.TickRotation` now emits `"In Portal Space - Please Wait..."` unconditionally on every rotation-segment expiry, exactly matching `gmSmartBoxUI::UseTime`'s `else`-arm at 0x004D6FCD, instead of gating on `_waitCueVisible`, which only ever went true after the invented 5-second `RuntimeWorldTransitState.RetailWaitCueDelay` hold; `RetailWaitCueDelay`/`ObserveWait`/`SetWaitCue` remain as `LocalPlayerTeleportController`'s own hold-delay telemetry (`RuntimePortalSnapshot.WaitCueShown`) but no longer gate the on-screen cue, so they are not a residual of this row — closes issue #329; AP-183 RETIRED 2026-08-10, issue #363 — every named site now routes through the `ChatVM.ShowInterfaceText`/`OnInterfaceText` seam (see AP-186's retirement note) at its correct retail type: `DoStupidChannelHack` ("You must specify the text you wish to say!", newly wired — the six legacy channel verbs previously fell through `ChatInputParser.Parse`'s pure `return null` with no message at all), `DoChannelList`/`On`/`Off` ("Please specify the channel name.", reclassified), `DoAllegiance` ("Please see @help Allegiance...", reclassified), `DoHouseAvailableList` (reclassified AND corrected to retail's own "Please see @help hslist for more information on how to use this command" string, replacing the acdream-synthesized "Usage: /hslist <house type>" fallback — verified `acclient_2013_pseudo_c.txt:381481`/`1029383`), and `DoReply` ("Someone must @tell you first!", newly wired for the message-but-no-last-teller branch only — bare `/r` with no message at all is a separate retail branch, deliberately still unported). `DoSpeaker`/`DoEndurance`/`DoTitle` are untouched, confirmed still correct at `0x00`. The generic bad-args fallback (`ChatCommandRouter.Submit`'s catalog dispatch) now resolves `WeenieErrorMessages.Resolve(0x026u, null)` ("That is not a valid command.", the exact port of `DoCommand @0x0057E46D`'s `HandleFailureEvent(0x26)`) instead of synthesizing a `"Usage: {Usage}"` line — cross-checked against five decompiled handlers (`DoDie` plus the four above), all `0x1A`, confirming the uniform routing decision; AP-182 filed 2026-08-09 at Campaign CH slice CH4, corrected at the CH4 REJECT-review (nit 11) — `@title` is wired to a pure no-op (the value is neither stored nor consumed anywhere) and also omits `DoTitle`'s three local failure messages; recount at the CH3 Opus review corrected a pre-existing off-by-one; AP-181 filed 2026-08-09, Campaign CH slice CH3 — the local chat spam throttle (`IsMessageSpam`) has no acdream port. AP-178 NARROWED 2026-08-09 at the CH2 REJECT-review rework NIT 3, wording corrected at the CH2 re-review nits pass (`docs/plans/2026-08-09-chat-parity-campaign.md`, nits 1/2/6) — the original `dats.Portal` pass used an id source that was not Portal's own (`dats.Portal.GetAllIdsOfType<LayoutDesc>()` is empty for this type), so it established nothing about Portal either way; extending a correctly-paired sweep to `dats.Local` FOUND the SpewBox element there; extent (`450×72`) and `MaxConcurrentItems` (`4`, not the code-default `1`) are now AUTHORED, leaving absolute screen position, colour, AND vertical content flow (now TOP-aligned, acdream's own invention pending measurement) open. AP-180 filed 2026-08-09 at the CH2 REJECT-review rework — `RuntimeCommunicationState.AddText`'s `windowId` parameter is accepted but not consumed, so retail's dual-destination echo (a `0x1A` message with a non-zero `windowId` lands in both the SpewBox and its originating chat window) is unimplemented; latent today since every production caller passes `windowId = 0`. AP-177/AP-178/AP-179 filed 2026-08-09, Campaign CH slice CH2 (interface text / SpewBox) — AP-177 records the invented 5-second SpewBox line lifetime (retail's real timeout is keystone-owned and unmeasured); AP-178's original filing recorded the invented SpewBox screen position/extent/font/colour/MaxConcurrentItems after `SpewBoxLayoutDumpDiagnostic`'s Portal-only sweep found zero elements of class 0x10000016 — see the NARROWED note above for the corrected finding; AP-179 is the OnCombatLine half of the RETIRED AP-176 split out to its own row. AP-176 RETIRED the same day — the WeenieErrorMessages full 344-row `HandleFailureEvent` port (`WeenieErrorMessages.Resolve`) replaces the single-stand-in-`LogTextType` approximation that row recorded for `ChatLog.OnWeenieError`. AP-175 filed 2026-08-09, Campaign CH slice CH1 — PopUpString renders as a chat-log line instead of retail's modal dialog; AP-39 updated the same day — chat coloring is now retail's exact 34-value `LogTextType` table, not a synthetic per-`ChatKind` approximation of it. AP-173 and AP-174 filed 2026-08-08, Campaign A slice A2 — AP-173 expresses retail's ±15 dB DirectSound pan as an OpenAL azimuth by inverting the constant-power pan law, since AL exposes no per-channel gain for a mono source; AP-174 records acdream's extra master volume knob on top of retail's three, folded into retail's single master multiply so the −50 dB cutoff and dB quantisation move with it. AP-172 and AP-171 filed 2026-08-08, #354 spell-bar drag-reorder fix — the favorite-bar reorder gesture defers its own list rebuild for the drag's duration so `UiRoot`'s drag-cancel safety net cannot destroy the in-flight cell, compensating the drop-time target index for the resulting stale sibling numbering; final positions and the wire pair are retail-exact, only the mid-drag visual reflow timing differs. AP-170 filed 2026-08-08, grand-gate finding G3 — an out-of-range vendor Use now arms on arrival instead of sending immediately, because the user's local ACE server polls for the player to actually reach use range before opening the shop panel and a too-early Use is silently lost; AP-169 filed 2026-08-08, grand-gate finding G2 — the vendor toolbar split-slider resolver falls back to the packed shop-supply-count field when the item's own `PublicWeenieDesc._stackSize` is absent, because the user's local ACE server never populates the latter for a browse-list item; AP-167/AP-168 filed 2026-08-09 at the Opus review of `92ea3977` (findings F1/F6) — Buy All's container-vs-item slot classification approximates retail's bitfield/capacity test with `ItemType.Container` [AP-168], and SellSingleItem's non-empty-container refusal branch is not ported [AP-167]; AP-164 RETIRED the same review (finding F4) — BF_RETAINED is now checked end to end; AP-162 NARROWED the same review (finding F1) — Buy All's four client-side pre-send guards are now ported, leaving only the single-item TryBuy path without one; AP-161 gains a REVIEW CORRECTIONS paragraph the same review (findings F1-F13) summarizing the rest as bug fixes to already-claimed behavior, not new divergences. AP-164/AP-165/AP-166 filed 2026-08-09 at Slice 6b/6c (staging+sell arc) — InqAcceptability's non-sellable bitfield is unmodeled [AP-164], the Buy-side stackable-removal-amount test substitutes DescStackSize for retail's _maxStackSize [AP-165], and the Buying/Selling tabs' own purse/count text plus the cross-panel pending-sell inventory highlight are unwired [AP-166]; AP-161 NARROWED the same day — the row's last vendor-specific residual (Buying/Selling tabs render but carry no data binding) CLOSES now that both tabs are fully wired (staging, drag-to-sell, InqAcceptability gating, Sell 0x0060, the X-close confirmation), leaving only the two long-standing PRE-EXISTING residuals (dropdown arrow-cap glyph, alt-currency m_last_sale simplification) plus the three new AP-164/165/166 residuals just filed; AP-162 EXTENDED the same day — the same no-client-pre-check omission now also covers the batched "Buy All" path (TryBuyAll), not just the single-item TryBuy. AP-162/AP-163 filed 2026-08-09 at Slice 6.3 (buy arc) — no client-side Buy affordability/capacity pre-check [AP-162] and the shop-item guid-collision skip-not-clobber policy [AP-163]; AP-161 NARROWED the same day — the private-selection and unwired-examine residuals CLOSE at Slice 6.1/6.2, leaving only the dropdown arrow-cap glyph and the alt-currency `m_last_sale` simplification, plus a confirmed-absent-from-retail note on double-click-to-buy. AP-161 REWRITTEN 2026-08-09 at the Slice 5.4 review (findings F1-F8) — the popup-never-rendered, wrong-quantity-price, no-auto-select, dropped-icon-layer, stale-category-on-vendor-switch, and unguarded-Apply-fanout bugs the review found are fixed (`VendorUiController.cs`, `VendorState.cs`, `GameEventWiring.cs`, `RetailUiRuntime.cs`); the row now records only the four consciously-deferred residuals it still owns (private per-panel selection vs. retail's global `ACCWeenieObject::selectedID`, the unwired shop-item examine route, the dropdown button-face arrow-cap glyph, and the alt-currency held-amount's `m_last_sale`-free simplification). AP-110's "retail-correct per-unit prices" phrasing is corrected the same day to "quantity-correct pricing" — the OLD phrase mischaracterized what retail even shows (a `GetObjectSplitSize`-quantity price, not literally one unit) independent of whether the code was buggy. AP-161 filed 2026-08-09 at Slice 5.4 (vendor browse panel) — the authored "Buying"/"Selling" tabs render and switch pages but carry no data binding, per contract decision 8's required successor to AP-110's narrowing; AP-110 NARROWED the same day — "vendor" is retired from its absent-panels list now that the "Items" browse tab is user-reachable. AP-160 filed 2026-08-07 at Slice 5.3 — the client-local vendor-panel distance watcher closes on plain 3D center distance instead of retail/ACE's cylinder-gap distance, because Runtime has no per-entity collision radius/height source outside the App-layer's Setup-cylinder resolver. AP-158 RETIRED 2026-08-06 by the #333 fix, closing #337 — the `maxReach` distance pre-filter is DELETED rather than re-centred, because retail has none: `CObjCell::find_obj_collisions` @0x0052b750 walks the cell's shadow list and calls `CPhysicsObj::FindObjCollisions` unconditionally. The row's predicted symptom was observed live at Neftet before it was fixed — a tall prop AP-156 had just placed correctly still not blocking, plus jumps sinking into the mesh and corpses falling through. Perf measured, not assumed: at the live-maximum 38 in-cell candidates 10.61 µs → 16.68 µs per resolve. AP-159 filed 2026-08-06 at the #334 fix — the INDOOR half of AP-156’s traversal residual is all that remains of it; the outdoor half is CLOSED by the `find_bbox_cell_list` port, and AP-156’s RISK COLUMN IS CORRECTED at the same commit: it recorded the residual as “extra broadphase candidates, never a missed one”, which generalised the indoor direction to the whole row and is exactly why #334 — a MISSED one, and a user-observed loss of collision on landblock-spanning formations — sat inside it unnoticed. AP-158 filed 2026-08-06 at the AP-156 fix review — the shadow broadphase's `maxReach` distance pre-filter is acdream's own invention with NO retail counterpart, and it measures from the part origin, so it can discard a genuine contact for exactly the off-centre parts AP-156 just placed correctly; issue #333. AP-156 CORRECTED at the same review: its population was understated — 172 is AP-152's DISPATCH population, not AP-156's CONTAINMENT population. AP-155 NARROWED and AP-156/AP-157 filed 2026-08-06 at the AP-152 retail-conformance review. AP-155 bundled two divergences with different code paths, populations and gates under one id; its flood half is now AP-156, **with its direction corrected**. AP-155(b) recorded the BSP flood approximation as OVER-inclusive and used that direction as the reason the residual was safe to defer; measured over the installed DAT it was UNDER-inclusive for 428 of the 530 BSP-bearing Setups (the AP-156 fix review corrected the originally-recorded '170 of 172'), because `BuildFloodSpheres` carried each physics-BSP part's root bounding-sphere RADIUS while discarding that sphere's own ORIGIN and centring it on the part origin. That is the #98/#168 class, and for 43 Setups the post-AP-152 flood was strictly smaller than the pre-AP-152 one. AP-156 records the correction and the fix — `ShadowShape.BoundsCenter`, filled from the same resolver that supplies the radius, plus the retirement of the 10-sphere clamp on a branch where retail has none — and keeps open only the sphere-vs-portal TRAVERSAL approximation. AP-157 is the previously unregistered third-branch substitution: retail floods from one `CPartArray::GetSortingSphere` where acdream floods from every Sphere shape, and acdream's cylinder flood ignores `CylHeight`. AP-152 RETIRED 2026-08-06, one day after it was filed: `ShadowShapeBuilder.FromSetup` now dispatches BSP-first instead of unioning, and `ShadowObjectRegistry.BuildFloodSpheres` now applies `calc_cross_cells`' own BSP → cylsphere → sorting-sphere order. Four statements in the row were false and are corrected in its retirement text — most importantly its predicted symptom, "catching on a doorway sill", which could not have been occurring: `Transition.BspOnlyDispatch` had already made the extra primitive inert at collision-query time since 2026-05-25. The live half was CELL MEMBERSHIP, the #98/#168 symptom class, which had no such guard. AP-153/AP-154/AP-155 filed at that retirement — retail's dispatch flag is cached once at part-array construction where acdream's gate is live [AP-153]; acdream's query-time guard takes a CLIENT-DERIVED flag off the WIRE and never derives it, an undeclared dependency on ACE reading the same DAT bit [AP-154]; and the static publication paths emit a Setup Sphere as a height-capped Cylinder while `BuildFloodSpheres` approximates retail's bounding BOX with bounding SPHERES [AP-155, whose flood-priority half is closed by the same commit]. AP-152 filed 2026-08-06 at the AP-22 retirement — the LIVE collision path emits Setup primitives and per-part physics-BSP shapes additively where retail's `CPhysicsObj::FindObjCollisions` dispatches exclusively; 172 of 5,935 installed Setups are affected, including BSP doors, so it needs its own visual gate and was deliberately not folded into the AP-22 commit; the count is unchanged because AP-22 retired in the same commit. AP-22 RETIRED 2026-08-06 — retail synthesizes no shape for a shapeless object (`CPhysicsObj::FindObjCollisions` 0x0050f050 exits at `0x0050f22f je 0x50f31b` returning the seeded OK_TS, and `CPartArray::GetRadius`/`GetHeight` are absent from its whole call set), so the invented `setup.Radius` cylinder was deleted rather than re-derived; the row's site list named one file that never contained the fallback and omitted the two that did, one of them the headless-only copy, and its "rare decorative props" risk described an unreachable branch — 0 of 5,935 installed Setups can satisfy the guard. AP-150/AP-151 filed 2026-08-06 at the #280 dual review — the wait cue's five-second arming is acdream's own and not retail's trigger [AP-150], and the reveal gate is materially stricter than retail's DAT-residency prefetch predicate on the mesh-build/GPU-upload axis [AP-151], the opposite asymmetry from AP-149; AP-149 filed 2026-08-05 at the #280 portal-prefetch fix — the reveal gate's outer ring accepts terrain-only publication where retail requires LandBlockInfo and every building EnvCell; the fix closes the reveal-window/visible-window ratio, not this residual; AP-148 filed 2026-08-05 at the C5b closeout — acdream's local-player Gate A requires the wire TELEPORT_TS to be EQUAL where retail requires only that it not be OLDER, verified by disassembly against the PDB-paired binary after two review rounds read the Binary Ninja tautology and missed it; AP-147 filed 2026-08-05 at the C5b architecture review, finding D3 — the accepted-Position delta stream's cardinality change and its torn intermediate; AP-138 amended at the same review — C5b staled its route-2 first-submit `CurrentCellId` measurement; AP-131 RETIRED 2026-08-05, C5b, closing #275 — the steady-state merge's `installPlacementFrame: true, clearParent: true` literals no longer exist; `InboundPhysicsStateController.TryApplyPosition` now computes both flags PRE-MERGE from `(disposition, hasAnimations(old))`, which is exactly `RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition`'s own `ApplyPlacementFrameBeforeRouting`/`UnparentBeforeRouting` rows (false/false on the Gate A force row, `!HasAnimations`/true on every accepted non-force route). Retail decides both writes BEFORE `MoveOrTeleport` is consulted — Gate A @0x0045400C returns @0x0045409D ahead of `unset_parent` @0x00454129 and the `HasAnims` `SetPlacementFrame` gate @0x00454137 — so the flags need no route, no player distance and no signature change. The row's predicted symptoms are gone: an animated entity's ordinary Position no longer installs a placement frame retail skips, and a ForcePosition no longer unparents. Evidence: `InboundPhysicsStateControllerTests` — `ApplyOnAnimatedEntity_NeverInstallsTheWirePlacementFrame`, `ApplyOnNonAnimatedEntity_InstallsTheWirePlacementFrame`, `ForcePositionOnParentedLocalPlayer_RetainsTheParentAttachment`, and the 12-row `MergedPrePlacementFieldsMatchTheClassifiedRouteFlags` matrix which uses the production classifier as its oracle rather than re-encoding the table; all four sabotage-verified in both directions. The row's "the legacy caller is deleted at the production cutover" framing was overtaken: the caller was CORRECTED, not deleted, and remains the only production Position wire caller; AP-145 RETIRED 2026-08-05, C5a commit 1, closing #318 — `TryPublishPlace` now publishes the local player's Place through `LocalPlayerShadowSynchronizer.SyncPose`, the same publisher ordinary per-tick movement uses, instead of a direct `LocalPlayerShadowState.Set` that never touched `PhysicsEngine.ShadowObjects`; AP-1 RETIRED 2026-08-05, C5a deletion sweep — `PhysicsEngine.Resolve`/`ResolvePlacement`/`HasCellSurface` deleted outright, zero production callers, so "production zero-delta routes remain on the legacy resolver" is now structurally false; AP-146 filed 2026-08-05, #319 fix — the local player's canonical cell is written only at login/inbound-Position/teleport, not per ordinary-movement tick as retail's SetPositionInternal does; #319's fix makes a player-parented child inherit exactly this coarseness, stale-but-equal to the parent, not a new staleness class; follow-up filed as issue #320; AP-144 filed 2026-08-05, C4 route 3 round 3 (R7) — the portal-arrival movement-event send reuses `UsePositionFromServer` (`autonomy_level != 2`) where retail's actual gate, `SendMovementEvent`, is `autonomy_level != 0`; the two agree everywhere except level 1, which no production caller can reach today; AP-142/AP-143 filed 2026-08-04, C4 route 7 — the parented-child single-field cell model (id/pointer collapse, zero-not-stale removal propagation, same-cell tick-loop subsumption) and the headless parent-realize drive's skipped holding-location validation; AP-141 filed 2026-08-04, C4 route 5, NARROWED 2026-08-04 at the round-2 delta review — the far-branch StopInterpolating clause was wrong for the adopted-body case (it is now ported there) and the row's language now distinguishes "never armed" from "never re-anchored"; CORRECTED 2026-08-04 at the round-3 delta review — the risk column's "would drag the body toward a stale anchor" claim was itself wrong (the leash anchor is write-only; `ConstraintManager::adjust_offset` only brakes, never pulls) and is retracted; every half remains test-gated only, since ACE never sends a missile UpdatePosition; AP-140 filed AND RETIRED 2026-08-04 — filed at the Bug B Opus review because the two accepted-Position routing gates read the client `Airborne` flag, i.e. walkability, where retail's free-flight predicate is CONTACT, and Bug B had just turned "in contact, not on walkable ground" from unreachable into ordinary; retired the same day by pointing both gates at `PhysicsBody.InContact`, retail's literal `transient_state & 1` test at `InterpolationManager::adjust_offset` @0x00555D52 (bit 0 = `CONTACT_TS`, acclient.h:3690), while leaving `Airborne` and all five of its `!Body.OnWalkable` writers untouched — the narrow shape the row itself pinned. A remote sliding on a steep face now interpolates as retail does instead of snapping at UpdatePosition cadence; AP-139 filed 2026-08-04, Bug B remote steep-contact slide — the interpolation-queue clear on the landing edge, carried over from the deleted hand-rolled remote landing block; AP-81 narrowed the same day by that fix, which retired its whole GRAVITY half; AP-87 annotated the same day — its predicted symptom was observed live and then fixed at the source, with the row's own thresholds and conditions deliberately unchanged; AP-138 filed 2026-08-04, C4 route 4b-2 dual Opus review, parts (1) and (2) rewritten the same day at the DELTA review — the far snap's refusable-placement residual: store_position only on the outcomes that never reached the engine, the two quiescence parks made restorable at the source, with the rollback gated on the cell it actually restores into, rather than refused by a pre-flight that structurally cannot see them, and the leash not armed through a superseded incarnation; AP-137 filed 2026-08-04, C4 route 4b-2 and rewritten the same day at that review, `teleport_hook`'s call list completed at the delta review — the acdream-only null/rejected/cell-less leftover arm, what the deleted duplicated 96 m/4 m constant pairs actually computed, and the vacuous headless satisfaction; AP-136 filed 2026-08-04, C4 route 4b-1 review, NARROWED 2026-08-04 at the C4 route 4b-2 delta review and AMENDED 2026-08-04 by the cancelled-park presentation rollback (the row's "restored visible" claim covered only the CANONICAL half; the presentation half was never rolled back, which left a parked-then-cancelled remote that stops moving invisible in the world AND absent from the radar for the rest of the session — a defect, now fixed by the `WithdrawalRestored` receipt, with the selection residual filed as AD-63) — a cancelled lost-cell park re-shows the entity where retail keeps it hidden until cell load, and the rollback's scope now covers the two placement-side quiescence parks whenever the cell it restores into is not itself quiescing — round 4 (2026-08-04) applies that same test a second time at RESTORE time, because a retained park's rollback lands a packet later; AP-135 filed 2026-08-03, C4 route 4a — the airborne no-op's retained acdream bookkeeping; the stated total was 2 rows stale before that filing and is now a literal count of this section; AP-130/AP-131/AP-132 filed 2026-08-02, continuation-executor slice; AP-5 retired 2026-07-31 at Campaign P Slice 2A — every successful `step_down` now performs retail's final `PLACEMENT_INSERT`; AP-3/AP-4 retired 2026-07-31 at Campaign P Slice 1B — `transitional_insert` and `edge_slide` now preserve retail's valid-contact early return and Branch-1-first order; AP-127 retired 2026-07-31 by #268 — the complete augmentation chain is shared by character UI and Runtime movement; AP-30 retired 2026-07-30 by the movement parity audit — retail Frame::is_equal genuinely uses the 0.0002 epsilon [byte-confirmed], so the row recorded a NON-divergence; acdream already matches; AP-129 narrowed 2026-07-30 at the P4 Opus review fix — `CanMoveInto`/`RestrictionDB::IsAllowedIn` are now ported and fed end-to-end (CreateObject HouseOwner/HouseRestrictions/Monarch tail fields + live `House_UpdateRestrictions 0x0248`, resolved through `PhysicsEngine.Objects`), retiring the original "CanMoveInto entirely unmodeled, unconditional fail-closed" gap the row described — the review was triggered by `RestrictionObjPrevalenceInspectionTests` showing 103,766 of 729,888 installed EnvCells (the whole housing estate) carry a baked `RestrictionObj`, so the unconditional fail-closed default would have locked every house for every player including its own owner; AP-10 retired 2026-07-30 at Campaign P Slice P4 — restored retail's 0.1 m dry-corner water sink-in, full suite green proving the sticky-bit no-regression argument; AP-71 retired same slice — `check_entry_restrictions` ported at the head of the indoor `FindEnvCollisions` branch, `CellPhysics.RestrictionObj` wired from the DAT-baked `EnvCell` field in both the dev and production caching paths; AP-128 filed 2026-07-30 at the P3 Opus review — PK-timer clock basis; AP-25 retired 2026-07-30 at Campaign P Slice P1 — the vitae/enchantment-aware run/jump skill chain; AP-7 retired 2026-07-30 at Campaign P Slice P2 — `calc_friction`'s threshold ported to retail's confirmed 0.25f; its still-open cos(10°)-vs-0.99999536f Sledding constant question moved to AD-55)
 
 Wave-0 UI ledger repair (2026-07-10) retired stale AP-38, resolved the AP-84
 collision, restored overwritten paperdoll rows as AP-92/AP-93, and registered
@@ -188,8 +188,8 @@ AP-94..AP-112 for the confirmed retail-UI completion gaps.
 | AP-193 | Character option id `0x34` (`ListenToPKDeathMessages` / "Listen to PK death messages") is mapped to `CharacterOptions2` bit `0x02000000` and modeled as a batched (non-auto-save) option purely on ACE's own enum — the id does not exist in the 2013 EoR PDB (`PlayerOption` there terminates at `TotalNumberOfPlayerOptions_PlayerOption = 0x34`), so neither the mask nor its `IsAutoSaveOption`/`GetDefaultOptionValue` classification is byte-verifiable against our binary. | `src/AcDream.Runtime/Gameplay/CharacterOptionTable.cs` (`HearPkDeathMessages` row) | The user's retail memory (and ACE's own `CharacterOption` enum) both carry this option; shipping wire+store coverage for it is strictly better than omitting the row the Character tab's screenshots show, and ACE never actually reads the bit server-side (`PlayerFactory.cs:659-660` — "possibly was added to Defaults post PDB we have"), so a wrong id/mask/auto-save guess here has zero server-observable consequence either way. | If the final EoR client's real id/mask/auto-save classification ever surfaces (a later PDB, or a byte-level trace against a 2015+ binary), this row's values may be wrong and need correcting — until then treat them as ACE-sourced, not retail-verified. | ACE `PlayerFactory.cs:659-660`, `CharacterOptions2.cs` (`ListenToPKDeathMessages = 0x02000000`); `named-retail/acclient.h:4162-4218` (2013 `PlayerOption` terminates at `0x34`); `docs/research/2026-08-10-set-character-options-wire.md` §8.1 |
 | AP-196 | **Filed 2026-08-11 at the OP4 review-fix round (MUST-FIX 3 / blast M2).** OP4's Group-C re-point (`AutoTarget`/`AutoRepeatAttack`/`ViewCombatTarget`/`VividTargetingIndicator`/`CoordinatesOnRadar`/`LockUI`/`AcceptLootPermits`/`ToggleRun`) moved these options' EFFECTIVE default source from the client-local `GameplaySettings.Default` record (or a persisted `settings.json`) to the retail constructor word, read live through `RuntimeCharacterOptionsState`/`CharacterOptionTable.ClientDefault` — a fresh install's observable default for `ViewCombatTarget` FLIPS from `true` (the old `GameplaySettings.Default`) to `false` (retail's real `CharacterOptions1` default — bit `0x80` is clear in `0x50C4A54A`). This fix round additionally DELETED the three now-fully-orphaned `GameplaySettings` fields (`AutoTarget`/`AutoRepeatAttack`/`ViewCombatTarget`) and their `RuntimeSettingsController` mirror properties/`SetCombatGameplay` method outright — the Combat panel's own three LEDs (`CombatUiController`) now read/write the SAME `RuntimeCharacterOptionsState` seam the Character tab's rows use, closing the "two writable copies" divergence the blast review found. The other five re-pointed options remain present in `GameplaySettings` as WRITE-BEHIND persistence/draft mirrors (`settings.json` still records the last-known value for restart continuity and Settings-panel draft consistency) — but the AUTHORITATIVE read for gameplay behavior is always the live server bit. | `src/AcDream.UI.Abstractions/Panels/Settings/GameplaySettings.cs`; `src/AcDream.App/Settings/RuntimeSettingsController.cs`; `src/AcDream.App/UI/Layout/CombatUiController.cs`; `src/AcDream.App/Combat/LiveCombatAttackOperations.cs` (`CharacterOptionCombatSettingsSource`) | Server-authoritative reads matching CH3's established precedent are strictly more correct than a client-local snapshot that can silently diverge from the character's real server state; the three deleted fields had zero remaining production consumers once the Combat panel's LEDs were re-pointed, so deleting rather than deprecating avoids a permanently-dead second store. | A fresh install (or a character whose `settings.json` predates this change) shows `ViewCombatTarget` OFF by default where it previously showed ON — a deliberate correctness fix, not a regression, if a future report cites "combat camera doesn't track by default." Any future code that still expects `GameplaySettings` to carry `AutoTarget`/`AutoRepeatAttack`/`ViewCombatTarget` fails to compile — a forcing function, not a silent gap. | `CharacterOptions1.Default = 0x50C4A54A` (`PlayerModule::PlayerModule @0x005D51F0`); `CharacterOptionTable.cs`'s `ClientDefault` column; `docs/research/2026-08-11-op4-review-blast.md` §S3. ADDENDUM (2026-08-11, re-review R4): the HEADLESS host's effective defaults changed in the same re-point — `HeadlessGameplayOperations` previously hardcoded `AutoRepeatAttack = false` / `AutoTarget = true` and now reads the live bits, so a bot that declares neither option observes `AutoRepeatAttack` flip `false → true` (the retail constructor word has it ON); a bot that needs the old behavior declares `"AutoRepeatAttack": false` in its `characterOptions` block (OP7) |
 | AP-197 | **Filed 2026-08-11 at the OP4 review-fix round (SF-1/S4).** "Display Timestamps" hardcodes retail's `PlayerModule` constructor-default format string `"%#H:%M:%S "` rather than reading the PER-CHARACTER override `GenericQualitiesData::InqString(m_pPlayerOptionsData, 1, &m_TimeStampFormat)` carries when the wire's `GenericQualitiesData` string-key `1` is populated — acdream's `PlayerDescription` parser reads and discards that field (wire research doc: "timestamp string (`0x80`) \| read, discarded \| ❌ \| never sent"). | `src/AcDream.Core/Chat/ChatLog.cs` (`FormatTimestampPrefix`); parser site cited at `docs/research/2026-08-10-set-character-options-wire.md:647` | The 2013 client's own constructor default is the only format any fresh/default character would ever show — retail ships no options-panel control that authors a custom one — so hardcoding the one value every real player sees is a safe, honest approximation until a consumer needs the per-character override. | A character whose account somehow carries a non-default persisted timestamp format (a modded/legacy server, or a hypothetical later retail patch exposing a UI for it) sees acdream render the DEFAULT format instead of their stored one — cosmetic only (still a valid H:MM:SS-shaped timestamp), never a wire or data-loss risk. | `PlayerModule::PlayerModule @0x005D51F0` (ctor default literal); `GenericQualitiesData::InqString` call site (wire doc §3.3); `docs/research/2026-08-10-set-character-options-wire.md` U6 |
-| AP-198 | **Filed 2026-08-11 at Campaign OP slice OP6.** The Config tab's "Graphics Options" + "Rendering Quality Options" sections author ten rows with no acdream renderer consumer: `Render_ScreenBrightness` (reuses the existing inert `DisplaySettings.Gamma` field — no gamma-correction pass exists), `Render_AutomaticDegrades`, `Render_GraphicsPerformance`, `Render_DegradeDistance`, `Render_LandscapeTextureDetail`, `Render_EnvironmentTextureDetail`, `Render_TextureFiltering`, `Render_LandscapeDrawDistance`, `Render_BuildingDetailTextures`, `Render_MultiPassAlpha`. acdream's world renderer is Vulkan driven by ONE aggregate `QualitySettings`/`QualityPreset` (near/far streaming radii, anisotropic level, alpha-to-coverage, completion budget) — there is no per-feature texture-detail/degrade-distance knob for any of these ten rows to drive. Each round-trips faithfully through `DisplaySettings`/`SettingsStore` and shows retail's own row/label/range (where applicable), with zero observable render effect. **Sub-note, `Render_LandscapeDrawDistance` specifically:** its retail default (`gmConfigUI::InitOptions @0x0049E70D`, `SetDefaultValue(8)`) does not index its own 6-entry `UIPreferences::SetEnumChoices` array (`ID_Graphics_Value_VeryLow`..`Extreme`, `gmClient::InitUIPreferences @0x004041b7`) — reproduced faithfully as an opaque `int` (`DisplaySettings.LandscapeDrawDistance`), not guessed into a clamped index; the Config-tab menu simply shows no highlighted selection at the default. | `src/AcDream.UI.Abstractions/Panels/Settings/DisplaySettings.cs`; `src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs` (`BindGraphicsSection`/`BindRenderingQualitySection`) | Building nine dead per-feature render knobs (plus reusing one already-dead field) into a Vulkan renderer that has no analogous per-feature toggles would be pure UI theater with no correctness payoff; persisting them faithfully keeps the panel honest (every row is clickable, nothing crashes, nothing silently discards a user's choice) while the register makes the "no effect" fact auditable rather than a silent gap a future report would have to re-discover. | A user who changes any of these ten Config-tab controls sees no visual change and, for `LandscapeDrawDistance` specifically, may see no highlighted menu item even after Defaults — both are the CONTRACTED behaviour for this row, not a bug. | `gmConfigUI::InitOptions @0x0049E400`; `gmClient::InitUIPreferences @0x004035b0` (`UIPreferences::AttachPreference`/`SetEnumChoices` calls); `src/AcDream.App/Settings/RuntimeSettingsController.cs` (`QualitySettings`/`ReapplyQualityPreset`) |
-| AP-199 | **Filed 2026-08-11 at Campaign OP slice OP6.** The Config tab's "Sound Options" section authors three rows with no acdream consumer: `Sound_SoundFeatures` (Stereo/Mono menu — acdream's OpenAL backend has no channel-count toggle), the Interface Sound toggle+slider trio (`Sound_InterfaceSoundDisabled`/`Sound_InterfaceSoundVolume` — AP-174 already documents this as retail's OWN dead knob, "registered and then never read... interface sounds are scaled by the EFFECT knob"; acdream matches that exact behaviour rather than building a working Interface bus), and `Sound_PlaySoundOnlyWhenActive` (no window-focus-based audio mute subsystem exists). All three round-trip faithfully through the new `AudioSettings.SoundFeatures`/`InterfaceDisabled`/`InterfaceVolume`/`PlaySoundOnlyWhenActive` fields. The Sound and Ambient trios' own toggle+slider pairs are NOT covered by this row — `SfxDisabled`/`AmbientDisabled`/`Sfx`/`Ambient` are LIVE (`RuntimeSettingsController.SaveAudio` now pushes into `OpenAlAudioEngine` on every change, gating the effective volume to zero when disabled). | `src/AcDream.UI.Abstractions/Panels/Settings/AudioSettings.cs`; `src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs` (`BindSoundSection`) | Matches the SAME reasoning AP-174 already established for the Interface knob specifically; Sound Features and Play-Only-When-Active are honest new store-only rows with no existing or planned acdream subsystem to bind (stereo/mono output selection and window-focus audio gating are both out of this campaign's scope). | A user who changes any of these three Config-tab controls sees/hears no change — the CONTRACTED behaviour, matching retail's own Interface-knob precedent for two of the three. | `gmClient::InitUIPreferences @0x004035b0` (`AttachPreference(&Sound_SoundFeatures, ...)`/`&Sound_InterfaceSoundDisabled`/`&Sound_InterfaceSoundVolume`/`&Sound_PlaySoundOnlyWhenActive`); AP-174 (Interface-knob precedent) |
+| AP-198 | **Filed 2026-08-11 at Campaign OP slice OP6; CORRECTED at the OP6 rework round (2026-08-11, review N1/S2) — the row count was ALWAYS ten (this row's own enumeration always listed ten items); the commit message that said "nine" was the error, now reconciled, and `Render_ScreenBrightness` no longer overloads `Gamma`.** The Config tab's "Graphics Options" + "Rendering Quality Options" sections author ten rows with no acdream renderer consumer: `Render_ScreenBrightness` (its OWN `DisplaySettings.ScreenBrightness` field, range [-1,1] default 0 — NOT the pre-existing `Gamma` multiplier, which has a different unit system and its own live legacy Settings-panel consumer; no gamma-correction pass exists for either), `Render_AutomaticDegrades`, `Render_GraphicsPerformance`, `Render_DegradeDistance`, `Render_LandscapeTextureDetail`, `Render_EnvironmentTextureDetail`, `Render_TextureFiltering`, `Render_LandscapeDrawDistance`, `Render_BuildingDetailTextures`, `Render_MultiPassAlpha`. acdream's world renderer is Vulkan driven by ONE aggregate `QualitySettings`/`QualityPreset` (near/far streaming radii, anisotropic level, alpha-to-coverage, completion budget) — there is no per-feature texture-detail/degrade-distance knob for any of these ten rows to drive. Each round-trips faithfully through `DisplaySettings`/`SettingsStore` and shows retail's own row/label/range (where applicable), with zero observable render effect. **Sub-note, `Render_LandscapeDrawDistance` specifically:** its retail default (`gmConfigUI::InitOptions @0x0049E70D`, `SetDefaultValue(8)`) does not index its own 6-entry `UIPreferences::SetEnumChoices` array (`ID_Graphics_Value_VeryLow`..`Extreme`, `gmClient::InitUIPreferences @0x004041b7`) — reproduced faithfully as an opaque `int` (`DisplaySettings.LandscapeDrawDistance`), not guessed into a clamped index; the Config-tab menu simply shows no highlighted selection at the default. | `src/AcDream.UI.Abstractions/Panels/Settings/DisplaySettings.cs`; `src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs` (`BindGraphicsSection`/`BindRenderingQualitySection`) | Building ten dead per-feature render knobs into a Vulkan renderer that has no analogous per-feature toggles would be pure UI theater with no correctness payoff; persisting them faithfully keeps the panel honest (every row is clickable, nothing crashes, nothing silently discards a user's choice) while the register makes the "no effect" fact auditable rather than a silent gap a future report would have to re-discover. | A user who changes any of these ten Config-tab controls sees no visual change and, for `LandscapeDrawDistance` specifically, may see no highlighted menu item even after Defaults — both are the CONTRACTED behaviour for this row, not a bug. | `gmConfigUI::InitOptions @0x0049E400`; `gmClient::InitUIPreferences @0x004035b0` (`UIPreferences::AttachPreference`/`SetEnumChoices` calls); `src/AcDream.App/Settings/RuntimeSettingsController.cs` (`QualitySettings`/`ReapplyQualityPreset`) |
+| AP-199 | **Filed 2026-08-11 at Campaign OP slice OP6; CORRECTED at the OP6 rework round (2026-08-11, review M2) — the field names and the "gating to zero when disabled" wording were describing an INVERTED, muted-by-default bug, not the shipped behaviour.** The Config tab's "Sound Options" section authors three rows with no acdream consumer: `Sound_SoundFeatures` (Stereo/Mono menu — acdream's OpenAL backend has no channel-count toggle), the Interface Sound toggle+slider trio (`Sound_InterfaceSoundDisabled`/`Sound_InterfaceSoundVolume` — AP-174 already documents this as retail's OWN dead knob, "registered and then never read... interface sounds are scaled by the EFFECT knob"; acdream matches that exact behaviour rather than building a working Interface bus), and `Sound_PlaySoundOnlyWhenActive` (no window-focus-based audio mute subsystem exists). All three round-trip faithfully through the new `AudioSettings.SoundFeatures`/`InterfaceEnabled`/`InterfaceVolume`/`PlaySoundOnlyWhenActive` fields. The Sound and Ambient trios' own toggle+slider pairs are NOT covered by this row — `SfxEnabled`/`AmbientEnabled`/`Sfx`/`Ambient` are LIVE (`RuntimeSettingsController.SaveAudio` now pushes into `OpenAlAudioEngine` on every change; the effective volume is zero only when the corresponding `*Enabled` flag is false — retail's own `SoundManager::effect_sounds_enabled`/`ambient_sounds_enabled` statics default to enabled, so a fresh profile is audible, not muted). | `src/AcDream.UI.Abstractions/Panels/Settings/AudioSettings.cs`; `src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs` (`BindSoundSection`) | Matches the SAME reasoning AP-174 already established for the Interface knob specifically; Sound Features and Play-Only-When-Active are honest new store-only rows with no existing or planned acdream subsystem to bind (stereo/mono output selection and window-focus audio gating are both out of this campaign's scope). | A user who changes any of these three Config-tab controls sees/hears no change — the CONTRACTED behaviour, matching retail's own Interface-knob precedent for two of the three. | `gmClient::InitUIPreferences @0x004035b0` (`AttachPreference(&Sound_SoundFeatures, ...)`/`&Sound_InterfaceSoundDisabled`/`&Sound_InterfaceSoundVolume`/`&Sound_PlaySoundOnlyWhenActive`); AP-174 (Interface-knob precedent); `SoundManager::InitPrefs @0x005503F0` (`UserPreferences::RegisterPreference` binding the enabled-sense statics) |
 | AP-200 | **Filed 2026-08-11 at Campaign OP slice OP6.** The Config tab's "UI Options" section authors `UI_ChatFontFace`/`UI_ChatFontSize` menu rows (retail Windows TrueType face name / a Tiny-Small-Medium-Large-XLarge size-tier enum). These are DELIBERATELY separate NEW fields (`ChatSettings.ChatFontFace`/`ChatFontSizeIndex`) rather than reusing the existing LIVE `ChatSettings.FontSize` (a 10..20pt float acdream's chat panel already renders with) — there is no verified index-to-point mapping from retail's five-tier enum to that float range, and acdream's text rendering has no arbitrary system-font-face swap capability (DAT-baked/bitmap fonts only, not OS TrueType files). Store-only round-trip; `FontSize` is untouched by these two rows. | `src/AcDream.UI.Abstractions/Panels/Settings/ChatSettings.cs`; `src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs` (`BindUiSection`) | Inventing a size-index-to-point mapping without retail evidence would risk silently overwriting `FontSize`'s own already-live, user-visible behaviour with a guessed value; keeping the two concepts separate is the honest choice until a byte-verified mapping (or a font-face-swap capability) exists. | A user who changes either Config-tab font control sees no chat-panel rendering change; the SEPARATE, pre-existing font-size control (wherever acdream currently exposes `ChatSettings.FontSize`) remains the only live one. | `gmClient::InitUIPreferences @0x0040387b`/`@0x00403a1a` (`AttachPreference(&UI_ChatFontFace, ...)`/`&UI_ChatFontSize`, `SetEnumChoices` choice arrays "Arial"/"Tiny".."XLarge") |
 | AP-172 | **Filed 2026-08-08 (#354 fix — spell-bar drag reorder).** Retail removes a lifted favorite from `PlayerModule` (+ UI list + wire) the instant a drag starts and the remaining shortcuts visibly slide left to close the gap for the rest of the gesture (`RecvNotice_ItemListBeginDrag` → `RemoveSpellFromMenu`, live). acdream's controller performs the same PlayerModule/wire removal at drag-begin but DEFERS the whole favorite-list's visual rebuild until the drag concludes (drop or off-bar release) — the lifted cell's icon stays visible in its old slot and siblings do not slide until release, instead of reflowing continuously through the gesture. `DropFavorite` compensates by porting retail's own `AddFavorite`-side index adjustment (decrement the target index by one when the lifted item's original index was before it) against the now-intentionally-stale sibling numbering, so the FINAL landed position is byte-identical to retail's in every case exercised (`DragFavoriteOntoAnotherSlot_ThroughTheRealPointerPipeline_ReordersAndSyncsWire`). **NARROWED + CORRECTED 2026-08-08 (drop-ring change).** Correction: this row originally claimed empty-tail-slot drops were "already-live-count-relative and are untouched" — false. The #354 `-1` adjustment sat inside `DropFavorite`, which the empty-cell path also calls, so its live-count-clamped (post-lift-numbered) index was double-corrected: lifting a non-last favorite onto the empty tail landed it second-to-last instead of last. `FavoriteDropIndex` is now THE one landing computation and applies retail's rule exactly — the `-1` is gated on the lifted spell's pre-lift-numbered removal site (retail's `RemoveSpellFromMenu`-return-gated decrement @0x004C7157), which for a live-numbered empty-tail target is retail's `RemoveSpellFromMenu == -1` no-adjustment case (test `SpellFavoriteDrag_DroppedOnTheEmptyTail_AppendsAtTheEnd` fails against the double-correcting code). Narrowing: the mid-drag presentation now includes retail's authored drag-over Accept ring — `SpellCastSubMenu::OnItemListDragOver` @0x004C5990 setting the per-cell authored DragAccept child (element 0x1000045A, `UIElement_UIItem::PostInit` @0x004E1870) to `ItemSlot_DragOver_Accept` (UIStateId 0x10000040 → authored art 0x060011F9) on the hovered cell while a spell drag is live, cleared on leave/drop (`UiCatalogSlot.DragOverAcceptance` → `UiItemSlot.DrawDragAcceptOverlay`), with the ring and the drop sharing `FavoriteDropIndex` so the ring cannot promise a different landing. | `src/AcDream.App/UI/Layout/SpellcastingUiController.cs` (`BeginFavoriteDrag`, `EndFavoriteDrag`, `DropFavorite`, `Tick` — the `_favoriteDragActive` gate) | `UiRoot`'s subtree-removal safety net (`ClearSubtreeOwnership`, `UiRoot.cs:240-247`) cancels any in-flight drag whose source widget is destroyed, and `Rebuild()` tears down and recreates every cell in the list (`UiItemList.Flush` → `RemoveChild` per cell) rather than incrementally diffing. Left unguarded, the press-time removal's `SpellbookChanged` event would let the very next per-frame `Tick()` (production drives this unconditionally via `RetailUiRuntime.Tick`) destroy the cell driving the gesture and silently cancel the reorder before the user could complete the drop — this was the reported bug. Deferring the rebuild for the gesture's duration is the minimal fix that does not touch the shared `UiRoot` drag machinery every other panel (toolbar/inventory/vendor/paperdoll) also depends on. | A future rewrite that makes `Rebuild()` an incremental per-cell diff (add/remove/reflow one cell) instead of flush-and-recreate-all would make this deferral unnecessary and should retire this row along with it — until then, a player watching their OWN spell bar mid-drag sees the vacated slot's icon linger and siblings snap into place only on release, rather than reflowing live as retail does — and one ring consequence of that frozen bar: when dragging rightward past the source, the Accept ring's SCREEN slot sits one cell right of where the icon finally lands (retail's live-reflowed bar makes them coincide); the ring is on the correct CELL in both — the spell lands immediately before that cell's spell, retail's exact insert-before semantic. No effect on final position, the wire pair sent, or any other panel; cross-window spellbook→favorite drops are live-count-relative and untouched (the empty-tail claim this sentence used to carry was corrected 2026-08-08 — see the Divergence column). | `gmSpellcastingUI::RecvNotice_ItemListBeginDrag` @0x004C7360 (`SpellCastSubMenu::RemoveSpellFromMenu`, immediate live-list removal at lift); `SpellCastSubMenu::AddFavorite` @0x004C7060 (`RemoveSpellFromMenu`'s return value gating the `-1`-if-lifted-before-target `m_numSpells` adjustment before `ItemList_InsertSpellShortcut`); `PlayerModule::AddSpellFavorite` @0x005D43E0 (`InsertPos`); `PlayerModule::RemoveSpellFavorite` @0x005D4910 |
 | AP-160 | **Filed 2026-08-07, Slice 5.3 (vendor browse lifecycle). CORRECTED AND EXTENDED 2026-08-07 at the Slice 5.3 review corrections (fixes 4/5).** **Correction (fix 4):** this row's own Retail-oracle citation originally grouped `WorldObject_Use.cs:50,57` under the SAME citation as `Vendor.CheckClose`/`GetCylinderDistance`, which read as if the `wo.UseRadius ?? 0.6f` fallback lived inside the close watcher. It does not: `WorldObject_Use.cs:50,57` is `WorldObject.IsWithinUseRadiusOf`, the APPROACH check ("how close you need to be to open the shop") — a wholly different method from `Vendor.CheckClose`, which reads `UseRadius` directly with no fallback of its own (`UseRadius` is `float?`; a nullable comparison against a null right operand is always `false`, so `CheckClose` never closes at all on an unauthored radius). `EnforceRange`'s own code comment carried the same mis-attribution and, worse, actually APPLIED that mis-borrowed 0.6f as its fallback; it now passes the raw authored `UseRadius` with no fallback of any kind (0 when absent/unauthored, matching retail's own memset-zero `PublicWeenieDesc::_useRadius` default — a plain `float` field, `acclient.h:37181`, no sentinel). Retail's own behavior for a radius-0 handler is exactly this: close on the very first nonzero-distance check. **Extension (fix 5):** the watcher reads the SERVER-ECHOED ACCEPTED position snapshot (`RuntimeEntityRecord.Snapshot.Position`), sampled once per advanced frame at the post-network-command-phase, not retail's continuous live-pose push (retail's own client simulates and renders every entity's pose every frame; `CPlayerSystem`'s range handler reads that live pose, never a periodically-echoed one). Between accepted-position updates the watcher's distance measurement is therefore up to one update-interval stale. The one BLIND WINDOW this staleness could open into a wrong in/out-of-range verdict — an in-session portal/teleport, where the player's and vendor's position snapshots can briefly sit in DIFFERENT landblock coordinate frames mid-transit — is closed unconditionally by this same review's fix 1b (`RuntimeWorldTransitState.HasPendingTeleportStart`/`IsTeleportActive` short-circuit the whole distance computation before it runs, closing the session instead of measuring across the transit), so the staleness itself never reaches that particular failure mode; it remains recorded here as a standing precision gap for the window fix 1b does NOT cover (ordinary out-of-transit movement between the same-generation position updates a slow network tick can leave briefly stale). **Original text:** The client-local vendor-panel distance watcher closes on PLAIN 3D center-to-center distance instead of retail/ACE's CYLINDER-GAP distance (both objects' own collision radius and height subtracted from the center distance before comparing to `UseRadius`). Retail: `gmVendorUI::OpenVendor` registers `CPlayerSystem::RegisterObjectRangeHandler` keyed to the vendor's own `PublicWeenieDesc._useRadius`; ACE's server-side belt-and-suspenders `Vendor.CheckClose` closes on `GetCylinderDistance(lastPlayer) > UseRadius`, i.e. `Position::cylinder_distance`/`Physics.Common.Position.CylinderDistance` with each side's real `GetRadius()`/`GetHeight()`. **NARROWED 2026-08-08 (vendor-verify gate): the watcher now measures retail's cylinder-gap via the ResolveObjectTableHost radii — the plain-center shortcut was self-closing sessions inside the walk-to-use acceptance band (opened at 4.29 m center vs authored radius 3, closed same frame). Residuals: heights pass 0, unresolvable hosts degrade to center distance (close-early only).** | `src/AcDream.Runtime/Gameplay/RuntimeVendorRangeQuery.cs` (`EnforceRange`) | `AcDream.Runtime` does not resolve a live per-entity collision radius/height for an arbitrary NPC outside the App-layer's Setup-cylinder resolver (`WorldSelectionQuery`'s `_setupCylinder`, App-only — out of Runtime's reach per the Core-structure rules, and `PhysicsBody`/`RuntimeEntityRecord` carry no radius/height field). Plain center distance is a well-defined, non-degenerate substitute (using `ObjectRangeMath.ObjectsInRange`'s existing `useRadii: false` branch rather than inventing a new metric) for a CLIENT-LOCAL UI convenience that never touches the wire or any authoritative state — closing the panel is not gated by, nor gates, anything server-visible. Reading the accepted-position snapshot rather than a continuously-integrated live pose is the same "Runtime has no live render-side pose, only the last accepted wire snapshot" constraint every other Runtime-side distance query in this codebase already accepts. | The panel can close up to (player radius + vendor radius) sooner than exact retail — typically well under a meter for a two-legged NPC — so a player standing exactly at the boundary of a large-radius vendor's `UseRadius` may see the panel close slightly earlier than retail would. No effect on any transaction, wire message, or authoritative state (Slice 6's buy/sell owns those). Retiring the cylinder-gap half requires a Runtime-owned per-entity collision radius/height source, which does not exist today; retiring the staleness half requires a continuously-updated live-pose source Runtime does not keep either. | `CPlayerSystem::RegisterObjectRangeHandler` pc:203677/0x004C4C34; `gmVendorUI::OnObjectRangeExit` pc:199486/0x004C02F0; ACE `Vendor.CheckClose`/`GetCylinderDistance` (`references/ACE/Source/ACE.Server/WorldObjects/Vendor.cs:322-367`) — a SEPARATE method, `WorldObject.IsWithinUseRadiusOf` (`WorldObject_Use.cs:44-52`), owns the unrelated `?? 0.6f` approach-check fallback; `acclient.h:37181` (`float _useRadius`, plain memset-zero field, no sentinel); `docs/research/2026-08-08-slice5-vendor-browse-research.md` §A.3/§B.1/§B.2 |
diff --git a/docs/research/2026-08-11-campaign-op-test-script.md b/docs/research/2026-08-11-campaign-op-test-script.md
index 212b08d6..b19ac5ce 100644
--- a/docs/research/2026-08-11-campaign-op-test-script.md
+++ b/docs/research/2026-08-11-campaign-op-test-script.md
@@ -531,9 +531,17 @@ rows total, byte-verified directly from `gmConfigUI::InitOptions
 @0x0049E400` and `gmClient::InitUIPreferences @0x004035b0` (the retail
 registration table that supplies every row's label/tooltip/range/enum-
 choice — a stronger source than this campaign's own research docs, which
-had left the slider-caption pairing explicitly UNVERIFIED; OP6 resolved it:
-**retail ships zero range captions on this tab** — do not expect
-"Dark/Bright"-style low/high labels on any slider).
+had left the slider-caption pairing explicitly UNVERIFIED). **CORRECTED at
+the OP6 rework round (2026-08-11, review M1):** the "zero range captions"
+reading was a Binary Ninja constant-folding artifact — the raw bytes at
+each `SetSliderLabel` call site are reads of runtime-filled string-id
+globals, not immediate zeros. **Retail DOES ship six low/high range
+captions**, one per labelled slider: Camera Stiffness (Soft/Hard), Camera
+Adjustment Speed (Slow/Fast), Field Of View (Narrow/Wide), Screen
+Brightness (Dark/Bright), Graphics Performance (Speed/Detail), Degrade
+Distance (Close/Far). Mouse Look Sensitivity is the one genuine exception —
+retail's own `InitOptions` never calls `SetSliderLabel` for it, so it alone
+should show no caption.
 
 ### Opening the tab and reading the rows
 
@@ -556,20 +564,27 @@ had left the slider-caption pairing explicitly UNVERIFIED; OP6 resolved it:
    ambient sound source, or trigger a combat/UI sound repeatedly). The
    volume should change LIVE, continuously, as you drag — not just on
    release.
-4. **Check the "Disable Sound Effects" checkbox** (the SAME row's toggle
-   half). Sound effects should go SILENT immediately, regardless of where
-   the slider is set. Uncheck it — sound effects resume at the slider's
-   current level.
-5. **Repeat steps 3-4 for the "Ambient Sound" trio** (the second row) using
+4. **CORRECTED at the OP6 rework round (2026-08-11, review M2) — the
+   checkbox's stored value is ENABLED-sense, not "Disabled" as the
+   rejected slice's own gate script previously described.** With the
+   "Disable Sound Effects" checkbox CHECKED (its default state — see step
+   6), sound effects are AUDIBLE. **Uncheck it** — sound effects go SILENT
+   immediately, regardless of where the slider is set. Check it again —
+   sound effects resume at the slider's current level. (The checkbox's own
+   retail LABEL reads as if checked should mean muted; byte evidence says
+   the opposite — see `AudioSettings`' class doc for the full citation.
+   This gate is about the OBSERVED behaviour, not the label's English.)
+5. **Repeat step 4 for the "Ambient Sound" trio** (the second row) using
    an ambient loop (wind, water, torches) as your audible test — same live
-   drag + mute-on-check behaviour.
-6. **Note the retail-faithful surprise:** on a FRESH character (never
+   drag + mute-on-uncheck behaviour.
+6. **Note the retail-faithful default:** on a FRESH character (never
    touched these settings), BOTH "Disable Sound Effects" and "Disable
-   Ambient Sound" checkboxes are CHECKED by default — i.e., sound starts
-   MUTED out of the box. This is retail's own byte-verified 2013 EoR
-   default (`gmConfigUI::InitOptions`'s `SetDefaultValue(1, ...)` on both
-   trios), reproduced faithfully — **not a bug**, however counterintuitive.
-   Uncheck both to hear anything.
+   Ambient Sound" checkboxes are CHECKED by default
+   (`gmConfigUI::InitOptions`'s `SetDefaultValue(1, ...)` on both trios) —
+   and CHECKED means AUDIBLE, matching retail's own byte-verified
+   `SoundManager::effect_sounds_enabled`/`ambient_sounds_enabled` statics
+   (both compiled `= 1`). **Sound starts ON out of the box, not muted.**
+   If you hear silence on a fresh character, that IS a defect — report it.
 7. **Drag the third slider / check its toggle ("Disable Interface Sound",
    third trio).** Expect NO audible change either way — this is retail's
    OWN dead knob (register row AP-174/AP-199): retail registers this
@@ -626,10 +641,13 @@ had left the slider-caption pairing explicitly UNVERIFIED; OP6 resolved it:
     ACTUAL effect too (sound un-mutes or re-mutes, resolution changes
     back), not just the checkbox art.
 15. **Click Defaults.** Every row jumps LIVE to retail's byte-verified
-    default (Sound/Ambient trios back to muted+100% volume, Resolution to
-    800×600, Full Screen on, Camera Stiffness to 0.45, etc.) — Apply/Reset
-    light up afterward if anything actually changed (Defaults never
-    commits by itself).
+    default (Sound/Ambient trios back to AUDIBLE+100% volume — CORRECTED
+    at the OP6 rework round, review M2; the checked-by-default checkbox
+    means enabled, not muted — Resolution to 800×600, now a highlighted
+    dropdown entry since it is one of `DisplaySettings.AvailableResolutions`
+    (review S4), Full Screen on, Camera Stiffness to 0.45, etc.) —
+    Apply/Reset light up afterward if anything actually changed (Defaults
+    never commits by itself).
 16. **Switch to another tab (e.g. Gameplay) without clicking Apply after
     an edit.** Uncommitted edits silently revert — switching tabs is a
     Reset, not a save.
@@ -649,11 +667,18 @@ had left the slider-caption pairing explicitly UNVERIFIED; OP6 resolved it:
 
 ### What to report
 
-- Any section/row/label missing, or a slider showing a low/high range
-  caption (retail ships none on this tab — see this section's own intro).
+- Any section/row/label missing, OR (CORRECTED at the OP6 rework round,
+  review M1) any of the SIX labelled sliders (Camera Stiffness/Adjustment
+  Speed, Field Of View, Screen Brightness, Graphics Performance, Degrade
+  Distance) MISSING its low/high range caption — retail ships one on each
+  of those six (see this section's own intro). Mouse Look Sensitivity is
+  the one slider that should show none.
 - A live row (Sound/Ambient volume+mute, Resolution, Full Screen) that
   does not change live, or a store-only row that unexpectedly DOES change
   something (a sign its "no consumer" premise is stale).
+- Sound effects or ambient audio SILENT on a freshly-created character
+  before you touch any Config-tab control (see step 6) — that is the M2
+  regression, not expected behaviour.
 - Reset/Defaults not behaving as described in 14-15.
 - Any row that fails to persist across a full relaunch (step 18),
   including the two next-launch-only rows (Sync To Refresh, Field of
diff --git a/src/AcDream.App/Settings/RuntimeSettingsTargets.cs b/src/AcDream.App/Settings/RuntimeSettingsTargets.cs
index 47828705..a81f8392 100644
--- a/src/AcDream.App/Settings/RuntimeSettingsTargets.cs
+++ b/src/AcDream.App/Settings/RuntimeSettingsTargets.cs
@@ -136,16 +136,34 @@ internal sealed class RuntimeSettingsStartupTargets : IRuntimeSettingsStartupTar
         if (engine is not { IsAvailable: true })
             return;
         engine.MasterVolume = audio.Master;
-        // Campaign OP slice OP6: the Config tab's toggle halves of the
-        // Sound/Ambient volume trios (Sound_SoundDisabled/
-        // Sound_AmbientSoundDisabled) gate the SAME slider value — retail's
-        // UIOption_CheckboxSlider is one row over two preferences, and a
-        // checked "Disable Sound Effects" LED mutes the category regardless
-        // of what the slider itself is set to. No engine-level "disabled"
-        // concept is needed: the effective volume sent IS zero when
-        // disabled, exactly as if the user dragged the slider to zero.
-        engine.SfxVolume = audio.SfxDisabled ? 0f : audio.Sfx;
-        engine.AmbientVolume = audio.AmbientDisabled ? 0f : audio.Ambient;
+        (float sfx, float ambient) = ComputeEffectiveCategoryVolumes(audio);
+        engine.SfxVolume = sfx;
+        engine.AmbientVolume = ambient;
+    }
+
+    /// <summary>
+    /// Campaign OP slice OP6 (2026-08-11), CORRECTED at the OP6 rework round
+    /// (review <c>docs/research/2026-08-11-op6-review.md</c> finding M2): the
+    /// Config tab's toggle halves of the Sound/Ambient volume trios
+    /// (<see cref="AudioSettings.SfxEnabled"/>/<see cref="AudioSettings.AmbientEnabled"/>
+    /// — retail's own ENABLED-sense <c>SoundManager::effect_sounds_enabled</c>/
+    /// <c>ambient_sounds_enabled</c> statics, see <see cref="AudioSettings"/>'s
+    /// class doc for the byte evidence) gate the SAME slider value: the
+    /// effective volume sent to the engine is the slider value when enabled,
+    /// zero when not — exactly as if the user dragged the slider to zero.
+    /// Extracted as a pure function (no <see cref="OpenAlAudioEngine"/>
+    /// dependency) so the mapping itself — not just that some target was
+    /// called — is unit-testable without OpenAL hardware/mocking (S5: the
+    /// rejected slice's only audio test asserted event ORDER, never the
+    /// VALUE that reached the engine, which is exactly how M2's muted-by-
+    /// default inversion shipped unnoticed).
+    /// </summary>
+    internal static (float Sfx, float Ambient) ComputeEffectiveCategoryVolumes(AudioSettings audio)
+    {
+        ArgumentNullException.ThrowIfNull(audio);
+        float sfx = audio.SfxEnabled ? audio.Sfx : 0f;
+        float ambient = audio.AmbientEnabled ? audio.Ambient : 0f;
+        return (sfx, ambient);
     }
 }
 
diff --git a/src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs b/src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs
index e2fb4901..6295796d 100644
--- a/src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs
+++ b/src/AcDream.App/UI/Layout/ConfigOptionsPageController.cs
@@ -32,7 +32,10 @@ namespace AcDream.App.UI.Layout;
 /// against string table <c>0x23000003</c>, table-enum <c>0x10000003</c>
 /// matching <c>AddHeader</c>'s own convention), its tooltip key
 /// (<c>&lt;label&gt;_Help</c> — verified at every non-truncated call site,
-/// applied uniformly), every slider's real-unit
+/// applied uniformly to every toggle/trio/slider/menu row's own
+/// interactive widget as of the OP6 rework round, review S3 — the
+/// rejected slice had wired it onto toggle/trio rows only), every slider's
+/// real-unit
 /// <c>UIPreferences::SetPreferenceRange</c> (NOT the widget's [0,1] scalar
 /// space — <see cref="ToNormalized"/>/<see cref="FromNormalized"/> convert
 /// at the build site), and every menu's <c>UIPreferences::SetEnumChoices</c>
@@ -41,21 +44,32 @@ namespace AcDream.App.UI.Layout;
 /// </para>
 ///
 /// <para>
-/// <b>U4 resolved: retail ships ZERO slider range captions on this tab.</b>
-/// Every one of the seven <c>PlayerOptionPage::SetSliderLabel</c> calls this
-/// tab makes passes literal <c>(0, 0)</c> for the low/high string ids
-/// (<c>0x0049E4E0</c>/<c>0x0049E51D</c>/<c>0x0049E556</c>/<c>0x0049E614</c>/
-/// <c>0x0049E65D</c>/<c>0x0049E68E</c> — six calls; the seventh slider,
-/// Mouse Look Sensitivity, gets NO <c>SetSliderLabel</c> call at all).
-/// <c>SetSliderLabel</c>'s own body (<c>0x004F2B80</c>) has no <c>IsValid</c>
-/// guard before writing — unlike <c>AddHeader</c> — so <c>StringId=0</c>
-/// resolves to blank text either way. The <c>ID_Graphics_Value_*</c> globals
-/// (Dark/Bright, Speed/Detail, ...) the structure doc's §4 found ARE real
-/// strings elsewhere in the binary, but THIS tab's <c>InitOptions</c> never
-/// wires them to any row — they are dead literals for this build. This
-/// controller therefore never touches the range-caption text children
-/// (<c>0x1000021E</c>/<c>0x1000021F</c>) at all — omitting them is the
-/// faithful port, not a shortcut.
+/// <b>U4 CORRECTED at the OP6 rework round (2026-08-11, review
+/// <c>docs/research/2026-08-11-op6-review.md</c> finding M1): retail DOES
+/// ship six slider range captions on this tab — the rejected slice's "zero
+/// captions" claim was a Binary Ninja constant-folding artifact, the SAME
+/// class of bug the header-string globals a few lines above already had to
+/// route around.</b> BN renders every
+/// <c>PlayerOptionPage::SetSliderLabel(this, slot, 0, 0)</c> call with
+/// literal zero operands, but the raw bytes at each call site
+/// (<c>0x0049E4C6</c>/<c>0x0049E51D</c>/.../<c>0x0049E68E</c>, PE-byte-
+/// verified against <c>C:\Users\erikn\Downloads\acclient.exe</c>) are
+/// <c>mov ecx, [ID_Graphics_Value_&lt;High&gt;]</c> /
+/// <c>mov edx, [ID_Graphics_Value_&lt;Low&gt;]</c> — reads of the SAME
+/// runtime-filled string-id globals the structure doc's §4 already found,
+/// not immediates. All six labelled sliders pair as: Camera Stiffness
+/// (Soft/Hard), Camera Adjustment Speed (Slow/Fast), Field Of View
+/// (Narrow/Wide), Screen Brightness (Dark/Bright), Graphics Performance
+/// (Speed/Detail), Degrade Distance (Close/Far) — declaration order,
+/// semantically obvious pairing, cross-checked against OP5's own PORTED
+/// mechanism for the exact same BN artifact
+/// (<c>ChatOptionsPageController.BuildOpacitySliders</c>'s
+/// Transparent/Opaque pair, <c>0x0049FD37</c>). Mouse Look Sensitivity (the
+/// SEVENTH slider, template idx3) genuinely gets NO <c>SetSliderLabel</c>
+/// call — that ONE omission is real and stays un-captioned; every idx6 row
+/// gets its low/high range-caption children (<c>0x1000021E</c>/
+/// <c>0x1000021F</c>) populated via <see cref="BuildSliderRow"/>'s optional
+/// <c>rangeLowKey</c>/<c>rangeHighKey</c> parameters.
 /// </para>
 ///
 /// <para>
@@ -75,8 +89,9 @@ namespace AcDream.App.UI.Layout;
 /// <c>0x1000021C</c>, no separate name text — the checkbox's OWN label
 /// carries the row); idx6 range-captioned slider row (Type 3,
 /// <c>0x1000021D</c>, name text <c>0x1000021B</c> + slider
-/// <c>0x1000021C</c> + UNUSED range-caption texts <c>0x1000021E</c>/
-/// <c>0x1000021F</c> — the six <c>arg3=1</c> sliders); idx7 a SECOND
+/// <c>0x1000021C</c> + POPULATED range-caption texts <c>0x1000021E</c>/
+/// <c>0x1000021F</c> (OP6 rework, review M1 — see class doc's U4 note) —
+/// the six <c>arg3=1</c> sliders); idx7 a SECOND
 /// toggle+slider trio template with range-caption children
 /// (<c>0x10000221</c>) that retail's own <c>InitOptions</c> never
 /// invokes — authored but dead, matching Chat's own unused-index pattern.
@@ -86,8 +101,9 @@ namespace AcDream.App.UI.Layout;
 /// <b>Consumer disposition (OP6 contract §4):</b> LIVE — the Sound/Ambient
 /// volume-trio sliders (<c>AudioSettings.Sfx</c>/<c>Ambient</c>, already
 /// live via <c>ApplyAudio</c>) and their toggle halves
-/// (<see cref="AudioSettings.SfxDisabled"/>/<see cref="AudioSettings.AmbientDisabled"/>,
-/// gating the SAME engine write); Resolution/Full Screen
+/// (<see cref="AudioSettings.SfxEnabled"/>/<see cref="AudioSettings.AmbientEnabled"/>
+/// — OP6 rework, review M2: retail's own ENABLED-sense fields, not
+/// "Disabled" — gating the SAME engine write); Resolution/Full Screen
 /// (<c>DisplaySettings.Resolution</c>/<c>Fullscreen</c>, immediately live —
 /// resizes the window on Save). NEXT-LAUNCH (existing precedent, not a new
 /// gap — neither the pre-existing dev-tools Settings panel nor this
@@ -95,17 +111,24 @@ namespace AcDream.App.UI.Layout;
 /// Refresh, Field of View. STORE-ONLY (register rows, cited per group below):
 /// Sound Features menu, Interface Sound trio (AP-174 — retail's own
 /// registered-and-never-read knob), Play Sound Only When Active; Screen
-/// Brightness (reuses the existing inert <c>DisplaySettings.Gamma</c> — no
-/// gamma-correction pass exists); Automatic Degrades/Graphics
-/// Performance/Degrade Distance/the four texture-detail-family
-/// menus/Building Detail Textures/Multi-Pass Alpha (the renderer is Vulkan +
-/// one aggregate <c>QualityPreset</c>, no per-feature knobs); Camera
-/// Stiffness/Adjustment Speed/Align To Slope/Mouse Look
+/// Brightness (OP6 rework, review S2: its OWN <c>DisplaySettings.ScreenBrightness</c>
+/// field, range [-1,1] default 0 — NOT the pre-existing <c>Gamma</c>
+/// multiplier, a different unit system with its own live legacy-panel
+/// consumer; no gamma-correction render pass exists for either); Automatic
+/// Degrades/Graphics Performance/Degrade Distance/the four texture-detail-
+/// family menus/Building Detail Textures/Multi-Pass Alpha (the renderer is
+/// Vulkan + one aggregate <c>QualityPreset</c>, no per-feature knobs);
+/// Camera Stiffness/Adjustment Speed/Align To Slope/Mouse Look
 /// Sensitivity/Invert Mouselook Y Axis/Use Mouse Turning (TS-74 — no
 /// persistent mouse-turning camera mode exists for ANY of these six to
 /// drive, already registered before this slice); Chat Font Face/Size
 /// (distinct NEW fields from the existing live <c>ChatSettings.FontSize</c>
-/// — no verified index-to-point/face mapping).
+/// — no verified index-to-point/face mapping; OP6 rework, review M3: Chat
+/// Font Face ships all FIVE of retail's authored choices — Arial,
+/// CourierNew, PalatinoLinotype, Tahoma, TimesNewRoman, a fixed
+/// compile-time array at <c>gmClient::InitUIPreferences @0x00403885</c>-
+/// <c>0x004039ed</c>, NOT a per-machine runtime enumeration as the
+/// rejected slice's comment claimed).
 /// </para>
 /// </summary>
 public static class ConfigOptionsPageController
@@ -157,6 +180,13 @@ public static class ConfigOptionsPageController
     /// same id CharacterOptions/ChatOptions controllers already cite.</summary>
     private const uint SliderElementId = 0x1000021Cu;
 
+    /// <summary>idx6 range-captioned slider template's low/high range-caption
+    /// children (OP6 rework, review M1) — the SAME ids
+    /// <see cref="ChatOptionsPageController"/> already cites for the exact
+    /// same BN artifact on the Chat tab's own labelled slider.</summary>
+    private const uint SliderRangeMinElementId = 0x1000021Eu;
+    private const uint SliderRangeMaxElementId = 0x1000021Fu;
+
     /// <summary>Menu row template's (idx4) name-label text child.</summary>
     private const uint MenuLabelElementId = 0x10000223u;
 
@@ -212,24 +242,30 @@ public static class ConfigOptionsPageController
 
         listBox.TemplateResolver = templateResolver;
 
-        // ScrollbarElementId (0x10000201) is SHARED with the Chat tab
-        // (0x1000050D's own scrollbar lookup cites the same hazard) —
-        // ImportedLayout.FindElement is a flat id->widget dictionary
-        // (last-build-wins on a collision), so a plain lookup here could
-        // silently wire THIS scroll model onto the Chat tab's own
-        // scrollbar instance. Scope the search to the Config page's own
-        // subtree instead. Scoped from PageSlotElementId, NOT RootElementId
-        // — see that field's own doc for why the standalone layout's root
-        // id does not survive base-merge here.
+        // OP6 rework (2026-08-11, review N2): read the scrollbar id the DAT
+        // itself authors (UiTemplateListBox.ScrollbarElementId, dat property
+        // 0x72) rather than the hardcoded ScrollbarElementId constant —
+        // feedback_prefer_dat_field_over_geometry. The constant above still
+        // documents retail's known value (0x10000201, SHARED with the Chat
+        // tab — 0x1000050D's own scrollbar lookup cites the same hazard) for
+        // callers that need it without a built listBox in hand, but Bind
+        // itself now trusts the authored field. ImportedLayout.FindElement is
+        // a flat id->widget dictionary (last-build-wins on a collision), so a
+        // plain lookup here could silently wire THIS scroll model onto the
+        // Chat tab's own scrollbar instance — scope the search to the Config
+        // page's own subtree instead. Scoped from PageSlotElementId, NOT
+        // RootElementId — see that field's own doc for why the standalone
+        // layout's root id does not survive base-merge here.
+        uint scrollbarElementId = listBox.ScrollbarElementId;
         UiElement? configPageSlot = layout.FindElement(PageSlotElementId);
-        UiElement? scrollbarElement = configPageSlot is null
+        UiElement? scrollbarElement = configPageSlot is null || scrollbarElementId == 0
             ? null
-            : UiElement.FindDescendant(configPageSlot, ScrollbarElementId);
+            : UiElement.FindDescendant(configPageSlot, scrollbarElementId);
         if (scrollbarElement is UiScrollbar scrollbar)
             scrollbar.Model = listBox.Scroll;
         else
             Console.WriteLine(
-                $"[D.2b] ConfigOptionsPageController: scrollbar 0x{ScrollbarElementId:X8} "
+                $"[D.2b] ConfigOptionsPageController: scrollbar 0x{scrollbarElementId:X8} "
                 + $"not found under Config page slot 0x{PageSlotElementId:X8} — the Config "
                 + "tab's row list will not scroll.");
 
@@ -249,6 +285,13 @@ public static class ConfigOptionsPageController
         BindInputSection(listBox, page, resolveString, bindings, ref cameraTurning);
         BuildSeparatorRow(listBox);
         BindUiSection(listBox, page, resolveString, bindings, ref chat);
+        // OP6 rework (2026-08-11, review S1): retail's own InitOptions ends
+        // with a SIXTH AddSeperator tailcall (0x0049e80d) — a trailing
+        // separator after the LAST section, not just the five INTERIOR ones
+        // between sections. 27 option rows + 6 headers + 6 separators = 39
+        // stacked ListBox items, matching retail exactly (the rejected slice
+        // built 38 — five interior separators, no trailing one).
+        BuildSeparatorRow(listBox);
 
         return true;
     }
@@ -276,21 +319,35 @@ public static class ConfigOptionsPageController
             },
             defaultValue: 0);
 
+        // OP6 rework (2026-08-11, review M2): read/apply the ENABLED-sense
+        // fields directly — toggleDefault stays `true` because retail's own
+        // SetDefaultValue(1) is checked-by-default AND checked means
+        // enabled (see AudioSettings' class doc for the byte evidence); only
+        // the FIELD's meaning changed, not this literal. sliderTooltipKey
+        // is the retail preference key for the SLIDER half specifically
+        // (Sound_SoundVolume/Sound_AmbientSoundVolume/
+        // Sound_InterfaceSoundVolume's own AttachPreference calls,
+        // gmClient::InitUIPreferences @0x0040360a/:00403676/:004036e0) —
+        // used ONLY to resolve its own "_Help" tooltip (review S3); the row
+        // has no separate slider name text, so this key never becomes
+        // visible label text.
         BuildTrioRow(
-            listBox, "ID_Sound_DisableSound", toggleDefault: true,
+            listBox, "ID_Sound_DisableSound", sliderTooltipKey: "ID_Sound_EffectVolume",
+            toggleDefault: true,
             sliderMin: 0f, sliderMax: 1f, sliderDefault: 1.0f,
             page, resolveString,
-            toggleRead: () => bindings.LoadAudio().SfxDisabled,
-            toggleApply: value => bindings.SaveAudio(bindings.LoadAudio() with { SfxDisabled = value }),
+            toggleRead: () => bindings.LoadAudio().SfxEnabled,
+            toggleApply: value => bindings.SaveAudio(bindings.LoadAudio() with { SfxEnabled = value }),
             sliderRead: () => bindings.LoadAudio().Sfx,
             sliderApply: value => bindings.SaveAudio(bindings.LoadAudio() with { Sfx = value }));
 
         BuildTrioRow(
-            listBox, "ID_Sound_DisableAmbientSound", toggleDefault: true,
+            listBox, "ID_Sound_DisableAmbientSound", sliderTooltipKey: "ID_Sound_AmbientVolume",
+            toggleDefault: true,
             sliderMin: 0f, sliderMax: 1f, sliderDefault: 1.0f,
             page, resolveString,
-            toggleRead: () => bindings.LoadAudio().AmbientDisabled,
-            toggleApply: value => bindings.SaveAudio(bindings.LoadAudio() with { AmbientDisabled = value }),
+            toggleRead: () => bindings.LoadAudio().AmbientEnabled,
+            toggleApply: value => bindings.SaveAudio(bindings.LoadAudio() with { AmbientEnabled = value }),
             sliderRead: () => bindings.LoadAudio().Ambient,
             sliderApply: value => bindings.SaveAudio(bindings.LoadAudio() with { Ambient = value }));
 
@@ -299,11 +356,12 @@ public static class ConfigOptionsPageController
         // read). Store-only, same shape as every other row here — this
         // trio simply has no live consumer to gate.
         BuildTrioRow(
-            listBox, "ID_Sound_DisableInterfaceSound", toggleDefault: true,
+            listBox, "ID_Sound_DisableInterfaceSound", sliderTooltipKey: "ID_Sound_InterfaceVolume",
+            toggleDefault: true,
             sliderMin: 0f, sliderMax: 1f, sliderDefault: 1.0f,
             page, resolveString,
-            toggleRead: () => bindings.LoadAudio().InterfaceDisabled,
-            toggleApply: value => bindings.SaveAudio(bindings.LoadAudio() with { InterfaceDisabled = value }),
+            toggleRead: () => bindings.LoadAudio().InterfaceEnabled,
+            toggleApply: value => bindings.SaveAudio(bindings.LoadAudio() with { InterfaceEnabled = value }),
             sliderRead: () => bindings.LoadAudio().InterfaceVolume,
             sliderApply: value => bindings.SaveAudio(bindings.LoadAudio() with { InterfaceVolume = value }));
 
@@ -328,17 +386,21 @@ public static class ConfigOptionsPageController
 
         // Camera Stiffness / Adjustment Speed / Align To Slope: TS-74 —
         // store-only, no persistent mouse-turning camera mode exists.
+        // rangeLowKey/rangeHighKey (OP6 rework, review M1): retail's own
+        // SetSliderLabel pair, byte-verified — see class doc's U4 note.
         BuildSliderRow(
             listBox, RangedSliderTemplateIndex, "ID_Camera_Stiffness",
             min: 0.285714298f, max: 1f, defaultValue: 0.45f, page, resolveString,
             read: () => bindings.LoadCameraTurning().Stiffness,
-            apply: value => bindings.SaveCameraTurning(bindings.LoadCameraTurning() with { Stiffness = value }));
+            apply: value => bindings.SaveCameraTurning(bindings.LoadCameraTurning() with { Stiffness = value }),
+            rangeLowKey: "ID_Graphics_Value_Soft", rangeHighKey: "ID_Graphics_Value_Hard");
 
         BuildSliderRow(
             listBox, RangedSliderTemplateIndex, "ID_Camera_AdjustmentSpeed",
             min: 5f, max: 80f, defaultValue: 40.0f, page, resolveString,
             read: () => bindings.LoadCameraTurning().AdjustmentSpeed,
-            apply: value => bindings.SaveCameraTurning(bindings.LoadCameraTurning() with { AdjustmentSpeed = value }));
+            apply: value => bindings.SaveCameraTurning(bindings.LoadCameraTurning() with { AdjustmentSpeed = value }),
+            rangeLowKey: "ID_Graphics_Value_Slow", rangeHighKey: "ID_Graphics_Value_Fast");
 
         // Field of View: NEXT-LAUNCH via DisplaySettings.FieldOfView + the
         // existing RuntimeSettingsController.ApplyStartup path — matches
@@ -348,7 +410,8 @@ public static class ConfigOptionsPageController
             listBox, RangedSliderTemplateIndex, "ID_Graphics_FieldOfView",
             min: 10f, max: 160f, defaultValue: 90.0f, page, resolveString,
             read: () => bindings.LoadDisplay().FieldOfView,
-            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { FieldOfView = value }));
+            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { FieldOfView = value }),
+            rangeLowKey: "ID_Graphics_Value_Narrow", rangeHighKey: "ID_Graphics_Value_Wide");
 
         BuildToggleRow(
             listBox, "ID_Camera_AlignToSlope", defaultValue: true, page, resolveString,
@@ -379,15 +442,14 @@ public static class ConfigOptionsPageController
         // generic path, matching that divergence honestly). SetConfirmChange
         // ships when a resolution-change confirmation flow exists — not
         // this slice (plan §4 OP6). Retail's literal default ("800x600",
-        // preserved below as the value Defaults restores) is NOT one of
-        // DisplaySettings.AvailableResolutions' modern presets — the same
-        // "opaque default the menu may not highlight" shape as
-        // LandscapeDrawDistance (register row AP-198's own sub-note), NOT
-        // a functional gap: TryParseResolution accepts any "WxH" string,
-        // so clicking Defaults still resizes the window correctly to
-        // 800x600, it just may not show a highlighted dropdown row. A
-        // FRESH profile's own current value (DisplaySettings.Default =
-        // "1280x720") IS in the preset list and highlights normally.
+        // preserved below as the value Defaults restores, byte-verified
+        // SetDefaultValue(0x03200258) @0x0049e5ac) IS now a selectable
+        // DisplaySettings.AvailableResolutions entry (OP6 rework, review
+        // S4 — it is a genuine retail display mode,
+        // Device::ForceDisplayResolution(1, 0x320, 0x258)
+        // @gmClient::Init 0x004047af, not an invented preset), so clicking
+        // Defaults both resizes the window AND leaves the dropdown showing
+        // a highlighted, re-selectable row.
         BuildStringMenuRow(
             listBox, "ID_Rendering_DisplayResolution",
             DisplaySettings.AvailableResolutions, page, resolveString,
@@ -407,13 +469,17 @@ public static class ConfigOptionsPageController
             read: () => bindings.LoadDisplay().VSync,
             apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { VSync = value }));
 
-        // Screen Brightness: reuses the existing DisplaySettings.Gamma
-        // field (no gamma-correction render pass exists — inert, store-only).
+        // Screen Brightness: OP6 rework (2026-08-11, review S2) — its OWN
+        // DisplaySettings.ScreenBrightness field ([-1,1], default 0), NOT
+        // the pre-existing Gamma multiplier (a different unit system with
+        // its own live legacy Settings-panel consumer). No gamma-correction
+        // render pass exists for either — inert, store-only.
         BuildSliderRow(
             listBox, RangedSliderTemplateIndex, "ID_Graphics_ScreenBrightness",
             min: -1f, max: 1f, defaultValue: 0f, page, resolveString,
-            read: () => bindings.LoadDisplay().Gamma,
-            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { Gamma = value }));
+            read: () => bindings.LoadDisplay().ScreenBrightness,
+            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { ScreenBrightness = value }),
+            rangeLowKey: "ID_Graphics_Value_Dark", rangeHighKey: "ID_Graphics_Value_Bright");
 
         BuildToggleRow(
             listBox, "ID_Graphics_AdaptiveDegrade", defaultValue: false, page, resolveString,
@@ -424,13 +490,15 @@ public static class ConfigOptionsPageController
             listBox, RangedSliderTemplateIndex, "ID_Graphics_AdaptiveDegradeBias",
             min: -1f, max: 1f, defaultValue: 0f, page, resolveString,
             read: () => bindings.LoadDisplay().GraphicsPerformance,
-            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { GraphicsPerformance = value }));
+            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { GraphicsPerformance = value }),
+            rangeLowKey: "ID_Graphics_Value_Speed", rangeHighKey: "ID_Graphics_Value_Detail");
 
         BuildSliderRow(
             listBox, RangedSliderTemplateIndex, "ID_Graphics_DegradeDistance",
             min: 0f, max: 100f, defaultValue: 50.0f, page, resolveString,
             read: () => bindings.LoadDisplay().DegradeDistance,
-            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { DegradeDistance = value }));
+            apply: value => bindings.SaveDisplay(bindings.LoadDisplay() with { DegradeDistance = value }),
+            rangeLowKey: "ID_Graphics_Value_Close", rangeHighKey: "ID_Graphics_Value_Far");
 
         display = bindings.LoadDisplay();
     }
@@ -548,9 +616,27 @@ public static class ConfigOptionsPageController
 
     // ── Section 6: UI Options ───────────────────────────────────────────
 
+    /// <summary>
+    /// OP6 rework (2026-08-11, review M3): all FIVE of retail's authored
+    /// choices, not the one the rejected slice shipped. The rejected
+    /// slice's "per-machine runtime enumeration" justification was
+    /// contradicted by the decompile it cited:
+    /// <c>gmClient::InitUIPreferences</c> builds a FIXED five-entry array
+    /// (<c>0x00403885</c>-<c>0x004039ed</c>) — Arial, CourierNew,
+    /// PalatinoLinotype, Tahoma, TimesNewRoman, in that order, then ONE
+    /// <c>SetEnumChoices</c> call — the exact same
+    /// <c>SmartArray&lt;unsigned long,1&gt;::grow</c> push idiom
+    /// <see cref="ChatFontSizeChoices"/> already uses for its five entries;
+    /// there is no unbounded/per-machine loop. All five strings are present
+    /// verbatim in the binary's <c>.rdata</c> (PE-byte-verified against
+    /// <c>C:\Users\erikn\Downloads\acclient.exe</c>). Default index 2
+    /// (PalatinoLinotype, <c>SetDefaultValue(2) @0x0049e7de</c>) now indexes
+    /// a real entry instead of falling past a 1-item array.
+    /// </summary>
     private static readonly string[] ChatFontFaceChoices =
     {
-        "ID_UI_Value_Arial",
+        "ID_UI_Value_Arial", "ID_UI_Value_CourierNew", "ID_UI_Value_PalatinoLinotype",
+        "ID_UI_Value_Tahoma", "ID_UI_Value_TimesNewRoman",
     };
 
     private static readonly string[] ChatFontSizeChoices =
@@ -570,12 +656,8 @@ public static class ConfigOptionsPageController
 
         // Chat Font Face/Size: store-only, distinct from the existing live
         // ChatSettings.FontSize (see that field's own doc for why). The
-        // face-choice array is authored with only ONE literal decoded so
-        // far ("Arial") — the remaining installed system fonts are a
-        // per-machine list retail enumerates at runtime
-        // (UIPreferences::AttachPreference's own SmartArray grow loop has
-        // no fixed upper bound in the decompile); the menu still shows
-        // every choice this table names rather than guessing a longer list.
+        // face-choice array ships all five retail-authored choices — see
+        // ChatFontFaceChoices' own doc (OP6 rework, review M3).
         BuildMenuRow(
             listBox, "ID_UI_ChatFontFace", ChatFontFaceChoices, page, resolveString,
             read: () => bindings.LoadChat().ChatFontFace,
@@ -673,11 +755,14 @@ public static class ConfigOptionsPageController
     /// <summary>Builds a slider row from EITHER <see cref="SimpleSliderTemplateIndex"/>
     /// (idx3, Mouse Look Sensitivity only) or <see cref="RangedSliderTemplateIndex"/>
     /// (idx6, the other six) — structurally identical leaves for this
-    /// controller's purposes (name text + slider; idx6's extra range-caption
-    /// children are deliberately left untouched — see class doc's U4 note).
-    /// Converts between the row's REAL-unit current/default (what
-    /// <paramref name="read"/>/<paramref name="apply"/> traffic in — the
-    /// settings-store unit) and the widget's normalized [0,1] scalar space.</summary>
+    /// controller's purposes (name text + slider). <paramref name="rangeLowKey"/>/
+    /// <paramref name="rangeHighKey"/> (OP6 rework, review M1) populate idx6's
+    /// extra range-caption children when supplied — left null (the default)
+    /// for Mouse Look Sensitivity, retail's own genuine no-caption exception
+    /// (see class doc's U4 note). Converts between the row's REAL-unit
+    /// current/default (what <paramref name="read"/>/<paramref name="apply"/>
+    /// traffic in — the settings-store unit) and the widget's normalized
+    /// [0,1] scalar space.</summary>
     private static void BuildSliderRow(
         UiTemplateListBox listBox,
         int templateIndex,
@@ -688,7 +773,9 @@ public static class ConfigOptionsPageController
         OptionPage page,
         Func<uint, uint, string?> resolveString,
         Func<float> read,
-        Action<float> apply)
+        Action<float> apply,
+        string? rangeLowKey = null,
+        string? rangeHighKey = null)
     {
         UiElement? row = listBox.AddItemFromTemplateList(templateIndex);
         if (row is null)
@@ -702,6 +789,11 @@ public static class ConfigOptionsPageController
         if (UiElement.FindDescendant(row, SliderLabelElementId) is UiText label)
             SetLabelText(label, labelKey, resolveString);
 
+        if (rangeLowKey is not null)
+            SetRangeLabel(row, SliderRangeMinElementId, rangeLowKey, resolveString);
+        if (rangeHighKey is not null)
+            SetRangeLabel(row, SliderRangeMaxElementId, rangeHighKey, resolveString);
+
         if (UiElement.FindDescendant(row, SliderElementId) is not UiScrollbar slider)
         {
             Console.WriteLine(
@@ -710,6 +802,12 @@ public static class ConfigOptionsPageController
             return;
         }
 
+        // OP6 rework (review S3): the slider IS the interactive/hoverable
+        // widget for this row — the label text has no hit-test surface.
+        string? tooltip = ResolveTooltip(labelKey, resolveString);
+        if (tooltip is not null)
+            slider.TooltipText = tooltip;
+
         float initial = read();
         slider.SetScalarPosition(ToNormalized(initial, min, max));
 
@@ -728,14 +826,41 @@ public static class ConfigOptionsPageController
         slider.ScalarChanged = normalized => row_.SetCurrentValue(FromNormalized(normalized, min, max));
     }
 
+    /// <summary>Populates one range-caption text child (idx6 template only —
+    /// <see cref="SliderRangeMinElementId"/>/<see cref="SliderRangeMaxElementId"/>)
+    /// — the same shape <see cref="ChatOptionsPageController.SetRangeLabel"/>
+    /// already ports for the identical BN artifact on the Chat tab's own
+    /// labelled slider (OP6 rework, review M1).</summary>
+    private static void SetRangeLabel(
+        UiElement row, uint elementId, string labelKey, Func<uint, uint, string?> resolveString)
+    {
+        if (UiElement.FindDescendant(row, elementId) is not UiText text)
+            return;
+        string? label = resolveString(StringTableId, DatStringResolver.ComputeHash(labelKey));
+        if (label is null)
+        {
+            Console.WriteLine(
+                $"[D.2b] ConfigOptionsPageController: range label '{labelKey}' did not "
+                + "resolve — rendered with no text rather than invented English.");
+            return;
+        }
+        text.LinesProvider = () => new[] { new UiText.Line(label, text.DefaultColor) };
+    }
+
     /// <summary>Builds the toggle+slider trio (idx5) — the checkbox half
     /// carries the ONLY row label (retail's own row shape has no separate
     /// name text; see class doc). Both halves are [0,1]-ranged in this
     /// campaign (every trio here is a volume knob), so no unit conversion
-    /// is needed for the slider half.</summary>
+    /// is needed for the slider half. <paramref name="sliderTooltipKey"/>
+    /// (OP6 rework, review S3) is the retail preference key for the SLIDER
+    /// half's OWN <c>AttachPreference</c> registration (e.g.
+    /// <c>Sound_SoundVolume</c>'s <c>ID_Sound_EffectVolume</c>) — used ONLY
+    /// to resolve its "_Help" tooltip, never as visible label text (the row
+    /// has none for the slider half).</summary>
     private static void BuildTrioRow(
         UiTemplateListBox listBox,
         string toggleLabelKey,
+        string sliderTooltipKey,
         bool toggleDefault,
         float sliderMin,
         float sliderMax,
@@ -783,6 +908,10 @@ public static class ConfigOptionsPageController
         page.Register(toggleRow);
         checkbox.OnClick = () => toggleRow.SetCurrentValue(checkbox.Selected);
 
+        string? sliderTooltip = ResolveTooltip(sliderTooltipKey, resolveString);
+        if (sliderTooltip is not null)
+            slider.TooltipText = sliderTooltip;
+
         float sliderInitial = sliderRead();
         slider.SetScalarPosition(ToNormalized(sliderInitial, sliderMin, sliderMax));
         var sliderRow = new FloatOptionRow(
@@ -833,6 +962,12 @@ public static class ConfigOptionsPageController
             return;
         }
 
+        // OP6 rework (review S3): the menu button IS the interactive/
+        // hoverable widget for this row.
+        string? tooltip = ResolveTooltip(labelKey, resolveString);
+        if (tooltip is not null)
+            menu.TooltipText = tooltip;
+
         string[] choiceLabels = new string[choiceKeys.Length];
         var items = new UiMenu.MenuItem[choiceKeys.Length];
         for (int i = 0; i < choiceKeys.Length; i++)
@@ -909,6 +1044,12 @@ public static class ConfigOptionsPageController
             return;
         }
 
+        // OP6 rework (review S3): the menu button IS the interactive/
+        // hoverable widget for this row.
+        string? tooltip = ResolveTooltip(labelKey, resolveString);
+        if (tooltip is not null)
+            menu.TooltipText = tooltip;
+
         var items = new UiMenu.MenuItem[choices.Count];
         for (int i = 0; i < choices.Count; i++)
             items[i] = new UiMenu.MenuItem(choices[i], choices[i]);
@@ -948,12 +1089,23 @@ public static class ConfigOptionsPageController
                 $"[D.2b] ConfigOptionsPageController: label '{labelKey}' did not resolve — "
                 + "row renders with no caption rather than invented English.");
 
-        string? tooltip = resolveString(
-            StringTableId, DatStringResolver.ComputeHash(labelKey + "_Help"));
+        string? tooltip = ResolveTooltip(labelKey, resolveString);
         if (tooltip is not null)
             checkbox.TooltipText = tooltip;
     }
 
+    /// <summary>
+    /// Resolves one <c>&lt;key&gt;_Help</c> tooltip string — the SAME suffix
+    /// convention <see cref="ApplyLabelAndTooltip"/> already used for toggle
+    /// rows, byte-verified as universal across all 27+ Config-tab
+    /// <c>AttachPreference</c> sites (OP6 rework, review S3): every row's
+    /// tooltip key is its own label key with <c>_Help</c> appended, no
+    /// exceptions found. Missing silently (no invented English), matching
+    /// every other string lookup on this page.
+    /// </summary>
+    private static string? ResolveTooltip(string labelKey, Func<uint, uint, string?> resolveString)
+        => resolveString(StringTableId, DatStringResolver.ComputeHash(labelKey + "_Help"));
+
     private static void SetLabelText(UiText label, string labelKey, Func<uint, uint, string?> resolveString)
     {
         string? text = resolveString(StringTableId, DatStringResolver.ComputeHash(labelKey));
diff --git a/src/AcDream.App/UI/UiMenu.cs b/src/AcDream.App/UI/UiMenu.cs
index c6183d2e..91afd2a6 100644
--- a/src/AcDream.App/UI/UiMenu.cs
+++ b/src/AcDream.App/UI/UiMenu.cs
@@ -34,6 +34,20 @@ public sealed class UiMenu : UiElement
     /// <summary>Button-face caption (the active target). Null ⇒ blank face.</summary>
     public Func<string>? ButtonLabelProvider { get; set; }
 
+    /// <summary>Settable tooltip, surfaced through the shared
+    /// <see cref="UiElement.GetTooltipText"/> hover pipeline — the SAME
+    /// pattern <see cref="UiButton.TooltipText"/> already established
+    /// (OP6 rework, review S3). Lets a menu-row controller (e.g. the
+    /// Config tab's Sound Features / texture-detail menus) attach retail's
+    /// own <c>_Help</c> string to the closed dropdown button itself, since
+    /// it — not the sibling label text — is the interactive/hoverable
+    /// surface for the row.</summary>
+    public string? TooltipText { get; set; }
+
+    /// <inheritdoc />
+    public override string? GetTooltipText() =>
+        string.IsNullOrWhiteSpace(TooltipText) ? null : TooltipText;
+
     public int   RowsPerColumn { get; set; } = 7;     // items per column (dat item template);
                                                        // ALSO the visible-row window height when Scrollable
     public float RowHeight     { get; set; } = 17f;   // dat item template 0x1000001E H=17
diff --git a/src/AcDream.App/UI/UiScrollbar.cs b/src/AcDream.App/UI/UiScrollbar.cs
index 34381b6b..7d207562 100644
--- a/src/AcDream.App/UI/UiScrollbar.cs
+++ b/src/AcDream.App/UI/UiScrollbar.cs
@@ -85,6 +85,19 @@ public sealed class UiScrollbar : UiElement
     public void SetScalarPosition(float position)
         => ScalarPosition = Math.Clamp(position, 0f, 1f);
 
+    /// <summary>Settable tooltip, surfaced through the shared
+    /// <see cref="UiElement.GetTooltipText"/> hover pipeline — the SAME
+    /// pattern <see cref="UiButton.TooltipText"/> already established
+    /// (OP6 rework, review S3). Lets a slider-row controller (e.g. the
+    /// Config tab's real-unit sliders) attach retail's own <c>_Help</c>
+    /// string to the scalar widget itself, since it — not the sibling
+    /// label text — is the interactive/hoverable surface for the row.</summary>
+    public string? TooltipText { get; set; }
+
+    /// <inheritdoc />
+    public override string? GetTooltipText() =>
+        string.IsNullOrWhiteSpace(TooltipText) ? null : TooltipText;
+
     /// <summary>RenderSurface id → (GL tex, w, h). 0 id = skip.</summary>
     public Func<uint, (uint tex, int w, int h)>? SpriteResolve { get; set; }
 
diff --git a/src/AcDream.UI.Abstractions/Panels/Settings/AudioSettings.cs b/src/AcDream.UI.Abstractions/Panels/Settings/AudioSettings.cs
index 364b7fdc..cae61c05 100644
--- a/src/AcDream.UI.Abstractions/Panels/Settings/AudioSettings.cs
+++ b/src/AcDream.UI.Abstractions/Panels/Settings/AudioSettings.cs
@@ -20,22 +20,56 @@ namespace AcDream.UI.Abstractions.Panels.Settings;
 /// </para>
 ///
 /// <para>
-/// Campaign OP slice OP6 (2026-08-11): the six trailing fields are the
-/// remaining Config-tab "Sound Options" rows, byte-verified from
-/// <c>gmClient::InitUIPreferences @0x004035b0</c>
-/// (<c>UIPreferences::AttachPreference</c> calls). <see cref="SfxDisabled"/>/
-/// <see cref="AmbientDisabled"/> gate the EXISTING live <see cref="Sfx"/>/
+/// Campaign OP slice OP6 (2026-08-11), CORRECTED at the OP6 rework round
+/// (2026-08-11, review <c>docs/research/2026-08-11-op6-review.md</c> finding
+/// M2): the six trailing fields are the remaining Config-tab "Sound Options"
+/// rows, byte-verified from <c>gmClient::InitUIPreferences @0x004035b0</c>
+/// (<c>UIPreferences::AttachPreference</c> calls) AND
+/// <c>SoundManager::InitPrefs @0x005503F0</c>. <see cref="SfxEnabled"/>/
+/// <see cref="AmbientEnabled"/> gate the EXISTING live <see cref="Sfx"/>/
 /// <see cref="Ambient"/> knobs (<c>RuntimeSettingsStartupTargets.ApplyAudio</c>
-/// sends 0 to the engine when disabled, else the slider value — retail's
-/// own <c>Sound_SoundDisabled</c>/<c>Sound_AmbientSoundDisabled</c> toggle
-/// halves of the SAME <c>UIOption_CheckboxSlider</c> row). The other four
-/// fields are honest store-only round-trips (register row, OP6): retail
-/// registers <c>Sound_InterfaceSoundVolume</c>/<c>Sound_InterfaceSoundDisabled</c>
-/// and then never reads them either — AP-174 already documents "interface
-/// sounds are scaled by the EFFECT knob" — so acdream matches retail's own
-/// dead-knob behaviour rather than building a working one; <see cref="SoundFeatures"/>
-/// (Stereo/Mono) and <see cref="PlaySoundOnlyWhenActive"/> have no acdream
-/// mixer-channel-count or window-focus-mute consumer.
+/// sends 0 to the engine when NOT enabled, else the slider value).
+/// </para>
+///
+/// <para>
+/// <b>Why "Enabled", not "Disabled" (the rejected OP6 slice's original
+/// naming).</b> The Config tab's checkbox LABEL reads "Disable Sound
+/// Effects"/"Disable Ambient Sound"/"Disable Interface Sound"
+/// (<c>ID_Sound_DisableSound</c> etc.), which reads as if checking it
+/// disables sound. Byte evidence says otherwise:
+/// <c>UserPreferences::RegisterPreference(&amp;SoundManager::effect_sounds_enabled,
+/// &amp;Sound_SoundDisabled, ...) @0x0055053d</c> (and the Ambient/Interface
+/// siblings at <c>:346734</c>/<c>:346741</c>) bind the checkbox's boolean
+/// value DIRECTLY — un-inverted — onto retail's own ENABLED-sense backing
+/// statics (<c>SoundManager::effect_sounds_enabled</c>/
+/// <c>ambient_sounds_enabled</c>/<c>interface_sounds_enabled</c>, each
+/// compiled <c>= 0x1</c> at <c>:1102289</c>/<c>:1102294</c>/<c>:1102299</c>,
+/// PE-byte-verified against <c>C:\Users\erikn\Downloads\acclient.exe</c>),
+/// and every consumer read is enabled-sense too (e.g.
+/// <c>if (SoundManager::effect_sounds_enabled != 0 &amp;&amp; ...) @:346813</c>).
+/// <c>gmConfigUI::InitOptions</c>'s <c>SetDefaultValue(1, 0x3f800000)</c>
+/// therefore means CHECKED-BY-DEFAULT maps to ENABLED-BY-DEFAULT — a fresh
+/// character has sound ON, not muted. The checkbox's own retail label is a
+/// legacy misnomer (the string key's name never changed even though the
+/// binding is not inverted); the STORED semantic is unambiguous. The
+/// rejected OP6 slice read the "1" as "Disabled=true" without checking what
+/// the registered backing variable actually meant, producing three inverted
+/// toggles that muted SFX and ambient audio for every profile — fresh AND
+/// existing (a missing key in an existing settings.json falls back to the
+/// record default, so the fix must make the RECORD DEFAULT mean "on").
+/// </para>
+///
+/// <para>
+/// The other four fields are honest store-only round-trips (register row
+/// AP-199): retail registers <c>Sound_InterfaceSoundVolume</c>/
+/// <c>Sound_InterfaceSoundDisabled</c> and then never reads them either —
+/// AP-174 already documents "interface sounds are scaled by the EFFECT
+/// knob" — so acdream matches retail's own dead-knob behaviour rather than
+/// building a working one (<see cref="InterfaceEnabled"/> keeps the same
+/// enabled-sense naming as its two live siblings for consistency, even
+/// though nothing reads it); <see cref="SoundFeatures"/> (Stereo/Mono) and
+/// <see cref="PlaySoundOnlyWhenActive"/> have no acdream mixer-channel-count
+/// or window-focus-mute consumer.
 /// </para>
 /// </summary>
 public sealed record AudioSettings(
@@ -45,14 +79,20 @@ public sealed record AudioSettings(
     // OP6: Sound Options menu row — Sound_SoundFeatures (Stereo=0/Mono=1).
     // Store-only: acdream's OpenAL backend has no channel-count toggle.
     int SoundFeatures = 0,
-    // OP6: the toggle halves of the Sound/Ambient volume trios
-    // (Sound_SoundDisabled / Sound_AmbientSoundDisabled). LIVE — gate the
-    // existing Sfx/Ambient knobs (RuntimeSettingsStartupTargets.ApplyAudio).
-    bool SfxDisabled = true,
-    bool AmbientDisabled = true,
-    // OP6: the Interface Sound trio — retail's own dead knob (AP-174).
-    // Store-only.
-    bool InterfaceDisabled = true,
+    // OP6 rework (2026-08-11, review M2): the toggle halves of the
+    // Sound/Ambient volume trios — retail's own ENABLED-sense
+    // SoundManager::effect_sounds_enabled/ambient_sounds_enabled statics
+    // (see class doc for the byte evidence), NOT "Disabled" fields. LIVE —
+    // gate the existing Sfx/Ambient knobs
+    // (RuntimeSettingsStartupTargets.ApplyAudio). Fresh key names — the
+    // rejected slice's "sfxDisabled"/"ambientDisabled" JSON keys never
+    // shipped in an accepted build.
+    bool SfxEnabled = true,
+    bool AmbientEnabled = true,
+    // OP6 rework: the Interface Sound trio — retail's own dead knob
+    // (AP-174). Store-only; enabled-sense naming kept for consistency with
+    // its two live siblings above.
+    bool InterfaceEnabled = true,
     float InterfaceVolume = 1.0f,
     // OP6: Sound_PlaySoundOnlyWhenActive — store-only, no window-focus
     // mute subsystem exists.
@@ -64,10 +104,10 @@ public sealed record AudioSettings(
     /// so ambient starts at unity rather than the invented 0.8. The six OP6
     /// trailing fields default to retail's OWN byte-verified
     /// <c>gmClient::InitUIPreferences</c> literals: <c>SetDefaultValue(1,
-    /// 0x3f800000)</c> on every trio (toggle=checked/"Disabled"=true,
-    /// slider=1.0) — retail's 2013 EoR build genuinely ships every Sound
-    /// category checkbox CHECKED (disabled) by default; ported faithfully,
-    /// not "fixed".
+    /// 0x3f800000)</c> on every trio (toggle=checked=enabled per the class
+    /// doc's byte evidence, slider=1.0) — retail's 2013 EoR build genuinely
+    /// ships every Sound category ENABLED and audible by default; ported
+    /// faithfully.
     /// </summary>
     public static AudioSettings Default { get; } = new(
         Master:  1.0f,
diff --git a/src/AcDream.UI.Abstractions/Panels/Settings/DisplaySettings.cs b/src/AcDream.UI.Abstractions/Panels/Settings/DisplaySettings.cs
index 310419a9..1416be9d 100644
--- a/src/AcDream.UI.Abstractions/Panels/Settings/DisplaySettings.cs
+++ b/src/AcDream.UI.Abstractions/Panels/Settings/DisplaySettings.cs
@@ -21,9 +21,9 @@ public enum ParticleRange
 /// <c>gmClient::InitUIPreferences @0x004035b0</c> DOES register
 /// <c>Render_FieldOfView</c> (<c>ID_Graphics_FieldOfView</c>, range
 /// [10,160]), <c>Display_SyncToRefresh</c>, <c>Display_Resolution</c>, and
-/// <c>Render_ScreenBrightness</c> (range [-1,1], mapped onto
-/// <see cref="Gamma"/> below) as genuine <c>UserPreferences.ini</c> rows —
-/// they simply had no acdream UI surface until OP6's Config tab. Resolution/
+/// <c>Render_ScreenBrightness</c> (<see cref="ScreenBrightness"/> below,
+/// range [-1,1]) as genuine <c>UserPreferences.ini</c> rows — they simply
+/// had no acdream UI surface until OP6's Config tab. Resolution/
 /// Fullscreen are LIVE on save (<c>RuntimeSettingsTargets.
 /// ApplyDisplayWindowState</c> resizes the window immediately); VSync/FOV/
 /// Gamma apply at the next launch only (<c>RuntimeSettingsController.
@@ -51,6 +51,18 @@ public sealed record DisplaySettings(
     // per-feature knobs (register row, OP6). Persisted faithfully; every
     // default below is retail's own byte-verified
     // gmClient::InitUIPreferences / gmConfigUI::InitOptions literal.
+    //
+    // OP6 rework (2026-08-11, review S2): Screen Brightness gets its OWN
+    // field — the rejected slice reused Gamma (a pre-existing multiplier,
+    // default 1.0, legacy Settings-panel range [0.5, 2.0]), a genuinely
+    // different unit system from retail's own Render_ScreenBrightness
+    // range [-1, 1] / default 0 (AttachPreference @0x004043df,
+    // SetPreferenceRange @0x004043f3). Overloading Gamma pinned the Config
+    // row at the WRONG default (a fresh Gamma=1.0 normalizes to the
+    // slider's maximum, not center) and made Defaults write a value (0)
+    // outside the legacy slider's own range. Gamma itself is untouched —
+    // still the pre-existing multiplier the legacy Settings panel drives.
+    float ScreenBrightness = 0f,
     bool AutomaticDegrades = false,
     float GraphicsPerformance = 0f,
     float DegradeDistance = 50f,
@@ -81,9 +93,24 @@ public sealed record DisplaySettings(
         Quality:      QualityPreset.High,
         ParticleRange: ParticleRange.Extended);
 
-    /// <summary>16:9 resolution presets offered in the dropdown.</summary>
+    /// <summary>
+    /// Resolution presets offered in the dropdown. <c>800x600</c> is retail's
+    /// OWN Config-tab default (OP6 rework, review S4) — a genuine legacy
+    /// display mode, not an invented entry: <c>gmClient::Init @0x004047af</c>
+    /// calls <c>Device::ForceDisplayResolution(1, 0x320, 0x258)</c> (0x320 =
+    /// 800, 0x258 = 600) at startup, and <c>gmConfigUI::InitOptions</c>'s own
+    /// <c>SetDefaultValue(0x03200258)</c> (byte-verified) names it as the
+    /// Resolution row's default. Without it in this list, clicking Defaults
+    /// resized the window correctly but left the dropdown showing an entry
+    /// that could never be re-selected — the same "opaque default" shape
+    /// LandscapeDrawDistance has for a genuinely different reason (AP-198's
+    /// sub-note); this one has a one-line fix instead of an opaque default,
+    /// so it gets the fix. The rest of the list is acdream's own modern
+    /// 16:9 preset ladder, not retail-authored.
+    /// </summary>
     public static IReadOnlyList<string> AvailableResolutions { get; } = new[]
     {
+        "800x600",
         "1280x720",
         "1366x768",
         "1600x900",
diff --git a/src/AcDream.UI.Abstractions/Panels/Settings/SettingsStore.cs b/src/AcDream.UI.Abstractions/Panels/Settings/SettingsStore.cs
index 33ba1933..3a46e2fe 100644
--- a/src/AcDream.UI.Abstractions/Panels/Settings/SettingsStore.cs
+++ b/src/AcDream.UI.Abstractions/Panels/Settings/SettingsStore.cs
@@ -71,6 +71,7 @@ public sealed class SettingsStore
                 Quality:     ReadQuality     (disp, "quality",     d.Quality),
                 ParticleRange: ReadParticleRange(
                     disp, "particleRange", d.ParticleRange),
+                ScreenBrightness:        ReadFloat(disp, "screenBrightness",        d.ScreenBrightness),
                 AutomaticDegrades:       ReadBool (disp, "automaticDegrades",       d.AutomaticDegrades),
                 GraphicsPerformance:     ReadFloat(disp, "graphicsPerformance",     d.GraphicsPerformance),
                 DegradeDistance:         ReadFloat(disp, "degradeDistance",         d.DegradeDistance),
@@ -120,9 +121,16 @@ public sealed class SettingsStore
                 Sfx:     ReadFloat(audio, "sfx",     d.Sfx),
                 Ambient: ReadFloat(audio, "ambient", d.Ambient),
                 SoundFeatures:           ReadInt  (audio, "soundFeatures",           d.SoundFeatures),
-                SfxDisabled:             ReadBool (audio, "sfxDisabled",             d.SfxDisabled),
-                AmbientDisabled:         ReadBool (audio, "ambientDisabled",         d.AmbientDisabled),
-                InterfaceDisabled:       ReadBool (audio, "interfaceDisabled",       d.InterfaceDisabled),
+                // OP6 rework (review M2): fresh enabled-sense key names — the
+                // rejected slice's "sfxDisabled"/"ambientDisabled"/
+                // "interfaceDisabled" keys never shipped in an accepted
+                // build, so there is no legacy key to migrate. A missing key
+                // (including every pre-OP6 settings.json) falls back to
+                // AudioSettings.Default, which is now enabled=true — sound
+                // ON, matching retail.
+                SfxEnabled:              ReadBool (audio, "sfxEnabled",              d.SfxEnabled),
+                AmbientEnabled:          ReadBool (audio, "ambientEnabled",          d.AmbientEnabled),
+                InterfaceEnabled:        ReadBool (audio, "interfaceEnabled",        d.InterfaceEnabled),
                 InterfaceVolume:         ReadFloat(audio, "interfaceVolume",         d.InterfaceVolume),
                 PlaySoundOnlyWhenActive: ReadBool (audio, "playSoundOnlyWhenActive", d.PlaySoundOnlyWhenActive));
         }
@@ -651,6 +659,7 @@ public sealed class SettingsStore
             ["particleRange"] = d.ParticleRange.ToString(),
             ["quality"]     = d.Quality.ToString(),
             ["resolution"]  = d.Resolution,
+            ["screenBrightness"]         = d.ScreenBrightness,
             ["showFps"]     = d.ShowFps,
             ["textureFiltering"]         = d.TextureFiltering,
             ["vsync"]       = d.VSync,
@@ -671,13 +680,13 @@ public sealed class SettingsStore
         => new(StringComparer.Ordinal)
         {
             ["ambient"]                 = a.Ambient,
-            ["ambientDisabled"]         = a.AmbientDisabled,
-            ["interfaceDisabled"]       = a.InterfaceDisabled,
+            ["ambientEnabled"]          = a.AmbientEnabled,
+            ["interfaceEnabled"]        = a.InterfaceEnabled,
             ["interfaceVolume"]         = a.InterfaceVolume,
             ["master"]                  = a.Master,
             ["playSoundOnlyWhenActive"] = a.PlaySoundOnlyWhenActive,
             ["sfx"]                     = a.Sfx,
-            ["sfxDisabled"]             = a.SfxDisabled,
+            ["sfxEnabled"]              = a.SfxEnabled,
             ["soundFeatures"]           = a.SoundFeatures,
         };
 
diff --git a/tests/AcDream.App.Tests/Settings/RuntimeSettingsControllerTests.cs b/tests/AcDream.App.Tests/Settings/RuntimeSettingsControllerTests.cs
index 1e06b52c..cbd925cc 100644
--- a/tests/AcDream.App.Tests/Settings/RuntimeSettingsControllerTests.cs
+++ b/tests/AcDream.App.Tests/Settings/RuntimeSettingsControllerTests.cs
@@ -319,6 +319,50 @@ public sealed class RuntimeSettingsControllerTests
         Assert.Equal(resolved, controller.ResolvedQuality);
     }
 
+    // OP6 rework (2026-08-11, review S5 / M2): pins the EFFECTIVE volume
+    // ApplyAudio actually computes, not just that some target was called.
+    // The FakeRuntimeTargets-based "target-audio" assertion above (and its
+    // predecessor before this rework) only ever checked that ApplyAudio
+    // fired, never what it fired WITH — the exact gap that let M2's
+    // Enabled/Disabled inversion mute every default profile unnoticed.
+    [Theory]
+    [InlineData(true, true, 0.6f, 0.9f, 0.6f, 0.9f)]     // enabled: slider value passes through
+    [InlineData(false, false, 0.6f, 0.9f, 0f, 0f)]       // disabled: forced to zero regardless of slider
+    [InlineData(true, false, 1.0f, 1.0f, 1.0f, 0f)]      // independent per-category gating
+    public void ComputeEffectiveCategoryVolumes_GatesSliderValueOnEnabledFlag(
+        bool sfxEnabled, bool ambientEnabled,
+        float sfxSlider, float ambientSlider,
+        float expectedSfx, float expectedAmbient)
+    {
+        AudioSettings audio = AudioSettings.Default with
+        {
+            SfxEnabled = sfxEnabled,
+            AmbientEnabled = ambientEnabled,
+            Sfx = sfxSlider,
+            Ambient = ambientSlider,
+        };
+
+        (float sfx, float ambient) = RuntimeSettingsStartupTargets.ComputeEffectiveCategoryVolumes(audio);
+
+        Assert.Equal(expectedSfx, sfx);
+        Assert.Equal(expectedAmbient, ambient);
+    }
+
+    [Fact]
+    public void ComputeEffectiveCategoryVolumes_DefaultProfile_IsAudible_NotMuted()
+    {
+        // The exact regression M2 shipped: a fresh/default AudioSettings
+        // must leave sound effects and ambient audio AUDIBLE on the next
+        // launch, matching retail's own byte-verified enabled-by-default
+        // statics (SoundManager::effect_sounds_enabled/
+        // ambient_sounds_enabled = 1) — see AudioSettings' class doc.
+        (float sfx, float ambient) =
+            RuntimeSettingsStartupTargets.ComputeEffectiveCategoryVolumes(AudioSettings.Default);
+
+        Assert.Equal(1.0f, sfx);
+        Assert.Equal(1.0f, ambient);
+    }
+
     [Fact]
     public void SaveChatPublishesSetSingleCharacterOptionOnlyForChangedBits()
     {
diff --git a/tests/AcDream.App.Tests/UI/Layout/ConfigOptionsPageControllerTests.cs b/tests/AcDream.App.Tests/UI/Layout/ConfigOptionsPageControllerTests.cs
index f06a1e7a..47e6aae9 100644
--- a/tests/AcDream.App.Tests/UI/Layout/ConfigOptionsPageControllerTests.cs
+++ b/tests/AcDream.App.Tests/UI/Layout/ConfigOptionsPageControllerTests.cs
@@ -41,16 +41,22 @@ public sealed class ConfigOptionsPageControllerTests
     [Fact]
     public void AudioSettings_Default_MatchesRetailByteVerifiedTrioDefaults()
     {
-        // gmClient::InitUIPreferences: every Sound trio's checkbox defaults
-        // to CHECKED ("Disabled"=true) — SetDefaultValue(1, 0x3f800000) in
-        // gmConfigUI::InitOptions, ported faithfully (see
-        // AudioSettings.Default's own doc for why this looks backwards but
-        // isn't a "fix").
+        // OP6 rework (2026-08-11, review M2): every Sound trio's checkbox
+        // defaults to CHECKED — SetDefaultValue(1, 0x3f800000) in
+        // gmConfigUI::InitOptions — AND checked means ENABLED, not
+        // "Disabled" (SoundManager::effect_sounds_enabled/
+        // ambient_sounds_enabled/interface_sounds_enabled are all compiled
+        // = 1 in .data, and UserPreferences::RegisterPreference binds the
+        // checkbox's boolean value directly onto those statics — see
+        // AudioSettings' own class doc for the full byte evidence). A
+        // fresh character therefore hears sound by default; this is NOT
+        // the "looks backwards but isn't a fix" case the rejected slice
+        // claimed — the rejected slice's inversion was the actual bug.
         AudioSettings d = AudioSettings.Default;
         Assert.Equal(0, d.SoundFeatures);
-        Assert.True(d.SfxDisabled);
-        Assert.True(d.AmbientDisabled);
-        Assert.True(d.InterfaceDisabled);
+        Assert.True(d.SfxEnabled);
+        Assert.True(d.AmbientEnabled);
+        Assert.True(d.InterfaceEnabled);
         Assert.Equal(1.0f, d.InterfaceVolume);
         Assert.True(d.PlaySoundOnlyWhenActive);
         Assert.Equal(1.0f, d.Sfx);
@@ -73,6 +79,8 @@ public sealed class ConfigOptionsPageControllerTests
     public void DisplaySettings_Default_MatchesRetailByteVerifiedConfigDefaults()
     {
         DisplaySettings d = DisplaySettings.Default;
+        // OP6 rework (review S2): ScreenBrightness is its own field now.
+        Assert.Equal(0f, d.ScreenBrightness);
         Assert.False(d.AutomaticDegrades);
         Assert.Equal(0f, d.GraphicsPerformance);
         Assert.Equal(50f, d.DegradeDistance);
@@ -102,12 +110,14 @@ public sealed class ConfigOptionsPageControllerTests
         try
         {
             var store = new SettingsStore(path);
+            // OP6 rework (review M2): renamed Enabled-sense fields, fresh
+            // JSON keys ("sfxEnabled" etc.) — see AudioSettings' own doc.
             var written = AudioSettings.Default with
             {
                 SoundFeatures = 1,
-                SfxDisabled = false,
-                AmbientDisabled = false,
-                InterfaceDisabled = false,
+                SfxEnabled = false,
+                AmbientEnabled = false,
+                InterfaceEnabled = false,
                 InterfaceVolume = 0.4f,
                 PlaySoundOnlyWhenActive = false,
             };
@@ -122,7 +132,47 @@ public sealed class ConfigOptionsPageControllerTests
     }
 
     [Fact]
-    public void SettingsStore_DisplayRoundTrip_PreservesTheNineOP6Fields()
+    public void SettingsStore_ExistingProfileMissingTheEnabledKeys_LoadsWithSoundOn()
+    {
+        // OP6 rework (review M2 blast radius): an existing settings.json
+        // written by a build that never had the sfxEnabled/ambientEnabled/
+        // interfaceEnabled keys (e.g. only the "display" section present)
+        // must fall back to AudioSettings.Default — enabled=true — NOT to
+        // an inverted/missing-means-muted reading. This is the exact
+        // scenario the review's blast-radius finding named: "every existing
+        // settings.json... loads as disabled" under the rejected slice.
+        string path = System.IO.Path.Combine(
+            System.IO.Path.GetTempPath(), $"acdream-op6-audio-legacy-{Guid.NewGuid():N}.json");
+        try
+        {
+            System.IO.File.WriteAllText(path, """
+                {
+                  "version": 2,
+                  "display": { "resolution": "1920x1080" }
+                }
+                """);
+            var store = new SettingsStore(path);
+            AudioSettings read = store.LoadAudio();
+
+            Assert.True(read.SfxEnabled);
+            Assert.True(read.AmbientEnabled);
+            Assert.True(read.InterfaceEnabled);
+            Assert.Equal(1.0f, read.Sfx);
+            Assert.Equal(1.0f, read.Ambient);
+
+            (float sfx, float ambient) =
+                AcDream.App.Settings.RuntimeSettingsStartupTargets.ComputeEffectiveCategoryVolumes(read);
+            Assert.Equal(1.0f, sfx);
+            Assert.Equal(1.0f, ambient);
+        }
+        finally
+        {
+            System.IO.File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public void SettingsStore_DisplayRoundTrip_PreservesTheTenOP6Fields()
     {
         string path = System.IO.Path.Combine(
             System.IO.Path.GetTempPath(), $"acdream-op6-display-{Guid.NewGuid():N}.json");
@@ -131,6 +181,8 @@ public sealed class ConfigOptionsPageControllerTests
             var store = new SettingsStore(path);
             var written = DisplaySettings.Default with
             {
+                // OP6 rework (review S2): ScreenBrightness's own field.
+                ScreenBrightness = 0.25f,
                 AutomaticDegrades = true,
                 GraphicsPerformance = 0.5f,
                 DegradeDistance = 75f,
@@ -327,15 +379,49 @@ public sealed class ConfigOptionsPageControllerTests
     }
 
     [Fact]
-    public void ToggleRow_SfxDisabled_WritesThroughAudioBindings()
+    public void Bind_ListBoxStacks39Items_SixHeaders_SixSeparators_27OptionRows()
+    {
+        // OP6 rework (review S1): retail's own InitOptions ends with a
+        // SIXTH AddSeperator tailcall (0x0049e80d @Bind) — a trailing
+        // separator after the LAST section, not just the five interior
+        // ones. 6 headers + 6 separators + 27 option-widget-rows (the 3
+        // trios are ONE widget row each despite registering TWO
+        // IOptionRow instances — see Bind_Succeeds_AndRegistersExactly30Rows)
+        // = 39 stacked ListBox items total, matching retail exactly. The
+        // rejected slice built 38 (five interior separators only).
+        ImportedLayout layout = FixtureLoader.LoadOptionsPanelHost();
+        OptionsPanelController controller = OptionsPanelController.Bind(
+            layout,
+            new OptionsPanelController.Callbacks(
+                Toggle: () => { },
+                RequestExitToCharacterSelection: () => { },
+                ExitGame: () => { },
+                UseMouseTurningSettings: () => { },
+                DisplaySystemMessage: _ => { }))!;
+        var fakeBindings = new FakeBindings();
+        bool bound = ConfigOptionsPageController.Bind(
+            layout, controller.ConfigPage, MakeTemplateResolver(), (_, _) => null,
+            fakeBindings.ToBindings());
+        Assert.True(bound);
+
+        var configSlot = UiElement.FindDescendant(controller.TabPanel, ConfigPageSlotId)!;
+        var listBox = Assert.IsType<UiTemplateListBox>(
+            UiElement.FindDescendant(configSlot, ConfigOptionsPageController.ListBoxElementId));
+
+        UiElement viewport = Assert.Single(listBox.Children);
+        Assert.Equal(39, viewport.Children.Count);
+    }
+
+    [Fact]
+    public void ToggleRow_SfxEnabled_WritesThroughAudioBindings()
     {
         (OptionsPanelController controller, FakeBindings bindings, _) = BindReal();
         var row = (BoolOptionRow)controller.ConfigPage.Rows[1]; // Sound trio toggle
 
-        row.SetCurrentValue(!AudioSettings.Default.SfxDisabled);
+        row.SetCurrentValue(!AudioSettings.Default.SfxEnabled);
 
         Assert.Single(bindings.AudioSaves);
-        Assert.Equal(!AudioSettings.Default.SfxDisabled, bindings.AudioSaves[0].SfxDisabled);
+        Assert.Equal(!AudioSettings.Default.SfxEnabled, bindings.AudioSaves[0].SfxEnabled);
         // The slider half's own field must be untouched by the toggle write.
         Assert.Equal(AudioSettings.Default.Sfx, bindings.AudioSaves[0].Sfx);
     }
@@ -468,6 +554,184 @@ public sealed class ConfigOptionsPageControllerTests
         }
     }
 
+    [Fact]
+    public void EveryRow_DefaultValue_MatchesRetailLiteral_NotJustSelfConsistency()
+    {
+        // OP6 rework (review S5): Defaults_RestoresRetailDefaultValue...
+        // above only proves each row's Current becomes its OWN
+        // DefaultValue — it says nothing about whether that DefaultValue
+        // IS retail's byte-verified literal. This pins every row's
+        // DefaultValue directly against the decompiled
+        // gmConfigUI::InitOptions/gmClient::InitUIPreferences constant,
+        // independent of the underlying settings-record defaults (already
+        // pinned separately above) — Build*Row's own inline
+        // `defaultValue:` parameters could drift from those record
+        // defaults without either test alone catching it.
+        (OptionsPanelController controller, _, _) = BindReal();
+        IReadOnlyList<IOptionRow> rows = controller.ConfigPage.Rows;
+        Assert.Equal(30, rows.Count);
+
+        object[] expected =
+        [
+            0,                  // 0  Sound Features menu (Stereo=0)
+            true, 1.0f,         // 1-2  Sound trio (Enabled, Sfx)
+            true, 1.0f,         // 3-4  Ambient trio
+            true, 1.0f,         // 5-6  Interface trio
+            true,               // 7  Play Sound Only When Active
+
+            0.45f,              // 8  Camera Stiffness
+            40.0f,              // 9  Camera Adjustment Speed
+            90.0f,              // 10 Field Of View
+            true,               // 11 Align To Slope
+
+            "800x600",          // 12 Resolution
+            true,               // 13 Full Screen
+            false,              // 14 Sync To Refresh
+            0f,                 // 15 Screen Brightness
+            false,              // 16 Automatic Degrades
+            0f,                 // 17 Graphics Performance
+            50.0f,              // 18 Degrade Distance
+
+            2,                  // 19 Landscape Texture Detail
+            1,                  // 20 Environment Texture Detail
+            1,                  // 21 Texture Filtering
+            8,                  // 22 Landscape Draw Distance (opaque — AP-198 sub-note)
+            true,               // 23 Building Detail Textures
+            false,              // 24 Multi-Pass Alpha
+
+            0.55f,              // 25 Mouse Look Sensitivity
+            false,              // 26 Invert Mouselook Y Axis
+            false,              // 27 Use Mouse Turning
+
+            2,                  // 28 Chat Font Face (PalatinoLinotype)
+            1,                  // 29 Chat Font Size
+        ];
+
+        for (int i = 0; i < rows.Count; i++)
+        {
+            object actual = rows[i] switch
+            {
+                BoolOptionRow b => b.DefaultValue,
+                FloatOptionRow f => f.DefaultValue,
+                IntOptionRow n => n.DefaultValue,
+                StringOptionRow s => s.DefaultValue,
+                _ => throw new InvalidOperationException(
+                    $"row {i} has unexpected type {rows[i].GetType()}"),
+            };
+            Assert.True(
+                Equals(expected[i], actual),
+                $"row {i}: expected retail default {expected[i]} but row.DefaultValue was {actual}.");
+        }
+    }
+
+    [Fact]
+    public void Bind_ResolvesOnlyTheAuthoredStringKeys_NoInventedOrDroppedKey()
+    {
+        // OP6 rework (review S5): the Character tab's registry-conformance
+        // pattern ("an invented row or a dropped row fails the build")
+        // applied to Config's label/tooltip/choice STRING KEYS — the exact
+        // dimension M3's 1-vs-5-entry ChatFontFaceChoices bug lived in and
+        // that LabelResolutionFailure... (null resolver) cannot see, since
+        // a null resolver makes every key invisible. Every string this
+        // page queries is transcribed here directly from
+        // gmClient::InitUIPreferences/gmConfigUI::InitOptions (bare label
+        // keys, their "<key>_Help" tooltip siblings, and every menu choice
+        // key) — an extra query (a typo'd/invented key) fails immediately;
+        // a query this test expected but never saw (a dropped key) fails
+        // at the end.
+        string[] expectedKeys =
+        [
+            // Headers
+            "ID_Sound_SoundSection", "ID_Camera_CameraSection",
+            "ID_Graphics_GraphicsSection", "ID_Graphics_TextureSection",
+            "ID_Input_InputSection", "ID_UI_UISection",
+
+            // Sound section
+            "ID_Sound_SoundFeatures", "ID_Sound_SoundFeatures_Help",
+            "ID_Sound_Stereo", "ID_Sound_Mono",
+            "ID_Sound_DisableSound", "ID_Sound_DisableSound_Help",
+            "ID_Sound_EffectVolume_Help",
+            "ID_Sound_DisableAmbientSound", "ID_Sound_DisableAmbientSound_Help",
+            "ID_Sound_AmbientVolume_Help",
+            "ID_Sound_DisableInterfaceSound", "ID_Sound_DisableInterfaceSound_Help",
+            "ID_Sound_InterfaceVolume_Help",
+            "ID_Sound_NoFocusNoSound", "ID_Sound_NoFocusNoSound_Help",
+
+            // Camera section
+            "ID_Camera_Stiffness", "ID_Camera_Stiffness_Help",
+            "ID_Graphics_Value_Soft", "ID_Graphics_Value_Hard",
+            "ID_Camera_AdjustmentSpeed", "ID_Camera_AdjustmentSpeed_Help",
+            "ID_Graphics_Value_Slow", "ID_Graphics_Value_Fast",
+            "ID_Graphics_FieldOfView", "ID_Graphics_FieldOfView_Help",
+            "ID_Graphics_Value_Narrow", "ID_Graphics_Value_Wide",
+            "ID_Camera_AlignToSlope", "ID_Camera_AlignToSlope_Help",
+
+            // Graphics section
+            "ID_Rendering_DisplayResolution", "ID_Rendering_DisplayResolution_Help",
+            "ID_Rendering_FullScreen", "ID_Rendering_FullScreen_Help",
+            "ID_Rendering_SyncToDisplayRefresh", "ID_Rendering_SyncToDisplayRefresh_Help",
+            "ID_Graphics_ScreenBrightness", "ID_Graphics_ScreenBrightness_Help",
+            "ID_Graphics_Value_Dark", "ID_Graphics_Value_Bright",
+            "ID_Graphics_AdaptiveDegrade", "ID_Graphics_AdaptiveDegrade_Help",
+            "ID_Graphics_AdaptiveDegradeBias", "ID_Graphics_AdaptiveDegradeBias_Help",
+            "ID_Graphics_Value_Speed", "ID_Graphics_Value_Detail",
+            "ID_Graphics_DegradeDistance", "ID_Graphics_DegradeDistance_Help",
+            "ID_Graphics_Value_Close", "ID_Graphics_Value_Far",
+
+            // Rendering Quality section
+            "ID_Graphics_LandscapeTextureDetail", "ID_Graphics_LandscapeTextureDetail_Help",
+            "ID_Graphics_EnvironmentTextureDetail", "ID_Graphics_EnvironmentTextureDetail_Help",
+            "ID_Graphics_Value_VeryLow", "ID_Graphics_Value_Low", "ID_Graphics_Value_Medium",
+            "ID_Graphics_Value_High", "ID_Graphics_Value_VeryHigh",
+            "ID_Graphics_TextureFiltering", "ID_Graphics_TextureFiltering_Help",
+            "ID_Graphics_TextureFiltering_Bilinear", "ID_Graphics_TextureFiltering_Trilinear",
+            "ID_Graphics_TextureFiltering_Sharp", "ID_Graphics_TextureFiltering_Anisotropic",
+            "ID_Graphics_LandscapeDrawDistance", "ID_Graphics_LandscapeDrawDistance_Help",
+            "ID_Graphics_Value_Extreme",
+            "ID_Graphics_BuildingDetailTextures", "ID_Graphics_BuildingDetailTextures_Help",
+            "ID_Graphics_MultiPassAlpha", "ID_Graphics_MultiPassAlpha_Help",
+
+            // Input section
+            "ID_Input_MouseLookSensitivity", "ID_Input_MouseLookSensitivity_Help",
+            "ID_Input_InvertMouseLookYAxis", "ID_Input_InvertMouseLookYAxis_Help",
+            "ID_Input_UseMouseTurning", "ID_Input_UseMouseTurning_Help",
+
+            // UI section
+            "ID_UI_ChatFontFace", "ID_UI_ChatFontFace_Help",
+            "ID_UI_Value_Arial", "ID_UI_Value_CourierNew", "ID_UI_Value_PalatinoLinotype",
+            "ID_UI_Value_Tahoma", "ID_UI_Value_TimesNewRoman",
+            "ID_UI_ChatFontSize", "ID_UI_ChatFontSize_Help",
+            "ID_UI_Value_Tiny", "ID_UI_Value_Small", "ID_UI_Value_Medium",
+            "ID_UI_Value_Large", "ID_UI_Value_XLarge",
+        ];
+
+        var expectedByHash = new Dictionary<uint, string>();
+        foreach (string key in expectedKeys)
+            expectedByHash[DatStringResolver.ComputeHash(key)] = key;
+
+        var seen = new HashSet<string>();
+        Func<uint, uint, string?> recordingResolver = (table, hash) =>
+        {
+            Assert.Equal(0x23000003u, table);
+            Assert.True(
+                expectedByHash.TryGetValue(hash, out string? key),
+                $"resolveString queried hash 0x{hash:X8} — no key in the expected table hashes "
+                + "to this value. Either an invented/typo'd key was added, or this test's "
+                + "expected-key table is stale.");
+            seen.Add(key!);
+            return "x"; // any non-null value keeps the row-build path fully populated.
+        };
+
+        (_, _, bool bound) = BindReal(recordingResolver);
+        Assert.True(bound);
+
+        IEnumerable<string> missing = expectedByHash.Values.Except(seen);
+        Assert.True(
+            !missing.Any(),
+            "Bind never queried these expected keys (a dropped row/key): "
+            + string.Join(", ", missing));
+    }
+
     // The tab host's own private per-page SLOT ids (OptionsPanelController's
     // ConfigPageId/ChatPageId) — the ids that actually survive base-merge in
     // the host-mounted tree (each page's own standalone-layout root id does