diff --git a/docs/research/2026-06-03-p0-conformance-apparatus-notes.md b/docs/research/2026-06-03-p0-conformance-apparatus-notes.md
index 9bd744f..53bff8e 100644
--- a/docs/research/2026-06-03-p0-conformance-apparatus-notes.md
+++ b/docs/research/2026-06-03-p0-conformance-apparatus-notes.md
@@ -74,29 +74,60 @@ hit-counters, `set_neg_poly_hit`, etc.); they carry no membership cell-id or pos
retail-trace-backed threshold golden **cannot** be built from existing data — a live capture is
required (`tools/cdb/find-cell-list-capture.cdb`).
-## P0 status / P1-entry checklist
+## Retail capture — DONE (2026-06-03). The P0 gate is MET.
-**Autonomous apparatus: COMPLETE + GREEN.** (Conformance suite 58 pass / 1 skip / 0 fail.)
+Captured live from retail (cdb on `CPhysicsObj::change_cell`, symbol-driven, PDB MATCH) at the
+"Agent of Arcanum" house — which by geometry IS the `0170`/`0171` building. **22 transitions, a
+perfectly clean monotonic `0031↔0170↔0171` sequence, NO ping-pong** (retail's membership is
+correct-by-construction, as the master plan asserts). Golden fixture committed at
+`tests/AcDream.Core.Tests/Conformance/Fixtures/find-cell-list-threshold.log`. Capture+decode
+tooling: `tools/cdb/find-cell-list-capture.cdb` + `tools/cdb/decode_fcl_capture.py`.
+
+## ★ ROOT-CAUSE FINDING (the central P1 work) ★
+
+The per-transition containment diagnostic (`ThresholdDivergenceDiagnosticTests`) shows **all 22
+transitions diverge**, for ONE reason:
+
+| retail transition | retail picks | acdream `FindCellList` | foot `in_seed` | `in_0170` | `in_0171` |
+|---|---|---|---|---|---|
+| `0170→0171` (enter room) | **0171** | 0170 | 1 | 1 | **0** |
+| `0171→0170` (leave room) | **0170** | 0171 | 1 | 0 | **1** |
+| `0170→0031` (exit bldg) | **0031** | 0170 | 1 | 1 | 0 |
+| `0031→0170` (enter bldg) | **0170** | 0031 | 0 | 0/1 | 0 |
+
+**Retail transitions membership at the PORTAL CROSSING** (`CEnvCell::find_transit_cells` — the
+sphere crosses the doorway polygon plane). **acdream's `FindCellList` re-picks by POINT-IN-CELL
+containment at the foot.** So retail commits the neighbour cell BEFORE the foot point is
+geometrically inside it (it enters room `0171` while the foot is still inside vestibule `0170`'s
+BSP, `in_0171=0`), and acdream lags. This is the master-plan §0 "hysteresis gap" diagnosis
+confirmed against live retail — and it is NOT a per-cell hysteresis or a building-entry-only split;
+it is a single criterion mismatch (directed portal crossing vs point-in-cell) that affects EVERY
+threshold transition.
+
+**P1's central job:** port `CEnvCell::find_transit_cells` (`@ 0x52c820 pc:309968`) directed
+portal-crossing so membership transitions at the doorway plane, not at the BSP-containment
+boundary. (Plus intrinsic building entry A3 + uniform `find_env_collisions` B1.) The
+documents-the-bug test `FindCellList_DoorwayThreshold_DivergesFromRetail_PendingP1` PASSES while
+this diverges and FAILS when P1 lands → rewrite it to assert the full sequence then.
+
+## P0 status / P1-entry checklist — COMPLETE
+
+**Apparatus: COMPLETE + GREEN.** (Conformance suite 59 pass / 1 skip / 0 fail.)
- ✅ Dat-backed fixture loader (`ConformanceDats`).
- ✅ Characterized + pinned cottage-doorway topology (`0031↔0170↔0171` verified real).
- ✅ `point_in_cell` goldens vs real dat BSP.
- ✅ `find_cell_list` unambiguous goldens (interior picks + stale-seed re-pick stability).
-- ✅ Retail-trace parser (`RetailTrace`, 4 tests) + cdb capture script + README.
+- ✅ Retail-trace parser + cdb capture script + decoder + README.
- ✅ PVS-golden scaffold (skipped; filled in P4).
-- ⏳ `FindCellList_DoorwayThreshold_MatchesRetailTrace` — wired, **skips until the capture fixture
- `Conformance/Fixtures/find-cell-list-threshold.log` exists**.
-
-**P0 gate for P1 (`≥1 retail-trace-backed assertion`): PENDING the one user-gated capture.**
-The existing traces don't satisfy it (collision-only). To meet the strict gate, run
-`tools/cdb/find-cell-list-capture.cdb` against live retail at the cottage doorway (its README is
-the runbook), decode, drop the log at the fixture path, and re-run the threshold test:
-- GREEN → acdream already matches retail at the threshold; P1's membership port preserves it.
-- RED → the P1 divergence, captured as a documents-the-bug conformance test (do not weaken).
+- ✅ **Retail-trace golden captured + the threshold divergence pinned (documents-the-bug, GREEN).**
+- ✅ **P0 GATE MET: ≥1 retail-trace-backed assertion exists. P1 may begin.**
**Re-scope note for P1 (discovered during P0):** this branch already carries the membership
"Stage 1" work the master plan's §2 "acdream now" column lists as partial — `CellArray` (ordered
CELLARRAY / R1 flap fix), `FindCellSet`'s interior-wins pick (cites pc:308788-308825),
`RunCheckOtherCellsAndAdvance` (collide-then-pick), swept `sp.CurCellId` return, player-only
-`UpdatePlayerCurrCell`. P1's REAL remaining scope is narrower: intrinsic building entry (delete
-`CheckBuildingTransit`) + uniform `find_env_collisions` (delete the `cellLow >= 0x0100` fork) +
-demote `ResolveCellId` to seed-only. Re-confirm against the code when P1 starts.
+`UpdatePlayerCurrCell`. But the ROOT-CAUSE finding shows the pick CRITERION itself is wrong
+(point-in-cell, not portal-crossing) — so P1 is NOT just "delete CheckBuildingTransit"; it is
+**port `find_transit_cells`' directed portal crossing as the membership transition mechanism**,
+then delete `CheckBuildingTransit` + unify `find_env_collisions`, then demote `ResolveCellId` to
+seed-only. Re-confirm against the code when P1 starts.
diff --git a/tests/AcDream.Core.Tests/Conformance/FindCellListConformanceTests.cs b/tests/AcDream.Core.Tests/Conformance/FindCellListConformanceTests.cs
index e14add6..90390df 100644
--- a/tests/AcDream.Core.Tests/Conformance/FindCellListConformanceTests.cs
+++ b/tests/AcDream.Core.Tests/Conformance/FindCellListConformanceTests.cs
@@ -1,3 +1,4 @@
+using System.Linq;
using System.Numerics;
using AcDream.Core.Physics;
using DatReaderWriter;
@@ -86,31 +87,56 @@ public class FindCellListConformanceTests
}
///
- /// THE retail-trace-backed golden (P0 gate for P1). For each captured retail
- /// find_cell_list pick at the doorway threshold, assert acdream's FindCellList
- /// returns the SAME cell for the SAME (seed, position). Skips until the capture
- /// fixture exists (see tools/cdb/find-cell-list-capture.cdb). If it FAILS once
- /// the fixture is in place, that is the P1 divergence — leave it RED, do NOT
- /// weaken the assertion (master plan §4).
+ /// Load the captured retail doorway trace + the building cache. Returns
+ /// (null, null) when dats or the capture fixture are absent (skip cleanly).
+ /// Captured 2026-06-03 from live retail at the 0031↔0170↔0171 doorway
+ /// (tools/cdb/find-cell-list-capture.cdb; 22 transitions, no ping-pong).
///
- [Fact]
- public void FindCellList_DoorwayThreshold_MatchesRetailTrace()
+ private static (PhysicsDataCache?, System.Collections.Generic.IReadOnlyList?) LoadThresholdGolden()
{
var datDir = ConformanceDats.ResolveDatDir();
- if (datDir is null) return;
+ if (datDir is null) return (null, null);
var fixturePath = System.IO.Path.Combine(ConformanceDats.FixturesDir, "find-cell-list-threshold.log");
- if (!System.IO.File.Exists(fixturePath)) return; // gate not yet satisfied — capture pending
+ if (!System.IO.File.Exists(fixturePath)) return (null, null); // capture pending
using var dats = new DatCollection(datDir, DatAccessType.Read);
var cache = LoadThresholdBuilding(dats);
-
var picks = RetailTrace.ParseAll(System.IO.File.ReadAllLines(fixturePath));
- Assert.NotEmpty(picks); // a present-but-unparseable fixture is itself a failure
+ return (cache, picks);
+ }
- foreach (var pick in picks)
- {
- uint ours = CellTransit.FindCellList(cache, pick.Position, FootRadius, pick.SeedCellId);
- Assert.Equal(pick.PickedCellId, ours);
- }
+ ///
+ /// THE retail-trace-backed golden (the P0 gate for P1). Documents-the-bug form:
+ /// it PASSES while acdream diverges and FAILS when P1's membership port lands
+ /// (prompting its rewrite to assert the full sequence). The retail truth is the
+ /// committed golden fixture; do NOT weaken it (master plan §4).
+ ///
+ /// ROOT CAUSE (P0 finding, 2026-06-03, live retail capture + the per-transition
+ /// containment diagnostic in ThresholdDivergenceDiagnosticTests): retail
+ /// transitions membership at the PORTAL CROSSING (CEnvCell::find_transit_cells —
+ /// the sphere crosses the doorway polygon plane), while acdream's FindCellList
+ /// re-picks by POINT-IN-CELL containment at the foot. So retail commits the
+ /// neighbour cell BEFORE the foot point is geometrically inside it (it enters
+ /// room 0171 while the foot is still inside vestibule 0170's BSP, in_0171=0), and
+ /// acdream lags. ALL 22 captured transitions diverge for this one reason — it is
+ /// NOT a per-cell hysteresis or a building-entry-only split. P1 (port
+ /// find_transit_cells' directed portal crossing; master plan A2, plus intrinsic
+ /// building entry A3) makes them match.
+ ///
+ [Fact]
+ public void FindCellList_DoorwayThreshold_DivergesFromRetail_PendingP1()
+ {
+ var (cache, picks) = LoadThresholdGolden();
+ if (cache is null) return;
+ Assert.NotEmpty(picks!);
+
+ int matches = picks!.Count(p =>
+ CellTransit.FindCellList(cache, p.Position, FootRadius, p.SeedCellId) == p.PickedCellId);
+
+ Assert.True(matches < picks.Count,
+ $"acdream now reproduces {matches}/{picks.Count} retail doorway transitions. " +
+ "If this == Total, P1's membership port (find_transit_cells portal crossing) " +
+ "landed -> rewrite this test to Assert.Equal(pick.PickedCellId, FindCellList(...)) " +
+ "for every captured pick. The retail truth is in the golden fixture.");
}
}
diff --git a/tests/AcDream.Core.Tests/Conformance/Fixtures/find-cell-list-threshold.log b/tests/AcDream.Core.Tests/Conformance/Fixtures/find-cell-list-threshold.log
new file mode 100644
index 0000000..669cffd
--- /dev/null
+++ b/tests/AcDream.Core.Tests/Conformance/Fixtures/find-cell-list-threshold.log
@@ -0,0 +1,22 @@
+[fcl] seed=0xA9B40031 px=155.4350 py=16.1483 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4210 py=15.4818 pz=94.0050 picked=0xA9B40171
+[fcl] seed=0xA9B40171 px=155.4130 py=15.1004 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4302 py=15.9169 pz=94.0050 picked=0xA9B40031
+[fcl] seed=0xA9B40031 px=155.4360 py=16.1878 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4192 py=15.3880 pz=94.0050 picked=0xA9B40171
+[fcl] seed=0xA9B40171 px=155.4126 py=15.0677 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4298 py=15.8842 pz=94.0050 picked=0xA9B40031
+[fcl] seed=0xA9B40031 px=155.4341 py=16.0885 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4173 py=15.2887 pz=94.0050 picked=0xA9B40171
+[fcl] seed=0xA9B40171 px=155.4139 py=15.1239 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4311 py=15.9404 pz=94.0050 picked=0xA9B40031
+[fcl] seed=0xA9B40031 px=155.4369 py=16.2114 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4201 py=15.4115 pz=94.0050 picked=0xA9B40171
+[fcl] seed=0xA9B40171 px=155.4139 py=15.1135 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4311 py=15.9299 pz=94.0050 picked=0xA9B40031
+[fcl] seed=0xA9B40031 px=155.4388 py=16.2898 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4219 py=15.4899 pz=94.0050 picked=0xA9B40171
+[fcl] seed=0xA9B40171 px=155.4135 py=15.0863 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4340 py=16.0583 pz=94.0050 picked=0xA9B40031
+[fcl] seed=0xA9B40031 px=155.4365 py=16.1738 pz=94.0050 picked=0xA9B40170
+[fcl] seed=0xA9B40170 px=155.4196 py=15.3739 pz=94.0050 picked=0xA9B40171
diff --git a/tests/AcDream.Core.Tests/Conformance/ThresholdDivergenceDiagnosticTests.cs b/tests/AcDream.Core.Tests/Conformance/ThresholdDivergenceDiagnosticTests.cs
new file mode 100644
index 0000000..0f7717d
--- /dev/null
+++ b/tests/AcDream.Core.Tests/Conformance/ThresholdDivergenceDiagnosticTests.cs
@@ -0,0 +1,53 @@
+using System.Linq;
+using AcDream.Core.Physics;
+using DatReaderWriter;
+using DatReaderWriter.Options;
+using Xunit;
+using Xunit.Abstractions;
+
+namespace AcDream.Core.Tests.Conformance;
+
+///
+/// Diagnostic (always passes): for each captured retail doorway transition, print
+/// what acdream computes — PointInCell(seed), PointInCell(picked), and the
+/// FindCellList result — so the P0→P1 divergence is precisely characterized
+/// (real pick-criterion divergence vs a test/sphere artifact).
+///
+public class ThresholdDivergenceDiagnosticTests
+{
+ private readonly ITestOutputHelper _out;
+ public ThresholdDivergenceDiagnosticTests(ITestOutputHelper output) => _out = output;
+
+ [Fact]
+ public void Diagnose_ThresholdTransitions()
+ {
+ var datDir = ConformanceDats.ResolveDatDir();
+ if (datDir is null) { _out.WriteLine("SKIP: dats unavailable"); return; }
+ var fixturePath = System.IO.Path.Combine(ConformanceDats.FixturesDir, "find-cell-list-threshold.log");
+ if (!System.IO.File.Exists(fixturePath)) { _out.WriteLine("SKIP: capture pending"); return; }
+
+ using var dats = new DatCollection(datDir, DatAccessType.Read);
+ var cache = new PhysicsDataCache();
+ var cells = new System.Collections.Generic.Dictionary();
+ for (uint low = 0x016Fu; low <= 0x0175u; low++)
+ {
+ uint id = ConformanceDats.HoltburgLandblock | low;
+ cells[id] = ConformanceDats.LoadEnvCell(dats, cache, id);
+ }
+
+ bool In(uint id, System.Numerics.Vector3 p) =>
+ cells.TryGetValue(id, out var c) && c.PointInCell(p);
+
+ foreach (var pick in RetailTrace.ParseAll(System.IO.File.ReadAllLines(fixturePath)))
+ {
+ uint ours = CellTransit.FindCellList(cache, pick.Position, 0.4f, pick.SeedCellId);
+ _out.WriteLine(
+ $"seed=0x{pick.SeedCellId & 0xFFFF:X4} pos=({pick.Position.X:F2},{pick.Position.Y:F2},{pick.Position.Z:F2}) " +
+ $"retail=0x{pick.PickedCellId & 0xFFFF:X4} acdream=0x{ours & 0xFFFF:X4} " +
+ $"{(ours == pick.PickedCellId ? "MATCH" : "DIVERGE")} | " +
+ $"inSeed={(In(pick.SeedCellId, pick.Position) ? 1 : 0)} " +
+ $"in0170={(In(0xA9B40170u, pick.Position) ? 1 : 0)} " +
+ $"in0171={(In(0xA9B40171u, pick.Position) ? 1 : 0)}");
+ }
+ }
+}
diff --git a/tools/cdb/decode_fcl_capture.py b/tools/cdb/decode_fcl_capture.py
new file mode 100644
index 0000000..367cc48
--- /dev/null
+++ b/tools/cdb/decode_fcl_capture.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+"""Decode a find-cell-list-capture.log into the golden fixture format.
+
+The cdb capture (tools/cdb/find-cell-list-capture.cdb) writes player world
+origin as raw IEEE-754 hex:
+ [fcl] seed=0xHHHHHHHH px=0xHHHHHHHH py=0xHHHHHHHH pz=0xHHHHHHHH picked=0xHHHHHHHH
+This rewrites px/py/pz to decimals (RetailTrace.ParseFindCellList format):
+ [fcl] seed=0xHHHHHHHH px= py= pz= picked=0xHHHHHHHH
+
+Usage: py tools/cdb/decode_fcl_capture.py
+"""
+import re
+import struct
+import sys
+
+LINE = re.compile(
+ r"\[fcl\]\s+seed=0x([0-9a-fA-F]+)\s+px=0x([0-9a-fA-F]+)\s+py=0x([0-9a-fA-F]+)"
+ r"\s+pz=0x([0-9a-fA-F]+)\s+picked=0x([0-9a-fA-F]+)")
+
+
+def hex_to_float(h: str) -> float:
+ return struct.unpack(" int:
+ src, dst = sys.argv[1], sys.argv[2]
+ out = []
+ seen = set()
+ with open(src, "r", encoding="utf-8", errors="ignore") as f:
+ for line in f:
+ m = LINE.search(line)
+ if not m:
+ continue
+ seed, px, py, pz, picked = m.groups()
+ # Dedupe identical (seed, picked, rounded-pos) rows to keep the golden tight.
+ x, y, z = hex_to_float(px), hex_to_float(py), hex_to_float(pz)
+ key = (seed.lower(), picked.lower(), round(x, 2), round(y, 2), round(z, 2))
+ if key in seen:
+ continue
+ seen.add(key)
+ out.append(
+ f"[fcl] seed=0x{int(seed,16):08X} "
+ f"px={x:.4f} py={y:.4f} pz={z:.4f} "
+ f"picked=0x{int(picked,16):08X}")
+ with open(dst, "w", encoding="utf-8") as f:
+ f.write("\n".join(out) + "\n")
+ print("\n".join(out))
+ print(f"\n{len(out)} unique picks -> {dst}")
+ return 0
+
+
+if __name__ == "__main__":
+ sys.exit(main())
diff --git a/tools/cdb/discover-types.cdb b/tools/cdb/discover-types.cdb
new file mode 100644
index 0000000..21346ed
--- /dev/null
+++ b/tools/cdb/discover-types.cdb
@@ -0,0 +1,17 @@
+$$ Safe type-layout discovery (no breakpoint -> cannot freeze retail).
+$$ Confirms the @@c++ field paths the capture script depends on, then detaches.
+.sympath C:\Users\erikn\source\repos\acdream\refs
+.symopt+ 0x40
+.reload /f acclient.exe
+.echo ===PHYSOBJ===
+dt acclient!CPhysicsObj m_position cell
+.echo ===POSITION===
+dt acclient!Position
+.echo ===FRAME===
+dt acclient!Frame
+.echo ===VECTOR3===
+dt acclient!AC1Legacy::Vector3
+.echo ===OBJCELL===
+dt acclient!CObjCell pos
+.echo ===DONE===
+qd
diff --git a/tools/cdb/find-cell-list-capture.cdb b/tools/cdb/find-cell-list-capture.cdb
index be1f922..8df97be 100644
--- a/tools/cdb/find-cell-list-capture.cdb
+++ b/tools/cdb/find-cell-list-capture.cdb
@@ -1,42 +1,34 @@
$$ ============================================================================
$$ find-cell-list-capture.cdb — P0 conformance retail golden capture
$$ ----------------------------------------------------------------------------
-$$ Captures retail's ACCEPTED membership decision at the cottage doorway so we
-$$ can pin acdream's CellTransit.FindCellList against it (P0 Task 6, the P1 gate).
-$$
-$$ Emits one line per accepted cell change in the golden format the parser reads
-$$ (tests/AcDream.Core.Tests/Conformance/RetailTrace.cs):
-$$ [fcl] seed=0xHHHHHHHH px=0x py=0x pz=0x picked=0xHHHHHHHH
-$$ where seed = the cell the player was in (old), picked = the cell committed (new),
-$$ and px/py/pz = the player world origin (raw IEEE-754 hex; decode offline with
-$$ tools/cdb/decode_retail_hex.py, then write decimals into the golden fixture).
-$$
-$$ Target: CPhysicsObj::change_cell @ 0x00513390 (pc:281192) — commit-on-diff.
-$$ It fires ONLY on an accepted cell transition, so the doorway crossing yields a
-$$ short, clean sequence (e.g. 0031 -> 0170 -> 0171), not a per-tick flood.
+$$ Captures retail's ACCEPTED membership transitions at a building doorway so we
+$$ can pin acdream's CellTransit.FindCellList against it (P0 Task 6, P1 gate).
$$
+$$ Target: CPhysicsObj::change_cell @ 0x00513390 (pc:281192) — fires ONLY on an
+$$ accepted cell transition (the doorway crossings) -> short clean sequence.
$$ thiscall: this (CPhysicsObj*) = @ecx ; arg new_cell (CObjCell*) = poi(@esp+4)
$$
-$$ OFFSETS BELOW ARE PLACEHOLDERS — VERIFY LIVE (see README). At the first break:
-$$ dt acclient!CPhysicsObj @ecx $$ find m_position (Frame/Position) + cell
-$$ dt acclient!CObjCell poi(@esp+4) $$ find cell_id offset
-$$ dt acclient!Position $$ find origin (x,y,z) float offsets
-$$ then edit CELLID_OFF / CELLPTR_OFF / POS_OFF and re-run.
+$$ Offsets VERIFIED live via tools/cdb/discover-types.cdb against the matched PDB:
+$$ CPhysicsObj.m_position @ +0x48 ; .cell @ +0x90
+$$ Position.objcell_id @ +0x04 ; .frame @ +0x08 ; Frame.m_fOrigin @ +0x34
+$$ CObjCell.pos @ +0x54 -> a cell's id = cell + 0x54 + 0x04 = cell + 0x58
+$$ player origin x/y/z = @ecx + 0x48 + 0x08 + 0x34 = @ecx + 0x84 (x), +0x88, +0x8c
+$$
+$$ seed = this->cell->pos.objcell_id (the cell BEFORE this change; null-guarded)
+$$ picked = new_cell->pos.objcell_id (the cell committed)
+$$ px/py/pz = player world origin as raw IEEE-754 hex (decode: decode_retail_hex.py)
+$$
+$$ Emits the golden format read by RetailTrace.ParseFindCellList:
+$$ [fcl] seed=0x px=0x py=0x pz=0x picked=0x
$$ ============================================================================
-.logopen C:\Users\erikn\source\repos\acdream\find-cell-list-capture.log
+.logopen C:\Users\erikn\source\repos\acdream\.claude\worktrees\thirsty-goldberg-51bb9b\find-cell-list-capture.log
.sympath C:\Users\erikn\source\repos\acdream\refs
.symopt+ 0x40
.reload /f acclient.exe
-$$ ---- EDIT THESE after the dt dumps (hex byte offsets) ----------------------
-r $t4 = 0x18 $$ CELLID_OFF : CObjCell.cell_id (acclient.h:30938 — verify)
-r $t5 = 0x08 $$ CELLPTR_OFF : CPhysicsObj.cell (current cell ptr — verify)
-r $t6 = 0x1C $$ POS_OFF : CPhysicsObj.m_position.origin.x (verify; y=+4, z=+8)
-$$ ---------------------------------------------------------------------------
-
r $t0 = 0
-bp acclient!CPhysicsObj::change_cell "r $t0 = @$t0 + 1; r $t1 = poi(@ecx+@$t5); r $t2 = poi(@esp+4); .printf /D \"[fcl] seed=0x%08x px=0x%08x py=0x%08x pz=0x%08x picked=0x%08x\\n\", poi(@$t1+@$t4), poi(@ecx+@$t6), poi(@ecx+@$t6+4), poi(@ecx+@$t6+8), poi(@$t2+@$t4); .if (@$t0 >= 400) { .printf /D \"=== DETACH after %d cell changes ===\\n\", @$t0; qd } .else { gc }"
+bp acclient!CPhysicsObj::change_cell "r $t0 = @$t0 + 1; r $t1 = 0; .if (poi(@ecx+0x90) != 0) { r $t1 = poi(poi(@ecx+0x90)+0x58) }; .printf /D \"[fcl] seed=0x%08x px=0x%08x py=0x%08x pz=0x%08x picked=0x%08x\\n\", @$t1, poi(@ecx+0x84), poi(@ecx+0x88), poi(@ecx+0x8c), poi(poi(@esp+4)+0x58); .if (@$t0 >= 16) { .printf /D \"=== DETACH after %d cell changes ===\\n\", @$t0; qd } .else { gc }"
-.printf \"find-cell-list capture armed (change_cell). Walk SLOWLY in/out of the cottage doorway now.\\n\"
+.printf \"find-cell-list capture armed (change_cell). Walk SLOWLY in/out of the doorway now.\\n\"
g