$$ Retail flat-floor contact-plane trace (2026-06-04, v2 — CORRECTED).
$$ Decisive question: when retail lands on the FLAT cottage floor during the climb, does
$$ BSPTREE::step_sphere_down SET the contact plane (return 3) or NOT (return 1)?
$$
$$ v1 (gu-in-bp-action) FAILED: "commands skipped ... target execution inside an event
$$ handler" corrupted eax -> a perfect 1,3,1,3 alternation artifact. DO NOT use `gu` in a
$$ bp action. v2: stash the carried cell in $t3 at ENTRY (arg2 = sphere_path at [esp+4],
$$ before the prologue), then break at the TWO RETURN addresses and print SET/NO + $t3.
$$
$$ STEP 0 (do this FIRST, before driving): the +0x218 (return 3) / +0x227 (return 1) offsets
$$ below are from the decomp (step_sphere_down @0x53a210; return 3 @0x53a428; return 1 @0x53a437)
$$ and MUST be verified against the live binary. After attaching, read the log: the `u` output
$$ (below) disassembles the function — confirm which addresses load eax=3 vs eax=1 (or jmp to the
$$ shared epilogue) and FIX the two `bp ...+0xNNN` offsets if they differ, then re-attach.
$$
$$ No qd / no Stop-Process needed if the user closes retail (debuggee exit detaches cdb).
.logopen C:\Users\erikn\source\repos\acdream\.claude\worktrees\thirsty-goldberg-51bb9b\retail-flatfloor-trace.log
.sympath C:\Users\erikn\source\repos\acdream\refs
.symopt+ 0x40
.reload /f acclient.exe
u acclient!BSPTREE::step_sphere_down L90
r @$t3 = 0
bp acclient!BSPTREE::step_sphere_down "r @$t3 = @@c++(((acclient!SPHEREPATH *)poi(@esp+4))->check_pos.objcell_id); gc"
bp acclient!BSPTREE::step_sphere_down+0x218 ".printf \"SET-CP cell=0x%x\\n\", @$t3; gc"
bp acclient!BSPTREE::step_sphere_down+0x227 ".printf \"NO-CP cell=0x%x\\n\", @$t3; gc"
g