TNC: Verified Results from 23.09.2026

Status: Offline-save repair and a more complete map alias have been built and specifically tested. A playable custom map has not yet been demonstrated. The following results replace contradictory speculations in earlier reports. Live gameplay, original saves, and Steam files were only read during this investigation.

1. Two Concrete Errors in Previous Save Candidates

game.details contains a dictionary CRC32, not a hash over the unchanged text file. Algorithm: Omit checksum entry, sort remaining keys, concatenate key bytes immediately with value bytes, compute CRC32 over the entirety. Write as signed 32-bit decimal. This matches id Software, idDict::Checksum.

Independent Proof: 26 existing original files, of which 21 have different contents, from TNC and TNO constitute the test. A changed map name with an unchanged checksum falls as expected. The old v2 candidate has exactly this error.

Additionally, checkpoint_mapstart.dat contains three LE-u32-length-prefixed map names and three layer names. The previous exchange of only text bytes extended the strings without adjusting their six length fields. Even with a valid DAT header, this candidate remains structurally incorrect.

Repaired:

• tools/probe_details_checksum.py: Dictionary verification and targeted recalculation.
• tools/build_custom_save_candidate.py: Length-aware exchange in both DATs, new MD5-fold DAT headers, new dictionary CRC, output exclusively as a new folder under re_probes/custom_save_candidates.
• tools/verify_custom_save_candidate.py: Identical identity transformation, longer/shorter paths byte-exactly backwards, false lengths despite correct DAT hash recognized; old v2 errors reproduced.

Candidate: re_probes/custom_save_candidates/FC2-WOLF0-c2v1_custom_v3. Source is the secured manual DLC2 savegame from UI Progression Slot 1, i.e., SLOT0/FC2-WOLF0. .verify was copied unchanged. Its runtime effect will be investigated separately from Claude's Save Verifier. From previous File Corrupt attempts, due to the proven other errors, no insurmountable cryptographic lock can be derived.

2. map and devmap are Present

Process 87400 was opened exclusively for reading with OpenProcess(0x410). Snapshot: re_probes/runtime_87400/module.bin, virtual RVA layout, no runnable or patched EXE. Captured .text, .rdata, .data, .pdata. EXE-SHA256: 68e6c21a97c2a0824ff75961a771605dacbd73f17e33e8e7265741535a3818c3. The addresses apply only to this build; ASLR base is determined per process.

The command system lies at RVA 0x4104420:

Registration 0xA6F3C0: the map callbacks are indeed passed to AddCommand. AddCommand 0x1264840: Flag 2 pulls Flag 4; only entries with Flag 4 additionally enter the exposed table.

Dispatcher 0x1265150, specifically 0x12651A7..0x12651BC, selects between the two tables depending on context system+0x200B8. This explains the observed Unknown-command messages. exec sets the restricted context 1 explicitly at 0x1264170; a CFG detour does not automatically lift this. After successful lookup, another Developer check exists. Its devMode_enable value at RVA 0x2FE3790 was read live as 1.

Tools: tools/tnc_runtime_read.py, tools/tnc_runtime_code.py, tools/tnc_runtime_commands.py. Complete tables: re_probes/runtime_87400/commands_live.json.

No runtime patch was applied. A targeted exposure of existing map callbacks is technically investigable; broadly claiming it was "removed" or "impossible" was incorrect. The second master Claude synchronized the runtime branch via the shared agent cache; until its feedback, Astra remains in isolated construction and read-only analysis.

3. The Second IDCL Header Hash is Solved

When loading, idResourceStorage::OpenContainer at RVA 0xACB780 checks the hash at header offset +0x08. The critical section 0xACBA62..0xACBAB7 shows:

h = farmhash64(header[0x10:0x78])
K = 0x9ddfea08eb382d69
M = (1 << 64) - 1
d = ((version ^ h) * K) & M
d ^= d >> 47
d ^= h
d = (d * K) & M
d ^= d >> 44
d = (d * K) & M
d ^= d >> 41
hash08 = (d * K) & M

version=12. First, the metadata hash at +0x20 is calculated, then +0x08, because +0x20 is part of the hashed header region. The previous metadata hash remains FarmHash64 over the entry table up to and including the final IDCL marker. Both hashes are publicly computable; no secret seed is required.

Proof with tools/tnc_container_hash.py: 27/27 Base/DLC archives, both hashes match. Changed header counters or modified metadata hashes are detected; changes to one's own +0x08 slot affect its calculation as expected. Claude's independent worker w-idclhash-a1 confirmed the same algorithm on 28 archive paths.

Concrete counter-test: bundle_casefold carries the incorrect old header hash cda7783767c0c98f; c729da551d3803c1 is required. bundle_headerfixed contains the newly calculated value and passes both checks. The old package is thus recognized as an invalid test candidate, not as proof against Custom Maps.

4. The Built Alias

Currently in use: re_probes/map_alias_v3/bundle_headerfixed.

• Resources: base/chunk_22.resources, 151,702,019 bytes.
• SHA256: 95236c3ebcaffb73a0f367bedbec71b720537677c3ab2aa3d87bd8cafd5fe2c2.
• 6,985 retail entries fully received with byte-identical payload data.
• 143 aliases added, including two genuine layer declarations from gameresources.resources. The previous alias lacked these layers.
• .mapresources fully parsed: MRL Version 1, two layers, 114 type names, 20,832 resource lines, 24 opaque bytes per line, and final map list. 140 resource references were specifically modified, sizes re-serialized.
• Text references in Entities/Kiscule account for case variants. Image names and texture keys remain intact. For a mount, the original DLC2 chunk_22.texdb is additionally required; it was intentionally not copied again into the workspace. Its source path stands in the manifest.
• Test feature: previously dark lobby light at (8.72,-192.97,1.32) with cyan-colored light, intensity 18, radius (5,5,4). Visibility untested.

tools/verify_tnc_map_alias_v3.py verifies receipt of all retail payload data, metadata/header hash, index/dependency inventory, orientation, new references, MRL roundtrips, modified lighting data, and specifically defective MRL data.

Limitations: Geometry, collision, PVS, and navigation remain the original data from Gestapo Office. The package is a correctly constructed alias candidate with its own entity changes, not a fully proven new small world. Entry data_hash, hash_0x60, and dependency hashes are still maintained; their runtime effect for alias entries remains open. Loading, movement, collision, and visible differences must be confirmed together in-game.

5. Next Coordinated Test

Claude and Astra must not simultaneously modify Save/Install/Process. A Master exclusively handles the runtime test; the other checks only in read mode. The original Save and currently installed DLC4 are backed up with a rollback before proceeding. First, mount the package and verify valid save listings, then load the new ID game/dlc/c02/c2v1_custom with unique log/runtime evidence and visible changes. A running process or menu alone does not constitute success. No further guessed console commands are required.