Pseudocode decompialtion improvements and docs

docs/spanish-cheat-differences.md

@@ -57,7 +57,9 @@ This is the same structural role already established in the English build: broad
 - It is read repeatedly from `13e8:14b4` in the same family of keyboard/debug checks.
 - Helper setters at `13e8:0071` and `13e8:0077` write `1` and `0` respectively, and are called from the Laurie-hint/computer-gump-side helper `13e8:0e31` setup path.
 
-This is the strongest live evidence that the Spanish build still preserves the same broad split between a master cheat/debug gate and a narrower keyboard-latch state.
+This no longer supports the older English-side `-laurie` plus `~` model by itself. The current Spanish pass found repeated **reads** of `1478:5fb3`, but still no recovered runtime writer inside the normal keyboard handler family. The only recovered writes remain the tiny `13e8:0071/0077` helpers, and `13e8:0e31` calls them back-to-back inside the Laurie hint path.
+
+Current safest read is therefore narrower: `1478:5fb3` is still a real gate byte in the Spanish keyboard/debug family, but the live Spanish session does **not** currently show the English-style runtime `~` toggle path that would make `-laurie` plus tilde a proven bootstrap for the broader keyboard-cheat state.
 
 ## Verified Hidden / Debug Event Lanes
 
@@ -83,6 +85,21 @@ The Spanish build still preserves the Hack Mover toggle lane:
   - `1478:605c` = `HACK MOVER ON`
   - `1478:606a` = `HACK MOVER OFF`
 
+The compiled runtime chain is now tighter too:
+
+- `1478:5fb2` is the actual Hack Mover on/off toggle, not the unresolved unlock byte
+- `13e8:0ef9` and `13e8:0f77` both clear `1478:5fb2`, so normal modal/setup helpers can forcibly shut the feature back off
+- `13e8:282f` is the adjacent runtime helper that watches `1478:5fb2`, uses temp/state byte `1478:8ad9`, and can transition into the active move setup at `13e8:2f0e`
+- `13e8:2f0e` captures cursor-to-object offsets into `1478:8acc` / `1478:8ace` and sets `1478:8ac0 = 1`
+- `13e8:3009` is the paired cleanup path that clears `1478:8ac0`
+
+So the live compiled split is now:
+
+- `1478:8ad6` = unresolved precondition / unlock gate
+- `1478:0910` = broad `-laurie` gate
+- `1478:5fb2` = Hack Mover active toggle
+- `1478:8ac0`, `1478:8acc`, `1478:8ace`, `1478:8ad9` = downstream runtime state after Hack Mover is already on
+
 So Hack Mover remains present and still uses English-facing status strings in this localized executable.
 
 That extra `1478:8ad6` pre-check matters. In the English build, Hack Mover was already strongest as a two-latch feature: it wanted the broader Laurie/debug gate plus a second post-sequence latch. The Spanish build still shows that same two-stage shape at the branch level, even though the exact sequence writer has not yet been re-identified.
@@ -110,6 +127,13 @@ The startup-side cheat text also remains English:
 
 This is strong evidence against any broad localization-driven rewrite of the cheat/debug feature family.
 
+The command-line side is also tighter now:
+
+- `CommandLineArg_HandleLaurie` at `1050:093d` is the only recovered live writer of `1478:0910`
+- no second non-`-laurie` writer of the broad gate was recovered in this Spanish pass
+
+So `-laurie` still clearly enables the broad Spanish debug/event framework, but current live evidence does **not** show a second hidden input path that also raises that gate the way the English `jassica16` matcher does.
+
 ## F10 / Option-Key Side
 
 The Spanish executable's option-key handler moved relative to the English live notes:
@@ -124,6 +148,18 @@ But the structure is still familiar:
 
 This pass did **not** fully re-close the Spanish F10 immortality leaf the way the English build is already documented, but there is no recovered evidence here that the Spanish build replaced the F10 cheat/control family with a different system.
 
+Follow-up tightening on that question now makes the old English comparison weaker rather than stronger:
+
+- the old English immortality-string slots at `1478:2850` / `1478:2866` are **not strings** in `/es/CRUSADER.EXE`; live bytes there are now pointer-like words, not `"Immortality disabled."` / `"Immortality enabled."`
+- MCP data-use queries on those two Spanish addresses returned no code uses at all
+- no explicit scan-code `0x44` F10 comparison was recovered in the currently identified Spanish gameplay-input handlers during this pass
+
+Current safest Spanish-side answer is therefore narrower than the English build:
+
+- the Spanish executable still preserves the broad Laurie/debug family
+- but this pass still did **not** recover a direct Spanish equivalent of the English `F10` restore/refill branch or the modifier-gated immortality leaf
+- so the old English `F10` health-replenish folklore should currently be treated as **unproven in `/es/CRUSADER.EXE`**, not as a still-confirmed surviving cheat path
+
 ## Secret Sequence Status
 
 This pass now closes part of the Spanish-side uncertainty more tightly: the live Spanish build does **not** preserve the English `jassica16` scan-code table as a static data object in the obvious old locations.
@@ -143,6 +179,17 @@ What can be said safely:
 - the same `-laurie` parser, Laurie hint path, CD-transfer-display lane, Hack Mover lane, and broad hidden/debug gated event family all survive in recognizably the same form
 - Hack Mover still has a second hidden precondition via `1478:8ad6` in addition to the broad gate at `1478:0910`, which is consistent with the Spanish build still retaining some post-sequence-style latch
 
+Additional live xref evidence from the current Spanish-only pass narrows that further:
+
+- `1478:0910` currently has only one recovered write in the live Spanish database: the `-laurie` parser at `1050:0985`. All other recovered uses are reads in the normal cheat/debug handler family.
+- `1478:5fb3` currently has only two recovered writes: `13e8:0071` and `13e8:0077`, and both helpers are only called from the Laurie-hint/computer-gump helper `13e8:0e31`.
+- `1478:8ad6` currently has only one recovered direct use: the Hack Mover pre-check at `13e8:249b`. No direct writer was recovered through MCP xrefs, data-use scans, or operand scans in this session.
+- the nearby state cluster does not currently explain that byte either: `1478:8ad7` and `1478:8ad8` are written by the gameplay-input modal helpers `13e8:0e7d` / `13e8:0ef9`, and `1478:8ad9` is the live temp/state slot used by the Hack-Mover-adjacent runtime helper `13e8:282f`; but none of those neighboring compiled writes touch `1478:8ad6`
+- One explicit multi-key helper still exists in the Spanish build, `11d0:024b`, but decompilation shows it is only a vararg `is current key in this list?` helper. Its only recovered caller in this session is the movement/control cluster at `1138:1b13`, not a cheat-toggle lane.
+- Full decompilation of `World_HandleKeyboardInput` (`13e8:14b4`) did **not** recover any translated `~` / `0x7e` runtime toggle branch. The visible cheat/debug lanes still cover the broad `1478:0910`-gated overlay/CD/Hack-Mover family, but no Spanish equivalent of the English `event_0x7e_cheat_latch_runtime_toggle` was recovered.
+
+That matters because it removes one easy false positive: the Spanish build still has generic key-list helpers, but the current live evidence does **not** tie any of them to a replacement `jassica16`-style cheat matcher.
+
 So the live evidence now splits cleanly into two layers:
 
 - the **framework** still matches the English cheat/debug family
@@ -152,7 +199,11 @@ Current best read:
 
 - the online claim that the Spanish build still uses the exact same static `jassica16` table is **not** supported by the live Spanish data-segment bytes
 - this pass still does not prove a replacement code
-- the remaining possibilities are narrower: the Spanish build either moved the matcher into code, rebuilds it dynamically, or uses a different hidden sequence while preserving the same surrounding cheat/debug framework
+- but the live xref picture is now narrower than before: no recovered Spanish writer currently toggles the broad gate `1478:0910`, the keyboard-cheat latch `1478:5fb3`, or the Hack Mover pre-latch `1478:8ad6` in a way that looks like a hidden input-sequence success path
+- current best working hypothesis is therefore no longer "same framework, unknown moved matcher" by default; it is now `same surrounding cheat/debug framework, but no recovered compiled Spanish replacement for the English jassica16 byte matcher`
+- the same correction now applies to the practical `-laurie` plus tilde folklore too: current live Spanish evidence does **not** support a surviving translated `~` cheat-latch toggle, so the old English-side `-laurie` plus `~` bootstrap should currently be treated as **unproven and likely absent** in `/es/CRUSADER.EXE`
+- the same caution now applies to the English `F10` replenish / immortality folklore too: the broad gameplay-input controller family is still present, but the old English immortality-string slots are repurposed in Spanish and no direct Spanish F10 cheat branch has been recovered in this pass
+- the remaining possibilities are now: the Spanish build removed the hidden sequence entirely, moved it into an analysis-dark path MCP has not surfaced yet, or preserves only a dead/unused remnant such as the unresolved `1478:8ad6` gate
 
 ## Comparison Outcome
 
@@ -162,16 +213,77 @@ Confirmed same-family behaviors:
 
 - broad `-laurie` / hidden-debug gate still present
 - gameplay-input suppression gate still present
-- separate low-level keyboard-cheat latch still present
+- separate `1478:5fb3` gate byte still present and widely read in the keyboard handler family
 - `Ctrl+Q` still maps to CD transfer display, not immortality
 - Hack Mover lane still present
 - Laurie hint path still present
 - English cheat/debug strings still embedded in the Spanish executable
 
+Current practical read for cheat use:
+
+- `-laurie` still appears to enable the broad debug/event family in the Spanish executable
+- current live Spanish evidence does **not** show the English-side `~` runtime latch toggle
+- so the usual English `-laurie` plus `~` route to the broader keyboard-cheat state is not currently supported by the Spanish static analysis
+- current live Spanish evidence also does **not** yet prove that the English `F10` restore/refill or modifier-gated immortality path still survives in compiled form
+
+## Definitive Enable Model
+
+Current strongest Spanish-side answer to "how are the cheats enabled" is now much simpler than the older folklore:
+
+- the **only recovered positive enabler** is still `-laurie`
+- `CommandLineArg_HandleLaurie` at `1050:093d` writes `1478:0910 = 1`
+- every broad hidden/debug branch recovered in `World_HandleKeyboardInput` that still behaves like the English Laurie/debug family checks that same `1478:0910` gate
+
+The supposed runtime latch at `1478:5fb3` no longer looks like an enabler in the Spanish build:
+
+- all recovered keyboard-handler branches that consult `1478:5fb3` require it to be **zero**, not one
+- the only recovered writes are still `13e8:0071` (`set 1`) and `13e8:0077` (`set 0`)
+- `Game_ShowLaurieHintComputerGump` calls those two helpers back-to-back, so the Laurie-hint path pulses the byte and leaves it cleared
+
+Current safest read is therefore:
+
+- `1478:0910` is the only proven positive Spanish cheat/debug enable gate
+- `1478:5fb3` is not a recovered "cheats on" latch in this build; it behaves more like a transient suppression/guard byte, and possibly a vestigial leftover from the English-side keyboard-latch design
+- `1478:8ad6` is the only still-plausible unresolved secondary latch, because Hack Mover checks it directly before checking `1478:0910`
+
+That gives a more definitive practical answer than the earlier passes: the compiled Spanish build still contains cheat/debug hotkeys, but the only proven way to enable the broad gated family is `-laurie`. No second runtime input path that raises the gate or a full keyboard-cheat latch has been recovered.
+
+## Keyboard Hotkey Split
+
+The main Spanish keyboard handler still contains a sizeable hotkey table, but it now splits into two different groups.
+
+### Proven `-laurie`-Gated Debug Lanes
+
+These branches all require `1478:0910 != 0`, so they are the clearest surviving Spanish cheat/debug hotkeys:
+
+- `0x410`: still toggles CD transfer display (`1478:5fb7`) and posts `CD TRANSFER DISPLAY ACTIVE/INACTIVE`
+- `0x141`, `0x241`, `0x441`: still toggle the same hidden overlay/debug bytes as the English build
+- `H` / `h`: still toggles Hack Mover, but only if `1478:8ad6 != 0` as well as `1478:0910 != 0`
+- `F`: still toggles byte `1478:2d14` after `NPC_SetAvatarInStasis(0)`
+- `T`: still has a direct `1478:0910` gate and acts on the current controlled NPC through `10a8:2667`
+
+### Player-Only Selection / Debug Utilities
+
+These branches do **not** prove a separate cheat-enable path. They mostly require the local `local_3` player/controlled-NPC condition and also require `1478:5fb3 == 0`, which is exactly the state left behind by the Laurie-hint helper pulse:
+
+- `R` / `r`: toggles the targeting reticle byte `1478:28a5` and posts the Spanish active/inactive strings
+- `Q` / `q`: cycles one `1..5` selector family backward through `13e8:0c07`
+- `W` / `w`: cycles that same `1..5` selector family forward through `13e8:0c72`
+- `I` / `i`: cycles one `0x0b..0x19` selector family backward through `13e8:0d5f`
+- `O` / `o`: cycles that same `0x0b..0x19` selector family forward through `13e8:0dc0`
+- `C` / `c` and `S` / `s`: enter the `13e8:3094` browsing/selection helper with mode `1` or `0`, which also sets `1478:5faf` while active
+- `E` / `e`, `M`, and `U` / `u`: object/selection-manipulation helpers that also require the local player-controlled condition and `1478:5fb3 == 0`
+
+So the keyboard evidence no longer supports a Spanish equivalent of the English layered model `master gate + tilde keyboard latch`. It supports a narrower model instead:
+
+- `-laurie` enables the broad Spanish debug/event hotkeys through `1478:0910`
+- several additional letter-key utilities still exist in the same handler, but they do not currently prove any second cheat-enable latch
+- Hack Mover is the one conspicuous remaining exception because it still demands the unrecovered `1478:8ad6` latch as well
+
 Unclosed item:
 
-- direct proof of the Spanish secret scan-code matcher routine and the exact writer of the secondary latch at `1478:8ad6`
+- direct proof of any live Spanish secret scan-code matcher routine at all, direct proof of a surviving Spanish `F10` cheat lane if one still exists, plus the exact writer of the secondary latch at `1478:8ad6`
 
 ## Recommended Follow-Up
 
-If the Spanish question is revisited, the next focused step should be a direct recovery of the Spanish secret-sequence matcher routine and the writer for `1478:8ad6`, rather than another sweep of the already-stable broad cheat/debug event lanes.
+If the Spanish question is revisited, the next focused step should be a direct recovery of the writer for `1478:8ad6` and any non-`-laurie` writer of `1478:0910`, rather than another sweep of the already-stable broad cheat/debug event lanes. At the moment, those two missing writers are the strongest remaining path to proving whether the Spanish executable still has any hidden cheat-trigger sequence at all.