Add new files and update project state for Spanish localization analysis

- Introduced new binary files for user data and database.
- Updated project state to include new paths for Spanish executable.
- Added detailed notes on Spanish cheat/debug differences in a new document.
- Revised mid-project plan to reflect findings from localized build comparison.

Crusader.rep/projectState

@@ -3,8 +3,8 @@
     <PROJECT_DATA_XML_NAME NAME="DISPLAY_DATA">
         <SAVE_STATE>
             <ARRAY NAME="EXPANDED_PATHS" TYPE="string">
-                <A VALUE="Crusader:regret:" />
                 <A VALUE="Crusader:" />
+                <A VALUE="Crusader:es:" />
             </ARRAY>
             <STATE NAME="SHOW_TABLE" TYPE="boolean" VALUE="false" />
         </SAVE_STATE>

Crusader.rep/user/00/0000000b.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="ac18b01ab332438409229485800" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a86451c28e202638509414500" />
+    </BASIC_INFO>
+</FILE_INFO>

Crusader.rep/user/~journal.dat

@@ -0,0 +1,2 @@
+IADD:0000000b:/udf_c0a86451c28e202638509414500
+IDSET:/udf_c0a86451c28e202638509414500:ac18b01ab332438409229485800

crusader_decompilation_notes.md

@@ -4,6 +4,8 @@ This file is an index. Detailed notes have been split into the `docs/` folder by
 
 Active live analysis target is now `CRUSADER.EXE`. Existing `CRUSADER-RAW.EXE` notes remain in scope as cross-reference evidence and should be cited alongside live NE addresses when they support a rename, variable role, or behavior claim.
 
+Recent verified localized-build batch: [docs/spanish-cheat-differences.md](docs/spanish-cheat-differences.md) now records a focused live-Ghidra comparison against `/es/CRUSADER.EXE` for the known cheat/debug control areas. Current best read is now split more tightly: the Spanish executable still preserves the same broad cheat/debug framework as the English build with relocated addresses rather than different behavior, but it does **not** preserve the English `jassica16` table as the same static data object. The `-laurie` parser still sets the broad cheat/debug gate (`1478:0910`), the gameplay-input gate still exists at `1478:0927`, the lower keyboard-cheat latch still exists at `1478:5fb3`, and Hack Mover still toggles through `13e8:24a5`; but a direct live byte scan found no exact `24 1e 1f 1f 17 2e 1e 02 07 00` table anywhere in Spanish data `1478:0000-8c3f` or `1480:0000-1fff`, and the old English-side slot at `1478:2833` now contains pointer-like words instead. The same batch also tightens the secondary-latch story: Hack Mover is pre-gated by `1478:8ad6` before the broad gate check, so the Spanish target still appears to retain an additional post-sequence-style latch even though its actual writer and matcher routine remain unresolved.
+
 Recent verified batch: [docs/retail-debug-arg.md](docs/retail-debug-arg.md) now records the live NE proof that retail `CRUSADER.EXE` still recognizes and executes a real `-debug` command-line branch. That branch prints `Debugging mode ON.`, sets `g_debugMsgLevel` at `1478:87e0`, and toggles two debug globals at `1478:0845/0859`. The later sink pass also closes the text-output target more tightly: `ProbablyPrintDebugMessage` formats through the static stdio-style table at `1478:6c32..6c81` and writes to the handle-`1` entry at `1478:6c46`, so the non-video side is ordinary DOS `stdout` gated by the debug threshold, plus the already-confirmed AVI timing overlay. Current best read remains `surviving debug-output / instrumentation switch`, not `the missing bootstrap for the hidden seg109/seg1408 usecode debugger`. The same batch also leaves the earlier `-laurie` and `0x659c/659e` debugger-state conclusions intact: `-debug` is a separate switch and is not currently evidenced as constructing the hidden usecode-debugger break-state object.
 
 Latest doc-reconciliation batch: [docs/ne-segment1.md](docs/ne-segment1.md) now has a combined hidden-debugger component table that explicitly separates the seg109/raw-reference UI wrappers (`000b:9a86`, `000b:9c0d`, `000b:b3b1`, `000b:b62c`, `000b:2882`) from the live seg1408 breakpoint-state helpers (`1408:0000`, `1408:0053`, `1408:00dd`, `1408:029e`, `1408:03b0`, `1408:03f7`, `1408:0419`, `1408:0432`, `1408:0444`) and the interpreter hook at `1418:04aa..04b5`. Current best read remains `two connected layers of one hidden usecode debugger`, not `conflicting address claims for the same function family`.
@@ -21,6 +23,7 @@ The same `docs/ne-segment1.md` note now also has the first consolidated cheat/de
 | [docs/overview.md](docs/overview.md) | Binary overview, installed copy findings, address space layout, NE fixup placeholder, segment map, NE import details, next steps |
 | [docs/phar-lap-extender.md](docs/phar-lap-extender.md) | DOS extender architecture, named functions (entry, loading, memory, I/O, interrupts), key string references |
 | [docs/ne-segment1.md](docs/ne-segment1.md) | NE Segment 1 full analysis: cursor, input, entity system, shot lifecycle, combat, weapons, AI, player/HUD, destruction, entity constants, vtable index, cheat system |
+| [docs/spanish-cheat-differences.md](docs/spanish-cheat-differences.md) | Focused comparison note for `/es/CRUSADER.EXE` versus the English build's known cheat/debug lanes: `-laurie`, broad cheat gate, gameplay-input gate, low-level keyboard latch, `Ctrl+Q`, Hack Mover, and the current status of the unresolved secret sequence |
 | [docs/raw-porting-progress.md](docs/raw-porting-progress.md) | seg091 RNG, 0x4588 callback lifecycle batches 1-6, 0007 gameplay helper batches, snap_entity_to_ground, AI sweep, animation/range/command globals, seg043 boundary recovery |
 | [docs/raw-000e.md](docs/raw-000e.md) | 000e parser helper cluster (record table init/parse/dispatch), 000e RIFF/animation cluster (animation object field map, RIFF format, constructor variants) |
 | [docs/raw-0007-rendering.md](docs/raw-0007-rendering.md) | Draw list node format and functions, world-to-screen isometric, tile visibility system, scroll/camera functions, scroll region table, save slot system, string/memory utilities, coordinate transform deep analysis |

docs/spanish-cheat-differences.md

@@ -0,0 +1,177 @@
+# Spanish `CRUSADER.EXE` Cheat / Debug Differences
+
+This note records a focused live-Ghidra pass over the Spanish executable opened from `/es/CRUSADER.EXE` and compares the known English cheat/debug control areas against the Spanish build.
+
+## Scope
+
+- Target analyzed in Ghidra MCP: `/es/CRUSADER.EXE`
+- Comparison baseline: live English `CRUSADER.EXE` findings already recorded in [docs/ne-segment1.md](docs/ne-segment1.md)
+- Goal: determine whether the Spanish executable changes the known `-laurie`, cheat-gate, F10, `Ctrl+Q`, Hack Mover, and secret-sequence lanes enough to support claims about different cheat behavior
+
+## Summary
+
+Current best read: the Spanish executable does **not** show a materially different cheat/debug framework in the known control areas.
+
+What changed is mostly address placement, not behavior:
+
+- the broad cheat/debug gate, gameplay-input gate, and low-level keyboard-cheat latch all still exist
+- the same hidden/debug event lanes are still present behind the broad gate
+- the `-laurie` parser still exists and still uses English-facing text
+- the Laurie hint string and multiple cheat/debug status strings are still English in the Spanish build
+- the `Ctrl+Q` lane is still the CD transfer display toggle, not the immortality toggle
+- the Hack Mover toggle lane is still present
+
+What is **not** yet proven from this pass is the exact secret scan-code matcher table. No replacement secret sequence was recovered in the known cheat areas, but the secret-sequence table itself was not directly pinned down in this Spanish session.
+
+## Verified Spanish Mapping
+
+### Master Cheat / Debug Gate
+
+- `1478:0910` is the Spanish build's broad cheat/debug master gate.
+- It is written by the `-laurie` parser at `1050:0985`.
+- It is read by the same large hidden/debug event handler family inside `World_HandleKeyboardInput` at `13e8:14b4`.
+
+Recovered gated case sites include:
+
+- `13e8:19da`
+- `13e8:1a0a`
+- `13e8:1a36`
+- `13e8:2211`
+- `13e8:243c`
+- `13e8:24a5`
+
+This matches the English-side model where one broad master gate enables several hidden/debug event handlers.
+
+### Gameplay Input / Option-Key Gate
+
+- `1478:0927` is the gameplay-input / option-key gate in the Spanish build.
+- It is set during `Game_Start` at `1028:0127`.
+- It is cleared in `ComputerGump_CreateGump` at `13a0:01f5`.
+- It is restored at `13a0:0233` during the paired computer-gump teardown path.
+
+This is the same structural role already established in the English build: broader gameplay-input eligibility, not a separate cheat-state bit.
+
+### Low-Level Keyboard Cheat Latch
+
+- `1478:5fb3` is the Spanish build's low-level keyboard-cheat latch.
+- It is read repeatedly from `13e8:14b4` in the same family of keyboard/debug checks.
+- Helper setters at `13e8:0071` and `13e8:0077` write `1` and `0` respectively, and are called from the Laurie-hint/computer-gump-side helper `13e8:0e31` setup path.
+
+This is the strongest live evidence that the Spanish build still preserves the same broad split between a master cheat/debug gate and a narrower keyboard-latch state.
+
+## Verified Hidden / Debug Event Lanes
+
+### CD Transfer Display (`Ctrl+Q` Family)
+
+The Spanish build still preserves the English-side `Ctrl+Q` conclusion:
+
+- `13e8:2211` is the `0x410` event lane under the broad gate at `1478:0910`
+- it toggles byte `1478:5fb7`
+- it posts the same English strings:
+  - `1478:6022` = `CD TRANSFER DISPLAY ACTIVE.`
+  - `1478:603e` = `CD TRANSFER DISPLAY INACTIVE.`
+
+That is consistent with the English analysis: this lane is still CD transfer display state, not immortality.
+
+### Hack Mover
+
+The Spanish build still preserves the Hack Mover toggle lane:
+
+- `13e8:249b` first requires `1478:8ad6 != 0`
+- `13e8:24a5` toggles byte `1478:5fb2`
+- it posts:
+  - `1478:605c` = `HACK MOVER ON`
+  - `1478:606a` = `HACK MOVER OFF`
+
+So Hack Mover remains present and still uses English-facing status strings in this localized executable.
+
+That extra `1478:8ad6` pre-check matters. In the English build, Hack Mover was already strongest as a two-latch feature: it wanted the broader Laurie/debug gate plus a second post-sequence latch. The Spanish build still shows that same two-stage shape at the branch level, even though the exact sequence writer has not yet been re-identified.
+
+### Overlay / Hidden Debug Toggles
+
+The Spanish build keeps the same broad gated overlay/debug cases:
+
+- `13e8:19da` toggles byte `1478:0f40`
+- `13e8:1a0a` toggles byte `1478:2be7`
+- `13e8:1a36` toggles byte `1478:2be8`
+
+These are the same structural hidden/debug lanes already identified in the English build.
+
+## Laurie Path
+
+The Laurie hint path is still present and still English-texted:
+
+- `13e8:0e31` is the Laurie-hint computer-gump path in the Spanish build
+- `1478:5fc6` still contains `FART  ...TRY... -laurie (Have fun, Jely)`
+
+The startup-side cheat text also remains English:
+
+- `1478:0b45` = `Cheats are active.`
+
+This is strong evidence against any broad localization-driven rewrite of the cheat/debug feature family.
+
+## F10 / Option-Key Side
+
+The Spanish executable's option-key handler moved relative to the English live notes:
+
+- the relevant function object lives at `1138:0896` in this build, not the English-side `1130:0896`
+
+But the structure is still familiar:
+
+- it checks gameplay-input state through `1478:0927`
+- it reads surrounding controller/current-NPC state from the same neighborhood used by the English build
+- the wider controller family around `1138:0896` / `1138:0b2d` / `1138:0d34` still looks like the same option-key and movement/control subsystem, just relocated
+
+This pass did **not** fully re-close the Spanish F10 immortality leaf the way the English build is already documented, but there is no recovered evidence here that the Spanish build replaced the F10 cheat/control family with a different system.
+
+## Secret Sequence Status
+
+This pass now closes part of the Spanish-side uncertainty more tightly: the live Spanish build does **not** preserve the English `jassica16` scan-code table as a static data object in the obvious old locations.
+
+Direct live byte-scan results against `/es/CRUSADER.EXE`:
+
+- the exact English table `24 1e 1f 1f 17 2e 1e 02 07 00` was **not** found anywhere in initialized data `1478:0000-8c3f`
+- the same exact table was **not** found in BSS / secondary data `1480:0000-1fff`
+- even the shorter `jassica` scan-code prefix `24 1e 1f 1f 17 2e 1e` was absent from both of those Spanish data segments
+- the old English-side matcher slot at `1478:2833` no longer contains the sequence bytes at all; it now reads as pointer-like words beginning `14 e8 11 3d 14 e8 11 02 05 28 10 ...`
+
+What can be said safely:
+
+- no alternate replacement secret sequence was recovered yet
+- the English `jassica16` static data table is not present in the live Spanish data map where the English build keeps it
+- the same surrounding cheat/debug framework remains intact
+- the same `-laurie` parser, Laurie hint path, CD-transfer-display lane, Hack Mover lane, and broad hidden/debug gated event family all survive in recognizably the same form
+- Hack Mover still has a second hidden precondition via `1478:8ad6` in addition to the broad gate at `1478:0910`, which is consistent with the Spanish build still retaining some post-sequence-style latch
+
+So the live evidence now splits cleanly into two layers:
+
+- the **framework** still matches the English cheat/debug family
+- the **exact English `jassica16` data table** does not survive as the same static table in this Spanish target
+
+Current best read:
+
+- the online claim that the Spanish build still uses the exact same static `jassica16` table is **not** supported by the live Spanish data-segment bytes
+- this pass still does not prove a replacement code
+- the remaining possibilities are narrower: the Spanish build either moved the matcher into code, rebuilds it dynamically, or uses a different hidden sequence while preserving the same surrounding cheat/debug framework
+
+## Comparison Outcome
+
+The Spanish build differs from the documented English build mainly by address relocation, not by cheat/debug behavior.
+
+Confirmed same-family behaviors:
+
+- broad `-laurie` / hidden-debug gate still present
+- gameplay-input suppression gate still present
+- separate low-level keyboard-cheat latch still present
+- `Ctrl+Q` still maps to CD transfer display, not immortality
+- Hack Mover lane still present
+- Laurie hint path still present
+- English cheat/debug strings still embedded in the Spanish executable
+
+Unclosed item:
+
+- direct proof of the Spanish secret scan-code matcher routine and the exact writer of the secondary latch at `1478:8ad6`
+
+## Recommended Follow-Up
+
+If the Spanish question is revisited, the next focused step should be a direct recovery of the Spanish secret-sequence matcher routine and the writer for `1478:8ad6`, rather than another sweep of the already-stable broad cheat/debug event lanes.

plan-mid.md

@@ -127,6 +127,7 @@ Detailed completed analysis belongs in the files under `docs/`, not in this plan
 - The same `-debug` lane is now bounded more comprehensively too. The user-confirmed moving bottom-of-video dots match the static two-scanline overlay model, so that AVI timing overlay is now the first closed visible effect. Outside the video lane, `-debug` also changes the global seg12d0 print threshold (`1478:87e0 = 10`) used by `ConsolePrintf`, `DebugPrintAndWaitForInput`, and the positioned print helpers, but the sink side is now tighter as well: `ProbablyPrintDebugMessage` formats through the static stdio-style table at `1478:6c32..6c81` and writes to the handle-`1` entry at `1478:6c46`, so the non-video side is ordinary DOS `stdout` gated by the threshold, not a separate hidden debugger console. Current xrefs still show that lane mostly as existing startup/config/cache/joystick/process diagnostics and a small set of dispatch/gump allocation failure-stop paths, not as a second confirmed hidden feature. The unresolved leftover is still `1478:0845`, which remains a parser-set latch with no recovered downstream consumer.
 - The print inventory behind that same `-debug` lane is now materially tighter too. A focused pass recovered concrete `ConsolePrintf` / `DebugPrintAndWaitForInput` strings instead of only caller families: startup/arg strings such as `Debugging mode ON.`, `You DO need help!`, `Enabling ENHANCED mode. (NOT!)`, `Warping to mission %d ...`, `Defaulting to skill level %d`, and `Demo mode.`; init/config strings such as `Using map patch file.`, `Running with partial installation.`, `Running with full installation.`, and `Redirecting mission %d tune to '%s'`; cache/swap progress scaffolding such as `Creating Swap file [` and repeated `.` / bracket fragments; plus stronger failure/debug-stop fingerprints like `COULD NOT CREATE GLOB ITEM!`, `No room for Dispatcher Record/Playback.`, `End of script! (press any key)`, and `Out of Memory! [%u]`. Recovered call levels so far are `0x32` and `0xff`, both above the `-debug` threshold of `10`, which reinforces that the practical scarcity of visible text is about path frequency and graphics-mode presentation, not about the threshold still filtering these known messages out.
 - The older folklore claim about flat offset `E69FB` and a possible secondary monochrome monitor is now materially weaker too. Local NE-segment mapping puts `0xE69FB` at live address `1478:2dfb`, which falls inside the `SYSTIMER.C` string in a data/name table (`KeyboardProcess`, `KEYIO.C`, `PRIORITY.C`, `SystemTimer`, `SYSTIMER.C`, `AccWait`), not inside executable instructions. The current retail print lane still points to ordinary `stdout` at `1478:6c46`, and targeted searches found no direct `mono`/`monochrome`/`hercules`/`MDA` strings or obvious monochrome-adapter port/memory references (`0x3b4/0x3b5/0x3b8/0x3ba`, `B000`). Current best read is therefore `folklore or address-mapping mistake`, not evidence for a hidden retail secondary-monitor debug display.
+- A focused localized-build comparison is now tighter too. The live `/es/CRUSADER.EXE` pass still shows the same broad cheat/debug framework with shifted addresses rather than a rewritten system: `-laurie` sets the broad master gate at `1478:0910`, the gameplay-input gate still exists at `1478:0927`, the lower keyboard-cheat latch still exists at `1478:5fb3`, event `0x410` at `13e8:2211` still toggles the CD transfer display, and `13e8:24a5` still toggles Hack Mover with English-facing strings. But the sequence side is narrower and more specific now: a direct live byte scan found no exact `jassica16` table `24 1e 1f 1f 17 2e 1e 02 07 00` anywhere in Spanish data `1478:0000-8c3f` or `1480:0000-1fff`, and the old English-side slot at `1478:2833` now holds pointer-like words instead of the matcher bytes. The same pass also surfaced a likely Spanish post-sequence latch analog: Hack Mover is pre-gated by `1478:8ad6` before the broad gate check. So the remaining open question is no longer "does Spanish have the same cheat/debug family"; it is "where did the Spanish secret matcher move, and what writes `1478:8ad6`?" Detailed notes now live in `docs/spanish-cheat-differences.md`.
 
 ### Recently Closed Or No Longer Live