Porting Test Drive II from SNES to PC, Part 24: Tightening the SNES selector domains and the B1F9 handoff window

The previous checkpoint created the first DOS-driven SNES front-end contract set.

That was useful, but still soft in two places:

• the selector domains were only loosely named
• the bank-1 handoff candidate near L009568/L0095AD was structurally plausible, but still blurry around the real gameplay callback chain

This checkpoint tightened both without pretending they are solved.

The four-state selector is now more concrete

The strongest static gain came from decoding the small table at 01:8000/01:8008.

That table is the source for $1C7E/$1C80, which means it drives the row base and row count used by the shared front-end descriptor builder.

It now decodes cleanly as:

• bases: [0, 5, 11, 18]
• counts: [5, 6, 7, 8]

So $1C7C is not just “some four-state knob.”

It is a verified four-group descriptor selector.

That still does not prove the human label is “track” or “scenery,” but it does eliminate a weaker reading where $1C7C was just another UI-only toggle with no real content boundary behind it.

It selects whole descriptor groups.

The three-choice preview domain also got sharper

The $0202 -> $1C78 preview path now has more than one kind of evidence behind it.

The code already showed:

• a three-choice animated preview loop in L00BBCB
• commit of the final choice into $1C78

Now the helper tables make that path look like a real content domain instead of a single visual trick.

The three preview bundle indices resolve to distinct helper triples:

• index 9 -> L00A9A0 00:B0AB, L00A9CB 0E:8000, L00A9F2 02:FC11
• index 10 -> 00:B6B2, 0E:91FE, 02:FBF3
• index 11 -> 00:BCBA, 0E:A428, 0D:C98F

And an adjacent unlabeled front-end UI helper consumes:

• $0202 + 0x0008

through the same 1E80 text/UI buffer used elsewhere in the menu flow.

That still does not give a final name-bearing proof that this is the car selector.

But combined with the verified CUSTOMIZE CAR surface, it makes $0202/$1C78 a much stronger car-facing candidate than it was before.

One good failure also landed

I tried to push the current helper-scene builder through those preview bundle indices.

That did not work cleanly.

The L00A9CB bulk path for helper indices 9..11 currently fails with a 26FB length mismatch:

• decoded bytes: 11348
• expected bytes: 16640

That is not a wasted attempt.

It says the three-choice preview is not just another instance of the already-solved simple helper scene path.

So the correct next move is a dedicated preview extractor, not more blind reuse of the simpler builder.

The handoff window got narrower, not fully solved

The other useful result came from forced probes on the two bank-1 sibling callbacks:

• 01:9568
• 01:95AD

Both forced lanes still do exactly one real thing we care about:

• they reach 01:B1F9 once
• that happens at frame 1201

And the stack return words still separate the two siblings cleanly:

• 01:9568 returns through 0x9575
• 01:95AD returns through 0x95B7

The state split also survives:

• 01:9568 enters with state_0f77 = 1
• 01:95AD enters with state_0f77 = 0

But the same narrow trace window still does not show:

• writes to $096C-$0971
• an exec hit at 02:9016

That matters because the broader static corridor does already stage:

• main callback 02:9016
• NMI callback 02:8F3C

So the missing proof is no longer “does this branch really enter the handoff code?”

It does.

The missing proof is now specifically:

when does callback promotion happen relative to that bank-1 branch boundary?

That is a better unknown than the old one.

What changed in practice

This checkpoint did not solve the front end.

It did make the next probes much less vague:

• $1C7C is now a verified four-group descriptor selector, not just a guess
• $0202/$1C78 is now backed by explicit preview bundle triples
• the preview extractor needs its own path
• L009568/L0095AD -> L00B1F9 is real, but the immediate 02:9016 promotion is still outside the narrow forced trace window

That is enough to move the next turn away from generic menu speculation and toward two concrete jobs:

• extend the preview extractor for helper indices 9..11
• widen the forced trace around callback promotion instead of repeating the same short B1F9 window