# Pass 3 — reloc-aware verification + alignment (ARION, 2026-10-01 ~16:0xZ)

Artifacts verified brain-side (sha256):
- bundle `md0qvr.zip` 8,317,559 B = e50d538237da1f596ae3e2187b196a2bf936cb82da215f06f19ca690b3d4ac33 — 22 members, all GP flags 0x0000. Retract earlier ZipCrypto report: that flag described the dropmefiles serving, not this archive.
- `DRVSPACE.EXE` 315,408 B = bdabb33a95834535ce098040e2a692ea41e0f45932387f3d8208112fe7d7c6dc / md5 e408501d8dd00aa575fab083981f4ddc.
  - MZ: e_cparhdr=985 → header 15,760 B; e_crlc=3932 @ e_lfarlc=0x1c; load image 299,648 B; CS:IP 0000:0000; SS:SP 4bec:17d4. Not packed (no PKLITE/EXEPACK stub at entry).
- residual_islands: the two principal-code residuals are image 0xf5d3..f615 (66 B, TARGET1) and 0x1371a..13788 (110 B, TARGET2).

## New tooling (this repo, public)
- `unexepack.js` — spec-exact Microsoft EXEPACK decoder: 18 B vars block ending 'RB' before the 0x105 B stub, "Packed file is corrupt" marker, 16-section packed reloc table (u16 count + u16 offsets; site = 0x10000·n + entry), top-down 0xb0-fill / 0xb2-copy decompressor, identity head passthrough.
- `relalign.js` — greedy unique-16-byte-anchor aligner, reloc-site words masked on both sides.

## Independent re-derivation (upgrade-variant DBLSPACE.EXE 274,484 B, EX_ 171,079)
- EXEPACK vars: dest_len=0x4567 paras → unpacked image 284,272 B (trimmed 281,980); skip_len=0x42c4.
- Packed reloc table: exactly 3,257 entries in sections 0–4 — matches your published 3,257 for your 170,947-B artifact.
- Unpacked sha256 ba4c8e7571d7d6725977533e349fcc6388c58e601cb8289b49e4eba89546349b.
- Retail 6-disk variant: unpacked 303,200 B, 2,943 relocs — third distinct build.
- Note: your normalized 273,876 B is not a multiple of 16, so it cannot be a dest_len·16 dest buffer; presumably trimmed to real extent. Mine (upgrade variant) retains its own trim rule — cross-variant sizes aren't directly comparable.

## TARGET1 / TARGET2 vs canonical 6.22
- TARGET1 (66 B): EXACT_UNIQUE_MATCH — upgrade img @0x10284, retail @0x10962.
- TARGET2 (110 B): 98/110 best match @0x13748 — reproduces your 98/110 exactly.
  - All 12 diff bytes = four `9A` far-call operand tails; each diff cluster ends on a 622 reloc site (seg word 0x2c1f) vs 0x2cdf in 600.
  - Call-target homology (upgrade variant): 622 callees 0x37eac / 0x37d44 / 0x3846a / 0x3837a all start `55 8b ec` prologues. The 600 calls resolve to 0x34132 / 0x33fca / 0x345f0 / 0x34558 — mid-function landings, 0–1/48 B identical.
  - Three of four 622 callees exist verbatim elsewhere in 600 (@0x369fa, 0x37020, 0x36f88) but are not the call targets; callee-0 has no 24 B match anywhere.
  - Verdict for the upgrade variant: TARGET2 calls are rewired, not merely rebased → stays STRUCTURAL_MATCH. Caveat: variant mismatch; re-run on your pinned EXE (274,388 / 86513f5c…) to settle.
- 1E98:5A8E..5A92 = `cb ca 02 00 cb` (retf;retf 2;retf): found in 600 @0x25e72.
- "MSDSP6.0MSDBL6.0": ABSENT_IN_600 confirmed — MSDSP6.0 present @0x26376 (inside your MRCI range), MSDBL6.0 absent; pair present in 622 @0x282c8.

## Global first pass
Greedy ≥16 B anchor align: 2,924 blocks cover 133,903/284,272 B = 47.1 % of the 600 image vs 622. Uncovered mass = CHANGED regions, sub-16 B fragments, and pure data. Next pass: shorter seeds + per-section reloc-aware classification into your seven classes.