[JS-banana]

What and why

Tied Together stops in patch_nso.py at a masked dispatch whose base is initialized later in address order and reused by other loops. Its equality guard excludes the highest masked value, so the table has seven entries, not eight.

Add a final fallback that proves candidate table bases together over the function's control flow. It rejects unknown incoming values, bypassed guards and return-address writes. Earlier recognizers are unchanged. The rewriter entry records the bounds and rejection rules.

The follow-up review found that an entry from another function could bypass this proof and leave a valid target out of the rewrite. Incoming direct branches now supply unknown states, including branches from code without x18 sites. Functions accepted by this fallback are checked again after all jump tables have been collected, so later-discovered table edges cannot bypass the proof either. Entry at a complete initializer remains valid. The direct-branch index is built once, lazily; embedded words resembling branches can conservatively refuse this fallback.

Validation

Rechecked on upstream main 38521863 (2026-11-13), including its stack-frame alignment change.

• 151 targeted tests pass: test_jump_copies, test_nso, test_nso_match, test_rewrite_parallel, test_sp_frame and test_docs.
• The synthetic NRO emits exactly seven targets. Additional full-rewriter cases reject external entries at the load, mask or partial initializer, including an offset table recognized later, while complete initialization paths still pass. The unsafe-entry cases were accepted before this follow-up fix.
• Python lint reports zero new findings. The symptom index is current and git diff --check passes.
• regress.py impact upstream/main..HEAD: Hades, Breath of the Wild, Pokémon Scarlet and Tears of the Kingdom match the broad rewriter rule; 161 profiles have no usage manifest. This is static reach analysis, not a game regression result.
• Game routes and Metal GPU regression remain untested on this revision. No game was launched. Latest-head CI is pending; previous-head CI results do not validate this revision.

Earlier local repair: Tied Together (0100B6D00C2DE000) 1.0.2 built and reached its menu; two-player gameplay was reported working on November 8. This rebased revision has not been played.

Docs

• General finding in docs/reference/rewriter.md; symptom index regenerated.
• Synthetic fixtures only. No game files, keys or extracted game data in the change or attachments.