Correct ADV History layout addressing

docs/engine-re.md

@@ -1366,6 +1366,20 @@ page. This is frame-scoped callback state, not a HISTORY name/offset special cas
 existing HIDEWIN scheduler family. A real regression activates x=684 in SC0000, runs unmodified HISTORY,
 selects/closes region 8, observes retained text, and returns to the same single page wait.
 
+Manual comparison exposed a separate typed-address bug in the first display build. `HISTORY.BIN` copies its
+button x/y tables into local integer cells `0x4` and `0x68`, then op `0x61` takes local pointers to selected
+elements for `draw-texture`. A local base operand names that local cell; it is not a local value containing a
+global address. The VM now retains the local/global domain in pointer values, so reads and writes through a
+local pointer reach the correct bank. This restores the six controls at x=768/y=121..411, the close control
+at x=768/y=549, and the hovered-row highlight while preserving RECOVER's global-array pointer behavior.
+The Python A0 oracle uses the same typed-address model.
+
+The History text batches already carry the native x origin 65 and cursor x 45. Their Godot labels were
+created with a full-rect anchor preset before being parented, which discarded the intended absolute
+placement in the live UI and caused a Godot parent/layout diagnostic. Dynamically composited ADV labels now
+use the default top-left anchors and their explicit position/size, yielding the native text x=110 and
+avoiding that diagnostic.
+
 History's remaining work is stored voice replay through `0x1bd` and the `0xd3/0xd4/0xd5` smooth-scroll
 callback scheduler. None changes backlog ownership or requires choosing a save/profile backend.
 

docs/opcode-reference.md

@@ -149,6 +149,13 @@
 
 ## compute
 
+### 0x61 `lookup-array` (lookup-array, argc 3)
+- **summary:** Take a typed reference to base[index], preserving whether the base belongs to local or global storage.
+- **grounding:** source=investigation, confidence=high
+- **evidence:** HISTORY.BIN copies x/y tables into local-int cells 0x4 and 0x68, then lookup-array local-ptr <- local-int base supplies every right-side button and hovered-row draw coordinate. Treating the local operand's current value as a global base collapses those draws to (0,0); retaining the local address yields the native x=768/y=121..549 positions. RECOVER.BIN independently exercises the same pointer destination with global bases.
+
+Operand 2 names the base cell itself: a global-bank operand produces a global reference and a local-bank operand produces a local reference. Operand 3 is added as the element offset. Pointer destinations retain that address domain; reading or writing the pointer dereferences the corresponding bank. Non-pointer destinations receive the addressed value. The same domain-preserving address model applies to lookup-array-2d (0x12c).
+
 ### 0x64 `copy-inline-int-array` (copy-inline-int-array, argc 2)
 - **summary:** (destination)(inline_blob_offset) - decode the count-prefixed integer literal blob at codebase + offset*4 and copy its values to consecutive VM integer cells beginning at destination.
 - **grounding:** source=investigation, confidence=high
@@ -760,10 +767,6 @@ op 0x90 (u0041BEB0, argc 7): `0x90 x y w h tgt_a tgt_b tgt_c`. Kelebek left it "
 - **summary:** —
 - **grounding:** source=kelebek, confidence=low
 
-### 0x61 `lookup-array` (lookup-array, argc 3)
-- **summary:** —
-- **grounding:** source=kelebek, confidence=med
-
 ### 0x63 `u00414A60` (u00414A60, argc 2)
 - **summary:** —
 - **grounding:** source=kelebek, confidence=low

docs/phase-a-slice-plan.md

@@ -1775,3 +1775,20 @@ effectful gaps total 13 instructions.
 
 **Next:** implement stored History voice replay (`0x1bd`) against the existing voice host path. Then take
 `0xd3/0xd4/0xd5` smooth-scroll interpolation as a separate scheduler/fidelity slice.
+
+### ADV History manual layout corrections (2026-07-19)
+
+Manual original/port comparison found that History's fixed rail was correct, but the lookup-driven buttons
+were clustered at the top-left, the hovered-row artwork disagreed with its hit region, and rendered text
+lost its x origin. The common VM cause was op `0x61`: `HISTORY.BIN` uses local-int operands as the bases of
+its copied coordinate arrays, while the port treated the values in those cells as global addresses. Local
+pointers now retain their local/global address domain, with matching dereference and write-through behavior
+in both the C# VM and Python oracle. A real-script regression fixes the seven button coordinates at
+x=768/y=121..549 and confirms every visible row retains layout origin x=65.
+
+Godot's dynamically created History/surface labels also no longer request full-rect anchors before they have
+a parent. They use top-left absolute placement, matching the batch's origin+cursor coordinates and removing
+the associated parent/layout diagnostic.
+
+**Next:** manually recheck History layout and hover against the original screenshot. If it matches, proceed
+with stored History voice replay (`0x1bd`), followed by `0xd3/0xd4/0xd5` smooth-scroll fidelity.