diff --git a/crates/rustynes-core/src/nes.rs b/crates/rustynes-core/src/nes.rs
index e57c36ab..2483e4a8 100644
--- a/crates/rustynes-core/src/nes.rs
+++ b/crates/rustynes-core/src/nes.rs
@@ -645,6 +645,21 @@ impl Nes {
         self.rewind_capture_enabled = enabled;
     }
 
+    /// Whether the per-frame rewind capture is currently armed.
+    ///
+    /// Added in v2.3.6 so a caller that needs to suppress capture temporarily can
+    /// save and restore the *caller's* setting rather than assume the default.
+    /// `rustynes-probe` does exactly that around a trial: its replayed frames
+    /// never happened on the user's timeline, so they must not enter the ring —
+    /// but nor may re-enabling capture afterwards turn it on for someone who had
+    /// deliberately turned it off. Run-ahead predates this and still restores an
+    /// unconditional `true`, which is correct only because nothing else disables
+    /// capture today.
+    #[must_use]
+    pub const fn rewind_capture_enabled(&self) -> bool {
+        self.rewind_capture_enabled
+    }
+
     /// Step exactly one CPU instruction. For debuggers / step-through tools.
     pub fn step_instruction(&mut self) -> u8 {
         #[cfg(feature = "cpu-boot-trace")]
diff --git a/crates/rustynes-frontend/src/app.rs b/crates/rustynes-frontend/src/app.rs
index 257b4e3f..d4ae3617 100644
--- a/crates/rustynes-frontend/src/app.rs
+++ b/crates/rustynes-frontend/src/app.rs
@@ -1393,10 +1393,11 @@ impl App {
         // v1.6.0 "Studio" A2 — a TAStudio session anchors on the closed ROM; end it.
         if let Some(d) = self.debugger.as_mut() {
             d.clear_tas_editor();
-            // v2.3.6 — a Latency Oracle report is bound to the ROM it was
-            // measured on. Left standing it describes a cartridge that is no
-            // longer loaded, with its Apply button still live. (PR #385 review.)
-            d.clear_latency_report();
+            // v2.3.6 — analysis results are bound to the ROM they were derived
+            // from. Left standing they describe a cartridge that is no longer
+            // loaded: a Latency Oracle report with its Apply button still live
+            // (PR #385 review), or a 2,048-entry RAM Atlas that looks like a map.
+            d.clear_rom_bound_analysis();
         }
         // Stop the dedicated emulation thread from producing frames.
         #[cfg(all(not(target_arch = "wasm32"), feature = "emu-thread"))]
@@ -1704,10 +1705,11 @@ impl App {
         // replay inputs/branches against a different `Nes`.
         if let Some(d) = self.debugger.as_mut() {
             d.clear_tas_editor();
-            // v2.3.6 — a Latency Oracle report is bound to the ROM it was
-            // measured on. Left standing it describes a cartridge that is no
-            // longer loaded, with its Apply button still live. (PR #385 review.)
-            d.clear_latency_report();
+            // v2.3.6 — analysis results are bound to the ROM they were derived
+            // from. Left standing they describe a cartridge that is no longer
+            // loaded: a Latency Oracle report with its Apply button still live
+            // (PR #385 review), or a 2,048-entry RAM Atlas that looks like a map.
+            d.clear_rom_bound_analysis();
         }
         // v2.8.0 Phase 5 increment 3 — a reload keeps the pacing regime but
         // may change the region (NTSC<->PAL frame duration); refresh the
@@ -7450,9 +7452,27 @@ impl App {
             let netplay_locked = self.netplay_is_active() || self.ra_hardcore_blocks();
             let mut guard = self.emu.lock();
             let movie_locked = guard.movie.is_playing() || guard.movie.is_recording();
-            guard.writes_locked = netplay_locked || movie_locked;
+            let locked = netplay_locked || movie_locked;
+            guard.writes_locked = locked;
             guard.raw_cheats = raw_cheats;
             guard.debug_pokes.extend(debug_pokes);
+            drop(guard);
+            self.publish_debugger_write_gate(locked);
+        }
+    }
+
+    /// v2.3.6 — mirror the combined write gate onto the debugger overlay.
+    ///
+    /// The RAM Atlas needs the same predicate `emu.write` uses: it advances the
+    /// live `Nes` and pokes work RAM, so under netplay or a TAS record/replay it
+    /// would diverge a timeline other peers are lockstepped to, and under
+    /// RA-hardcore it is precisely the write the mode exists to forbid. Passed the
+    /// already-computed value rather than re-deriving it, so the two consumers
+    /// cannot drift apart. (PR #392 review.)
+    #[cfg(not(target_arch = "wasm32"))]
+    const fn publish_debugger_write_gate(&mut self, locked: bool) {
+        if let Some(d) = self.debugger.as_mut() {
+            d.set_writes_locked(locked);
         }
     }
 
@@ -8279,9 +8299,18 @@ impl App {
                     // replay/record; wasm has no native netplay/RA-hardcore).
                     let debug_pokes = debugger.take_debug_pokes();
                     let mut guard = self.emu.lock();
-                    guard.writes_locked = guard.movie.is_playing() || guard.movie.is_recording();
+                    let locked = guard.movie.is_playing() || guard.movie.is_recording();
+                    guard.writes_locked = locked;
                     guard.raw_cheats = raw_cheats;
                     guard.debug_pokes.extend(debug_pokes);
+                    // v2.3.6 — the RAM Atlas needs the same gate: it advances the
+                    // live `Nes` and pokes work RAM, which would diverge a TAS
+                    // timeline being recorded or replayed. Mirrored here as well as
+                    // on the native path, because `post_produce_housekeeping` — the
+                    // native republish site — is `cfg(not(wasm32))`, so relying on
+                    // it alone would leave the wasm build ungated while every
+                    // native gate looked correct. (PR #392 review.)
+                    debugger.set_writes_locked(locked);
                 }
             }
         }
@@ -8587,10 +8616,11 @@ impl App {
         // session (it anchored on the previous `Nes`).
         if let Some(d) = self.debugger.as_mut() {
             d.clear_tas_editor();
-            // v2.3.6 — a Latency Oracle report is bound to the ROM it was
-            // measured on. Left standing it describes a cartridge that is no
-            // longer loaded, with its Apply button still live. (PR #385 review.)
-            d.clear_latency_report();
+            // v2.3.6 — analysis results are bound to the ROM they were derived
+            // from. Left standing they describe a cartridge that is no longer
+            // loaded: a Latency Oracle report with its Apply button still live
+            // (PR #385 review), or a 2,048-entry RAM Atlas that looks like a map.
+            d.clear_rom_bound_analysis();
         }
         // v2.8.0 Phase 5 increment 3 — let the (idle) emulation thread start
         // producing now that the core holds a ROM. Set AFTER `nes` is in
diff --git a/crates/rustynes-frontend/src/debugger/atlas_panel.rs b/crates/rustynes-frontend/src/debugger/atlas_panel.rs
new file mode 100644
index 00000000..de7e3031
--- /dev/null
+++ b/crates/rustynes-frontend/src/debugger/atlas_panel.rs
@@ -0,0 +1,820 @@
+//! RAM Atlas panel (v2.3.6) — **what is each byte of work RAM for?**
+//!
+//! The UI over [`rustynes_probe::atlas`]. The classifier is headless and tested
+//! independently; this file is presentation plus the two budgeted actions that
+//! drive the emulator, and deliberately contains no classification logic of its
+//! own — a threshold decided here would be a threshold no test could reach.
+//!
+//! # Why this is not the memory-compare panel
+//!
+//! Tools → Analysis already offers RAM Search and RAM Watch, and Debug → Memory
+//! offers per-address access counts. Those narrow a set the user already has a
+//! hypothesis about, or say an address was touched. Neither says what it is. This
+//! panel classifies every address, then lets the user *verify* a candidate by
+//! perturbing it — the step that separates cause from coincidence, and the step
+//! no RAM search can perform.
+//!
+//! # The two actions are separate because they cost differently
+//!
+//! **Observe** runs a window of frames once and classifies all 2048 addresses. It
+//! is bounded by [`OBSERVE_FRAMES`] and costs about three seconds of emulation.
+//!
+//! **Verify** costs two trials per address — a baseline and a perturbed run — so
+//! a full 2048-address sweep would be over four thousand trials and tens of
+//! minutes. It is therefore offered per-address on demand and as a bounded batch
+//! of [`VERIFY_BATCH`], never as "verify everything". A button that quietly takes
+//! twenty minutes is a worse affordance than one that admits its limit.
+//!
+//! # Honesty
+//!
+//! The panel's job is to not over-claim on the classifier's behalf. Three rules:
+//!
+//! - `Untested` renders as its own state, never blank and never as `Inert`.
+//! - Every verification names the **lens** it used, because liveness is relative
+//!   to the observable (a byte is `Live` through work RAM and may be `Inert`
+//!   through the framebuffer).
+//! - The evidence — change count, direction, range, the threshold that decided it
+//!   — is shown beside the label, so a reader can disagree with the label.
+
+use rustynes_core::{Buttons, Nes};
+use rustynes_probe::atlas::{
+    self, Behaviour, FRAME_TICK_RATIO, Label, Liveness, Observation, SPARSE_MAX_CHANGES, WRAM_LEN,
+};
+use rustynes_probe::{Budget, Observable, Probe};
+
+use crate::icons::{glyph, label as ic};
+
+/// Frames captured by one Observe.
+///
+/// About three seconds of NTSC. Long enough for a score to tick, a timer to
+/// count and an animation to cycle; short enough that the synchronous pause is
+/// comparable to the Latency Oracle's, which users already accept.
+const OBSERVE_FRAMES: u32 = 180;
+
+/// Frames each verification trial runs.
+///
+/// Short on purpose: a poke that matters usually matters immediately, and the
+/// cost is paid twice per address. A byte whose effect takes longer than this
+/// reads `Inert`, which the panel says is "not observable inside the budget"
+/// rather than "dead".
+const VERIFY_FRAMES: u32 = 8;
+
+/// Trials one address costs to verify: a baseline plus a perturbed run.
+///
+/// Named because it appears in three places that must agree — the hover text
+/// quoting the cost, the `Budget` sizing in `do_verify`, and
+/// `atlas::verify_liveness`'s own up-front affordability check. A bare `2` in the
+/// budget with a stale number in the tooltip is the drift this prevents.
+/// (PR #392 review.)
+const TRIALS_PER_ADDRESS: usize = 2;
+
+/// Addresses one batch verification will attempt.
+///
+/// Sixteen, so a batch is 32 trials — a fraction of a second of emulation, and
+/// small enough that the button's cost is honestly predictable. The alternative,
+/// verifying every changed address, is unbounded in the only case that matters:
+/// a busy game where hundreds of addresses moved.
+const VERIFY_BATCH: usize = 16;
+
+/// Persistent panel state.
+pub struct AtlasPanel {
+    /// Classified labels; empty until an observation has been made.
+    labels: Vec<Label>,
+    /// Frames the current labels were derived from.
+    frames: u32,
+    /// The lens verification uses. Part of the result, not a hidden default.
+    lens: Observable,
+    /// Hide the (usually overwhelming) untouched addresses.
+    hide_untouched: bool,
+    /// "Observe" was clicked this frame; the action runs after the render so
+    /// `nes` is never captured by the viewport callback.
+    observe_requested: bool,
+    /// A single address the user asked to verify.
+    verify_requested: Option<u16>,
+    /// A bounded batch verification was requested.
+    verify_batch_requested: bool,
+    /// The address whose detail is expanded.
+    selected: Option<u16>,
+    /// Status / cost line.
+    status: String,
+}
+
+impl Default for AtlasPanel {
+    fn default() -> Self {
+        Self {
+            labels: Vec::new(),
+            frames: 0,
+            // The framebuffer is the default question — "does this drive what I
+            // see?" — and the one whose `Inert` answer is informative. Work RAM
+            // would report almost everything `Live` (a poke is a work-RAM change
+            // by construction), which is true and useless.
+            lens: Observable::Framebuffer,
+            hide_untouched: true,
+            observe_requested: false,
+            verify_requested: None,
+            verify_batch_requested: false,
+            selected: None,
+            status: String::new(),
+        }
+    }
+}
+
+impl AtlasPanel {
+    /// Discard everything bound to the previous ROM.
+    ///
+    /// An atlas describes one game's memory map. Left standing across a ROM
+    /// change every label becomes a confident statement about a cartridge it was
+    /// never derived from — worse than a stale latency number, because there are
+    /// two thousand of them and they look like a map.
+    pub fn clear(&mut self) {
+        *self = Self::default();
+    }
+}
+
+/// Draw the RAM Atlas window. `nes` is `Some` only when a ROM is loaded under the
+/// held lock; both actions are disabled otherwise.
+pub fn show(
+    ctx: &egui::Context,
+    detached: &mut std::collections::HashSet<&'static str>,
+    open: &mut bool,
+    state: &mut AtlasPanel,
+    nes: Option<&mut Nes>,
+    writes_locked: bool,
+) {
+    // Both actions advance the live `Nes`, and Verify pokes work RAM. Under
+    // netplay or a TAS record/replay that diverges a timeline other peers are
+    // lockstepped to; under RetroAchievements hardcore it is the write the mode
+    // exists to forbid. `restore_quiet` puts the state back, but a netplay peer
+    // has already consumed the frames. Gated on the same predicate `emu.write`
+    // uses rather than on `nes.is_some()` alone. (PR #392 review.)
+    let can_run = nes.is_some() && !writes_locked;
+    super::detachable_window(
+        ctx,
+        detached,
+        "ram_atlas",
+        "RAM Atlas",
+        super::WindowCfg {
+            default_width: Some(520.0),
+            ..Default::default()
+        },
+        open,
+        |ui| body(ui, state, can_run, writes_locked),
+    );
+    // Actions run AFTER the render — `nes` is free here, not captured by any
+    // closure. Same shape as the Latency Oracle and `BasicBot`.
+    run_actions(state, nes);
+}
+
+/// The panel body, shared by the docked window and the detached OS viewport.
+fn body(ui: &mut egui::Ui, state: &mut AtlasPanel, can_run: bool, writes_locked: bool) {
+    ui.label("Classifies every byte of the 2 KiB work RAM by how it behaves, then");
+    ui.label("verifies a candidate by changing it and re-simulating.");
+    ui.separator();
+
+    ui.horizontal(|ui| {
+        if ui
+            .add_enabled(
+                can_run,
+                egui::Button::new(ic(glyph::MAGNIFYING_GLASS_PLUS, "Observe")),
+            )
+            .on_hover_text(format!(
+                "Runs {OBSERVE_FRAMES} frames (about 3 seconds) and classifies all \
+                 {WRAM_LEN} addresses. Briefly pauses the emulator."
+            ))
+            .clicked()
+        {
+            state.observe_requested = true;
+        }
+        ui.label("lens:");
+        // The lens is chosen before verification and reported with every result:
+        // liveness is relative to it.
+        egui::ComboBox::from_id_salt("atlas_lens")
+            .selected_text(lens_name(state.lens))
+            .show_ui(ui, |ui| {
+                for lens in [
+                    Observable::Framebuffer,
+                    Observable::AudioEnergy,
+                    Observable::Wram,
+                ] {
+                    ui.selectable_value(&mut state.lens, lens, lens_name(lens));
+                }
+            });
+    });
+
+    if !can_run {
+        // Distinguish the two reasons, or a user in a netplay session sees a dead
+        // button and concludes the tool is broken.
+        if writes_locked {
+            ui.weak(
+                "Unavailable during netplay, TAS recording or playback, and \
+                 RetroAchievements hardcore: this tool advances the emulator and \
+                 pokes memory.",
+            );
+        } else {
+            ui.weak("Load a ROM to observe.");
+        }
+    }
+
+    if state.labels.is_empty() {
+        if !state.status.is_empty() {
+            ui.separator();
+            ui.weak(&state.status);
+        }
+        return;
+    }
+
+    ui.separator();
+    summary(ui, state);
+    ui.separator();
+
+    ui.horizontal(|ui| {
+        ui.checkbox(&mut state.hide_untouched, "Hide untouched");
+        // The real count, not the cap: "Verify next 16" when three remain
+        // overstates what the button will do. (PR #392 review.)
+        let pending = state
+            .labels
+            .iter()
+            .filter(|l| l.liveness == Liveness::Untested && l.behaviour != Behaviour::Untouched)
+            .count()
+            .min(VERIFY_BATCH);
+        if ui
+            .add_enabled(
+                can_run && pending > 0,
+                egui::Button::new(ic(glyph::GAUGE, &format!("Verify next {pending}"))),
+            )
+            .on_hover_text(format!(
+                "Perturbs up to {VERIFY_BATCH} not-yet-tested addresses, \
+                 {TRIALS_PER_ADDRESS} trials each. A full sweep of all {WRAM_LEN} \
+                 addresses is deliberately not offered: it would be {} trials.",
+                WRAM_LEN * TRIALS_PER_ADDRESS
+            ))
+            .clicked()
+        {
+            state.verify_batch_requested = true;
+        }
+    });
+
+    ui.separator();
+    table(ui, state, can_run);
+
+    if !state.status.is_empty() {
+        ui.separator();
+        ui.weak(&state.status);
+    }
+}
+
+/// Counts per behaviour, plus how much of the atlas has been verified.
+fn summary(ui: &mut egui::Ui, state: &AtlasPanel) {
+    let mut counts = [0usize; 6];
+    let mut tested = 0usize;
+    let mut live = 0usize;
+    for l in &state.labels {
+        counts[behaviour_index(l.behaviour)] += 1;
+        match l.liveness {
+            Liveness::Untested => {}
+            Liveness::Live => {
+                tested += 1;
+                live += 1;
+            }
+            Liveness::Inert => tested += 1,
+        }
+    }
+    ui.label(format!(
+        "{} frames observed. {} of {WRAM_LEN} addresses changed.",
+        state.frames,
+        WRAM_LEN - counts[behaviour_index(Behaviour::Untouched)]
+    ));
+    ui.weak(format!(
+        "tick {} · rising {} · falling {} · sparse {} · volatile {} · untouched {}",
+        counts[behaviour_index(Behaviour::FrameTick)],
+        counts[behaviour_index(Behaviour::RisingCounter)],
+        counts[behaviour_index(Behaviour::FallingCounter)],
+        counts[behaviour_index(Behaviour::Sparse)],
+        counts[behaviour_index(Behaviour::Volatile)],
+        counts[behaviour_index(Behaviour::Untouched)],
+    ));
+    // Stated as a fraction of the whole, so "we verified 16" cannot read as "we
+    // verified the atlas".
+    ui.weak(format!(
+        "verified {tested} of {WRAM_LEN} through {} — {live} live, {} inert, \
+         {} untested",
+        lens_name(state.lens),
+        tested - live,
+        WRAM_LEN - tested
+    ));
+}
+
+/// The per-address rows, virtualized, with the detail pane below them.
+///
+/// `show_rows` renders only the visible slice. With "hide untouched" off this
+/// list is all [`WRAM_LEN`] addresses, and building two thousand selectable
+/// labels every frame is a cost the panel has no reason to pay. (PR #392 review.)
+///
+/// Virtualization requires a uniform row height, which is why the expanded
+/// evidence sits in a fixed pane BELOW the scroll area rather than inline under
+/// its row. That is the better arrangement anyway: the detail no longer shifts
+/// the rows around it when opened, and it stays visible while scrolling.
+fn table(ui: &mut egui::Ui, state: &mut AtlasPanel, can_run: bool) {
+    // No per-frame allocation. Review suggested caching a filtered `Vec<Label>`
+    // and invalidating it when `labels` or the filter changes; this avoids the
+    // allocation *without* adding cache state to keep in sync — and stale derived
+    // state is the defect class this release has already produced three times.
+    //
+    // `show_rows` needs a count up front, so the filter is walked twice: once to
+    // count (2,048 predicate evaluations at worst, no allocation) and once inside
+    // the closure, where `skip`/`take` bound the work to the visible slice.
+    // (PR #392 review.)
+    let hide_untouched = state.hide_untouched;
+    let visible = |l: &&Label| !(hide_untouched && l.behaviour == Behaviour::Untouched);
+    let row_count = state.labels.iter().filter(visible).count();
+    if row_count == 0 {
+        ui.weak("No addresses changed during the window.");
+        return;
+    }
+
+    let row_h = ui.text_style_height(&egui::TextStyle::Monospace);
+    // Copied out so the row loop can mutate `state.selected` without holding a
+    // borrow of `state.labels`; `Label` is `Copy` and the slice is one screenful.
+    let mut clicked: Option<u16> = None;
+    let labels = &state.labels;
+    let selected_addr = state.selected;
+    egui::ScrollArea::vertical()
+        .max_height(240.0)
+        .show_rows(ui, row_h, row_count, |ui, range| {
+            let start = range.start;
+            let len = range.len();
+            for l in labels.iter().filter(visible).skip(start).take(len) {
+                let selected = selected_addr == Some(l.addr);
+                let text = format!(
+                    "${:04X}  {:<15} {:<9} {}",
+                    l.addr,
+                    behaviour_name(l.behaviour),
+                    liveness_name(l.liveness),
+                    short_evidence(l),
+                );
+                if ui
+                    .selectable_label(selected, egui::RichText::new(text).monospace())
+                    .clicked()
+                {
+                    clicked = Some(l.addr);
+                }
+            }
+        });
+    if let Some(addr) = clicked {
+        state.selected = if selected_addr == Some(addr) {
+            None
+        } else {
+            Some(addr)
+        };
+    }
+
+    // The detail pane. Resolved from `rows` rather than `state.labels` so a
+    // selection hidden by the current filter stops being shown, instead of
+    // lingering as evidence for a row the user can no longer see.
+    // Resolved against the FILTERED set, so a selection hidden by the current
+    // filter stops showing evidence for a row the user cannot see.
+    if let Some(addr) = state.selected
+        && let Some(l) = state
+            .labels
+            .iter()
+            .filter(visible)
+            .find(|l| l.addr == addr)
+            .copied()
+    {
+        ui.separator();
+        detail(ui, state, &l, can_run);
+    }
+}
+
+/// The expanded evidence for one address, plus its Verify button.
+fn detail(ui: &mut egui::Ui, state: &mut AtlasPanel, l: &Label, can_run: bool) {
+    ui.indent(l.addr, |ui| {
+        let s = &l.stats;
+        ui.weak(format!(
+            "changed {} times · {} up, {} down, {} wraps · range {:#04X}-{:#04X} · \
+             {} distinct values",
+            s.changes, s.increases, s.decreases, s.wraps, s.min, s.max, s.distinct
+        ));
+        if let Some(f) = s.first_change {
+            ui.weak(format!("first changed on frame {f}"));
+        }
+        // The threshold that decided it, so the label can be disagreed with.
+        ui.weak(why(l, state.frames));
+
+        match l.liveness {
+            Liveness::Live => {
+                let at = l
+                    .divergence_frame
+                    .map_or_else(|| "unknown frame".to_owned(), |f| format!("frame {f}"));
+                ui.label(format!(
+                    "VERIFIED LIVE through {}: changing this byte changed the \
+                     observed output at {at}.",
+                    lens_name(state.lens)
+                ));
+                ui.weak(
+                    "This does NOT identify what the byte is — only that it \
+                     participates in what the lens observes.",
+                );
+            }
+            Liveness::Inert => {
+                ui.label(format!(
+                    "VERIFIED INERT through {}: changing this byte changed nothing \
+                     the lens observed within {VERIFY_FRAMES} frames.",
+                    lens_name(state.lens)
+                ));
+                ui.weak(
+                    "Not the same as unused. A byte the game rewrites from a master \
+                     copy each frame reads inert because the change is overwritten \
+                     before it can matter.",
+                );
+            }
+            Liveness::Untested => {
+                ui.weak("Not verified. Behaviour above is a hypothesis from observation only.");
+                if ui
+                    .add_enabled(can_run, egui::Button::new("Verify this address"))
+                    .clicked()
+                {
+                    state.verify_requested = Some(l.addr);
+                }
+            }
+        }
+    });
+}
+
+/// The threshold that produced this label, in words.
+fn why(l: &Label, frames: u32) -> String {
+    let transitions = frames.saturating_sub(1);
+    match l.behaviour {
+        Behaviour::Untouched => "held one value for the whole window".to_owned(),
+        Behaviour::FrameTick => format!(
+            "changed on {} of {} transitions, at or above the {:.0}% frame-tick \
+             threshold",
+            l.stats.changes,
+            transitions,
+            FRAME_TICK_RATIO * 100.0
+        ),
+        Behaviour::RisingCounter => {
+            format!("{} steps up and none down", l.stats.increases)
+        }
+        Behaviour::FallingCounter => {
+            format!("{} steps down and none up", l.stats.decreases)
+        }
+        Behaviour::Sparse => format!(
+            "changed {} times, at or below the sparse threshold of {SPARSE_MAX_CHANGES}",
+            l.stats.changes
+        ),
+        Behaviour::Volatile => format!(
+            "changed {} times in both directions, below the frame-tick threshold",
+            l.stats.changes
+        ),
+    }
+}
+
+/// One-line evidence for the collapsed row.
+fn short_evidence(l: &Label) -> String {
+    if l.behaviour == Behaviour::Untouched {
+        return format!("={:#04X}", l.stats.min);
+    }
+    format!(
+        "{}ch {:#04X}-{:#04X}",
+        l.stats.changes, l.stats.min, l.stats.max
+    )
+}
+
+const fn behaviour_index(b: Behaviour) -> usize {
+    match b {
+        Behaviour::Untouched => 0,
+        Behaviour::FrameTick => 1,
+        Behaviour::RisingCounter => 2,
+        Behaviour::FallingCounter => 3,
+        Behaviour::Sparse => 4,
+        Behaviour::Volatile => 5,
+    }
+}
+
+const fn behaviour_name(b: Behaviour) -> &'static str {
+    match b {
+        Behaviour::Untouched => "untouched",
+        Behaviour::FrameTick => "frame tick",
+        Behaviour::RisingCounter => "rising",
+        Behaviour::FallingCounter => "falling",
+        Behaviour::Sparse => "sparse",
+        Behaviour::Volatile => "volatile",
+    }
+}
+
+const fn liveness_name(l: Liveness) -> &'static str {
+    match l {
+        Liveness::Untested => "untested",
+        Liveness::Live => "LIVE",
+        Liveness::Inert => "inert",
+    }
+}
+
+const fn lens_name(o: Observable) -> &'static str {
+    match o {
+        Observable::Framebuffer => "screen",
+        Observable::IndexFramebuffer => "screen (indices)",
+        Observable::Wram => "work RAM",
+        Observable::AudioEnergy => "audio",
+    }
+}
+
+/// Run whichever action the body requested, against the live emulator.
+fn run_actions(state: &mut AtlasPanel, nes: Option<&mut Nes>) {
+    // Observe is checked FIRST and the verification flags are left in place if it
+    // wins, rather than being taken unconditionally. Taking them up front
+    // discarded a Verify click that landed in the same frame as an Observe — and
+    // silently, since the request simply vanished. It now survives to the next
+    // frame. (PR #392 review.)
+    //
+    // A fresh observation replaces every label, so a verification queued against
+    // the OLD labels must not then be applied to the new ones; the observe branch
+    // clears them explicitly for that reason, which is a different thing from
+    // dropping them by accident.
+    let observe = std::mem::take(&mut state.observe_requested);
+    if !observe && state.verify_requested.is_none() && !state.verify_batch_requested {
+        return;
+    }
+    let Some(nes) = nes else {
+        "No ROM loaded.".clone_into(&mut state.status);
+        return;
+    };
+
+    if observe {
+        do_observe(state, nes);
+        // An observation invalidates any prior verification: the labels are new
+        // objects, and carrying old verdicts across would attach a verdict to a
+        // hypothesis it was not tested against. Dropped deliberately here, having
+        // been preserved above.
+        state.verify_requested = None;
+        state.verify_batch_requested = false;
+        return;
+    }
+
+    let single = state.verify_requested.take();
+    // Cleared whether or not it is used: the branch below is chosen by `single`.
+    state.verify_batch_requested = false;
+    let targets: Vec<u16> = if let Some(addr) = single {
+        vec![addr]
+    } else {
+        state
+            .labels
+            .iter()
+            .filter(|l| l.liveness == Liveness::Untested && l.behaviour != Behaviour::Untouched)
+            .take(VERIFY_BATCH)
+            .map(|l| l.addr)
+            .collect()
+    };
+    if targets.is_empty() {
+        "Nothing left to verify.".clone_into(&mut state.status);
+        return;
+    }
+    do_verify(state, nes, &targets);
+}
+
+/// Restores a snapshot into the live emulator on drop, including on an unwind.
+///
+/// Both actions here advance the live `Nes` by hundreds of frames and put it back
+/// afterwards. A plain restore at the end of the function is correct on the happy
+/// path and wrong on a panic: the user would be left mid-analysis, several hundred
+/// frames from where they were, with no indication why. `Drop` cannot return a
+/// `Result`, so the unwind path is best-effort — but best-effort recovery beats
+/// none, and the success path still checks. (PR #392 review.)
+struct TimelineGuard<'a> {
+    nes: &'a mut Nes,
+    snapshot: Vec<u8>,
+    restored: bool,
+}
+
+impl<'a> TimelineGuard<'a> {
+    fn capture(nes: &'a mut Nes) -> Self {
+        let snapshot = nes.snapshot();
+        Self {
+            nes,
+            snapshot,
+            restored: false,
+        }
+    }
+
+    /// Restore on the success path, where a failure can still be surfaced.
+    fn restore(&mut self) {
+        self.nes
+            .restore_quiet(&self.snapshot)
+            .expect("a snapshot taken from this instance restores to it");
+        self.restored = true;
+    }
+}
+
+impl Drop for TimelineGuard<'_> {
+    fn drop(&mut self) {
+        if !self.restored {
+            // Unwind path only. Cannot report, so it must not panic here either —
+            // a panic during unwinding aborts.
+            let _ = self.nes.restore_quiet(&self.snapshot);
+        }
+    }
+}
+
+/// Observe and classify, restoring the live timeline afterwards.
+fn do_observe(state: &mut AtlasPanel, nes: &mut Nes) {
+    let mut guard = TimelineGuard::capture(nes);
+    // Idle input: an atlas taken while a button is held describes a different
+    // situation, which is a useful thing to offer later but a confusing default.
+    let obs: Observation = atlas::observe(guard.nes, OBSERVE_FRAMES, |_| {
+        (Buttons::empty(), Buttons::empty())
+    });
+    // `restore_quiet`, not `restore`: this is the same timeline, snapshotted
+    // moments ago on this instance, so the rewind ring must survive.
+    guard.restore();
+
+    state.labels = atlas::classify(&obs);
+    state.frames = obs.frames();
+    state.selected = None;
+    state.status = format!(
+        "Observed {OBSERVE_FRAMES} frames. Nothing is verified yet — every \
+         behaviour below is a hypothesis."
+    );
+}
+
+/// Verify the given addresses, restoring the live timeline afterwards.
+fn do_verify(state: &mut AtlasPanel, nes: &mut Nes, targets: &[u16]) {
+    let mut guard = TimelineGuard::capture(nes);
+    // Two trials per address, plus nothing else: sized exactly, so a budget that
+    // runs out is a bug in this arithmetic rather than a silent truncation.
+    let budget = Budget {
+        max_frames_per_trial: VERIFY_FRAMES,
+        max_trials: u32::try_from(targets.len() * TRIALS_PER_ADDRESS).unwrap_or(u32::MAX),
+    };
+    let mut probe = Probe::anchor(&*guard.nes, budget);
+
+    let mut live = 0usize;
+    let mut inert = 0usize;
+    let mut untested = 0usize;
+    for &addr in targets {
+        let (liveness, frame) =
+            atlas::verify_liveness(&mut probe, guard.nes, addr, VERIFY_FRAMES, state.lens);
+        match liveness {
+            Liveness::Live => live += 1,
+            Liveness::Inert => inert += 1,
+            Liveness::Untested => untested += 1,
+        }
+        // Direct index, not a linear scan: `classify` emits one label per
+        // address over `0..WRAM_LEN` in order, so the index IS the address. The
+        // assertion keeps that from being a silent assumption — if the layout
+        // ever changes, this fails loudly instead of writing a verdict onto the
+        // wrong address. (PR #392 review.)
+        if let Some(l) = state.labels.get_mut(addr as usize) {
+            debug_assert_eq!(
+                l.addr, addr,
+                concat!(
+                    "atlas labels are no longer address-indexed; ",
+                    "a verdict would have been recorded against the wrong address"
+                )
+            );
+            l.liveness = liveness;
+            l.divergence_frame = frame;
+        }
+    }
+
+    guard.restore();
+
+    // The untested count is reported rather than folded into "inert", so a
+    // budget shortfall is visible instead of looking like a finding.
+    state.status = if untested > 0 {
+        format!(
+            "Verified {} through {}: {live} live, {inert} inert. {untested} could \
+             not be tested within the budget.",
+            targets.len() - untested,
+            lens_name(state.lens)
+        )
+    } else {
+        format!(
+            "Verified {} through {}: {live} live, {inert} inert.",
+            targets.len(),
+            lens_name(state.lens)
+        )
+    };
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rustynes_probe::atlas::AddressStats;
+
+    fn label(addr: u16, behaviour: Behaviour, liveness: Liveness) -> Label {
+        Label {
+            addr,
+            behaviour,
+            stats: AddressStats::default(),
+            liveness,
+            divergence_frame: None,
+        }
+    }
+
+    /// A ROM change must discard the whole atlas. Two thousand labels describing
+    /// a cartridge that is no longer loaded is a worse lie than one stale number,
+    /// because it looks like a map.
+    #[test]
+    fn clearing_discards_the_whole_atlas() {
+        let mut p = AtlasPanel {
+            labels: vec![label(0, Behaviour::FrameTick, Liveness::Live)],
+            frames: 180,
+            selected: Some(0),
+            status: "stale".to_owned(),
+            ..AtlasPanel::default()
+        };
+        p.clear();
+        assert!(p.labels.is_empty());
+        assert_eq!(p.frames, 0);
+        assert_eq!(p.selected, None);
+        assert!(p.status.is_empty());
+    }
+
+    /// A batch must never spend trials on untouched addresses: they are the bulk
+    /// of work RAM, and perturbing a byte the game never reads is the one case
+    /// guaranteed to be uninformative.
+    #[test]
+    fn a_batch_skips_untouched_and_already_tested_addresses() {
+        let labels = [
+            label(0x00, Behaviour::Untouched, Liveness::Untested),
+            label(0x01, Behaviour::FrameTick, Liveness::Untested),
+            label(0x02, Behaviour::Volatile, Liveness::Live),
+            label(0x03, Behaviour::RisingCounter, Liveness::Untested),
+        ];
+        let picked: Vec<u16> = labels
+            .iter()
+            .filter(|l| l.liveness == Liveness::Untested && l.behaviour != Behaviour::Untouched)
+            .take(VERIFY_BATCH)
+            .map(|l| l.addr)
+            .collect();
+        assert_eq!(
+            picked,
+            [0x01, 0x03],
+            "a batch selected an untouched or already-verified address"
+        );
+    }
+
+    /// The batch is bounded. An unbounded "verify everything" is 4,096 trials and
+    /// tens of minutes of a frozen UI.
+    #[test]
+    fn a_batch_is_bounded() {
+        let labels: Vec<Label> = (0..500u16)
+            .map(|a| label(a, Behaviour::Volatile, Liveness::Untested))
+            .collect();
+        let picked = labels
+            .iter()
+            .filter(|l| l.liveness == Liveness::Untested && l.behaviour != Behaviour::Untouched)
+            .take(VERIFY_BATCH)
+            .count();
+        assert_eq!(picked, VERIFY_BATCH);
+    }
+
+    /// `Untested` must have its own rendering. Sharing a string with `Inert`
+    /// would present "we did not look" as "we looked and saw nothing".
+    #[test]
+    fn untested_is_named_distinctly_from_inert() {
+        assert_ne!(
+            liveness_name(Liveness::Untested),
+            liveness_name(Liveness::Inert)
+        );
+        assert_ne!(
+            liveness_name(Liveness::Live),
+            liveness_name(Liveness::Inert)
+        );
+    }
+
+    /// Every behaviour needs a distinct summary slot, or the counts silently
+    /// merge two classes.
+    #[test]
+    fn behaviour_indices_are_distinct() {
+        let all = [
+            Behaviour::Untouched,
+            Behaviour::FrameTick,
+            Behaviour::RisingCounter,
+            Behaviour::FallingCounter,
+            Behaviour::Sparse,
+            Behaviour::Volatile,
+        ];
+        let mut seen = [false; 6];
+        for b in all {
+            let i = behaviour_index(b);
+            assert!(!seen[i], "two behaviours share summary slot {i}");
+            seen[i] = true;
+        }
+        assert!(seen.iter().all(|&s| s), "a summary slot is unused");
+    }
+
+    /// The explanation must name the threshold that decided the label, so a
+    /// reader can disagree with it.
+    #[test]
+    fn the_explanation_cites_its_threshold() {
+        let mut l = label(0, Behaviour::Sparse, Liveness::Untested);
+        l.stats.changes = 2;
+        let text = why(&l, 180);
+        assert!(
+            text.contains(&SPARSE_MAX_CHANGES.to_string()),
+            "the sparse explanation did not cite its threshold: {text}"
+        );
+    }
+}
diff --git a/crates/rustynes-frontend/src/debugger/mod.rs b/crates/rustynes-frontend/src/debugger/mod.rs
index 5745258a..e6ffa340 100644
--- a/crates/rustynes-frontend/src/debugger/mod.rs
+++ b/crates/rustynes-frontend/src/debugger/mod.rs
@@ -121,6 +121,7 @@ mod expr;
 mod game_db_panel;
 // v2.2.0 "Capstone" — read-only ROM Info browser (per-game DB + No-Intro CRC +
 // decoded cartridge header for the loaded ROM).
+mod atlas_panel;
 mod latency_panel;
 mod rom_info_panel;
 // v1.5.0 "Lens" Workstream A4 — HD-pack per-pixel inspector (native + hd-pack).
@@ -194,6 +195,8 @@ pub enum ToolPanel {
     /// v2.3.6 — the Latency Oracle: measures the game's own input lag and
     /// recommends (never applies) a run-ahead depth.
     LatencyOracle,
+    /// v2.3.6 — the RAM Atlas: what each byte of work RAM is for.
+    RamAtlas,
     /// Live "Input Display" panel — the consolidated controller + expansion-
     /// device HUD (v1.7.0 "Forge" beta.5, #51; the v1.5.0 "Lens" Workstream A1
     /// Input Miniatures overlay absorbed the former standalone Input Display).
@@ -552,6 +555,7 @@ pub fn detached_window_meta(id: &'static str) -> (&'static str, (u32, u32)) {
         "game_db" => ("Game Database", (560, 480)),
         "rom_info" => ("ROM Info", (520, 520)),
         "latency_oracle" => ("Latency Oracle", (380, 420)),
+        "ram_atlas" => ("RAM Atlas", (560, 620)),
         "provenance" => ("Pixel Provenance", (520, 620)),
         "perf" => ("Performance", (560, 440)),
         "documentation" => ("Documentation", (780, 560)),
@@ -680,6 +684,10 @@ pub struct DebuggerOverlay {
     show_rom_info: bool,
     /// v2.3.6 — Latency Oracle panel visible.
     show_latency: bool,
+    /// v2.3.6 — RAM Atlas window visible.
+    show_atlas: bool,
+    /// v2.3.6 — locked-session write gate, republished by `App` each frame.
+    writes_locked: bool,
     /// v2.3.2 "Lucid" — pixel provenance inspector.
     show_provenance: bool,
     /// "Input Display" panel open flag (v1.7.0 "Forge" beta.5, #51; née the
@@ -768,6 +776,8 @@ pub struct DebuggerOverlay {
     /// Read-only ROM Info panel state (v2.2.0 "Capstone").
     rom_info_ui: rom_info_panel::RomInfoPanelState,
     latency_ui: latency_panel::LatencyPanel,
+    /// v2.3.6 — RAM Atlas panel state.
+    atlas_ui: atlas_panel::AtlasPanel,
     /// Pixel provenance inspector state (v2.3.2 "Lucid").
     provenance_ui: provenance_panel::ProvenancePanelState,
     /// CRC32 of the currently-loaded ROM (PRG+CHR, header-excluded), pushed by
@@ -945,6 +955,8 @@ impl DebuggerOverlay {
             show_game_db: false,
             show_rom_info: false,
             show_latency: false,
+            show_atlas: false,
+            writes_locked: false,
             show_provenance: false,
             show_input_display: false,
             #[cfg(all(not(target_arch = "wasm32"), feature = "hd-pack"))]
@@ -984,6 +996,7 @@ impl DebuggerOverlay {
             game_db_ui: game_db_panel::GameDbPanelState::default(),
             rom_info_ui: rom_info_panel::RomInfoPanelState,
             latency_ui: latency_panel::LatencyPanel::default(),
+            atlas_ui: atlas_panel::AtlasPanel::default(),
             provenance_ui: provenance_panel::ProvenancePanelState::default(),
             rom_crc: None,
             rom_crc_full: None,
@@ -1106,6 +1119,18 @@ impl DebuggerOverlay {
         self.show_tas = false;
     }
 
+    /// v2.3.6 — republish the locked-session write gate from `App`.
+    ///
+    /// `true` under netplay, a TAS record/replay, or `RetroAchievements` hardcore —
+    /// the same condition `emu.write` and the debugger writeback path use. The
+    /// RAM Atlas reads it to disable both of its actions, since each advances the
+    /// live `Nes` and Verify additionally pokes work RAM. Republished per frame
+    /// rather than queried, mirroring `EmuCore::writes_locked`, so there is one
+    /// source of truth for the condition.
+    pub const fn set_writes_locked(&mut self, locked: bool) {
+        self.writes_locked = locked;
+    }
+
     /// v2.3.6 — discard a Latency Oracle measurement bound to the previous ROM.
     ///
     /// Called at every ROM transition, beside [`Self::clear_tas_editor`], which
@@ -1116,6 +1141,18 @@ impl DebuggerOverlay {
         self.latency_ui.clear();
     }
 
+    /// v2.3.6 — discard every analysis result bound to the previous ROM.
+    ///
+    /// One hook rather than one call per panel, deliberately. The Latency Oracle
+    /// shipped without a clear and needed a review to catch it (PR #385), and the
+    /// Pixel Provenance panel had the same defect in a different form. A single
+    /// entry point means the next ROM-bound analysis panel is one line away from
+    /// being correct instead of one omission away from being wrong.
+    pub fn clear_rom_bound_analysis(&mut self) {
+        self.clear_latency_report();
+        self.atlas_ui.clear();
+    }
+
     /// Returns `true` when the overlay is currently visible. The render
     /// path uses this to pick its emu-lock policy (v2.8.0 Phase 5): the
     /// egui pass needs `&mut Nes`, so a visible overlay holds the lock
@@ -1489,6 +1526,7 @@ impl DebuggerOverlay {
             ToolPanel::GameDb => self.show_game_db = true,
             ToolPanel::RomInfo => self.show_rom_info = true,
             ToolPanel::LatencyOracle => self.show_latency = true,
+            ToolPanel::RamAtlas => self.show_atlas = true,
             ToolPanel::PixelProvenance => self.show_provenance = true,
             ToolPanel::InputDisplay => self.show_input_display = true,
             ToolPanel::Replay => self.show_replay = true,
@@ -1774,6 +1812,7 @@ impl DebuggerOverlay {
             || self.show_rom_info
             || self.show_provenance
             || self.show_latency
+            || self.show_atlas
     }
 
     /// Whether the **Pixel Provenance** inspector is open.
@@ -2095,6 +2134,11 @@ impl DebuggerOverlay {
     /// overlay is visible, so the menu bar can surface them directly. Panels
     /// that read `nes` (Cheats) no-op when `nes` is `None`.
     fn tool_panels(&mut self, ctx: &egui::Context, mut nes: Option<&mut Nes>, config: &mut Config) {
+        // The locked-session gate, republished by `App` each frame from the exact
+        // same condition `emu.write` uses. Read once here so every panel that
+        // mutates or advances the live `Nes` shares one predicate rather than
+        // re-deriving it. (PR #392 review.)
+        let atlas_writes_locked = self.writes_locked;
         // v2.3.0 "Datum II" — a detached render pass paints only its one target
         // panel (via `detachable_window`, which self-filters); the non-detachable
         // tool panels + the RetroAchievements HUD below render only in the
@@ -2134,6 +2178,29 @@ impl DebuggerOverlay {
                 config.input.run_ahead = depth;
             }
         }
+        // v2.3.6 workstream C — the RAM Atlas. Needs `&mut Nes`: it observes a
+        // window of frames and perturbs candidate addresses, restoring the live
+        // timeline after each action. Reads no config and writes none.
+        //
+        // Gated on the SAME locked-session predicate `emu.write` and the debugger
+        // writeback path use (`writes_locked || hardcore_blocked`). Both of its
+        // actions advance the live `Nes`, and Verify additionally pokes work RAM —
+        // under netplay or a TAS record/replay that diverges the timeline every
+        // peer is lockstepped to, and under RetroAchievements hardcore it is a
+        // memory write the mode exists to forbid. `restore_quiet` puts the state
+        // back, but a netplay peer has already consumed the frames. Checking only
+        // `nes.is_some()` bypassed a gate that exists precisely for this.
+        // (PR #392 review.)
+        if self.show_atlas {
+            atlas_panel::show(
+                ctx,
+                &mut self.detached_panels,
+                &mut self.show_atlas,
+                &mut self.atlas_ui,
+                nes.as_deref_mut(),
+                atlas_writes_locked,
+            );
+        }
         // v2.1.6 "Expansion Audio" B7 — the Audio Mixer. It reads `config` (the
         // persisted mix) and the optional `nes` (read-only DAC taps for the
         // scopes + the sink for pushing changed gain/mask to the core overlay);
diff --git a/crates/rustynes-frontend/src/ui_shell.rs b/crates/rustynes-frontend/src/ui_shell.rs
index ef7b2162..8562d103 100644
--- a/crates/rustynes-frontend/src/ui_shell.rs
+++ b/crates/rustynes-frontend/src/ui_shell.rs
@@ -1394,6 +1394,18 @@ impl UiShell {
                             out.action = Some(MenuAction::OpenPanel(ToolPanel::PixelProvenance));
                             ui.close();
                         }
+                        // v2.3.6 workstream C — the RAM Atlas: classify every
+                        // byte of work RAM by behaviour, then verify a candidate
+                        // by perturbing it. Sits with the other output-only
+                        // analysis tools; needs a loaded ROM to have any memory
+                        // to describe.
+                        if ui
+                            .add_enabled(rom, egui::Button::new(ic(glyph::MEMORY, "RAM Atlas")))
+                            .clicked()
+                        {
+                            out.action = Some(MenuAction::OpenPanel(ToolPanel::RamAtlas));
+                            ui.close();
+                        }
                         // v1.8.9 "Backlog" — BasicBot input-search control panel.
                         if ui
                             .button(ic(glyph::WAND_MAGIC_SPARKLES, "BasicBot"))
diff --git a/crates/rustynes-probe/src/atlas.rs b/crates/rustynes-probe/src/atlas.rs
new file mode 100644
index 00000000..0ac55dba
--- /dev/null
+++ b/crates/rustynes-probe/src/atlas.rs
@@ -0,0 +1,871 @@
+//! RAM Atlas: **what is each byte of work RAM for?**
+//!
+//! # The gap this fills
+//!
+//! Every emulator ships a RAM search — `TASVideos`' `RamSearch` is the canonical
+//! one, and this project already has RAM Search plus RAM Watch in the memory
+//! compare panel, and per-address access counts in the access counter. All of
+//! them *narrow a set the user already has a hypothesis about*. None of them says
+//! what an address is.
+//!
+//! The reason none of them does is that you cannot tell from observation alone.
+//! An address that counts up while the score counts up might be the score, or
+//! might be a frame counter that happens to be running. Distinguishing them
+//! requires changing the byte and seeing whether anything downstream actually
+//! moves — which requires re-simulating the same interval twice under a
+//! controlled difference. `RustyNES` can do that soundly because its determinism
+//! contract is a hard guarantee (see the crate docs), so this module can.
+//!
+//! # Two stages, with deliberately different epistemic status
+//!
+//! **Stage 1, [`observe`] then [`classify`]: correlation only.** Capture work RAM
+//! once per frame over a window and describe how each address behaved — untouched,
+//! ticking every frame, counting monotonically up or down, changing rarely,
+//! churning. Every result is a [`Behaviour`], and a `Behaviour` is a
+//! **hypothesis**. Nothing here can distinguish cause from coincidence, and the
+//! type does not pretend otherwise.
+//!
+//! **Stage 2, [`verify_liveness`]: a fact, and a narrow one.** Poke the byte,
+//! re-simulate from the same anchor, and compare against an unpoked baseline. If
+//! the screen diverges, that byte demonstrably drives something visible:
+//! [`Liveness::Live`]. If not, [`Liveness::Inert`].
+//!
+//! # What a label does NOT mean
+//!
+//! This matters more than what it does mean, because the failure mode of a tool
+//! like this is a confident wrong label that a user then builds a cheat or an
+//! achievement on:
+//!
+//! - [`Liveness::Inert`] means "perturbing it changed nothing observable **inside
+//!   the budget**". It does *not* mean unused. An address the game rewrites from
+//!   a master copy every frame reads `Inert` because the poke is overwritten
+//!   before it can matter — and that is a genuinely interesting fact about the
+//!   address, but it is not "dead".
+//! - [`Liveness::Live`] means "changing it changed the framebuffer". It does
+//!   *not* say the address *is* a coordinate, a score, or health. It says the
+//!   byte participates in what you see.
+//! - A [`Behaviour`] is never upgraded by verification. `RisingCounter` +
+//!   `Live` means "counts up, and drives something visible" — two separate
+//!   observations, not a conclusion that it is the score.
+//!
+//! Every threshold below is a named **public** constant with the reasoning
+//! attached. Public deliberately: a classifier whose cutoffs are unexplained
+//! magic numbers cannot be argued with, and one whose cutoffs are documented but
+//! unreachable cannot be displayed next to the labels they produced. A UI showing
+//! "changed on 91% of frames, threshold 90%" is checkable; one showing
+//! `FrameTick` is not.
+
+use rustynes_core::{Buttons, Nes};
+
+use crate::{Observable, Probe};
+
+/// Bytes of work RAM. The NES has 2 KiB at `$0000-$07FF`, mirrored to `$1FFF`.
+pub const WRAM_LEN: usize = 2048;
+
+/// A change on at least this fraction of frames reads as "every frame".
+///
+/// Not 100%: a frame counter incremented in the NMI handler can miss a frame
+/// during a lag frame or a scene transition, and a strict test would then
+/// misfile it as [`Behaviour::Volatile`]. 90% tolerates that without admitting
+/// anything that merely changes often.
+pub const FRAME_TICK_RATIO: f64 = 0.9;
+
+/// At most this many changes over the window reads as event-driven rather than
+/// continuous.
+///
+/// Three, because the interesting cases — a life lost, a door opened, a state
+/// transition — happen a handful of times in a several-second window, while
+/// anything continuous changes tens of times.
+pub const SPARSE_MAX_CHANGES: u32 = 3;
+
+/// A monotonic run needs at least this many steps in one direction before it is
+/// called a counter.
+///
+/// Two, not one. A single step is indistinguishable from any other one-off
+/// change, and calling it a "counter" would put a confident label on the
+/// weakest possible evidence.
+pub const COUNTER_MIN_STEPS: u32 = 2;
+
+/// A transition from at least this high to at most [`WRAP_LOW`] is treated as a
+/// wrap rather than a decrease.
+pub const WRAP_HIGH: u8 = 0xF0;
+
+/// The low side of the wrap window. See [`WRAP_HIGH`].
+pub const WRAP_LOW: u8 = 0x0F;
+
+/// Work RAM sampled once per frame over a window.
+///
+/// Stored **address-major** (all frames for `$0000`, then all frames for `$0001`)
+/// because every consumer walks one address across time, and the transpose makes
+/// that a contiguous slice instead of a strided gather over 2 KiB.
+#[derive(Clone, Debug)]
+pub struct Observation {
+    frames: u32,
+    /// `WRAM_LEN * frames` bytes, indexed `addr * frames + frame`.
+    data: Vec<u8>,
+}
+
+impl Observation {
+    /// Build an observation from address-major data.
+    ///
+    /// Public so a caller that captured work RAM by some other route — a movie
+    /// replay, a netplay trace — can classify it without going through
+    /// [`observe`], and so the classifier can be tested against constructed
+    /// series rather than only against whatever a fixture ROM happens to do.
+    ///
+    /// # Panics
+    ///
+    /// Panics unless `data.len() == WRAM_LEN * frames`. A silently-misshaped
+    /// observation would produce plausible labels for the wrong addresses, which
+    /// is the worst outcome available here.
+    #[must_use]
+    pub fn from_addr_major(frames: u32, data: Vec<u8>) -> Self {
+        assert_eq!(
+            data.len(),
+            WRAM_LEN * frames as usize,
+            "observation data must be exactly WRAM_LEN * frames bytes, \
+             address-major; a misshaped buffer labels the wrong addresses"
+        );
+        Self { frames, data }
+    }
+
+    /// Frames captured.
+    #[must_use]
+    pub const fn frames(&self) -> u32 {
+        self.frames
+    }
+
+    /// This address's values over the window, one per frame, in order.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `addr` is outside work RAM.
+    #[must_use]
+    pub fn series(&self, addr: u16) -> &[u8] {
+        let a = addr as usize;
+        assert!(a < WRAM_LEN, "address ${addr:04X} is outside work RAM");
+        let f = self.frames as usize;
+        &self.data[a * f..(a + 1) * f]
+    }
+}
+
+/// Capture work RAM once per frame, advancing `nes`.
+///
+/// **Advances the emulator it is given**, exactly like [`crate::latency::measure`]
+/// — pass a scratch instance, or restore afterwards. It deliberately does not
+/// snapshot-and-restore internally: a caller that wants a repeatable window
+/// anchors a [`Probe`] first and owns the restore, and hiding that here would
+/// make the cost invisible.
+///
+/// `input` is called once per frame with the zero-based frame index. Holding a
+/// button changes what the game does, so it changes what the atlas describes;
+/// that is a feature — an atlas taken while walking right tells you about
+/// movement state.
+pub fn observe<F>(nes: &mut Nes, frames: u32, mut input: F) -> Observation
+where
+    F: FnMut(u32) -> (Buttons, Buttons),
+{
+    // Frame-major while capturing (work RAM is contiguous, so a frame is one
+    // copy), transposed once at the end. The alternative — writing directly into
+    // address-major layout — would stride 2,048 times per frame across a buffer
+    // far larger than cache.
+    let mut frame_major: Vec<u8> = Vec::with_capacity(WRAM_LEN * frames as usize);
+    // Rewind capture is suppressed for the whole window, by the same guard a
+    // trial uses. These frames advance the live emulator and the caller rolls
+    // them back, so they never happened on the user's timeline — letting them
+    // into the ring would allow rewinding *into an observation*, which is exactly
+    // the defect this crate had just fixed for `verify_liveness` and then
+    // reintroduced one function away. Caught in review on PR #392.
+    //
+    // The guard also makes this panic-safe: an observation is 180 frames, and a
+    // panic part-way through must not leave capture disabled on a `Nes` the
+    // caller keeps using.
+    let guard = crate::CaptureGuard::suppress(nes);
+    for f in 0..frames {
+        let (p1, p2) = input(f);
+        guard.nes.set_buttons(0, p1);
+        guard.nes.set_buttons(1, p2);
+        guard.nes.run_frame();
+        frame_major.extend_from_slice(&guard.nes.wram()[..WRAM_LEN]);
+    }
+    // Restores the caller's capture setting.
+    drop(guard);
+
+    let n = frames as usize;
+    let mut data = vec![0u8; WRAM_LEN * n];
+    for (f, chunk) in frame_major.chunks_exact(WRAM_LEN).enumerate() {
+        for (a, &v) in chunk.iter().enumerate() {
+            data[a * n + f] = v;
+        }
+    }
+    Observation::from_addr_major(frames, data)
+}
+
+/// How an address behaved over the window. **A hypothesis, never a conclusion.**
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Behaviour {
+    /// Held one value for the whole window.
+    ///
+    /// The largest class by far in practice, and the useful one to be able to
+    /// exclude: it is most of work RAM on any given screen.
+    Untouched,
+    /// Changed on nearly every frame — an animation phase, a frame counter, a
+    /// scroll position.
+    FrameTick,
+    /// Only ever went up (wraps allowed), at least [`COUNTER_MIN_STEPS`] times.
+    RisingCounter,
+    /// Only ever went down (wraps allowed), at least [`COUNTER_MIN_STEPS`] times.
+    FallingCounter,
+    /// Changed at most [`SPARSE_MAX_CHANGES`] times — event-driven state.
+    Sparse,
+    /// Changed often, in both directions, but not every frame.
+    Volatile,
+}
+
+/// Raw per-address statistics, kept alongside the label as its evidence.
+///
+/// Carried so a UI can show *why* an address was classified as it was. A label
+/// without its evidence cannot be checked, and this tool's whole claim is that
+/// its output can be.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub struct AddressStats {
+    /// Frames on which the value differed from the previous frame.
+    pub changes: u32,
+    /// Distinct values observed.
+    pub distinct: u32,
+    /// Transitions strictly upward, excluding wraps.
+    pub increases: u32,
+    /// Transitions strictly downward, excluding wraps.
+    pub decreases: u32,
+    /// Transitions that looked like an 8-bit wrap in either direction.
+    pub wraps: u32,
+    /// Lowest value observed.
+    pub min: u8,
+    /// Highest value observed.
+    pub max: u8,
+    /// Index of the first frame that differed from frame 0, if any.
+    pub first_change: Option<u32>,
+}
+
+/// Whether perturbing an address demonstrably changes what the screen shows.
+///
+/// Read the caveats in the module docs before acting on this — particularly that
+/// [`Self::Inert`] is not "unused".
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Liveness {
+    /// Not tested: verification was not requested, or the trial budget ran out
+    /// before reaching this address.
+    ///
+    /// Distinct from [`Self::Inert`] on purpose. "We did not look" and "we looked
+    /// and saw nothing" are different claims, and collapsing them is how a
+    /// budget-limited sweep starts reporting untested addresses as dead.
+    Untested,
+    /// Poking the byte changed the framebuffer within the window.
+    Live,
+    /// Poking the byte changed nothing observable within the window.
+    Inert,
+}
+
+/// One address's entry in the atlas: what it did, the evidence, and whether
+/// perturbing it mattered.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Label {
+    /// Work-RAM address, `$0000-$07FF`.
+    pub addr: u16,
+    /// The behavioural hypothesis from observation.
+    pub behaviour: Behaviour,
+    /// The evidence behind [`Self::behaviour`].
+    pub stats: AddressStats,
+    /// The verification verdict, if verification ran.
+    pub liveness: Liveness,
+    /// Frame at which the perturbed run first diverged from the baseline, when
+    /// [`Self::liveness`] is [`Liveness::Live`].
+    ///
+    /// Useful on its own: a byte that diverges on frame 0 is read the very next
+    /// frame, while one that diverges on frame 30 feeds something slower.
+    pub divergence_frame: Option<u32>,
+}
+
+/// Compute one address's statistics from its series.
+#[must_use]
+pub fn stats_for(series: &[u8]) -> AddressStats {
+    let mut s = AddressStats::default();
+    let Some(&first) = series.first() else {
+        return s;
+    };
+    s.min = first;
+    s.max = first;
+
+    // Distinct values via a 256-bit set rather than sorting or hashing: the
+    // domain is one byte, so this is exact and allocation-free.
+    let mut seen = [false; 256];
+    seen[first as usize] = true;
+
+    for (i, w) in series.windows(2).enumerate() {
+        let (prev, next) = (w[0], w[1]);
+        s.min = s.min.min(next);
+        s.max = s.max.max(next);
+        seen[next as usize] = true;
+        if prev == next {
+            continue;
+        }
+        s.changes += 1;
+        if s.first_change.is_none() {
+            // `i` indexes the window, so the CHANGED frame is `i + 1`.
+            s.first_change = u32::try_from(i + 1).ok();
+        }
+        // A wrap is counted as neither an increase nor a decrease, so a counter
+        // that rolls over stays monotonic. Judged by the two values straddling
+        // the byte boundary rather than by the arithmetic difference, which
+        // cannot tell 0xFF -> 0x00 from 0xFF -> 0x00 by subtraction alone.
+        let wrapped_up = prev >= WRAP_HIGH && next <= WRAP_LOW;
+        let wrapped_down = prev <= WRAP_LOW && next >= WRAP_HIGH;
+        if wrapped_up || wrapped_down {
+            s.wraps += 1;
+        } else if next > prev {
+            s.increases += 1;
+        } else {
+            s.decreases += 1;
+        }
+    }
+    // `seen` is exactly 256 entries, so the count cannot exceed 256. `expect`
+    // rather than `unwrap_or(u32::MAX)`: the saturating form implied the value
+    // could plausibly be huge, which misdescribes a one-byte domain.
+    // (PR #392 review.)
+    s.distinct = u32::try_from(seen.iter().filter(|&&b| b).count())
+        .expect("at most 256 distinct byte values");
+    s
+}
+
+/// Classify one address from its statistics.
+///
+/// Order matters and is deliberate: `Untouched` and `FrameTick` are decided
+/// before the counter tests, so a frame counter is reported as a frame tick
+/// rather than as a `RisingCounter` — it is monotonic, but "ticks every frame" is
+/// the more specific and more useful statement.
+#[must_use]
+pub fn classify_stats(stats: &AddressStats, frames: u32) -> Behaviour {
+    if stats.changes == 0 {
+        return Behaviour::Untouched;
+    }
+    // Transitions available, not frames: an N-frame window has N-1 of them.
+    let transitions = f64::from(frames.saturating_sub(1));
+    if transitions > 0.0 && f64::from(stats.changes) / transitions >= FRAME_TICK_RATIO {
+        return Behaviour::FrameTick;
+    }
+    let rising = stats.decreases == 0 && stats.increases >= COUNTER_MIN_STEPS;
+    let falling = stats.increases == 0 && stats.decreases >= COUNTER_MIN_STEPS;
+    if rising {
+        return Behaviour::RisingCounter;
+    }
+    if falling {
+        return Behaviour::FallingCounter;
+    }
+    if stats.changes <= SPARSE_MAX_CHANGES {
+        return Behaviour::Sparse;
+    }
+    Behaviour::Volatile
+}
+
+/// Classify every work-RAM address in an observation.
+///
+/// Returns all [`WRAM_LEN`] labels, including [`Behaviour::Untouched`] ones, with
+/// [`Liveness::Untested`] throughout — verification is a separate, budgeted step.
+/// Returning the untouched addresses rather than filtering them is deliberate:
+/// "this address did nothing during the window" is an answer, and a caller that
+/// wants only the interesting ones can filter, whereas one that wants the full
+/// map cannot recover what was dropped.
+#[must_use]
+pub fn classify(obs: &Observation) -> Vec<Label> {
+    (0..WRAM_LEN)
+        .map(|a| {
+            let addr = u16::try_from(a).expect("WRAM_LEN fits u16");
+            let stats = stats_for(obs.series(addr));
+            Label {
+                addr,
+                behaviour: classify_stats(&stats, obs.frames()),
+                stats,
+                liveness: Liveness::Untested,
+                divergence_frame: None,
+            }
+        })
+        .collect()
+}
+
+/// The value a perturbation writes: the bitwise complement of what is there.
+///
+/// Guaranteed to differ from the current value for every input, which a
+/// `wrapping_add(1)` also achieves — but the complement is a *large* change, and
+/// a large change is far more likely to produce an observable difference. A
+/// coordinate nudged by one may move a sprite inside the same pixel; the same
+/// coordinate complemented moves it across the screen.
+#[must_use]
+pub const fn perturbed_value(current: u8) -> u8 {
+    !current
+}
+
+/// Perturb one address and report whether `observable` then diverged.
+///
+/// Runs up to two trials against `probe`'s budget: a baseline and a perturbed
+/// run. Returns [`Liveness::Untested`] with no divergence frame if the budget
+/// cannot fund both — never [`Liveness::Inert`], because an untested address is
+/// not an inert one.
+///
+/// **Liveness is relative to the observable, and that is the point.** The same
+/// byte can be [`Liveness::Live`] under [`Observable::Wram`] (the poke reached
+/// memory, which it always does) and [`Liveness::Inert`] under
+/// [`Observable::Framebuffer`] (nothing drew from it). Answering "does this drive
+/// what I see?" is [`Observable::Framebuffer`]; "does this drive what I hear?" is
+/// [`Observable::AudioEnergy`]. A caller that reports a verdict without naming
+/// the lens it used is over-claiming.
+///
+/// `nes` is scratch: `probe` restores its anchor into it before each trial.
+pub fn verify_liveness(
+    probe: &mut Probe,
+    nes: &mut Nes,
+    addr: u16,
+    frames: u32,
+    observable: Observable,
+) -> (Liveness, Option<u32>) {
+    let idle = |_: u32| (Buttons::empty(), Buttons::empty());
+
+    // An address outside work RAM cannot be perturbed, and the old code silently
+    // skipped the write and then let the two identical trials agree — reporting
+    // `Inert` for an address it never touched. That is the exact failure mode the
+    // module docs above spend three paragraphs warning against, produced by this
+    // function's own bounds check. `Untested` is the honest answer, and refusing
+    // before the budget is spent also stops two trials going on a no-op.
+    //
+    // The case is reachable: this is public and takes a full `u16`, so a caller
+    // passing a CPU-space mirror such as `$0810` is entirely plausible. Folding
+    // mirrors to their physical byte is deliberately NOT done here — silently
+    // reinterpreting the caller's address would be its own confident guess.
+    // (PR #392 review.)
+    let a = addr as usize;
+    if a >= WRAM_LEN {
+        return (Liveness::Untested, None);
+    }
+
+    // Both trials must be funded, or neither is meaningful. Checking up front
+    // avoids spending a baseline trial that the perturbed run then cannot match.
+    if probe.trials_remaining() < 2 {
+        return (Liveness::Untested, None);
+    }
+
+    let Some(baseline) = probe.run(nes, frames, observable, idle) else {
+        return (Liveness::Untested, None);
+    };
+    let Some(poked) = probe.run_perturbed(
+        nes,
+        frames,
+        observable,
+        |n| {
+            // `a` is in range: checked above, before any trial was spent.
+            let current = n.wram()[a];
+            n.wram_mut()[a] = perturbed_value(current);
+        },
+        idle,
+    ) else {
+        return (Liveness::Untested, None);
+    };
+
+    // A short vector means the budget cut a trial off. Comparing unequal-length
+    // runs would silently compare prefixes and could report "no divergence" for
+    // a run that simply stopped early.
+    if baseline.len() != poked.len() || baseline.is_empty() {
+        return (Liveness::Untested, None);
+    }
+
+    Probe::first_divergence(&baseline, &poked)
+        .map_or((Liveness::Inert, None), |f| (Liveness::Live, Some(f)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Build a single-address observation: `series` for `$0000`, everything else
+    /// held at zero. Keeps the classifier tests readable.
+    fn obs_of(series: &[u8]) -> Observation {
+        let frames = u32::try_from(series.len()).expect("test window is small");
+        let mut data = vec![0u8; WRAM_LEN * series.len()];
+        data[..series.len()].copy_from_slice(series);
+        Observation::from_addr_major(frames, data)
+    }
+
+    fn behaviour_of(series: &[u8]) -> Behaviour {
+        let obs = obs_of(series);
+        let stats = stats_for(obs.series(0));
+        classify_stats(&stats, obs.frames())
+    }
+
+    #[test]
+    fn a_constant_address_is_untouched() {
+        assert_eq!(behaviour_of(&[7, 7, 7, 7, 7, 7]), Behaviour::Untouched);
+    }
+
+    #[test]
+    fn a_value_changing_every_frame_is_a_frame_tick() {
+        assert_eq!(
+            behaviour_of(&[0, 1, 2, 3, 4, 5, 6, 7]),
+            Behaviour::FrameTick
+        );
+    }
+
+    /// A frame counter is monotonic, so it would also satisfy the rising-counter
+    /// test. `FrameTick` must win, because it is the more specific statement —
+    /// this pins the ordering inside `classify_stats`, which is otherwise easy to
+    /// "tidy" into the wrong answer.
+    #[test]
+    fn a_frame_counter_is_a_frame_tick_not_a_rising_counter() {
+        let stats = stats_for(&[0, 1, 2, 3, 4, 5, 6, 7]);
+        assert_eq!(stats.decreases, 0, "fixture is monotonic");
+        assert!(
+            stats.increases >= COUNTER_MIN_STEPS,
+            "fixture would qualify"
+        );
+        assert_eq!(
+            classify_stats(&stats, 8),
+            Behaviour::FrameTick,
+            "the more specific label lost to the more general one"
+        );
+    }
+
+    /// A score that rises in bursts, not every frame.
+    #[test]
+    fn an_intermittent_rise_is_a_rising_counter() {
+        assert_eq!(
+            behaviour_of(&[0, 0, 0, 5, 5, 5, 9, 9, 9, 12, 12, 12]),
+            Behaviour::RisingCounter
+        );
+    }
+
+    /// A timer counting down, likewise not every frame.
+    #[test]
+    fn an_intermittent_fall_is_a_falling_counter() {
+        assert_eq!(
+            behaviour_of(&[60, 60, 60, 59, 59, 59, 58, 58, 58, 57, 57, 57]),
+            Behaviour::FallingCounter
+        );
+    }
+
+    /// THE case that makes wrap handling load-bearing: a counter rolling
+    /// `0xFF -> 0x00` is still counting up. Without the wrap window that single
+    /// transition registers as a decrease and the address is demoted from
+    /// `RisingCounter` to `Volatile` — a real counter reported as churn.
+    #[test]
+    fn a_counter_that_wraps_is_still_monotonic() {
+        let series = [0xFD, 0xFD, 0xFE, 0xFE, 0xFF, 0xFF, 0x00, 0x00, 0x01, 0x01];
+        let stats = stats_for(&series);
+        assert_eq!(
+            stats.wraps, 1,
+            "the 0xFF -> 0x00 step was not seen as a wrap"
+        );
+        assert_eq!(stats.decreases, 0, "a wrap was miscounted as a decrease");
+        assert_eq!(behaviour_of(&series), Behaviour::RisingCounter);
+    }
+
+    #[test]
+    fn a_rare_change_is_sparse() {
+        let mut series = [3u8; 20];
+        series[10] = 2;
+        assert_eq!(behaviour_of(&series), Behaviour::Sparse);
+    }
+
+    /// Changing often in both directions, but not every frame.
+    #[test]
+    fn two_way_churn_is_volatile() {
+        let series = [0, 5, 5, 2, 2, 9, 9, 1, 1, 7, 7, 3, 3, 8, 8, 4];
+        let stats = stats_for(&series);
+        assert!(stats.increases > 0 && stats.decreases > 0, "fixture churns");
+        assert_eq!(behaviour_of(&series), Behaviour::Volatile);
+    }
+
+    /// A single step is not a counter. Two is the documented floor, and one step
+    /// is indistinguishable from any other one-off change.
+    #[test]
+    fn one_step_is_not_a_counter() {
+        let mut series = [1u8; 20];
+        for v in &mut series[10..] {
+            *v = 2;
+        }
+        let stats = stats_for(&series);
+        assert_eq!(stats.increases, 1);
+        assert_eq!(behaviour_of(&series), Behaviour::Sparse);
+    }
+
+    #[test]
+    fn stats_record_the_evidence() {
+        let stats = stats_for(&[10, 10, 12, 12, 11]);
+        assert_eq!(stats.changes, 2);
+        assert_eq!(stats.increases, 1);
+        assert_eq!(stats.decreases, 1);
+        assert_eq!(stats.min, 10);
+        assert_eq!(stats.max, 12);
+        assert_eq!(stats.distinct, 3);
+        assert_eq!(
+            stats.first_change,
+            Some(2),
+            "first_change must index the frame that CHANGED, not the one before it"
+        );
+    }
+
+    /// A perturbation must always actually perturb, or a "no divergence" result
+    /// would mean nothing. Checked across the whole byte domain because the two
+    /// fixed points of a naive scheme (`0x00` for multiply, `0xFF` for OR) are
+    /// exactly the values a real address is most likely to hold.
+    #[test]
+    fn perturbation_always_differs_from_the_original() {
+        for v in 0..=u8::MAX {
+            assert_ne!(perturbed_value(v), v, "perturbing {v:#04X} was a no-op");
+        }
+    }
+
+    #[test]
+    fn classify_labels_every_address_as_untested() {
+        let obs = obs_of(&[0, 1, 2, 3]);
+        let labels = classify(&obs);
+        assert_eq!(labels.len(), WRAM_LEN);
+        assert!(
+            labels.iter().all(|l| l.liveness == Liveness::Untested),
+            "observation alone must never claim liveness"
+        );
+        assert_eq!(labels[0].behaviour, Behaviour::FrameTick);
+        assert_eq!(labels[1].behaviour, Behaviour::Untouched);
+    }
+
+    /// Addresses must line up with their series. A transpose off by one row
+    /// would produce a fully-populated, entirely wrong atlas — plausible output
+    /// being the failure mode this tool most needs to avoid.
+    #[test]
+    fn the_transpose_keeps_addresses_aligned() {
+        let frames = 4usize;
+        let mut data = vec![0u8; WRAM_LEN * frames];
+        // $0010 counts up; $0011 counts down.
+        for f in 0..frames {
+            data[0x10 * frames + f] = u8::try_from(f).expect("small");
+            data[0x11 * frames + f] = u8::try_from(frames - f).expect("small");
+        }
+        let obs = Observation::from_addr_major(4, data);
+        assert_eq!(obs.series(0x10), &[0, 1, 2, 3]);
+        assert_eq!(obs.series(0x11), &[4, 3, 2, 1]);
+        let labels = classify(&obs);
+        assert_eq!(labels[0x10].behaviour, Behaviour::FrameTick);
+        assert_eq!(labels[0x11].behaviour, Behaviour::FrameTick);
+    }
+
+    #[test]
+    #[should_panic(expected = "address-major")]
+    fn a_misshaped_observation_panics() {
+        let _ = Observation::from_addr_major(4, vec![0u8; 10]);
+    }
+
+    // ---- integration: the whole path against a real `Nes` ------------------
+    //
+    // The classifier tests above use constructed series, which is right for
+    // pinning thresholds but proves nothing about `observe` and
+    // `verify_liveness` actually working. This project has repeatedly shipped
+    // features whose core logic was tested and whose wiring was not — pixel
+    // provenance and the attestation path both — so the wiring is tested here.
+
+    use crate::Budget;
+
+    /// A minimal NROM that spins forever, mirroring the crate-root fixture.
+    fn synth_nrom() -> Vec<u8> {
+        let mut bytes = Vec::new();
+        bytes.extend_from_slice(b"NES\x1A");
+        bytes.push(1);
+        bytes.push(1);
+        bytes.push(0);
+        bytes.push(0);
+        bytes.extend_from_slice(&[0u8; 8]);
+        let mut prg = vec![0u8; 16 * 1024];
+        prg[0] = 0x4C; // JMP $C000
+        prg[1] = 0x00;
+        prg[2] = 0xC0;
+        let len = prg.len();
+        prg[len - 6] = 0x00;
+        prg[len - 5] = 0xC0;
+        prg[len - 4] = 0x00; // RESET -> $C000
+        prg[len - 3] = 0xC0;
+        prg[len - 2] = 0x00;
+        prg[len - 1] = 0xC0;
+        bytes.extend_from_slice(&prg);
+        bytes.extend_from_slice(&vec![0u8; 8 * 1024]);
+        bytes
+    }
+
+    fn nes() -> Nes {
+        Nes::from_rom(&synth_nrom()).expect("fixture parses")
+    }
+
+    fn idle_input(_: u32) -> (Buttons, Buttons) {
+        (Buttons::empty(), Buttons::empty())
+    }
+
+    /// `observe` must produce a correctly-shaped observation from a real
+    /// emulator, and a ROM that only spins must classify as untouched
+    /// throughout. If the transpose or the capture were wrong, a do-nothing ROM
+    /// is the one case that would still look plausible — hence checking the
+    /// shape explicitly rather than only the labels.
+    #[test]
+    fn observing_a_spinning_rom_yields_an_untouched_atlas() {
+        let mut n = nes();
+        let obs = observe(&mut n, 6, idle_input);
+        assert_eq!(obs.frames(), 6);
+        assert_eq!(obs.series(0).len(), 6);
+        assert_eq!(
+            obs.series(0x7FF).len(),
+            6,
+            "the last address must be present"
+        );
+
+        let labels = classify(&obs);
+        assert_eq!(labels.len(), WRAM_LEN);
+        assert!(
+            labels.iter().all(|l| l.behaviour == Behaviour::Untouched),
+            "a ROM that only spins changed work RAM"
+        );
+        assert!(labels.iter().all(|l| l.liveness == Liveness::Untested));
+    }
+
+    /// Observing must not leak its frames into the caller's rewind ring.
+    ///
+    /// `observe` advances the live emulator and the caller rolls it back, so those
+    /// frames never happened on the user's timeline. Letting them into the ring
+    /// would allow rewinding *into an observation* — the same defect this crate
+    /// fixed for `verify_liveness` and then reintroduced one function away, caught
+    /// in review on PR #392.
+    ///
+    /// Mutation-checked: removing the `CaptureGuard` from `observe` fails this
+    /// with the ring grown by the window length.
+    #[test]
+    fn observing_does_not_pollute_the_callers_rewind_ring() {
+        let mut n = nes();
+        n.enable_rewind();
+        for _ in 0..3 {
+            n.run_frame();
+            n.rewind_capture();
+        }
+        let before = n.rewind_len();
+        assert!(before > 0, "fixture failed to buffer any rewind frames");
+
+        let _ = observe(&mut n, 12, idle_input);
+
+        assert_eq!(
+            n.rewind_len(),
+            before,
+            "an observation leaked its frames into the caller's rewind ring"
+        );
+        assert!(
+            n.rewind_capture_enabled(),
+            "observation left rewind capture disabled"
+        );
+    }
+
+    /// THE positive case for verification: a poke must reach the observable and
+    /// the divergence must be detected. Under `Observable::Wram` this is
+    /// guaranteed by construction — the poke IS a work-RAM change — which is
+    /// what makes it a clean test of the machinery rather than of the game.
+    #[test]
+    fn a_poke_is_live_under_the_wram_observable() {
+        let mut n = nes();
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let (liveness, frame) = verify_liveness(&mut probe, &mut n, 0x0010, 4, Observable::Wram);
+        assert_eq!(
+            liveness,
+            Liveness::Live,
+            "a work-RAM poke did not register as a work-RAM divergence"
+        );
+        assert_eq!(
+            frame,
+            Some(0),
+            "the poke lands before frame 0, so it must diverge on frame 0"
+        );
+    }
+
+    /// The matching negative case, and the reason `Liveness` is documented as
+    /// relative to its lens: the SAME poke on the SAME ROM is inert through the
+    /// framebuffer, because this fixture never draws from work RAM.
+    ///
+    /// This pair is what proves `Inert` is a real verdict rather than a stuck
+    /// default — one perturbation, two observables, opposite answers.
+    #[test]
+    fn the_same_poke_is_inert_under_the_framebuffer_observable() {
+        let mut n = nes();
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let (liveness, frame) =
+            verify_liveness(&mut probe, &mut n, 0x0010, 4, Observable::Framebuffer);
+        assert_eq!(liveness, Liveness::Inert);
+        assert_eq!(
+            frame, None,
+            "an inert verdict must carry no divergence frame"
+        );
+    }
+
+    /// An address outside work RAM must be `Untested`, never `Inert`.
+    ///
+    /// The old code skipped the perturbation for such an address and then let the
+    /// two identical trials agree, reporting `Inert` — a confident verdict for a
+    /// byte it never touched, which is precisely what this module documents itself
+    /// as never doing. `$0810` is a CPU-space mirror of `$0010` and a plausible
+    /// caller input. Raised in review on PR #392.
+    #[test]
+    fn an_address_outside_work_ram_is_untested_not_inert() {
+        let mut n = nes();
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let (liveness, frame) = verify_liveness(&mut probe, &mut n, 0x0810, 4, Observable::Wram);
+        assert_eq!(
+            liveness,
+            Liveness::Untested,
+            "an un-perturbable address was given a verdict"
+        );
+        assert_eq!(frame, None);
+        assert_eq!(
+            probe.trials_used(),
+            0,
+            "two trials were spent on an address that could not be perturbed"
+        );
+    }
+
+    /// A budget too small to fund both trials must report `Untested`, never
+    /// `Inert`. Collapsing those two is how a budget-limited sweep starts
+    /// reporting addresses it never looked at as dead.
+    #[test]
+    fn an_unaffordable_verification_is_untested_not_inert() {
+        let mut n = nes();
+        let budget = Budget {
+            max_trials: 1,
+            ..Budget::default()
+        };
+        let mut probe = Probe::anchor(&n, budget);
+        let (liveness, frame) = verify_liveness(&mut probe, &mut n, 0x0010, 4, Observable::Wram);
+        assert_eq!(
+            liveness,
+            Liveness::Untested,
+            "a verification that could not afford both trials claimed a verdict"
+        );
+        assert_eq!(frame, None);
+        assert_eq!(
+            probe.trials_used(),
+            0,
+            "an unaffordable verification must not spend a half-measurement"
+        );
+    }
+
+    /// Verification must not leave the caller's atlas sweep unable to continue:
+    /// each address costs exactly two trials, so the budget arithmetic a caller
+    /// does to size a sweep has to hold.
+    #[test]
+    fn verification_costs_exactly_two_trials() {
+        let mut n = nes();
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let before = probe.trials_used();
+        let _ = verify_liveness(&mut probe, &mut n, 0x0010, 2, Observable::Wram);
+        assert_eq!(
+            probe.trials_used() - before,
+            2,
+            "a caller sizing a sweep by trials-per-address would mis-budget"
+        );
+    }
+}
diff --git a/crates/rustynes-probe/src/lib.rs b/crates/rustynes-probe/src/lib.rs
index 805de056..2445a126 100644
--- a/crates/rustynes-probe/src/lib.rs
+++ b/crates/rustynes-probe/src/lib.rs
@@ -58,6 +58,7 @@
 //! # }
 //! ```
 
+pub mod atlas;
 pub mod latency;
 
 use rustynes_core::{Buttons, Nes, ROM_HASH_TAG_LEN};
@@ -188,15 +189,17 @@ impl Probe {
     /// from, or if the anchor fails to restore. Both are caller errors that
     /// would otherwise yield a plausible, wrong answer, and this engine exists
     /// to produce answers people will act on.
-    fn run_uncounted<F>(
+    fn run_uncounted<F, S>(
         &self,
         nes: &mut Nes,
         frames: u32,
         observable: Observable,
+        setup: S,
         mut input: F,
     ) -> Vec<u64>
     where
         F: FnMut(u32) -> (Buttons, Buttons),
+        S: FnOnce(&mut Nes),
     {
         assert_eq!(
             nes.rom_hash_tag(),
@@ -204,19 +207,52 @@ impl Probe {
             "probe anchor belongs to a different ROM than the emulator it was \
              replayed into; restoring across ROMs yields confident nonsense"
         );
-        nes.restore(&self.snapshot)
+        // `restore_quiet`, NOT `restore`. The loud variant additionally clears
+        // the rewind ring, on the correct reasoning that a state loaded from
+        // elsewhere is unrelated to what was buffered. That reasoning does not
+        // hold for a probe: the anchor was snapshotted from this same timeline,
+        // and a trial ends by putting it back.
+        //
+        // This was a real, user-visible bug. `latency::measure_in_place` runs up
+        // to 21 trials against the LIVE emulator, so asking "how much input lag
+        // does this game have?" silently destroyed the user's rewind history
+        // twenty-one times over. PR #385 review caught the symptom and the fix
+        // there changed only `measure_in_place`'s FINAL restore — which left
+        // every trial's restore, the actual source, untouched. Fixed here at the
+        // one site all trials share.
+        nes.restore_quiet(&self.snapshot)
             .expect("probe anchor round-trips: it came from Nes::snapshot");
 
+        // A trial's frames are re-simulated: they never happened on the user's
+        // timeline. Letting them into the rewind ring would let the user rewind
+        // *into a measurement* — the same reason run-ahead suppresses capture
+        // around its hidden frames. Suppressed for the trial and restored to
+        // whatever the caller had, not to an assumed `true`, so a caller who had
+        // deliberately disabled capture does not get it switched back on.
+        //
+        // Held by a guard rather than restored at the end of the function, so an
+        // unwinding panic anywhere in the trial cannot leave capture switched off
+        // on a `Nes` the caller keeps using. That failure would be silent and
+        // durable: rewind would simply stop recording, with nothing to indicate
+        // why. (PR #392 review.)
+        let guard = CaptureGuard::suppress(nes);
+
+        // The perturbation, if any: applied to the freshly-restored anchor before
+        // frame 0, so it is the ONLY difference between this trial and a
+        // baseline one. That is what lets a divergence be attributed to it.
+        setup(guard.nes);
+
         let n = frames.min(self.budget.max_frames_per_trial);
         let mut samples = Vec::with_capacity(n as usize);
         // Generously sized so one frame always fits: an NTSC frame at 192 kHz is
-        // ~3,200 samples. Allocated once per trial, not per frame.
+        // ~3,200 samples. Allocated once per trial, not per frame, and reused as
+        // the drain target via `drain_audio_into`.
         let mut audio = vec![0.0f32; 8192];
         for f in 0..n {
             let (p1, p2) = input(f);
-            nes.set_buttons(0, p1);
-            nes.set_buttons(1, p2);
-            nes.run_frame();
+            guard.nes.set_buttons(0, p1);
+            guard.nes.set_buttons(1, p2);
+            guard.nes.run_frame();
             // Drain EVERY frame, whatever the observable. `Nes::restore` does
             // drop the blip's pending queue (verified by
             // `tests/restore_audio_pin.rs`), so trials cannot contaminate each
@@ -224,10 +260,25 @@ impl Probe {
             // safety depend on restore's audio semantics staying as they are,
             // and let a 120-frame framebuffer trial pile up ~88k samples for
             // nothing. Raised in review on #384.
-            audio.clear();
-
-            samples.push(sample(nes, observable, &audio));
+            //
+            // v2.3.6: this was `audio.clear()` and nothing else — the buffer was
+            // emptied and never filled, so `sample` summed an EMPTY slice and
+            // `Observable::AudioEnergy` reported zero energy on every frame of
+            // every trial. Two trials therefore always agreed under that
+            // observable, which made the audio lens incapable of detecting any
+            // divergence: `latency`'s audio fallback silently never fired, and the
+            // RAM Atlas's audio lens would have reported EVERY address `Inert` —
+            // a confident wrong verdict, from a comment that said "drain" beside
+            // code that did not. Caught in review on PR #392.
+            // Samples actually written by this frame's drain. `audio` keeps its
+            // full capacity, so `sample` gets only the populated prefix — passing
+            // the whole buffer would mix this frame's samples with stale trailing
+            // zeros and make the energy depend on buffer length rather than audio.
+            let audio_len = guard.nes.drain_audio_into(&mut audio);
+
+            samples.push(sample(guard.nes, observable, &audio[..audio_len]));
         }
+        // `guard` restores the caller's capture setting as it drops here.
         samples
     }
 
@@ -256,7 +307,37 @@ impl Probe {
             return None;
         }
         self.trials_used += 1;
-        Some(self.run_uncounted(nes, frames, observable, input))
+        Some(self.run_uncounted(nes, frames, observable, |_| {}, input))
+    }
+
+    /// Restore the anchor, apply `setup`, then run one **budgeted** trial.
+    ///
+    /// `setup` sees the emulator with the anchor freshly restored and before any
+    /// frame has run, so whatever it changes is the only difference between this
+    /// trial and a baseline [`Self::run`]. That is precisely what licenses
+    /// attributing a divergence to it — the RAM Atlas pokes one work-RAM byte
+    /// here and asks whether the screen then differs.
+    ///
+    /// Counts against the same trial budget as [`Self::run`]: a perturbation
+    /// sweep is the easiest way to spend an unbounded number of trials, so it
+    /// must not have a cheaper path to the emulator than anything else.
+    pub fn run_perturbed<F, S>(
+        &mut self,
+        nes: &mut Nes,
+        frames: u32,
+        observable: Observable,
+        setup: S,
+        input: F,
+    ) -> Option<Vec<u64>>
+    where
+        F: FnMut(u32) -> (Buttons, Buttons),
+        S: FnOnce(&mut Nes),
+    {
+        if self.trials_remaining() == 0 {
+            return None;
+        }
+        self.trials_used += 1;
+        Some(self.run_uncounted(nes, frames, observable, setup, input))
     }
 
     /// The first frame index at which two trials differ, or `None` if they agree
@@ -284,6 +365,46 @@ impl Probe {
     }
 }
 
+/// Suppresses rewind capture for the lifetime of a trial and restores the
+/// caller's setting on drop — including on an unwinding panic.
+///
+/// A plain save-and-restore around the trial body is correct on the happy path
+/// and wrong on the unwind: a panic inside `Nes::run_frame` or the perturbation
+/// closure would skip the restore and leave capture switched off on a `Nes` the
+/// caller keeps using. Rewind would then stop recording silently, with nothing
+/// to indicate why.
+///
+/// Worth contrasting with the `Drop` guard declined for
+/// `latency::measure_in_place` on PR #385, because the reasoning genuinely
+/// differs rather than being applied inconsistently. There, the guard would have
+/// had to restore a snapshot — a fallible operation — and `Drop` cannot return a
+/// `Result`, so it would have reintroduced the silent failure that review had
+/// just asked to remove. Here the restored value is a `bool` and the operation is
+/// infallible, so the guard has no downside at all. And the release profile's
+/// `panic = "abort"` argument does not rescue this case either: in a build that
+/// does unwind, this flag outlives the panic, whereas an advanced timeline in a
+/// dying process does not.
+pub(crate) struct CaptureGuard<'a> {
+    pub(crate) nes: &'a mut Nes,
+    restore_to: bool,
+}
+
+impl<'a> CaptureGuard<'a> {
+    pub(crate) const fn suppress(nes: &'a mut Nes) -> Self {
+        // The caller's setting, not an assumed `true`: someone who deliberately
+        // disabled capture must not have it switched back on by a probe.
+        let restore_to = nes.rewind_capture_enabled();
+        nes.set_rewind_capture(false);
+        Self { nes, restore_to }
+    }
+}
+
+impl Drop for CaptureGuard<'_> {
+    fn drop(&mut self) {
+        self.nes.set_rewind_capture(self.restore_to);
+    }
+}
+
 /// Reduce the emulator's current state to one comparable value.
 fn sample(nes: &Nes, observable: Observable, audio: &[f32]) -> u64 {
     match observable {
@@ -298,19 +419,27 @@ fn sample(nes: &Nes, observable: Observable, audio: &[f32]) -> u64 {
             h
         }
         Observable::Wram => fnv1a64(nes.wram()),
-        Observable::AudioEnergy => {
-            // Quantised sum of |amplitude|. Exact float equality across a
-            // resampled stream would compare noise; this asks the coarser
-            // question the fallback is for — "did this frame make a
-            // meaningfully different sound?".
-            let energy: f32 = audio.iter().map(|s| s.abs()).sum();
-            #[allow(clippy::cast_possible_truncation, clippy::cast_sign_loss)]
-            let q = (energy * 64.0) as u64;
-            q
-        }
+        Observable::AudioEnergy => audio_energy(audio),
     }
 }
 
+/// Quantised sum of |amplitude| for one frame of drained audio.
+///
+/// Exact float equality across a resampled stream would compare noise; this asks
+/// the coarser question the fallback is for — "did this frame make a meaningfully
+/// different sound?".
+///
+/// Extracted from [`sample`] so its dependence on its input can be tested without
+/// a ROM that makes noise. That matters because the trial loop once handed this an
+/// always-empty slice, and a lens returning a constant is invisible to every test
+/// that only compares trials to each other: constants always agree. (PR #392.)
+fn audio_energy(audio: &[f32]) -> u64 {
+    let energy: f32 = audio.iter().map(|s| s.abs()).sum();
+    #[allow(clippy::cast_possible_truncation, clippy::cast_sign_loss)]
+    let q = (energy * 64.0) as u64;
+    q
+}
+
 const FNV_OFFSET: u64 = 0xcbf2_9ce4_8422_2325;
 const FNV_PRIME: u64 = 0x0000_0100_0000_01b3;
 
@@ -557,6 +686,173 @@ mod tests {
         assert!(!Probe::agree(&a, &b));
     }
 
+    /// A trial must not destroy the caller's rewind history.
+    ///
+    /// `latency::measure_in_place` runs up to 21 trials against the **live**
+    /// emulator, so a loud `restore` here means asking "how much input lag does
+    /// this game have?" wipes the user's rewind buffer twenty-one times over.
+    /// PR #385 review caught the symptom; the fix there changed only
+    /// `measure_in_place`'s final restore and left every trial's restore — the
+    /// actual source — untouched, so the bug survived a fix that claimed it.
+    ///
+    /// The ring must come back **exactly** as it was: neither cleared nor grown.
+    /// Growth is its own defect — a trial's frames are re-simulated and never
+    /// happened on the user's timeline, so rewinding into them would be rewinding
+    /// into a measurement.
+    ///
+    /// Mutation-checked in both directions: swapping `restore_quiet` back to
+    /// `restore` fails this at `rewind_len()` 0, and removing the
+    /// `set_rewind_capture(false)` guard fails it at 10 against 8.
+    #[test]
+    fn a_trial_preserves_the_callers_rewind_ring() {
+        let mut n = nes();
+        n.enable_rewind();
+        for _ in 0..4 {
+            n.run_frame();
+            n.rewind_capture();
+        }
+        let before = n.rewind_len();
+        assert!(before > 0, "fixture failed to buffer any rewind frames");
+
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let _ = probe
+            .run(&mut n, 2, Observable::Wram, idle)
+            .expect("within budget");
+
+        assert_eq!(
+            n.rewind_len(),
+            before,
+            "running a probe trial cleared the caller's rewind ring; a trial \
+             restores its own anchor onto the same timeline and has no business \
+             invalidating history the user recorded"
+        );
+    }
+
+    /// An unwinding panic inside a trial must still restore the caller's rewind
+    /// capture setting.
+    ///
+    /// Without the RAII guard this leaves capture switched OFF on a `Nes` the
+    /// caller keeps using, and rewind then stops recording silently with nothing
+    /// to indicate why. Raised in review on PR #392.
+    ///
+    /// The panic is injected through the perturbation closure, which is the one
+    /// caller-supplied hook that runs inside the guarded region. Mutation-checked:
+    /// replacing the guard with a save-and-restore around the trial body fails
+    /// this test.
+    #[test]
+    fn a_panic_inside_a_trial_still_restores_rewind_capture() {
+        let mut n = nes();
+        assert!(
+            n.rewind_capture_enabled(),
+            "fixture starts with capture armed"
+        );
+
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let _ = probe.run_perturbed(
+                &mut n,
+                4,
+                Observable::Wram,
+                |_| panic!("injected mid-trial failure"),
+                idle,
+            );
+        }));
+        assert!(result.is_err(), "the injected panic did not propagate");
+
+        assert!(
+            n.rewind_capture_enabled(),
+            "a panic inside a trial left rewind capture disabled; the caller's \
+             rewind would silently stop recording"
+        );
+    }
+
+    /// The trial loop must actually DRAIN audio each frame.
+    ///
+    /// This is the wiring test, and it is the one that was missing. The sibling
+    /// test below proves `audio_energy` responds to its input, but it calls that
+    /// function directly — so it passes with the drain removed, which is exactly
+    /// how the bug survived: core logic tested, plumbing not.
+    ///
+    /// Asserted through the emulator's own queue rather than through the samples:
+    /// this fixture is silent, so drained audio is all zeros and hashes identically
+    /// to an empty slice. What *is* observable is the residue. If the loop drains
+    /// every frame, the queue is empty when the trial ends; if it never drains, the
+    /// queue holds the whole trial's audio.
+    ///
+    /// Mutation-checked: removing the `drain_audio_into` call fails this with
+    /// thousands of samples left pending.
+    #[test]
+    fn a_trial_drains_audio_every_frame() {
+        let mut n = nes();
+        let mut probe = Probe::anchor(&n, Budget::default());
+        let _ = probe
+            .run(&mut n, 8, Observable::Framebuffer, idle)
+            .expect("within budget");
+
+        let residue = n.drain_audio().len();
+        assert_eq!(
+            residue, 0,
+            "a trial left {residue} audio samples pending; the per-frame drain \
+             did not run, so `Observable::AudioEnergy` would see an empty slice \
+             and report the same value on every frame of every trial"
+        );
+    }
+
+    /// The audio observable's value must depend on the samples it is given.
+    ///
+    /// Direct on `sample`, because that is where the empty-slice bug lived and it
+    /// can be proven without a ROM that makes noise.
+    #[test]
+    fn the_audio_observable_reflects_drained_samples() {
+        let empty = super::audio_energy(&[]);
+        let quiet = super::audio_energy(&[0.0, 0.0, 0.0]);
+        let loud = super::audio_energy(&[0.4, -0.4, 0.4]);
+        assert_ne!(
+            loud, empty,
+            "audio energy of a non-silent buffer matched an EMPTY buffer; the \
+             observable cannot distinguish audio from a missing drain"
+        );
+        assert_ne!(loud, quiet, "audio energy did not respond to amplitude");
+    }
+
+    /// A caller's rewind configuration must not change what a trial MEASURES.
+    ///
+    /// This is the question that decides whether the rewind fix above
+    /// invalidated earlier results. Before it, every trial ran with capture
+    /// enabled and the ring being cleared; after it, capture is suppressed and
+    /// the ring is left alone. If either had perturbed emulation, samples taken
+    /// under the two regimes would differ — and every measurement predating the
+    /// fix would need re-running.
+    ///
+    /// One anchor, two trials, rewind armed between them: the probe restores the
+    /// same emulation state both times, so any difference in the sample vectors
+    /// is attributable to the rewind machinery alone.
+    #[test]
+    fn a_trials_samples_are_independent_of_the_callers_rewind_state() {
+        let mut n = nes();
+        let mut probe = Probe::anchor(&n, Budget::default());
+
+        let without = probe
+            .run(&mut n, 8, Observable::Framebuffer, idle)
+            .expect("within budget");
+
+        n.enable_rewind();
+        for _ in 0..3 {
+            n.run_frame();
+            n.rewind_capture();
+        }
+        let with_ring = probe
+            .run(&mut n, 8, Observable::Framebuffer, idle)
+            .expect("within budget");
+
+        assert_eq!(
+            without, with_ring,
+            "a trial's samples changed when the caller armed rewind; the rewind \
+             machinery is perturbing emulation, and every probe result taken \
+             under a different rewind configuration would be suspect"
+        );
+    }
+
     /// Replaying an anchor into an emulator running a different ROM must fail
     /// loudly. A snapshot restored across ROMs would produce a confident, wrong
     /// answer, which is worse than no answer for a tool people act on.