@@ -11,20 +11,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **AccuracySNES: the Mesen oracle's root cause — the battery hangs at `A3.03`.** Under MesenCE it
-  completes **14 of 335** tests and stops; snes9x runs all 335. Index 14 is `A3.03` "PLD escapes,
-  PLY not".
+- **AccuracySNES: the Mesen oracle's stopping point, and a hardened `A3.03`.** Under MesenCE the
+  battery writes **14 of 335** status bytes and stops; snes9x runs all 335. By catalogue order index
+  14 is `A3.03` "PLD escapes, PLY not" — but hardening its stack handling did **not** move the
+  number, so that hypothesis is wrong and the root cause is still open.
 
   This corrects two earlier conclusions. It is **not** the frame budget (4000 fails as 900 did), and
   it is **not** the Lua-to-emulator memory bridge — the bridge works, and is how the 14 was counted,
   by scanning the per-test status array at timeout. The magic never reading `ACSN` was a symptom of
   the battery never getting far enough to write it.
 
-  `A3.03` sets `S = $01FF`, enters emulation and executes `PLD`, asserting it escapes page 1. The
-  test's own control flow then rides on that stack, so a core confining the stack differently
-  produces a wrong *return address* rather than a wrong verdict, and the cart runs away instead of
-  scoring. Fix direction recorded in `docs/accuracysnes-plan.md`: rows that hand-load `S` must
-  restore a known-good stack before anything that returns.
+  `A3.03` is hardened regardless, on its own merits: it hand-loads `S` and then runs assertions that
+  need the stack, so on a core confining the stack differently the divergence would land in the
+  return address rather than the verdict. The caller's `S` is now stashed and restored through long
+  addressing before any assertion branches. Generalised in the plan — rows that hand-load `S` must
+  restore a known-good stack before anything that returns — but it is not the oracle's fix.
 
 - **AccuracySNES: the Mesen2 oracle diagnosed, and a stale frame budget aligned.** Three `v1.28.0`
   items ended at "no oracle can arbitrate", so the headless runner was investigated rather than
 
@@ -480,8 +480,21 @@ not *impossible*.
 
 ### The Mesen oracle — the battery hangs at `A3.03` (`v1.29.0`)
 
-**Root cause found.** Under MesenCE the battery completes **14 of 335** tests and stops; snes9x runs
-all 335. Index 14 is **`A3.03` "PLD escapes, PLY not"**.
+**Stopping point found; root cause NOT yet.** Under MesenCE the battery writes **14 of 335** status
+bytes and stops; snes9x runs all 335. By catalogue order index 14 is `A3.03` "PLD escapes, PLY not",
+which made its stack handling the obvious suspect.
+
+**That hypothesis was tested and is wrong.** `A3.03` hand-loads `S` and then runs assertions that
+need the stack, so a core confining the stack differently would corrupt the return path rather than
+the verdict. It has been hardened accordingly — the caller's `S` is stashed and restored through long
+addressing before any assertion branches — and MesenCE still stops at **14**. The hardening is kept
+on its own merits (a row that hand-loads `S` and then asserts is fragile whatever the host does), but
+it is **not** the fix and must not be recorded as one.
+
+What remains unknown is what actually stalls at or after index 14. Two things to check next, in
+order: whether the status array is written in catalogue order at all — the whole index-to-test
+mapping rests on that and it has not been verified — and, if it is, what `A3.03` does that MesenCE
+does not return from, since the stack is no longer a candidate.
 
 Two earlier conclusions were wrong and are corrected here:
 
 
@@ -715,9 +715,18 @@ CATALOG_IMPL = 1
     .i16
     ; E=1, S=$01FF. PLD (new) pulls from $0200/$0201; PLY (old) pulls from $0100.
     ; This pair is the cleanest test of the emulation-mode stack-confinement rule.
+    ; 
+    ; BOTH halves hand-load S and then run an assertion, and an assertion needs the stack. On a
+    ; core that confines the stack differently the divergence lands in the RETURN ADDRESS, not
+    ; in the verdict, so the cart runs away instead of scoring -- and every later test is lost
+    ; with it. That is exactly what MesenCE did: the battery stopped here, 14 of 335 in, and the
+    ; host saw only an unattributed timeout. So the caller's S is stashed first and restored
+    ; through long addressing (no stack) the instant the measured value is safely in WRAM.
     rep #$30
     .a16
     .i16
+    tsc
+    sta f:$7E00C0     ; the caller's stack pointer, to be restored before any jsr/rts
     sep #$20
     .a8
     lda #$AB
@@ -745,11 +754,18 @@ CATALOG_IMPL = 1
     .a16
     .i16
     tdc
+    sta f:$7E00C2     ; park the reading BEFORE touching the stack
+    lda f:$7E00C0
+    tcs               ; stack restored: the assertion below can safely branch
+    lda f:$7E00C2
     cmp #$CDAB
     beq :+
     jmp @fail1
   :
     ; --- PLY: must NOT escape ---
+    rep #$30
+    .a16
+    .i16
     lda #$0000
     tcd
     lda #$01FF
@@ -766,6 +782,13 @@ CATALOG_IMPL = 1
     rep #$30
     .a16
     .i16
+    ; STY/LDY have no long-addressing form, so the parking goes through A.
+    tya
+    sta f:$7E00C4     ; park Y before the stack is touched
+    lda f:$7E00C0
+    tcs               ; and restore the caller's stack
+    lda f:$7E00C4
+    tay
     cpy #$005E
     beq :+
     jmp @fail2
 
@@ -749,7 +749,18 @@ fn a3_03() -> Test {
     let mut a = Asm::new();
     a.c("E=1, S=$01FF. PLD (new) pulls from $0200/$0201; PLY (old) pulls from $0100.");
     a.c("This pair is the cleanest test of the emulation-mode stack-confinement rule.");
+    a.c("");
+    a.c(
+        "BOTH halves hand-load S and then run an assertion, and an assertion needs the stack. On a",
+    );
+    a.c("core that confines the stack differently the divergence lands in the RETURN ADDRESS, not");
+    a.c("in the verdict, so the cart runs away instead of scoring -- and every later test is lost");
+    a.c("with it. That is exactly what MesenCE did: the battery stopped here, 14 of 335 in, and the");
+    a.c("host saw only an unattributed timeout. So the caller's S is stashed first and restored");
+    a.c("through long addressing (no stack) the instant the measured value is safely in WRAM.");
     a.l("rep #$30");
+    a.l("tsc");
+    a.l("sta f:$7E00C0     ; the caller's stack pointer, to be restored before any jsr/rts");
     a.l("sep #$20");
     a.l("lda #$AB");
     a.l("sta f:$7E0200");
@@ -766,11 +777,16 @@ fn a3_03() -> Test {
     a.enter_native();
     a.l("rep #$30");
     a.l("tdc");
+    a.l("sta f:$7E00C2     ; park the reading BEFORE touching the stack");
+    a.l("lda f:$7E00C0");
+    a.l("tcs               ; stack restored: the assertion below can safely branch");
+    a.l("lda f:$7E00C2");
     a.assert_a16(
         0xCDAB,
         "PLD did not pull from $0200/$0201 (it must escape page 1)",
     );
     a.c("--- PLY: must NOT escape ---");
+    a.l("rep #$30");
     a.l("lda #$0000");
     a.l("tcd");
     a.l("lda #$01FF");
@@ -779,6 +795,13 @@ fn a3_03() -> Test {
     a.l("ply               ; 8-bit index in emulation");
     a.enter_native();
     a.l("rep #$30");
+    a.c("STY/LDY have no long-addressing form, so the parking goes through A.");
+    a.l("tya");
+    a.l("sta f:$7E00C4     ; park Y before the stack is touched");
+    a.l("lda f:$7E00C0");
+    a.l("tcs               ; and restore the caller's stack");
+    a.l("lda f:$7E00C4");
+    a.l("tay");
     a.assert_y16(
         0x005E,
         "PLY escaped page 1 (old instructions must wrap to $0100)",