diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md
index f455b82..289406b 100644
--- a/dwt/notes/CROSS.md
+++ b/dwt/notes/CROSS.md
@@ -125,3 +125,42 @@ four-entry DWT parser (`TEST/INIT/HELP/SHOW`, `rdebug-static.md` §9). It is
 parser, so it cannot reach `rdebug_peek`/`poke`/`jump`; those are TCP port 771
 and gated (`rdebug-static.md` §1/§7). Use this client for the documented
 console, not as an rdebug transport.
+
+## 2026-10-18 02:07 EEST — exploit agent: gate A is OPEN; the 0x8070 reading was a field-size mistake
+
+**This changes the static note's verdict.** `accept_debug_conn` does **not** read a
+16-bit word.  The listing is:
+
+```
+3f58b280:	setf   2, 0, 0          ; field size = 2 BITS (MAME prints 1..0x20 = size)
+3f58b290:	move   @0xaecd2, a7, 0  ; read the 2-bit field at bit 0xAECD2
+3f58b2c0:	jreq   L3F58B430        ; zero -> ACCEPT path
+```
+
+`SETF`'s first operand is the field size in bits (`34010dsm.cpp` prints
+`(op & 0x1f) ? op & 0x1f : 0x20`); `setf 2` = 2 bits.  The compared value is
+therefore **bits 2..3 of the word at 0xAECD0**, not the whole word.  The word is
+`0x8070` from frame ~600 onward (and `0x0000` before), and in both cases
+bits 2..3 are **0**.
+
+Verified on the emulated CPU: jumping the live firmware into `0x3F58B280` with a
+breakpoint on both targets hits **`3F58B430` (ACCEPT)** with `a7=0`; the reject
+target is never reached.  Evidence: `dwt/evidence/run-branch/`.
+
+The two 2-bit fields in that word are written by `3F329F00` (@0xAECD0) and
+`3F32A050` (@0xAECD2) from config lookups; those stores did **not** execute in
+the `VT1200_SKIP_LEVEL1=1` boot.  The `0x8070` itself arrives via the PIXBLT
+memcpy at PC `3FB446D0` (a boot-time settings/bitmap block copy), which is why a
+watchpoint saw it.  Do not use the whole-word value as a gate indicator.
+
+**Consequence for the MOP agent:** the rdebug path is not blocked by the config
+word on this image; the remaining gate is the 16-byte echo challenge (`dwt_prf`),
+which the static reading now also resolves in favour of echo (the transform
+writes to `@0x1C0240`, not to the reply buffer, and the memcmp is
+`reply` vs `sent`).  Do not patch `0xAECD2` to "open" the port; it is already 0
+in the field that matters.
+
+**Tap:** no vt1200 MAME instance or tcpdump is running as of 02:07.  I am about
+to use `tap-mess-1000-0` / bridge `vt1200` for a short live TCP test.  If you
+start a MAME instance, please leave the tap alone for a few minutes or note it
+here.