diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7cca60a..8416b08 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -87,7 +87,9 @@ function(add_mmx_variant TARGET GEN_DIR CFG_DIR)
 endfunction()
 set_property(SOURCE src/main.c APPEND PROPERTY COMPILE_DEFINITIONS
     SNESRECOMP_BUILD_VERSION="${SNESRECOMP_BUILD_VERSION}")
-add_mmx_variant(MegaManXSNESRecomp "${CMAKE_CURRENT_SOURCE_DIR}/src/gen"
+set(MMX_GEN_DIR "${CMAKE_CURRENT_SOURCE_DIR}/src/gen" CACHE PATH
+    "Generated USA program directory (allows isolated coverage comparisons)")
+add_mmx_variant(MegaManXSNESRecomp "${MMX_GEN_DIR}"
     "${CMAKE_CURRENT_SOURCE_DIR}/recomp")
 add_mmx_variant(RockmanXSNESRecomp "${CMAKE_CURRENT_SOURCE_DIR}/variants/jp/gen"
     "${CMAKE_CURRENT_SOURCE_DIR}/variants/jp/config"
diff --git a/docs/validation/coverage-2026-09-28.md b/docs/validation/coverage-2026-09-28.md
new file mode 100644
index 0000000..b2c4a7d
--- /dev/null
+++ b/docs/validation/coverage-2026-09-28.md
@@ -0,0 +1,46 @@
+# Mega Man X coverage checkpoint
+
+Study base: `b3210a6` (current origin/main, 1.6.6). Engine: snesrecomp `3e73b07`
+on `feat/coverage-feedback`. The owner passed the initial and extended stage
+playtests; integration is in progress.
+
+Two 12,000-frame routes (attract and controller Highway gameplay/fuzz) match the
+existing-root control's CPU/WRAM traces and final three full WRAM/video/resource
+snapshots. Capture on/off also matches. Checkpoint plus journal imports remain
+identical when duplicated, and program/executable identities match. No runtime
+or ingest warnings occurred. Audio waveforms were not compared.
+
+The corrected reconciliation retains all 243 original roots and adds four,
+but they were already in the analysis closure. Static variants remain 4,708;
+interpreted instructions remain 10,985,081 (attract) and 13,985,348 (Highway).
+No coverage or performance gain is claimed. An earlier apparent increase to
+5,309 entries was entirely duplicate mirrors and was rejected. The shared
+discovery fix canonicalizes only proven mapper aliases; raw logs and live PBR
+are retained. Existing title hook checks remain strict and pass unchanged.
+
+`MMX_GEN_DIR` selects isolated generated trees. Approved three-title work from
+the preceding study remains in separate checkpoints. This MMX commit changes
+build selection and records evidence. The integration below installs the
+dependency pins and profile migration. Regenerate complete
+output: the current balanced fallback API requires explicit entry semantics.
+
+Conversion/reconciliation and full commands are documented in the engine's
+`docs/COVERAGE_FEEDBACK.md` and `docs/validation/mmx-2026-09-28.md` / `.json`.
+V1 input `recomp/tier2_coverage.json` must be explicitly associated with the
+verified headerless USA v1.1 ROM SHA-256
+`b8f70a6e7fb93819f79693578887e2c11e196bdf1ac6ddc7cb924b1ad0be2d32`.
+Use it as `--historical-profile-manifest`, alongside new same-build JSON/journal
+`--profile-manifest` inputs. Old evidence supplies analysis seeds, not a claim
+that the new generated build is correct. Fresh replay remains required.
+
+Local artifacts: engine `build/authority-study/mmx/`; interactive profile:
+`build-coverage-playtest/`. No ROMs, generated C or player saves are committed.
+Beads: `beads-8wg.1.27`.
+
+Integration: the engine is pinned to `8867499d28543e74cd31134abae9468a88675847`, and the UI to
+`01bff9477e6847b2281260f0a9526a85e45b8ba2`, matching the validated build dependency.
+The regeneration script explicitly binds each regional v1 profile to its
+known ROM hash and treats it as historical seed evidence. USA generation
+retains the same analyzed nodes/exit facts and 4,708 static entry variants;
+both final 12,000-frame replays match the owner-approved candidate.
+Japan profile migration is wired; the gameplay qualification here is USA.
diff --git a/recomp-ui b/recomp-ui
index 2946678..01bff94 160000
--- a/recomp-ui
+++ b/recomp-ui
@@ -1 +1 @@
-Subproject commit 294667885a3be25bd6a06eb37eeaec6a5149cc16
+Subproject commit 01bff9477e6847b2281260f0a9526a85e45b8ba2
diff --git a/snesrecomp b/snesrecomp
index 6c8fd2e..8867499 160000
--- a/snesrecomp
+++ b/snesrecomp
@@ -1 +1 @@
-Subproject commit 6c8fd2e95009e6bd3635af956ea18cacaa1fd29a
+Subproject commit 8867499d28543e74cd31134abae9468a88675847
diff --git a/tools/regen.sh b/tools/regen.sh
index 62ad6ec..ac960b5 100644
--- a/tools/regen.sh
+++ b/tools/regen.sh
@@ -81,7 +81,8 @@ regen_variant() {
       cfg_dir="recomp"
       out_dir="src/gen"
       funcs_h="recomp/funcs.h"
-      emit_extra=(--profile-manifest recomp/tier2_coverage.json)
+      emit_extra=(--historical-profile-manifest recomp/tier2_coverage.json
+                  --legacy-profile-rom-sha256 b8f70a6e7fb93819f79693578887e2c11e196bdf1ac6ddc7cb924b1ad0be2d32)
       ;;
     jp)
       rom="variants/jp/roms/rockmanx.sfc"
@@ -92,7 +93,8 @@ regen_variant() {
       # optional HLE scheduler contains region-specific addresses. Its own
       # clean LLE observations are the authoritative AOT optimization profile.
       emit_extra=(--no-host-root-scan
-                  --profile-manifest variants/jp/tier2_coverage.json)
+                  --historical-profile-manifest variants/jp/tier2_coverage.json
+                  --legacy-profile-rom-sha256 76f80cdf704a0e1daf1af5bbf564e427b425a5ee42329417de6f29219fe63e5f)
       ;;
   esac