Manipulating memory in AIZ2 to perform a cutscene skip skip

NOTE: this explanation occasionally references Sonic Retro's publicly available Sonic 3 & Knuckles disassembly (for example, 'check Obj_Level_6C2C' which means check the code under the label 'Obj_Level_6C2C'). If you feel adventurous enough to check the references (and also my work here as well), you can download the disassembly here: https://github.com/sonicretro/skdisasm and then browse through the 'sonic3k.asm' file

INTRODUCTION
In Angel Island 2, if playing as Sonic, Sonic&Tails or Tails, to the right of the boss arena, there's a button on a cliff unaccessible to the player which is part of the Knuckles cutscene. In normal gameplay, once the boss is defeated, there is a little cutscene that plays out, where the character moves to a nearby bridge, looks up to see Knuckles start mischievously laughing before pushing the aforementioned button. This causes the bridge to collapse, the player to fall down, and after a few second, transition to Hydrocity 1.

In the past however, there have been instances of players accidentally somehow triggering the bridge collapsing animation early (visually noticeable as well by having the camera unlock vertically). If this happened while the boss was still active, it meant that the player would fall to their doom once the cutscene started. However, if this happened after the boss was defeated, it meant that the player would essentially skip the bit of the cutscene where Knuckles pushes down the button, saving approximately five and a half seconds in an RTA speedrun setting. Although the same time save could be obtained by resetting after the score tally is over and loading from a save file, doing so prevents the player from achieving the complete Carnival Night 2 ceiling ending, as you are prevented from making it to the boss arena by a wall that fully blocks the path; which in order to fix requires running back down to the normal playfield (and then either continuing glitchless or with a slight modification continuing to use wheel glitch to go the boss area), both losing a considerable amount of time. As such, if the described cutscene skip setup could be achieved consistently, it would allow players to do both a cutscene skip and do the complete ceiling strat, as opposed to having to choose one or the other.

HOW IT WORKS
The game has different slots reserved in memory for all objects it needs to currently keep track on and all its properties. We can number them 0, 1, 2, 3, 4, etc. Like Sonic 2, slots 0 and 1 are for players 1 and 2, and slot 2 is reserved for level handling. However, any object can take slots 3 forward (as opposed to only slots $10 forward), and when they spawn, they will spawn in the earliest available slot. In particular, the cutscene Knuckles object, when spawned, will take one of the slots 3, 4, 5, ..., and will then store in another RAM Address ($FFFAA4) the slot number it has been assigned to, so that all objects that somehow rely on Knuckles can use this RAM Address to be able to do their things. In particular, the button uses this RAM value to be able to obtain Knuckles' x and y coordinates, as the way the button becomes pushed is if those x and y coordinates are within a certain range of the button (a box of size $60).

There is one important thing to note though, $FFFAA4 is only cleared when a new zone is loaded, or you restart an act from a death, special stage, or bonus stage. It is not cleared when Knuckles despawns nor between acts of the same zone. As such, if at some point this address was set to some slot, all objects that actively query this address will consider the object that is related to the slot, even if that object is not Knuckles itself. For our purposes, that means that if that address is not properly reset, the button will be looking at whatever object the slot stored in $FFFAA4 contains, even if it is not Knuckles or if there is no Knuckles loaded.

Conveniently, $FFFAA4 is improperly not cleared by the time the AIZ2 cutscene starts, as a result of the cutscene that happens at the start of AIZ1, where Knuckles kicks you out of the Super form and steals all the Chaos Emeralds away from you. At this moment, $FFFAA4 is set to B1BC, which corresponds to slot 5 (as that is the slot Knuckles takes when spawning). Given that you have no control whatsoever before Knuckles appears, he will always spawn in that same slot every time. Therefore, if you spawn the button by moving far enough to the right in the boss arena without having triggered Knuckles' apparition (which normally happens once you make it to the midpoint of the collapsing bridge), the button will be looking for any object in slot 5 in order to do its pushing routine if needed (i.e. any object in slot 5 close enough to the button will push it).

And what thing can we force to spawn in slot 5 that is close enough to the button? Robotnik never gets close enough, the fireballs are either too low, the bridge is not close enough either, and the sparkles from the lightning shield get ever so close but not quite if the camera is locked, and by the time we can get them to be close enough, the cutscene has already started and you do not have control. Fortunately, there is one laughably silly solution: have the button itself take slot 5. As the distance from the button to the same button is zero, if the button spawns in slot 5, the button believes the button to be Knuckles and that it is in the proper range, so what ends up happening is that the button pushes itself.

FORCING
We would like to find a way to have the button take slot 5 once it spawns, ideally with as little time loss as possible. Fortunately for us, the tube that comes before the ship cutscene is long enough so that there is always one point at which there are no objects in memory other than the players. As such, we need not worry about how we play up to that point, the only thing we need to consider is not dying on the way to the AIZ2 boss and not entering any Bonus Stage nor Special Stage (as any of those actions will clear $FFFAA4). That means however that, if we do not do anything to prevent it, the ship with all of its controller objects will take slots 3 through 5, and will throw off everything that comes later. Fortunately, we can do the first memory manipulation just before it spawns: by performing a double jump with the lightning shield, we can create four temporary sparkle objects (loc_19874) in order to prevent the ship objects from taking slots 3 through 5.

Now for the interesting bit, we want to have objects that stick around in slot 3 and 4 at the time the button spawns, as it will force the button to take slot 5, provided that slot 5 is empty. Some of the best candidates are: a path swapper located just after the seventh tree pair (loc_1CD3C, later loc_1CD8A), another path swapper located just before the left bridge, the logs from the bridge (loc_2AEE2 and loc_2AEB4), and the left and right posts from the left bridge (loc_2B962).

*The "left" path swapper spawns at the seventh tree pair and despawns at the eleventh tree pair, so it's no good.
*The bridge logs spawn a frame after the first path swapper despawns, and despawns as they go offscreen due to them being burned, so they are no good either.
*The right post spawns at the last tree pair and does not despawn, so it's no good either.
*The "right" path swapper and the left post spawn after you go past the tenth tree pair respectively and despawn a frame after the button spawns, so if these two take slots 3 and 4, we are good to go. We will call these objects 'good'.

In the important slot 5 we would like to either have no objects or have an object that despawns before the cutscene, but spawns before all other persistent objects spawn (so that we can guarantee slot 5 being empty as the button spawns). As there are plenty of objects that will spawn and despawn during the boss fight and act transition, we have to take the second option. One good example would be the aforementioned collapsing bridge logs at the boss arena, whose spawning and despawning moments where described beforehand. If we do that, all objects other than the 'good' objects that spawn from now on will despawn before the cutscene starts (even objects that take slot 5, such as the bridge logs), and when that happens, as slots 3 and 4 are taken with our good objects, the switch will take slot 5, and we are done.

In order to guarantee that, we need to force our good objects to take slots 3 and 4. The only objects that spawn and despawn while running past the trees (which is really the only moment we need to care about) are the path swappers, the bridge posts, and the bridge logs. The only object that spawns before the good objects is the other path swapper, and as this path swapper does not despawn before the good objects spawn, if we have that bad path swapper take slot 3, the good objects will take slots 4 and 5, thus ruining the strat. Fortunately, we can do the second memory manipulation bit here: by braking at the point where the first path swapper would spawn (the seventh tree pair), we create dust particles (loc_18b3e) that temporarily take slot 3 away from the bad path swapper. As these dust particles despawn way before the good objects spawn and there are no other bad objects, this should be sufficient.

SONIC & TAILS
However, if playing with Sonic&Tails, as soon as the cutscene starts, Tails will spawn an additional object (loc_863D6) that locks the 2P controls so that a second player cannot manipulate Tails during the cutscene; as such, it would seem as if we can make only one of those good objects take slots 3 or 4, we'd be done. Unfortunately, that is not really possible, as the good objects spawn and despawn simultaneously. However, we can take advantage of other candidate objects that were originally discarded: in particular, the left path swapper and the right post. If we keep the left path swapper in slot 3 and have slots 4 and 5 empty long enough, what will happen is that eventually the bridge logs will take slots 4 and 5, the path swapper will free up slot 3, and eventually the right bridge post will take slot 3. There are no other bad persistent objects that will spawn before the bridge logs collapse (i.e. everything from now on will despawn just before the cutscene starts) so as soon as the cutscene starts, the Tails exclusive object will take slot 4, and the switch will take slot 5 as needed.

Therefore, in order to do that, we must keep the left path swapper in slot 3 and prevent the good objects from taking slots 4 and 5. As such, we can modify our memory manipulation bit to not brake at the seventh tree pair (which we used to do to prevent the left path swapper from taking slot 3), but to brake at the tenth tree instead (which is the point where the 'good' objects would spawn), so that the good objects spawn in higher slots, thus allowing for the bridge logs to take slots 4 and 5, and then the right bridge post to take slot 3, which is exactly what we wanted.

VIDEOS
There are two videos I have made that should be watched for a clearer understanding of what is going on:
*https://youtu.be/91V7xy10pRE Showcases the strats, including onscreen explanations. Ideal if you are just interested in learning the strats.
*https://youtu.be/7RjK32Gj4Gg Showcases the strats with a complementary view of what object is taking what slot at all instants. Includes a 'normal' gameplay, 'Sonic Solo' CS Skip method, 'Sonic & Tails' doing the Solo CS Skip method, and 'Sonic & Tails' doing the modified CS Skip method.

GENERALIZING
Unfortunately, the bridge collapsing and the camera unlocking is not enough for an early HZ1 transition. These other criteria must be satisfied: the boss must be defeated (check sub_69BE2, loc_69C36 and further calls), the post-boss flag ($FFFAA8) must not be set: which is set after capsule appears and cleared after the score tally disappears (check loc_694D4), and player control must be unlocked (check loc_69588). All of these conditions are satisfied if the boss is defeated while he is all the way to the left burning the bridge down or in its leftmost 'attack' position where he just shoots fireballs at the player, and as far as I could tell, not in any other way. Note that in the following list, when I say 'camera is unlocked', I mean the camera is unlocked 'vertically' as a result of the right bridge collapsing due to the button pushing itself, not horizontally due to Robotnik having completely burned the bridge down.

*If the camera is unlocked during the boss fight and you manually drop off the boss area before defeating it, you will not advance as you have not defeated the boss, which is a condition for the objects that handle the transition to appear (check sub_69BE2).
*If the camera is unlocked during the boss fight or just after the boss is defeated, you defeat the boss, then quickly drop off the boss area, you will not advance as the required objects to handle the transition rely on a timer to spawn, and by the time that timer runs out, the post-boss flag is already set, preventing you from advancing (check loc_69C36 and loc_694D4).
*If the camera is unlocked during the boss fight or at any point before the tally goes offscreen, you defeat the boss, wait for a bit, then manually drop off, you will not advance as the post-boss flag is set (check loc_694D4).
*If the camera is unlocked during the boss fight or at any point before the tally goes offscreen, you defeat the boss and let the cutscene start playing out, you will not advance as the cutscene locks the controls and we never get control back (controls are unlocked only when the button is pushed; check loc_65C56; and this only happens once due to the object changing to a dummy object afterwards; check loc_65C18).

ENDING
That is all there is to the explanation of how the trick works and how to deduce the two methods I have come up with. I know I have gone really overboard explaining that deduction bit, as I know full well that you do not really need to know how one comes up with this, or how it works behind the scene, in order to replicate the cutscene skip skip, which only really saves a few seconds. However, I claim that letting the general public know the thought process and the gory details allows for a deeper understanding of the game, fully accounts for 'how in the world did this person come up with this?' questions (especially given that the setups and the reasoning behind them are both exceedingly non-trivial), and allows for future exploration of the trick and possible new applications elsewhere. Memory manipulation is not often considered in Sonic games due to them being generally very difficult to generate consistent strats for. As such, fully explaining how I eventually came up with this method I believe will allow for future glitch hunters to develop more memory manipulation techniques that will help communities that heavily use glitches (such as speedrunners) and further enhance their knowledge of the games.