$E06C ($5C6C) and $E06D ($5C6D) are NOT part of the pointer table below -- they are two independent 1-bit trigger flags, each tested/consumed via RLC (HL)+RET C/NC: $5C6C by es_attribute_fade_in ($E42E), $5C6D by the handshake frame-advance code at $E472/handshake_table. RLC both tests bit 7 (into carry) and rotates it into bit 0, so each read self-clears/advances the flag -- confirmed via skool cross-reference (LD HL,$5C6C at $E42E and $E472; LD HL,$5C6D at $E3BA and $E46D)

Still unidentified (3 bytes, values $01,$3F,$96) -- confirmed dead end: grepped for literal $5C6E/$5C6F/$5C70 operands across the full static bank-7 disassembly and the entire trace-end-screen.log execution capture, zero hits either way. Not reached by any direct-addressed instruction in the code disassembled so far; either accessed only via computed/indexed addressing not yet spotted, read by common-RAM code outside bank 7, or genuinely unused padding

Pointer table for the congratulations text: three pointers packed tight ($E071-$E076), then a 2-byte gap, then a fourth pointer ($E079-$E07A), then a trailing byte. Bytes at $E071-$E072, $E073-$E074, $E075-$E076, $E079-$E07A are little-endian relocated pointers $5C7C/$5CA5/$5CD0/$5CE8 -- relocating back (+$8400) gives $E07C/$E0A5/$E0D0/$E0E8, an exact match to the four text strings below

Gap between pointer 3 and pointer 4 ($FF,$03) -- same confirmed dead end as $E06E: no literal $5C77/$5C78 operand anywhere in bank 7's static disassembly or trace-end-screen.log. $FF matches the terminator convention seen elsewhere (see $F8F5 SFX table), possibly a record separator/duration byte rather than table padding, but unproven