Two class-header words are base-relative offsets pointing past the tie packets

Chasing where the AD-GIF is, since f43a1c2 established it is not in the packet.
Two of the undecoded class-header words are offsets.

base + 0x1c and base + 0x34 land inside core_data on 1,864 of 1,864 classes, so
both are relative to the class base rather than absolute, and both are non-zero
on every class. Both also land **past** that class's own tie packet blocks on
every class, so they address per-class data held elsewhere in core_data rather
than the tie geometry.

That is consistent with f43a1c2: if the packet's own control region is not a tag
stream, the per-class draw state is referenced from somewhere else.

WHAT IS THERE, AND WHAT IS NOT CLAIMED

The bytes are structured, not random -- class 3 shows a fixed-stride table with
`80 01 00` recurring, class 2's field is a monotone byte table, class 5's has
`38 38 38` and `ff 00 ff ff`. They read like compiled shader programs with
small-integer parameters, or lookup tables.

**Not identified, and deliberately not named.** None of those three fragments has
been run against a control, and all three were picked because they looked like
something. That is precisely the finding rule 4 refuses, and having spent this
session on four retractions I would rather record an honest "structured,
unidentified" than a plausible format that has not earned it. If any of these
turns out to be a shader program the next step is a control, not a better-looking
hex dump.

ALSO SETTLED

0x24 is demonstrably not an offset: only 17 of 1,864 of its values land in range
for core_data. Recorded as packed data. 0x28, 0x2c, 0x38 remain high-entropy and
unexplained.

281 passing with the disc present (23 + 19 + 61 + 156 + 22), clippy clean.

crates/gc-formats/src/tie.rs

@@ -111,8 +111,14 @@ impl TieClassHeader {
         //               bfc_distance is flat across every bucket.
         //   0x40        a float -- 0.00208 to 10.84, no negatives. The bounding
         //               sphere radius or the class scale; not distinguished.
-        // 0x1c, 0x34 look like offsets (0x1e0..0x3cd60, 0x190..0x31e20) and
-        // 0x24, 0x28, 0x2c, 0x38 are high-entropy. Unidentified.
+        // 0x1c and 0x34 are base-relative offsets: base + offset lands inside
+        // core_data on 1,864 of 1,864 classes, and always *past* the class's own
+        // tie packet blocks, so they address per-class data stored elsewhere.
+        // The bytes there are structured -- repeating small-integer records,
+        // occasional `ff 00 ff ff` -- but are not VIF or GIF DMA tags and are
+        // not identified. See tie_class_tail_offsets_point_past_the_tie_packets.
+        // 0x24, 0x28, 0x2c, 0x38 are high-entropy and unidentified; 0x24 is
+        // demonstrably not an offset (17 of 1,864 land in range).
         b.skip(0x44 - 0x1c, "tie class fields not decoded yet")?;
         let o_class = b.i32("tie class number")?;
         Ok(TieClassHeader {