Martin, the loose spline is simulated with the off centre roller on the nose of a S&G lock, but you know it already. But an actual loose spline is a nightmare. They could make a lock with a similar "defect", if mechanical locks were still interesting for manufacturers.
jarveee, I don't have one, but a couple of colleagues have their own and I can borrow one if I need it. With this safe, it saved me!

The idea is to reach the latest point that I can read. I touch the contact point and read, then touch it again a couple times until it no longer moves. That should give me a consistent reading, since the spline key is at its movement range limit.
I knew what was going on inside the lock, so the first graph wasn't that difficult to make. It took more time than a normal graph because I had to read the contact points multiple times. It was clear there was a gate at L9.
The high low tests were unclear, and I decided to make them again. The gate at L 9 could be on wheel #1 or #2. I needed a break.
A few days later I decided to make the second graph with both wheel #1 and #2 at L9, testing only wheel #3 Around Left.
I obviously had to dial AWL, then made almost two turns Right so I could test wheel #3 Around Left, starting at 10, much more convenient since it's the normal dialing direction.
There's nothing wrong in checking a wheel the other way around, but then you have to convert the gate center and there's always the risk to make a mistake.
This graph was rich in extra contact points, so I traced a line across the most external points to get a better view.
It became clear that wheel #3 had a gate at L26!
Now it's time to decide the next step. I could brute force wheel #2 and if it fails brute force wheel #1, second choice because it takes longer.
Or I could test a few combos to see if I can determine if the gate at L9 is on wheel #1 or #2.
Cheers
