{"kind":"hwanse-hud-menu-opener-boundary-review","status":"payloads-grounded-normal-field-opener-unproven","source":["out/menu_cancel_window_consumer_review.json","out/menu_descriptor_stack_review.json","out/menu_right_panel_ui_review.json","out/status_menu_ui_expression_review.json","out/status_menu_vm_table_review.json","out/status_comment_selector_binding_review.json","out/menu_descriptor_stack_review.json:strictInventoryOpenerProbe","tools/build_hud_menu_opener_boundary_review.py"],"summary":{"surfaceCount":9,"confirmedSurfaceCount":7,"normalFieldEscOpenerProven":false,"topMenuObjectSequenceVaHex":"0x004ddc6c","topMenuObjectSequenceFieldEscOpenerRefs":0,"topRegionScriptDataHits":0,"exactTopContextInitializerRows":3,"strictInventoryDescriptorAddScripts":0,"strictInventoryCancelOpScripts":0,"cancelMaskDescriptorAddStreamCandidates":0,"cancelMaskDescriptorAddStreamScannedStarts":0,"addRoutineNonOpcodeCallCount":0,"removeRoutineNonOpcodeCallCount":0,"cancelConsumerGrounded":true,"rightMenuPayloadGrounded":true,"decision":"ESC/X 입력 bit, cancel consumer, region/template, descriptor stack, status/right-menu payload는 확정됐다. strict active-object inventory에는 opener가 없다는 음성 증거도 확보했다. 남은 것은 정상 필드 상태에서 ESC/X가 top-menu object sequence를 materialize하는 exact opener root다."},"surfaces":[{"surface":"keyboard cancel/back action","promotion":"confirmed-input-consumer","artifact":"menu_cancel_window_consumer_review.json","finding":"input packer 0x0042f6d2, edge mask 0x0059e312; cancel action 9 bit 0x0200; consumer opcode 0x9f handler 0x0040c6cc.","gap":"취소/뒤로가기 consumer는 확정이지만, 필드에서 최초 상태창을 여는 opener는 아니다."},{"surface":"window region draw / template binding","promotion":"confirmed-regions","artifact":"menu_right_panel_ui_review.json + menu_cancel_window_consumer_review.json","finding":"normal HUD regions [1, 2]; top menu candidates [3, 4, 6]; right menu region count 5.","gap":"region #1/#2/#3/#4/#6 위치와 window template은 확정됐지만, opener root와는 별도다."},{"surface":"status left region #6 payload","promotion":"confirmed-payload","artifact":"status_menu_ui_expression_review.json","finding":"payload 0x004e842e..0x004e85fc; region 6; actor row 0x00457750 stride 0xd8; stat coverage 12/12.","gap":"상태창 그리기 core는 확정됐지만, ESC/X opener 선택 시점은 별도 producer다."},{"surface":"right menu #2/#3/#4 payload","promotion":"confirmed-payload / opener-pending","artifact":"menu_right_panel_ui_review.json","finding":"status=top-menu-object-and-right-content-payload-grounded-opener-pending; evidence rows 28; top menu icons #0,#1,#2,#3,#8,#4 and sub-list/page models are grounded.","gap":"payload 자체는 top-menu object construction에 attach되지만 normal-field opener는 아직 없다."},{"surface":"shared active descriptor stack","promotion":"confirmed-materializer / opener-blocked","artifact":"menu_descriptor_stack_review.json","finding":"add 0x00431fe8; remove 0x00432541; active count 0x004576e8; slot table 0x00457750; topMenuObjectSequence 0x004ddc6c; add callers opcode/non-opcode 1/0; remove callers opcode/non-opcode 1/0.","gap":"field ESC opener refs 0; direct refs 1 (the only direct ref currently lands in the intro/title resource context, not the normal-field ESC/X opener). The add/remove materializers are reached only through opcode handlers, so the opener must be an upstream command stream/root rather than a direct x86 caller."},{"surface":"strict active-object inventory opener exclusion","promotion":"negative-static-proof / opener-outside-inventory","artifact":"menu_descriptor_stack_review.json:strictInventoryOpenerProbe","finding":"script count 722; stack-op scripts 3; input-like scripts 2; descriptor-add scripts 0; cancel-op scripts 0.","gap":"strict active-object +0xec inventory 안에는 0x62 descriptor-add와 0x9f cancel/back이 없다. 정상 필드 opener는 higher-level field controller 또는 mode/state dispatcher 쪽으로 밀린다."},{"surface":"same-stream ESC/X cancel + descriptor-add probe","promotion":"negative-static-proof / simple-stream-opener-excluded","artifact":"hud_menu_opener_boundary_review.json:cancelMaskDescriptorAddStreamScan","finding":"mask 0x00000200; scope .data/.rdata stream starts within 0x40 bytes before opcode 0x1d cancel-mask branches; scanned starts 0; candidate streams 0.","gap":"No .data/.rdata linear command stream was found with opcode 0x1d using the confirmed ESC/X action bit directly.  The opener likely consumes the packed input bit through x86/control state first, then reaches descriptor materialization indirectly."},{"surface":"status/menu 0x40 VM tables","promotion":"confirmed-table-shapes / producers-pending","artifact":"status_menu_vm_table_review.json","finding":"opcode14 tables 3; opcode13 tables 16; branch lists 3; promotion table-shapes-grounded-producers-pending.","gap":"각 table shape은 확정됐지만, 현재 선택 actor/menu/page를 계산하는 root producer는 별도다."},{"surface":"status short-comment selector","promotion":"confirmed-selector-array / producer-pending","artifact":"status_comment_selector_binding_review.json","finding":"comment groups 9; actor tables 21; selector array count 9; all blocks matched True.","gap":"producer status inline-vm-array-consumer-grounded-producer-pending."}],"cancelMaskDescriptorAddStreamScan":{"status":"scanned","maskHex":"0x00000200","candidateCount":0,"scannedStartCount":0,"scanScope":".data/.rdata stream starts within 0x40 bytes before opcode 0x1d cancel-mask branches","candidates":[],"interpretation":"No .data/.rdata linear command stream was found with opcode 0x1d using the confirmed ESC/X action bit directly.  The opener likely consumes the packed input bit through x86/control state first, then reaches descriptor materialization indirectly."},"nextFrontier":["field controller/input edge mask consumer 주변에서 action 9 bit가 cancel이 아니라 menu-open으로 분기되는 script/root를 찾는다.","topMenuObjectSequence 0x004ddc6c의 direct ref가 intro/title context뿐인 이유를 분리하고 indirect descriptor-add path를 추적한다.","confirmed cancel mask 0x00000200과 descriptor-add 0x62가 같은 linear stream에 없으므로, opener는 같은 command-list 안의 단순 패턴이 아니라 state/mode dispatcher 또는 selected-root 경유일 가능성이 높다.","strict active-object inventory는 제외됐으므로 higher-level field controller 또는 mode/state dispatcher 쪽 descriptor-add materializer를 찾는다.","정적 field controller의 input-action dispatch 표면에서 active descriptor count/order와 object sequence pointer write producer를 찾는다."]}