route: map1_01a -> map2_02d; writer 0x005428bc; reader 0x00542b0c.
active flag 0x00457744; static 0x01; save offset 0x006c; startup init 0x00411300.
all predecessor starts pass: True; prior selectionBuffer still primary blocker under predecessor hypothesis: False; promotion status blocked.
The active-selection flag evidence removes one static unknown from the 0x005428bc writer: the EXE/startup default for 0x00457744 is 1, so opcode 0x12 normally starts from the prior selectionBuffer[0x20] value. However, 0x00457744 is also save offset 0x006c and can be overwritten by a loaded save. More importantly, the prior start slot is not the decisive blocker under the strongest predecessor-fill hypothesis: if 1:0 leaves secondaryBranchState as [1,1,0..], both activeFlag=1 for every possible prior slot and activeFlag=0 from zero select a passing slot. Without that predecessor/runtime table proof, opcode 0x12 still only selects a nonzero state, and state value 2 would fail the 0x00542b0c reader. Promotion therefore remains blocked on predecessor execution/state persistence, the gated control path, and a strict map1_01a hotspot.
| active flag | start source | start slot | selected slot | selected value | reader falls through |
|---|---|---|---|---|---|
| 1 | prior selectionBuffer[0x20] | 0 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 1 | 1 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 2 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 3 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 4 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 5 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 6 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 7 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 8 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 9 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 10 | 0 | 1 | yes |
| 1 | prior selectionBuffer[0x20] | 11 | 0 | 1 | yes |
| 0 | forced zero | 0 | 0 | 1 | yes |
| start slot | selected slot | selected value | reader falls through | meaning |
|---|---|---|---|---|
| 0 | 0 | 2 | no | opcode 0x12 can select a nonzero state value that is not the reader's required value 1 |
| 1 | 1 | 2 | no | the active flag can change the search start, but it cannot convert state value 2 into pass value 1 |