{"source":"map1_01a","target":"map2_02d","gateOffsetsHex":["0xe8","0xea"],"expectedIndexRange":[0,11],"partySlotStrideHex":"0x00d8","candidateCount":12,"partySlotStatByteCandidateCount":4,"directRefCandidateCount":0,"runtimePointerModeStillRequired":true,"proofFound":false,"gateBaseCandidateProofFound":false,"failedGateBaseCandidateGateIds":["save-runtime-gate-byte-route-sample","party-slot-branch-state-index","runtime-pointer-mode-proof","control-path-gate-base-proof"],"missingEvidence":["current selector 2:0 save/runtime sample proving save-runtime gate bytes","party-slot byte mapping that yields a valid branch-state index instead of stat bytes","runtime pointer-mode proof selecting the correct context+0xa8 base","control-path proof that the resolved gate base enables current frontier fallthrough"],"evidenceRefs":[{"path":"out/save_selector_gate_offset_sources.json","description":"current gate offsets and inherited/runtime gate-source classification"},{"path":"out/save_selector_selection_buffer_bases.json","description":"candidate context+0xa8 base modes and static address reference checks"},{"path":"tools/parse_savedata.py","description":"save-block and field-offset schema used for loader-aware byte classification"}],"evidenceRefCount":3,"promotionStatus":"blocked","baseCandidates":[{"baseKind":"global selection buffer","slot":null,"gateVaHex":"0x005428c4","gateOffset":232,"gateOffsetHex":"0xe8","runtimeBaseHex":"0x0059e310","runtimeAddressHex":"0x0059e3f8","saveBacked":false,"runtimeSaveBlock":null,"runtimeBlockOffsetHex":null,"saveOffset":null,"saveOffsetHex":null,"knownField":null,"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"unresolved-global-buffer"},{"baseKind":"save/runtime block base","slot":null,"gateVaHex":"0x005428c4","gateOffset":232,"gateOffsetHex":"0xe8","runtimeBaseHex":"0x004576d8","runtimeAddressHex":"0x004577c0","saveBacked":true,"runtimeSaveBlock":"partyAndStats","runtimeBlockOffsetHex":"0x0070","saveOffset":226,"saveOffsetHex":"0x00e2","knownField":{"field":"unknown within partyAndStats save block","fieldOffset":226,"fieldOffsetHex":"0x00e2","fieldSize":1,"byteRole":"unmapped-byte"},"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"save-backed-unmapped-byte"},{"baseKind":"party slot base","slot":0,"gateVaHex":"0x005428c4","gateOffset":232,"gateOffsetHex":"0xe8","runtimeBaseHex":"0x00457750","runtimeAddressHex":"0x00457838","saveBacked":true,"runtimeSaveBlock":"partyAndStats","runtimeBlockOffsetHex":"0x00e8","saveOffset":346,"saveOffsetHex":"0x015a","knownField":{"field":"Rinshan MP recover","fieldOffset":346,"fieldOffsetHex":"0x015a","fieldSize":2,"byteRole":"low-byte"},"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"implausible-stat-byte-index"},{"baseKind":"party slot base","slot":1,"gateVaHex":"0x005428c4","gateOffset":232,"gateOffsetHex":"0xe8","runtimeBaseHex":"0x00457828","runtimeAddressHex":"0x00457910","saveBacked":true,"runtimeSaveBlock":"partyAndStats","runtimeBlockOffsetHex":"0x01c0","saveOffset":562,"saveOffsetHex":"0x0232","knownField":{"field":"Smashu MP recover","fieldOffset":562,"fieldOffsetHex":"0x0232","fieldSize":2,"byteRole":"low-byte"},"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"implausible-stat-byte-index"},{"baseKind":"party slot base","slot":2,"gateVaHex":"0x005428c4","gateOffset":232,"gateOffsetHex":"0xe8","runtimeBaseHex":"0x00457900","runtimeAddressHex":"0x004579e8","saveBacked":true,"runtimeSaveBlock":null,"runtimeBlockOffsetHex":null,"saveOffset":null,"saveOffsetHex":null,"knownField":null,"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"party-slot-byte-needs-runtime-proof"},{"baseKind":"runtime object pointer table","slot":null,"gateVaHex":"0x005428c4","gateOffset":232,"gateOffsetHex":"0xe8","runtimeBaseHex":"dword[0x0059db30+i*4] or dword[0x0059dd70+i*4]","runtimeAddressHex":"-","saveBacked":false,"saveBaseHex":null,"saveOffset":null,"saveOffsetHex":null,"knownField":null,"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"unresolved-pointer-table-base"},{"baseKind":"global selection buffer","slot":null,"gateVaHex":"0x005428cc","gateOffset":234,"gateOffsetHex":"0xea","runtimeBaseHex":"0x0059e310","runtimeAddressHex":"0x0059e3fa","saveBacked":false,"runtimeSaveBlock":null,"runtimeBlockOffsetHex":null,"saveOffset":null,"saveOffsetHex":null,"knownField":null,"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"unresolved-global-buffer"},{"baseKind":"save/runtime block base","slot":null,"gateVaHex":"0x005428cc","gateOffset":234,"gateOffsetHex":"0xea","runtimeBaseHex":"0x004576d8","runtimeAddressHex":"0x004577c2","saveBacked":true,"runtimeSaveBlock":"partyAndStats","runtimeBlockOffsetHex":"0x0072","saveOffset":228,"saveOffsetHex":"0x00e4","knownField":{"field":"unknown within partyAndStats save block","fieldOffset":228,"fieldOffsetHex":"0x00e4","fieldSize":1,"byteRole":"unmapped-byte"},"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"save-backed-unmapped-byte"},{"baseKind":"party slot base","slot":0,"gateVaHex":"0x005428cc","gateOffset":234,"gateOffsetHex":"0xea","runtimeBaseHex":"0x00457750","runtimeAddressHex":"0x0045783a","saveBacked":true,"runtimeSaveBlock":"partyAndStats","runtimeBlockOffsetHex":"0x00ea","saveOffset":348,"saveOffsetHex":"0x015c","knownField":{"field":"Rinshan MP maximum","fieldOffset":348,"fieldOffsetHex":"0x015c","fieldSize":2,"byteRole":"low-byte"},"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"implausible-stat-byte-index"},{"baseKind":"party slot base","slot":1,"gateVaHex":"0x005428cc","gateOffset":234,"gateOffsetHex":"0xea","runtimeBaseHex":"0x00457828","runtimeAddressHex":"0x00457912","saveBacked":true,"runtimeSaveBlock":"partyAndStats","runtimeBlockOffsetHex":"0x01c2","saveOffset":564,"saveOffsetHex":"0x0234","knownField":{"field":"Smashu MP maximum","fieldOffset":564,"fieldOffsetHex":"0x0234","fieldSize":2,"byteRole":"low-byte"},"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"implausible-stat-byte-index"},{"baseKind":"party slot base","slot":2,"gateVaHex":"0x005428cc","gateOffset":234,"gateOffsetHex":"0xea","runtimeBaseHex":"0x00457900","runtimeAddressHex":"0x004579ea","saveBacked":true,"runtimeSaveBlock":null,"runtimeBlockOffsetHex":null,"saveOffset":null,"saveOffsetHex":null,"knownField":null,"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"party-slot-byte-needs-runtime-proof"},{"baseKind":"runtime object pointer table","slot":null,"gateVaHex":"0x005428cc","gateOffset":234,"gateOffsetHex":"0xea","runtimeBaseHex":"dword[0x0059db30+i*4] or dword[0x0059dd70+i*4]","runtimeAddressHex":"-","saveBacked":false,"saveBaseHex":null,"saveOffset":null,"saveOffsetHex":null,"knownField":null,"expectedIndexRange":"0..11","directDwordRefCount":0,"classification":"unresolved-pointer-table-base"}],"conclusion":"Mapping the gate offsets through known context+0xa8 base candidates weakens the party-slot-base path: for party slots, 0xe8/0xea land on later character MP/stat bytes such as Rinshan and Smashu MP fields, not on documented selector-index bytes. Since opcode 0x11 expects a branch-state slot index in the 0..11 range, those stat-byte mappings are not promotion evidence. Loader-aware save/runtime mapping also matters here: 0x004576d8+0xe8/0xea falls into the second loaded save block after the six-byte runtime gap, so those bytes map to save offsets 0x00e2/0x00e4 rather than linear offsets 0x00e8/0x00ea. The viable sources remain an unresolved global/save-runtime buffer or object pointer table mode, so control-flow proof is still blocked."}