Save Selector Gate Base Proof Gap

route map1_01a -> map2_02d; current writer 0x005428bc; opcode 0x20 candidate 0x005428a8; handler signatures 7/7; nested dispatcher uses general table True; nested runner swaps context stream True; context+0xf2 refs/read/write 204/141/63; context+0xf2 object selectors 16; context+0xf2 runtime table required True; local direct base setters before gate 0; descriptor+4 specific gate base proven False; descriptor+4 encoded route-target scalars 0/0/0; all descriptor-script gate writers/readers 0/0; all descriptor-script selection-buffer opcode-shaped rows 362; all descriptor-script encoded route-target scalars 0/0/0; all descriptor-script specific gate base proven False; diagnostic active order gate base proven False; diagnostic active-order recheck route hits 125/0/0; diagnostic active-order recheck count 0x00x679; diagnostic active-order recheck gate base still unproven True; public predecessor active order gate base proven False; public predecessor left-overrun active order gate base proven False; proof found False; gate base proof found False; active order proof found False; gate-time base proof found False; failed gate-base gates opcode20-runtime-base-path,predecessor-state-persistence,strict-source-hotspot; missing evidence count 3; evidence refs 19; gate pass if save/runtime base and predecessor state False; promotion status blocked.

The current gate pass calculation only becomes useful if the gate-time context+0xa8 base is known. The local stream before 0x005428c4 has no direct context+0xa8 base setter; the only base-affecting candidate in the activation window is opcode 0x20 at 0x005428a8, which runs runtime descriptor+4 nested scripts through the general handler table. The opcode 0x20 handler signature scan confirms that this row uses the descriptor+4 nested stream shape, and the nested runner swaps into the general dispatcher rather than executing the save-selector stream inline. Static descriptor scanning finds no descriptor+4 field-map records, no direct or encoded-scalar current-frontier/route refs, and no 0xe8/0xea gate readers or writers. The same gate-offset count is zero across descriptor+0, descriptor+4, and descriptor+8 scripts even though those scripts contain 362 selection-buffer opcode-shaped rows, so the active descriptor order alone cannot prove this route. The patched selector 2:0 diagnostic active order selects descriptor 0x004f867c, but its descriptor+4 script has no field-map/current-frontier/gate rows and its last context+0xa8 setter is a pointer-dword-low-byte-collision, so that diagnostic path is also non-promoting. A public predecessor direction sweep reaches selector 1:0 with active order 0x01/[0x00] and the same descriptor 0x004f867c, but it still does not reach selector 2:0 or the route context and descriptor+4 remains without field/frontier/gate rows. The constructed diagnostic left-route hit is not reproduced by either the selector-only recheck or the active-order recheck, and that active-order recheck stays at count 0, so it does not prove the gate-time base. A public predecessor left-overrun activation sweep also reaches selector 1:0 with the same non-promoting active-order evidence and still misses selector 2:0/current root. Therefore the context+0xf2 source scan is part of this gate-base proof: it sees runtime object-table reads and copies, not a fixed current-route object pointer. The supporting gate-offset, base-candidate, sample-value, selection-buffer-base, object-base, order-space, slot-source, descriptor-writer, and runtime-materializer reports also remain blocked/non-promoting: the gate offsets are inherited reader-only state, public samples do not cover selector 2:0, active order is not proven for the current frontier, and slot/materializer scans still require runtime descriptor/object state. save/runtime pass matrix narrows the hypothesis but cannot promote map1_01a -> map2_02d until the opcode 0x20 runtime descriptor/base path or an equivalent runtime trace is proven.

Missing Evidence

• prove opcode 0x20 runtime descriptor/base path before 0x005428c4; active order alone is insufficient
• prove predecessor 1:0 state persistence into current 2:0
• find strict map1_01a source hotspot or equivalent non-coordinate trigger

Evidence Refs

Local Base-Affecting Rows

Gate Window Trace

The gate window trace shows that between opcode 0x20 and the first 0xe8 gate, the gate window only opcode 0x20 base candidate flag is true.

Descriptor+4 Static Gate Evidence

descriptor+4 field-map/current-frontier refs and gate offset rows are kept separate from active order alone sufficient for gate proof.

Opcode 0x20 Context+0xf2 Source Evidence

The context+0xf2 source scan is kept inside this gate-base proof so the non-pointer context+0xa8 rows cannot be read as fixed route bases.

Descriptor All-Slot Static Gate Evidence

descriptor+0, descriptor+4, and descriptor+8 are scanned together to rule out a gate-offset row hiding in another descriptor script slot.

Diagnostic Active-Order Gate Evidence

The diagnostic active order came from a patched public-base save load, so it is diagnostic active order evidence and not route proof.

Diagnostic Active-Order Recheck

The selector-only and active-order rechecks are kept separate from the first constructed left-route hit.

Public Predecessor Active-Order Gate Evidence

The public predecessor active order came from the real public savedat direction sweep. It reaches selector 1:0 but not selector 2:0 or the route context.

Public Predecessor Left-Overrun Active-Order Gate Evidence

The left-overrun activation sweep is a second public predecessor calibration run. It reaches selector 1:0 but not selector 2:0 or the current root.

Sample Non-Pointer Context+0xa8 Base Histogram

Remaining Proofs

• prove opcode 0x20 runtime descriptor/base path before 0x005428c4; active order alone is insufficient
• prove predecessor 1:0 state persistence into current 2:0
• find strict map1_01a source hotspot or equivalent non-coordinate trigger