Save Selector Gate Offset Sources

route map1_01a -> map2_02d; selector 2:0; root 0x00540714..0x00543578.

gate offsets: 0xe8, 0xea; any script-local selection writer: False; any global script selection writer: False; control path gate status: inherited-runtime-state; proofFound False; promotion status: blocked.

The control gates before the current frontier reader use selectionBuffer offsets 0xe8 and 0xea, but the dword-aligned save-selector script scan finds no opcode 0x12/0x13 writer for either offset globally or inside the current 2:0 root. In the current root these offsets appear only as reader gates. That means the fallthrough path depends on inherited/runtime selection-buffer bytes rather than a script-local setup in this root, so control-flow proof remains open.

Failed Gates

• script-local-gate-byte-writer
• global-script-gate-byte-writer
• runtime-inherited-selection-buffer-state
• control-path-fallthrough-proof

Missing Evidence

• opcode 0x12/0x13 writer to selectionBuffer[0xe8] or [0xea] before the current gate
• runtime sample showing inherited gate bytes on the current selector path
• control-flow proof that the gate fallthrough reaches the frontier reader
• strict hotspot or selected-root context tying the fallthrough to map1_01a -> map2_02d

Evidence Refs

• Hwanse2.exe: dword-aligned save-selector script scan for gate-offset readers/writers
• out/save_scene_selectors.json: selector root ranges used to isolate the current 2:0 script root
• out/save_selector_branch_gate_consistency.json: nearest current writer/frontier reader gate rows that define offsets 0xe8 and 0xea

Gates

Gate 0x005428c4 Offset 0xe8

Gate 0x005428cc Offset 0xea