{"source":"map1_01a","target":"map2_02d","sampleSource":"","sampleSourceUrl":"","sampleSources":[],"gateOffsetsHex":["0xe8","0xea"],"expectedIndexRange":[0,11],"currentFrontierSelector":"2:0","sampleCount":0,"uniqueSelectorCount":0,"sampleSelectors":[],"currentFrontierSampleCovered":false,"saveRuntimeGateCandidateCount":2,"partySlotStatCandidateCount":4,"saveRuntimeGateSampleRows":[],"partySlotStatSampleRows":[],"saveRuntimeGateSampleValueCount":0,"saveRuntimeGateInRangeSampleValueCount":0,"saveRuntimeGateDistinctValuesHex":[],"partySlotStatSampleValueCount":0,"partySlotStatInRangeSampleValueCount":0,"partySlotStatDistinctValuesHex":[],"runtimePointerModeStillRequired":true,"controlPathProofStatus":"blocked","proofFound":false,"gateSampleValueProofFound":false,"failedGateSampleValueGateIds":["current-selector-2-0-sample","runtime-pointer-mode-proof","party-slot-index-evidence","control-path-gate-byte-proof"],"missingEvidence":["public or captured sample covering current selector 2:0 gate bytes","runtime pointer-mode proof selecting the correct gate base","party-slot byte evidence that yields a valid branch-state index rather than stat bytes","control-path proof that sampled gate bytes apply to the current frontier gates"],"evidenceRefs":[{"path":"data/savedata_sample_gate_values.json","description":"public savedat byte samples used to calibrate gate offsets"},{"path":"out/save_selector_gate_base_candidates.json","description":"candidate gate-base mappings and save offsets being sampled"}],"evidenceRefCount":2,"promotionStatus":"blocked","conclusion":"The public savedat bytes keep the save/runtime block base plausible only as calibration: loader-aware mapping puts 0x004576d8+0xe8/0xea at save offsets 0x00e2/0x00e4 after the six-byte runtime gap, and all public samples read 0x00 there. Those values are in the expected 0..11 branch-index range, but the samples cover selectors 0:0, 1:0, and 22:0, not the current frontier selector 2:0. The same samples make the party-slot-base mapping weaker: the corresponding stat-byte candidates are 0xe7, 0xa6, or 0x7a, outside the expected selection-index range. This rejects the stat-byte interpretation as promotion evidence while leaving global/save-runtime buffer or object pointer table runtime proof still required."}