{"source":"map1_01a","target":"map2_02d","contextFieldOffsetHex":"0x000000f2","runtimeObjectTableHex":"0x0059db30","referenceCount":204,"readReferenceCount":141,"writeReferenceCount":63,"accessHistogram":{"read":141,"write":63},"patternHistogram":[{"value":"read_al_from_eax_f2","count":62},{"value":"read_cl_from_eax_f2","count":78},{"value":"read_dl_from_ecx_f2","count":1},{"value":"write_al_to_ecx_f2","count":63}],"runtimeObjectTableReaderCount":65,"directInitializerCount":2,"copyWriterCount":61,"constantWriteCount":0,"knownEvidenceRows":[{"vaHex":"0x00406470","access":"read","instruction":"mov cl, byte [eax+0xf2]","role":"opcode 0x42 context+0xf2 object-base reader","sourceExpression":"context+0xf2","effect":"loads dword[0x0059db30 + context[0xf2]*4] for context+0xa8","nearbyEvidenceVaHex":"0x00406480","usesRuntimeObjectTable":true},{"vaHex":"0x0040c00e","access":"write","instruction":"mov byte [ecx+0xf2], al","role":"active object initializer","sourceExpression":"loop/local object index","effect":"sets context+0xf2 to the table slot and stores the context in 0x0059db30[index]","nearbyEvidenceVaHex":"0x0040c048","directInitializer":true},{"vaHex":"0x0040c24f","access":"write","instruction":"mov byte [ecx+0xf2], al","role":"secondary object initializer","sourceExpression":"loop/local object index + 3","effect":"sets context+0xf2 to an offset slot and stores the context in 0x0059db3c[index]","nearbyEvidenceVaHex":"0x0040c28b","directInitializer":true},{"vaHex":"0x0041d90f","access":"read","instruction":"mov cl, byte [eax+0xf2]","role":"alternate context+0xf2 object-base reader","sourceExpression":"context+0xf2","effect":"loads dword[0x0059db30 + context[0xf2]*4] for context+0xa8","nearbyEvidenceVaHex":"0x0041d91f","usesRuntimeObjectTable":true},{"vaHex":"0x00433430","access":"read","instruction":"mov al, byte [eax+0xf2]","role":"object field materializer","sourceExpression":"linked context+0xf2","effect":"copies linked context+0xf2 into object+0x61","nearbyEvidenceVaHex":"0x00433439"}],"directInitializerRows":[{"vaHex":"0x0040c00e","access":"write","instruction":"mov byte [ecx+0xf2], al","role":"active object initializer","sourceExpression":"loop/local object index","effect":"sets context+0xf2 to the table slot and stores the context in 0x0059db30[index]","nearbyEvidenceVaHex":"0x0040c048","directInitializer":true},{"vaHex":"0x0040c24f","access":"write","instruction":"mov byte [ecx+0xf2], al","role":"secondary object initializer","sourceExpression":"loop/local object index + 3","effect":"sets context+0xf2 to an offset slot and stores the context in 0x0059db3c[index]","nearbyEvidenceVaHex":"0x0040c28b","directInitializer":true}],"sampleRuntimeObjectTableReaders":[{"vaHex":"0x00406470","access":"read","instruction":"mov cl, byte [eax+0xf2]","role":"opcode 0x42 context+0xf2 object-base reader","sourceExpression":"context+0xf2","effect":"loads dword[0x0059db30 + context[0xf2]*4] for context+0xa8","nearbyEvidenceVaHex":"0x00406480","usesRuntimeObjectTable":true},{"vaHex":"0x0040da31","access":"read","instruction":"mov dl, byte [ecx+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0040e224","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0040e52b","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0040e592","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0040e7e6","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0040e84d","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0040eadf","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x0041178b","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x004117dc","access":"read","instruction":"mov al, byte [eax+0xf2]","usesRuntimeObjectTable":true,"copiesF2ToChildContext":true},{"vaHex":"0x004117fe","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x00411a2a","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x00411b36","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x00411c43","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x00411d01","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true},{"vaHex":"0x00411e12","access":"read","instruction":"mov cl, byte [eax+0xf2]","usesRuntimeObjectTable":true}],"objectBaseCandidateCount":16,"contextF2ObjectSelectorCount":16,"fixedStream2ObjectSelectorCount":0,"currentFrontierSampleCovered":false,"activeOrderAlonePromotesRoute":false,"diagnosticRuntimeObjectTableEvidence":{"available":true,"sourcePoll":"runtime_selected_pointer_patched_public_selector_2_0_active_order_poll.json","diagnosticOnly":true,"totalSequenceCount":2,"totalSampleCount":374,"routeSequenceCount":1,"routeSampleCount":210,"routeSequenceNames":["input-path-slot1-down-enter-enter"],"nonRouteSequenceCount":1,"observedSelectors":["50:0","2:0","10:0"],"observedStagedSelectors":["2:0"],"reachedCurrentRoot":true,"reachedRouteSelector":true,"loadedBaseHex":"0x00120000","activeOrderCountHex":"0x01","activeOrderCount":1,"orderByteHexes":["0x00","0x02","0x02"],"activeOrderHexes":["0x00"],"activeSlotFirstDwordsHex":["0x0021867c","0x00546004","0x00546004"],"activeSlotFirstDwordsStaticHex":["0x004f867c",null,null],"runtimeSlotBaseTableHexes":["0x00177750","0x00000000","0x00000000"],"runtimeSlotBaseTableStaticHexes":["0x00457750",null,null],"runtimeObjectTableHexes":["0x0027be00","0x0027d2f8","0x0027d5d4"],"runtimeObjectTableStaticHexes":["0x0055be00","0x0055d2f8","0x0055d5d4"],"allWatchedValuesStable":true,"specificRuntimeObjectPointerProven":false,"normalRouteProof":false,"notRoutePromotionProof":true,"promotionStatus":"diagnostic-only","nonPromotingBecause":["the object-table values were captured only while loading the patched public-base diagnostic save","the poll reaches selector 2:0 through constructed save staging, not a captured normal gameplay route save","the stable runtime object table explains the diagnostic run but does not prove a normal-route context+0xf2 object pointer"]},"fixedContextF2ValueProvenForCurrentFrontier":false,"specificRuntimeObjectPointerProven":false,"runtimeObjectTableStateRequired":true,"proofFound":false,"opcode20ContextF2ProofFound":false,"failedOpcode20ContextF2GateIds":["normal-route-runtime-object-table-state","context-f2-current-frontier-value","opcode42-object-pointer-trace","strict-source-hotspot"],"missingEvidence":["non-diagnostic/normal-route selector 2:0 active order/count with live 0x0059db30 object-table contents","current frontier context+0xf2 byte or equivalent runtime object selector","runtime trace of opcode 0x42 reader 0x00406470 resolving the current route object pointer","strict map1_01a source hotspot or equivalent route trigger"],"evidenceRefs":[{"path":"Hwanse2.exe","description":"static context+0xf2 read/write and object-table reader scan"},{"path":"out/save_selector_opcode20_object_base_candidates.json","description":"opcode 0x20 object-base candidates that depend on context+0xf2"},{"path":"out/save_selector_opcode20_order_space.json","description":"current selector sample coverage and active-order insufficiency"},{"path":"out/runtime_selected_pointer_patched_public_selector_2_0_active_order_poll.json","description":"diagnostic-only active order and object-table snapshot"}],"evidenceRefCount":4,"promotionStatus":"blocked","remainingProofs":["capture non-diagnostic/normal-route selector 2:0 active order/count with live 0x0059db30 object-table contents","trace the opcode 0x42 read at 0x00406470 to a concrete context+0xf2 slot and object pointer","find a strict map1_01a source hotspot if object-table state cannot be proven statically"],"conclusion":"The opcode 0x20 object-base candidates all rely on context+0xf2, but the f2 byte is a runtime object-slot selector. Static code evidence finds only runtime initializers/copies and object-table readers, with no constant f2 assignment or fixed stream+2 object index for the current route. The patched public-base diagnostic poll now captures a stable active order and 0x0059db30 object-table snapshot, but that capture is constructed diagnostic evidence rather than a normal-route proof. Because the current selector sample is still uncovered and active order alone does not promote the route, context+0xf2 cannot identify a specific map1_01a->map2_02d gate object without non-diagnostic runtime object-table state or an equivalent trace."}