Save Selector Opcode 0x20 Nested Base Modes

route map1_01a -> map2_02d; current row 0x005428a8 value 0x00200020; stream+1 mode 0x00; nested runner 0x00402360; handler table 0x00440538; gate offset proof status blocked; runtime pointer mode still required: True; proofFound False; promotion status blocked.

The current activation row at 0x005428a8 is save-selector opcode 0x20 with mode 0. Mode 0 does not directly choose map1_01a -> map2_02d; it iterates runtime save/object slots, calls nested runner 0x00402360 with descriptor+4 script pointers, and those nested scripts dispatch through general handler table 0x00440538. Several general handlers can replace context+0xa8 with different selection-buffer bases. Because the actual runtime object scripts and selected base before the 0xe8/0xea gates are still not proven, this narrows the blocker but does not promote the route.

Failed Gates

runtime-object-script-selection
gate-time-context-a8-base
gate-offset-fallthrough-proof
strict-source-hotspot

Missing Evidence

runtime object script selected by opcode 0x20 mode 0
context+0xa8 base value at the 0xe8/0xea gate time
control-flow proof that the inherited gate offsets fall through to the frontier reader
strict map1_01a source hotspot

Evidence Refs

Hwanse2.exe: opcode 0x20 handler, nested runner, and general handler table bytes
out/save_selector_current_writer_paths.json: current opcode 0x20 activation row at 0x005428a8
out/save_selector_gate_offset_sources.json: 0xe8/0xea gate offset source classification
out/save_selector_selection_buffer_bases.json: context+0xa8 base candidates and unresolved runtime pointer mode

Opcode 0x20 Modes

mode	current	slot count	slot base	nested stream	call	meaning
`0x00`	True	`0x004576e8`	`0x00457750 + slot * 0xd8`	`dword[dword[slotBase] + 4]`	`0x0040c447`	runs each active save/object slot's secondary script pointer stored at descriptor+4.
`0x01`	False	`0x004576e8`	`0x00457750 + slot * 0xd8 plus dword[0x00442da1]`	`dword[dword[0x00442da1] + 4], then dword[dword[slotBase] + 0]`	`0x0040c466, 0x0040c4a4`	runs a party/runtime script first, then each slot's primary script pointer stored at descriptor+0.

Nested General Handlers

opcode	handler	writes context+0xa8	base expression	evidence	meaning
`0x28`	`0x0040570c`	True	`dword[0x0059dd70 + stream[2]*4]`	`0x0040575a`	mode 1 restores context+0xa8 from the saved pointer table; mode 0 stores context+0x58 into that table.
`0x3f`	`0x004063d8`	False	`-`	`-`	passes dword [stream+4] to 0x00423a2f; this handler is adjacent to the base-mode group but does not directly write context+0xa8.
`0x40`	`0x004063fc`	True	`0x0059e310`	`0x00406405`	sets context+0xa8 to the global selection buffer.
`0x41`	`0x0040641b`	True	`0x00457750 + stream[1] * 0xd8`	`0x0040643d`	computes a save/runtime block slot base from stream+1.
`0x42`	`0x0040644f`	True	`dword[0x0059db30 + context[0xf2]4] or dword[0x0059db30 + stream[2]4]`	`0x00406480, 0x004064a0`	selects an object pointer table entry either from context+0xf2 or stream+2.
`0x43`	`0x004064d5`	True	`0x004576d8`	`0x004064de`	sets context+0xa8 to the save/runtime block base.
`0x44`	`0x004064f4`	False	`-`	`-`	calls 0x00421509 and may call 0x0041b579; it does not directly write context+0xa8 in this handler body.

Gate Rows

gate	offset	root writers before gate	global writers	source
`0x005428c4`	`0xe8`	0	0	no opcode 0x12/0x13 script writer; inherited/runtime selection-buffer byte
`0x005428cc`	`0xea`	0	0	no opcode 0x12/0x13 script writer; inherited/runtime selection-buffer byte

Signatures

signature	found
reads stream+1 mode	True
loops save slot count 0x004576e8	True
loads slot descriptor pointer from 0x00457750 + slot*0xd8	True
mode 0 uses descriptor+4 nested stream	True
calls nested runner 0x00402360	True
mode 1 uses descriptor+0 nested stream	True
advances save-selector stream by 4	True