{"source":"map1_01a","target":"map2_02d","currentWriterVaHex":"0x005428bc","currentOpcode20VaHex":"0x005428a8","currentOpcode20ValueHex":"0x00200020","currentOpcode20OpcodeHex":"0x20","currentOpcode20StreamPlus1Hex":"0x00","currentOpcode20StreamPlus2Hex":"0x20","currentMode":"mode 0","currentModeHex":"0x00","currentModeIsNestedObjectPlus4":true,"saveSelectorOpcode20HandlerVaHex":"0x0040c3f4","saveSelectorOpcode20HandlerMatchesExpected":true,"saveSelectorOpcode20HandlerSection":".text","opcode20SignatureSummary":{"handlerBytesScanned":236,"signatureMatches":[{"label":"reads stream+1 mode","found":true},{"label":"loops save slot count 0x004576e8","found":true},{"label":"loads slot descriptor pointer from 0x00457750 + slot*0xd8","found":true},{"label":"mode 0 uses descriptor+4 nested stream","found":true},{"label":"calls nested runner 0x00402360","found":true},{"label":"mode 1 uses descriptor+0 nested stream","found":true},{"label":"advances save-selector stream by 4","found":true}]},"nestedRunner":{"nestedRunnerVaHex":"0x00402360","nestedDispatcherVaHex":"0x00402321","nestedHandlerTableVaHex":"0x00440538","dispatcherUsesGeneralTable":true,"runnerTemporarilySwapsContextStream":true,"meaning":"0x00402360 saves context+0x40, runs the nested stream through dispatcher 0x00402321, then restores context+0x40. The dispatcher uses handler table 0x00440538, not the save-selector table."},"modes":[{"mode":0,"modeHex":"0x00","currentMode":true,"slotCountSourceHex":"0x004576e8","slotBaseExpression":"0x00457750 + slot * 0xd8","nestedStreamExpression":"dword[dword[slotBase] + 4]","callVaHex":"0x0040c447","runnerVaHex":"0x00402360","meaning":"runs each active save/object slot's secondary script pointer stored at descriptor+4."},{"mode":1,"modeHex":"0x01","currentMode":false,"slotCountSourceHex":"0x004576e8","slotBaseExpression":"0x00457750 + slot * 0xd8 plus dword[0x00442da1]","nestedStreamExpression":"dword[dword[0x00442da1] + 4], then dword[dword[slotBase] + 0]","callVaHex":"0x0040c466, 0x0040c4a4","runnerVaHex":"0x00402360","meaning":"runs a party/runtime script first, then each slot's primary script pointer stored at descriptor+0."}],"currentModeRow":{"mode":0,"modeHex":"0x00","currentMode":true,"slotCountSourceHex":"0x004576e8","slotBaseExpression":"0x00457750 + slot * 0xd8","nestedStreamExpression":"dword[dword[slotBase] + 4]","callVaHex":"0x0040c447","runnerVaHex":"0x00402360","meaning":"runs each active save/object slot's secondary script pointer stored at descriptor+4."},"generalHandlerTableVaHex":"0x00440538","generalHandlerRows":[{"opcode":40,"opcodeHex":"0x28","entryVaHex":"0x004405d8","handlerVaHex":"0x0040570c","handlerSection":".text","name":"save/load selection-buffer base pointer","writesContextA8":true,"baseExpression":"dword[0x0059dd70 + stream[2]*4]","evidenceVaHex":"0x0040575a","meaning":"mode 1 restores context+0xa8 from the saved pointer table; mode 0 stores context+0x58 into that table."},{"opcode":63,"opcodeHex":"0x3f","entryVaHex":"0x00440634","handlerVaHex":"0x004063d8","handlerSection":".text","name":"call stream+4 helper","writesContextA8":false,"baseExpression":"-","evidenceVaHex":"-","meaning":"passes dword [stream+4] to 0x00423a2f; this handler is adjacent to the base-mode group but does not directly write context+0xa8."},{"opcode":64,"opcodeHex":"0x40","entryVaHex":"0x00440638","handlerVaHex":"0x004063fc","handlerSection":".text","name":"select global selection buffer","writesContextA8":true,"baseExpression":"0x0059e310","evidenceVaHex":"0x00406405","meaning":"sets context+0xa8 to the global selection buffer."},{"opcode":65,"opcodeHex":"0x41","entryVaHex":"0x0044063c","handlerVaHex":"0x0040641b","handlerSection":".text","name":"select indexed save block","writesContextA8":true,"baseExpression":"0x00457750 + stream[1] * 0xd8","evidenceVaHex":"0x0040643d","meaning":"computes a save/runtime block slot base from stream+1."},{"opcode":66,"opcodeHex":"0x42","entryVaHex":"0x00440640","handlerVaHex":"0x0040644f","handlerSection":".text","name":"select runtime object pointer","writesContextA8":true,"baseExpression":"dword[0x0059db30 + context[0xf2]*4] or dword[0x0059db30 + stream[2]*4]","evidenceVaHex":"0x00406480, 0x004064a0","meaning":"selects an object pointer table entry either from context+0xf2 or stream+2."},{"opcode":67,"opcodeHex":"0x43","entryVaHex":"0x00440644","handlerVaHex":"0x004064d5","handlerSection":".text","name":"select save/runtime block base","writesContextA8":true,"baseExpression":"0x004576d8","evidenceVaHex":"0x004064de","meaning":"sets context+0xa8 to the save/runtime block base."},{"opcode":68,"opcodeHex":"0x44","entryVaHex":"0x00440648","handlerVaHex":"0x004064f4","handlerSection":".text","name":"runtime setup helper","writesContextA8":false,"baseExpression":"-","evidenceVaHex":"-","meaning":"calls 0x00421509 and may call 0x0041b579; it does not directly write context+0xa8 in this handler body."}],"directContextA8SetterCount":5,"runtimePointerModeStillRequired":true,"gateOffsetProofStatus":"blocked","controlPathGateStatus":"inherited-runtime-state","gateOffsetsHex":["0xe8","0xea"],"gateRows":[{"gateVaHex":"0x005428c4","selectionBufferOffsetHex":"0xe8","currentRootWriterBeforeGateCount":0,"globalWriterCount":0,"sourceClassification":"no opcode 0x12/0x13 script writer; inherited/runtime selection-buffer byte"},{"gateVaHex":"0x005428cc","selectionBufferOffsetHex":"0xea","currentRootWriterBeforeGateCount":0,"globalWriterCount":0,"sourceClassification":"no opcode 0x12/0x13 script writer; inherited/runtime selection-buffer byte"}],"staticGateOffsetDirectRefCount":0,"activationContext":{"writerVaHex":"0x005428bc","rootHex":"0x00540714","rootLabels":["2:0"],"rootFieldMaps":["map1_01a","map2_02d","map2_18d","map2_09g","map2_10g","map2_11g","map2_12h","map2_17h","map2_14j","map2_15j","map2_16j"],"activationRow":{"vaHex":"0x005428a8","valueHex":"0x00200020","opcodeHex":"0x20","meaning":"dispatch/load runtime object or party-member script references"}},"proofFound":false,"opcode20NestedBaseProofFound":false,"failedOpcode20NestedBaseGateIds":["runtime-object-script-selection","gate-time-context-a8-base","gate-offset-fallthrough-proof","strict-source-hotspot"],"missingEvidence":["runtime object script selected by opcode 0x20 mode 0","context+0xa8 base value at the 0xe8/0xea gate time","control-flow proof that the inherited gate offsets fall through to the frontier reader","strict map1_01a source hotspot"],"evidenceRefs":[{"path":"Hwanse2.exe","description":"opcode 0x20 handler, nested runner, and general handler table bytes"},{"path":"out/save_selector_current_writer_paths.json","description":"current opcode 0x20 activation row at 0x005428a8"},{"path":"out/save_selector_gate_offset_sources.json","description":"0xe8/0xea gate offset source classification"},{"path":"out/save_selector_selection_buffer_bases.json","description":"context+0xa8 base candidates and unresolved runtime pointer mode"}],"evidenceRefCount":4,"promotionStatus":"blocked","conclusion":"The current activation row at 0x005428a8 is save-selector opcode 0x20 with mode 0. Mode 0 does not directly choose map1_01a -> map2_02d; it iterates runtime save/object slots, calls nested runner 0x00402360 with descriptor+4 script pointers, and those nested scripts dispatch through general handler table 0x00440538. Several general handlers can replace context+0xa8 with different selection-buffer bases. Because the actual runtime object scripts and selected base before the 0xe8/0xea gates are still not proven, this narrows the blocker but does not promote the route."}