{"source":"map1_01a","target":"map2_02d","slotBaseHex":"0x00457750","slotStrideHex":"0x00d8","countRuntimeVaHex":"0x004576e8","orderBytesVaHex":"0x004576e9","runtimeSlotBaseTableHex":"0x0059db30","runtimeObjectTableHex":"0x0059dd70","descriptorTableVaHex":"0x00442d95","descriptorTableRefSummary":{"targetVaHex":"0x00442d95","count":3,"sampleRefs":["0x004321bf","0x004323cf","0x00432711"]},"descriptorRows":[{"index":0,"entryVaHex":"0x00442d95","descriptorVaHex":"0x004f867c","script0VaHex":"0x004f8dd8","script4VaHex":"0x004f8df8","script8VaHex":"0x004f8e0c"},{"index":1,"entryVaHex":"0x00442d99","descriptorVaHex":"0x004e75a0","script0VaHex":"0x004e785c","script4VaHex":"0x004e787c","script8VaHex":"0x004e7890"},{"index":2,"entryVaHex":"0x00442d9d","descriptorVaHex":"0x00546004","script0VaHex":"0x005462fc","script4VaHex":"0x0054631c","script8VaHex":"0x00546330"},{"index":3,"entryVaHex":"0x00442da1","descriptorVaHex":"0x004b218c","script0VaHex":"0x004b35d4","script4VaHex":"0x004b3604","script8VaHex":"0x004b3620"},{"index":4,"entryVaHex":"0x00442da5","descriptorVaHex":"0x004d5868","script0VaHex":"0x004d5ca8","script4VaHex":"0x004d5cc8","script8VaHex":"0x004d5d6c"},{"index":5,"entryVaHex":"0x00442da9","descriptorVaHex":"0x004da88c","script0VaHex":"0x004dac1c","script4VaHex":"0x004dac3c","script8VaHex":"0x004dace0"},{"index":6,"entryVaHex":"0x00442dad","descriptorVaHex":"0x00524060","script0VaHex":"0x00524350","script4VaHex":"0x00524370","script8VaHex":"0x00524414"},{"index":7,"entryVaHex":"0x00442db1","descriptorVaHex":"0x004d21c0","script0VaHex":"0x004d222c","script4VaHex":"0x004d224c","script8VaHex":"0x004d22bc"},{"index":8,"entryVaHex":"0x00442db5","descriptorVaHex":"0x0048c094","script0VaHex":"0x0048c144","script4VaHex":"0x0048c164","script8VaHex":"0x0048c1e0"},{"index":9,"entryVaHex":"0x00442db9","descriptorVaHex":"0x0055734c","script0VaHex":"0x005573cc","script4VaHex":"0x005573ec","script8VaHex":"0x00557468"},{"index":10,"entryVaHex":"0x00442dbd","descriptorVaHex":"0x0052dad8","script0VaHex":"0x0052db58","script4VaHex":"0x0052db7c","script8VaHex":"0x0052dbf8"},{"index":11,"entryVaHex":"0x00442dc1","descriptorVaHex":"0x004aab00","script0VaHex":"0x004aab84","script4VaHex":"0x004aaba4","script8VaHex":"0x004aac54"}],"routines":[{"routineVaHex":"0x0043215c","name":"add active save/object slot","role":"adds an id to 0x004576e9[count], stores slot base in 0x0059db30[count], increments count, then materializes descriptors","orderWriteVaHex":"0x00432167","slotBaseTableWriteVaHex":"0x00432188","countWriteVaHex":"0x0043218f","descriptorWriteVaHex":"0x004321cd","descriptorScriptOffset":"0x00","nestedRunVaHex":"0x004321fe","objectStoreVaHex":"0x004322bd"},{"routineVaHex":"0x00432323","name":"rebuild active slot descriptors","role":"rebuilds active descriptors from 0x004576e9 order bytes and stores created runtime objects in 0x0059dd70","orderWriteVaHex":"-","slotBaseTableWriteVaHex":"0x004323ba","countWriteVaHex":"-","descriptorWriteVaHex":"0x004323dd","descriptorScriptOffset":"0x00","nestedRunVaHex":"0x0043240e","objectStoreVaHex":"0x004324cd"},{"routineVaHex":"0x00432541","name":"remove/rebuild active slot descriptors","role":"runs descriptor+4 scripts for active objects, removes a matching id, compacts order/slot tables, then rematerializes descriptors","orderWriteVaHex":"0x004326a3","slotBaseTableWriteVaHex":"0x004326b6","countWriteVaHex":"0x004326c2","descriptorWriteVaHex":"0x0043271f","descriptorScriptOffset":"0x00 after removal; 0x04 before removal","nestedRunVaHex":"0x004325a7, 0x00432750","objectStoreVaHex":"0x0043280f"}],"descriptorWriteCount":3,"slotFirstDwordSource":"runtime descriptor table 0x00442d95[index]","opcode20Mode0ScriptSource":"descriptor+4","runtimeActiveOrderRequired":true,"controlPathProofStatus":"blocked","proofFound":false,"opcode20DescriptorWriterProofFound":false,"failedOpcode20DescriptorWriterGateIds":["runtime-active-order","descriptor-materializer-execution","descriptor-plus4-selection","selected-root-execution-or-trace"],"missingEvidence":["runtime active order/count selecting descriptor table entries","descriptor materializer routine execution on the current route path","descriptor+4 script selected by opcode 0x20 mode 0 for selector 2:0","selected-root execution or equivalent runtime trace reaching descriptor materialization"],"evidenceRefs":[{"path":"Hwanse2.exe","description":"descriptor table references and materializer routine writes"},{"path":"out/save_selector_opcode20_slot_sources.json","description":"slot base/count source and runtime descriptor pointer requirement"}],"evidenceRefCount":2,"promotionStatus":"blocked","conclusion":"The opcode 0x20 slot first dword is a runtime descriptor pointer, not a static object pointer. The materializer routines write descriptors from table 0x00442d95 into 0x00457750 + slot*0xd8, using active order bytes at 0x004576e9 and the runtime count at 0x004576e8. Opcode 0x20 mode 0 therefore follows descriptor+4 scripts only after these routines have run. The next proof target is the active order/count at the current frontier or the descriptor+4 script chosen for that order; route promotion remains blocked."}