{
  "kind": "hwanse-scenario-selected-root-pattern-review",
  "source": "tools/build_scenario_selected_root_pattern_review.py",
  "status": "scenario-selected-root-vm-pattern-grounded-producer-pending",
  "decision": "The web-runtime observation is consistent with the EXE.  A common VM runner, selected-root writers, and selected-root executor are statically grounded.  The remaining missing evidence is the upstream producer that chooses those streams from concrete field/NPC/region conditions.",
  "globals": {
    "selectedRootVaHex": "0x0059de30",
    "rootObjectVaHex": "0x0055be00",
    "currentStreamOffsetHex": "0x40",
    "returnStackOffsetHex": "0x44",
    "returnDepthOffsetHex": "0x5c",
    "vmContextOffsetCandidateHex": "0xa8",
    "scriptPointerOffsetCandidateHex": "0xb0"
  },
  "dispatch": {
    "vmDispatcher": {
      "handlerVaHex": "0x00402321",
      "dispatchRefs": [],
      "allDwordRefs": [
        "0x004022fc",
        "0x0040255d",
        "0x00406b11",
        "0x0040796f",
        "0x00407a8f",
        "0x0040e929",
        "0x0040e94c",
        "0x0040e9b1",
        "0x0040ef68",
        "0x004117a5",
        "0x00411811",
        "0x0041183d",
        "0x00411909",
        "0x0041194a",
        "0x00411a53",
        "0x00411a89",
        "0x00411b53",
        "0x00411c60",
        "0x00411d6b",
        "0x00411e7c",
        "0x00411f8d",
        "0x00412099",
        "0x004121aa",
        "0x004122b8",
        "0x004123c9",
        "0x00412487",
        "0x0041256b",
        "0x004125f3",
        "0x004126c4",
        "0x00412793",
        "0x00412888",
        "0x004128f9",
        "0x004129cf",
        "0x00412a7c",
        "0x00412b53",
        "0x00412bf4",
        "0x00412c9e",
        "0x00412d9b",
        "0x00412efd",
        "0x004130fc",
        "0x004131a8",
        "0x0041329f",
        "0x004133c6",
        "0x00413546",
        "0x00413677",
        "0x00413815",
        "0x00413999",
        "0x00413ada",
        "0x00413b7b",
        "0x00413c3e",
        "0x00413d40",
        "0x00413e67",
        "0x00413eed",
        "0x00413fad",
        "0x00414088",
        "0x00414148",
        "0x00414278",
        "0x004143da",
        "0x00414499",
        "0x00414509",
        "0x00414591",
        "0x004146a3",
        "0x004147ce",
        "0x004148da",
        "0x004149e5",
        "0x00414ab4",
        "0x00414d13",
        "0x00414e1a",
        "0x00414ed5",
        "0x00414f7f",
        "0x00415088",
        "0x0041b72a",
        "0x0041be1c",
        "0x0041d559",
        "0x0041febb",
        "0x004284f2",
        "0x004321d7",
        "0x004322cc",
        "0x004323e7",
        "0x004324ea",
        "0x00432729",
        "0x0043281e",
        "0x00433131"
      ]
    },
    "selectorByteWriter": {
      "handlerVaHex": "0x00406dbb",
      "dispatchRefs": [
        {
          "entryVaHex": "0x00440674",
          "opcodeIndex": 79,
          "opcodeIndexHex": "0x4f"
        }
      ],
      "allDwordRefs": [
        "0x00440674"
      ]
    },
    "selectedRootIndexedWriter": {
      "handlerVaHex": "0x0040ad9b",
      "dispatchRefs": [
        {
          "entryVaHex": "0x0044073c",
          "opcodeIndex": 129,
          "opcodeIndexHex": "0x81"
        }
      ],
      "allDwordRefs": [
        "0x0044073c"
      ]
    },
    "selectedRootExecutor": {
      "handlerVaHex": "0x0040adc9",
      "dispatchRefs": [
        {
          "entryVaHex": "0x00440740",
          "opcodeIndex": 130,
          "opcodeIndexHex": "0x82"
        }
      ],
      "allDwordRefs": [
        "0x00440740"
      ]
    },
    "selectedRootDirectWriter": {
      "handlerVaHex": "0x0040ae0e",
      "dispatchRefs": [
        {
          "entryVaHex": "0x00440744",
          "opcodeIndex": 131,
          "opcodeIndexHex": "0x83"
        }
      ],
      "allDwordRefs": [
        "0x00440744"
      ]
    }
  },
  "byteEvidence": [
    {
      "label": "generic VM dispatcher",
      "vaHex": "0x00402321",
      "bytes": "55 8b ec 53 56 57 c7 05 b8 a1 55 00 00 00 00 00 83 3d b8 a1 55 00 00 0f 85 1d 00 00 00 8b 45 08 50 8b 45 08 8b 40 40 33 c9 8a 08 ff 14 8d 38 05 44 00 83 c4 04 e9 d6 ff ff ff 5f 5e 5b c9 c3",
      "decoded": "reads object+0x40 as current stream, reads opcode byte, dispatches through table 0x00440538.",
      "status": "confirmed"
    },
    {
      "label": "nested VM stream runner",
      "vaHex": "0x00402360",
      "bytes": "55 8b ec 83 ec 04 53 56 57 8b 45 08 8b 40 40 89 45 fc 8b 45 0c 8b 4d 08 89 41 40 8b 45 08 50 e8 9d ff ff ff 83 c4 04 8b 45 fc 8b 4d 08 89 41 40 c7 05 b8 a1 55 00 00 00 00 00 5f 5e 5b c9 c3",
      "decoded": "temporarily replaces object+0x40 with an argument stream, runs the dispatcher, then restores the old stream.",
      "status": "confirmed"
    },
    {
      "label": "selector byte writer",
      "vaHex": "0x00406dbb",
      "bytes": "55 8b ec 83 ec 04 53 56 57 8b 45 08 8b 40 40 33 c9 8a 48 01 89 4d fc e9 a7 00 00 00 8b 45 08 8b 40 40 83 c0 04 8b 4d 08 0f bf 49 5c 8b 55 08 89 44 8a 44 8b 45 08 66 ff 40 5c a1 18 c5 4d 00 8b 4d 08 89 41 40 e9 a4 00 00 00 8b 45 08 8b 40 40 8a 40 02 a2 da 76 45 00 8b 45 08 8b 40 40 8a 40 03 a2 db 76 45 00 8b 45 08 8b 40 40 83 c0 04 8b 4d 08 0f bf 49 5c 8b 55 08 89 44 8a 44 8b 45 08 66 ff 40 5c a1 14 c5 4d 00 8b 4d 08 89 41 40 e9 5a 00 00 00 a0 20 e3 59 00 50 6a 00 e8 bd c4 01 00 83 c4 08 e9 3e 00 00 00 a0 20 e3 59 00 50 6a 01 e8 a8 c4 01 00 83 c4 08 e9 29 00 00 00 e9 24 00 00 00 83 7d fc 03 0f 87 1a 00 00 00 8b 45 fc ff 24 85 92 6e 40 00 d7 6d 40 00 05 6e 40 00 4f 6e 40 00 64 6e 40 00 8b 45 08 83 40 40 04 5f 5e 5b c9 c3",
      "decoded": "mode 1 writes selector bytes from stream operands and jumps to a fixed root pointer; modes 2/3 delegate save/load restore.",
      "status": "confirmed"
    },
    {
      "label": "selected root indexed writer",
      "vaHex": "0x0040ad9b",
      "bytes": "55 8b ec 53 56 57 8b 45 08 8b 40 40 33 c9 8a 48 01 8b 45 08 8b 40 40 8b 40 04 8b 04 88 a3 30 de 59 00 8b 45 08 83 40 40 08 5f 5e 5b c9 c3",
      "decoded": "selected_root = dword[streamTable + stream[1] * 4], where streamTable is dword at stream+4; advances stream by 8.",
      "status": "confirmed"
    },
    {
      "label": "selected root executor",
      "vaHex": "0x0040adc9",
      "bytes": "55 8b ec 53 56 57 8b 45 08 83 40 40 04 83 3d 30 de 59 00 00 0f 84 26 00 00 00 8b 45 08 8b 40 40 8b 4d 08 0f bf 49 5c 8b 55 08 89 44 8a 44 8b 45 08 66 ff 40 5c a1 30 de 59 00 8b 4d 08 89 41 40 5f 5e 5b c9 c3",
      "decoded": "if selected_root is nonzero, pushes current continuation to object+0x44 return stack, increments object+0x5c, and writes selected_root to object+0x40.",
      "status": "confirmed"
    },
    {
      "label": "selected root direct writer",
      "vaHex": "0x0040ae0e",
      "bytes": "55 8b ec 83 ec 04 53 56 57 8b 45 08 8b 40 40 33 c9 8a 48 01 89 4d fc e9 36 00 00 00 8b 45 08 83 40 40 04 8b 45 08 8b 40 40 a3 30 de 59 00 e9 38 00 00 00 8b 45 08 8b 40 40 8b 40 04 a3 30 de 59 00 8b 45 08 83 40 40 08 e9 1e 00 00 00 e9 19 00 00 00 83 7d fc 00 0f 84 c0 ff ff ff 83 7d fc 01 0f 84 cd ff ff ff e9 00 00 00 00 5f 5e 5b c9 c3",
      "decoded": "mode 0 stores inline stream+4 as selected_root; mode 1 stores dword at stream+4 as selected_root.",
      "status": "confirmed"
    },
    {
      "label": "root object pool initializer",
      "vaHex": "0x004359d6",
      "bytes": "05 00 be 55 00 8b 4d fc 8b d1 8d 0c 49 8d 0c c9 8d 0c c9 89 84 11 0c be 55 00 e9 c0 ff ff ff c7 05 ec bc 55 00 00 be 55 00 c7 05 58 3a 57 00 00 00 00 00 c7 45 fc 00 00 00 00 e9 03 00 00 00 ff 45 fc 83 7d fc 05 0f 83 90 00",
      "decoded": "initializes the object pool/list around 0x0055be00, matching the VM object base seen in selected-root handlers.",
      "status": "confirmed-base"
    }
  ],
  "globalRefs": {
    "selectedRoot": {
      "vaHex": "0x0059de30",
      "dwordRefs": [
        "0x0040adb9",
        "0x0040add8",
        "0x0040adff",
        "0x0040ae38",
        "0x0040ae4b",
        "0x004234bb"
      ]
    },
    "rootObject": {
      "vaHex": "0x0055be00",
      "dwordRefs": [
        "0x004359d7",
        "0x004359fb"
      ]
    }
  },
  "confirmed": [
    "The VM dispatcher at 0x00402321 executes bytecode streams from object+0x40.",
    "selected_root at 0x0059de30 is a real global consumed by the selected-root executor.",
    "0x0040ad9b writes selected_root by table index; 0x0040ae0e writes it directly or as an inline continuation.",
    "0x0040adc9 pushes the current stream to object+0x44/object+0x5c and jumps object+0x40 to selected_root.",
    "0x00406dbb writes selector bytes and jumps to fixed roots, so selector bytes and selected roots are part of the same VM family.",
    "Existing selector-root reports already expose dozens of roots and command blocks that fit this mechanism."
  ],
  "candidates": [
    "field/NPC/region triggers likely enter this VM through active descriptors or inline stream pointers, but the exact live producer is not promoted here.",
    "object+0xa8 appears repeatedly in VM handlers as a context/base pointer family; object+0xb0 remains a script-pointer candidate, not a confirmed stream slot in this review.",
    "selectedRoot indexed tables and direct inline roots are good static enumeration targets, but each entry still needs owner/trigger binding."
  ],
  "blocked": [
    "No static proof yet maps a specific field entrance, talk target, or region descriptor to one selected_root write in normal gameplay.",
    "scene/event command streams are found, but route-linked command block count remains zero in the current command-stream candidate report.",
    "automatic map transition and scenario branch producer remain separate problems from the selected-root executor mechanism."
  ],
  "relatedSummary": {
    "selectorRootCount": 93,
    "selectorRows": 94,
    "rootsWithSceneSeqCount": 37,
    "rootsWithResourceRefCount": 66,
    "sequenceRootWithResourceStructureCount": 37,
    "unclassifiedSelectorRootCount": 27,
    "rootsWithSelectedRootOpcodeCount": 57,
    "opcode4fMode1WriterCount": 27,
    "opcode4fSelfWriterCount": 23,
    "opcode4fSlotAliasCount": 4,
    "selectedRootDirectRefCount": 10,
    "selectedRootExecutorFound": true,
    "liveWriterStatus": "selected-root-writer-primitives-grounded-route-producer-pending",
    "opcodeMatrixStatus": "opcode-matrix-grounded-no-upstream-route-producer",
    "selectorStructureStatus": "selector-root-structure-decomposed-candidate",
    "routeReviewStatus": "partial-execution-route-blocked-direct-root-missing",
    "directExecutionRootFound": false,
    "commandBlockCount": 47,
    "dialogueLikeBlockCount": 43,
    "routeLinkedCommandBlockCount": 0,
    "mapLinkedCommandBlockCount": 7
  },
  "relatedReports": [
    {
      "json": "out/selected_root_live_writer_frontier_review.json",
      "html": "web/selected_root_live_writer_frontier_review.html"
    },
    {
      "json": "out/selected_root_opcode_matrix_review.json",
      "html": "web/selected_root_opcode_matrix_review.html"
    },
    {
      "json": "out/selector_root_structure_review.json",
      "html": "web/selector_root_structure_review.html"
    },
    {
      "json": "out/scene_event_vm_execution_route_review.json",
      "html": "web/scene_event_vm_execution_route_review.html"
    },
    {
      "json": "out/scene_event_vm_command_stream_candidates.json",
      "html": "web/scene_event_vm_command_stream_candidates.html"
    }
  ],
  "nextStaticActions": [
    "Enumerate opcode 0x81 indexed-writer command rows and group them by owner root.",
    "Enumerate opcode 0x83 direct-writer inline roots and split mode 0 inline continuation from mode 1 dword-root writes.",
    "Cross-link selected-root writer rows to prompt/text groups and resource records, but keep them below route-proof until a producer is found.",
    "Use future runtime traces to tag which writer row fired before a known talk/region/event interaction."
  ]
}