{"scope":"selected scene/text root consumer trace","promotionStatus":"consumer-grounded-route-proof-blocked","summary":{"selectedPointerGlobalHex":"0x0059de30","currentSelector":"2:0","currentSelectorRootHex":"0x00540714","consumerHandlerVaHex":"0x0040adc9","consumerZeroCheckVaHex":"0x0040add6","consumerReadVaHex":"0x0040adfe","consumerContextStoreVaHex":"0x0040ae06","consumerVerified":true,"writerHookCount":4,"readerHookCount":2,"sourceOrPredecessorOpcode08ActivatorCount":162,"sourceOrPredecessorCurrentRootProducerCount":0,"sourceOrPredecessorCurrentRangeProducerCount":0,"currentInternalCurrentRangeProducerCount":24,"directExecutionRootFound":false,"routeConsumerProofFound":false,"routeBridgeProofFound":false,"selectedRootExternalProofFound":false,"realSelector20SaveCount":0,"sourceToCurrentBridgeHitCount":0,"predecessorToCurrentBridgeHitCount":0,"forwardMergeBridgeHitCount":0,"producerHotspotProofFound":false,"runtimeSelectedRootConsumerProofFound":false,"runtimeConsumerHitProbeCount":0,"runtimeRouteValueProbeCount":0,"saveLoaderRestoreFunctionVaHex":"0x00423319","saveLoaderRestoreSelectedRootConsumerVaHex":"0x004234a3","saveLoaderRestoreStateBlockVaHex":"0x004576d8","saveLoaderRestoreStateBlockSizeHex":"0x72","saveLoaderRestoreDescriptorBlockVaHex":"0x00457750","saveLoaderRestoreDescriptorBlockSizeHex":"0x288","saveLoaderRestoreFlagBlockVaHex":"0x0059db60","saveLoaderRestoreFlagBlockSizeHex":"0x200","saveLoaderRestoreConsumerContextGrounded":true,"saveLoaderRestoreConsumerRouteProducerPromoted":false},"pseudoCode":["opcode07: selected = dword[dword[stream+4] + byte[stream+1] * 4]; global_0059de30 = selected; stream += 8","opcode08: stream += 4; if global_0059de30 != 0 { stack.push(stream); stream = global_0059de30 }","opcode09 mode0: stream += 4; global_0059de30 = stream","opcode09 mode1: global_0059de30 = dword[stream+4]; stream += 8","save/load restore: read 0x4576d8[0x72], 0x457750[0x288], 0x59db60[0x200]","save/load restore: global_0059de30 = selectorGroupTable[byte[0x4576da]][byte[0x4576db]]"],"handlerContexts":[{"name":"save-loader-selector-store","role":"producer","handlerVaHex":"0x0042349c","hookVaHexes":["0x004234ba"],"verified":true,"effect":"save bytes 0x0002/0x0003 select a group/slot row, then store the selected root into 0x0059de30","routeImplication":"a captured save must contain selector group 2 slot 0 before this store can prove 0x00540714","traceHook":"watch write 0x004234ba or load a real selector 2:0 savedat"},{"name":"opcode07-indexed-store","role":"producer","handlerVaHex":"0x0040ad9b","hookVaHexes":["0x0040adb8"],"verified":true,"effect":"selected pointer = dword[[context+0x40]+4 + zero_extend(byte[[context+0x40]+1]) * 4]","routeImplication":"non-current roots would need an opcode 0x07 row selecting 0x00540714; current scans find none","traceHook":"break on 0x0040adb8 and inspect eax before store"},{"name":"opcode08-activator","role":"consumer","handlerVaHex":"0x0040adc9","hookVaHexes":["0x0040add6","0x0040adfe"],"verified":true,"effect":"if 0x0059de30 is nonzero, save the current stream and set context+0x40 = 0x0059de30","routeImplication":"0x0040adfe is the narrowest runtime proof point for showing selector 2:0 becomes active bytecode","traceHook":"break on 0x0040adfe and require eax/0x0059de30 == 0x00540714"},{"name":"opcode09-stream-store","role":"producer","handlerVaHex":"0x0040ae0e","hookVaHexes":["0x0040ae37","0x0040ae4a"],"verified":true,"effect":"mode 0 stores the current active stream, mode 1 stores dword[stream+4], other modes fall through without a selected-pointer store","routeImplication":"opcode 0x09 only promotes if the active stream or operand is already in selector 2:0; current evidence is internal only","traceHook":"break on 0x0040ae37/0x0040ae4a and classify the stored pointer range"}],"consumerByteChecks":[{"label":"advance stream by 4 before selected-pointer test","vaHex":"0x0040add2","bytes":"83 40 40 04","matches":true},{"label":"test selected pointer global for zero","vaHex":"0x0040add6","bytes":"83 3d 30 de 59 00 00","matches":true},{"label":"push return stream into context stack","vaHex":"0x0040adf3","bytes":"89 44 8a 44","matches":true},{"label":"read selected pointer global 0x0059de30","vaHex":"0x0040adfe","bytes":"a1 30 de 59 00","matches":true},{"label":"replace context+0x40 with selected pointer","vaHex":"0x0040ae06","bytes":"89 41 40","matches":true}],"saveLoaderRestoreContext":{"functionVaHex":"0x00423319","modeArgument":"[ebp+0x08]","loadMode":0,"saveMode":1,"stateBlockVaHex":"0x004576d8","stateBlockSizeHex":"0x72","selectorGroupByteVaHex":"0x004576da","selectorSlotByteVaHex":"0x004576db","descriptorBlockVaHex":"0x00457750","descriptorBlockSizeHex":"0x288","flagBlockVaHex":"0x0059db60","flagBlockSizeHex":"0x200","selectedRootRestoreVaHex":"0x004234a3","selectedPointerGlobalHex":"0x0059de30","selectorGroupTableBaseHex":"0x00442d35","contextGrounded":true,"routeProducerPromoted":false,"interpretation":"This path restores 0x0059de30 after loading persisted selector bytes 0x4576da/0x4576db. It proves save/load selected-root reconstruction, not a normal live scene/event route producer.","byteChecks":[{"label":"load state block 0x4576d8 size 0x72","vaHex":"0x004233f3","expectedBytes":"6a 00 8d 45 e8 50 6a 72 68 d8 76 45 00 8b 45 e4 50 ff 15 1c 04 5a 00","actualBytes":"6a 00 8d 45 e8 50 6a 72 68 d8 76 45 00 8b 45 e4 50 ff 15 1c 04 5a 00","matches":true},{"label":"load descriptor block 0x457750 size 0x288","vaHex":"0x0042341c","expectedBytes":"6a 00 8d 45 e8 50 68 88 02 00 00 68 50 77 45 00 8b 45 e4 50 ff 15 1c 04 5a 00","actualBytes":"6a 00 8d 45 e8 50 68 88 02 00 00 68 50 77 45 00 8b 45 e4 50 ff 15 1c 04 5a 00","matches":true},{"label":"load flag block 0x59db60 size 0x200","vaHex":"0x00423448","expectedBytes":"6a 00 8d 45 e8 50 68 00 02 00 00 68 60 db 59 00 8b 45 e4 50 ff 15 1c 04 5a 00","actualBytes":"6a 00 8d 45 e8 50 68 00 02 00 00 68 60 db 59 00 8b 45 e4 50 ff 15 1c 04 5a 00","matches":true},{"label":"restore selected root from loaded selector group/slot","vaHex":"0x004234a3","expectedBytes":"a0 da 76 45 00 8b 04 85 35 2d 44 00 33 c9 8a 0d db 76 45 00 8b 04 88 a3 30 de 59 00","actualBytes":"a0 da 76 45 00 8b 04 85 35 2d 44 00 33 c9 8a 0d db 76 45 00 8b 04 88 a3 30 de 59 00","matches":true},{"label":"save state block 0x4576d8 size 0x72","vaHex":"0x0042352c","expectedBytes":"6a 00 8d 45 e8 50 6a 72 68 d8 76 45 00 8b 45 e4 50 ff 15 04 04 5a 00","actualBytes":"6a 00 8d 45 e8 50 6a 72 68 d8 76 45 00 8b 45 e4 50 ff 15 04 04 5a 00","matches":true},{"label":"save descriptor block 0x457750 size 0x288","vaHex":"0x00423555","expectedBytes":"6a 00 8d 45 e8 50 68 88 02 00 00 68 50 77 45 00 8b 45 e4 50 ff 15 04 04 5a 00","actualBytes":"6a 00 8d 45 e8 50 68 88 02 00 00 68 50 77 45 00 8b 45 e4 50 ff 15 04 04 5a 00","matches":true},{"label":"save flag block 0x59db60 size 0x200","vaHex":"0x00423581","expectedBytes":"6a 00 8d 45 e8 50 68 00 02 00 00 68 60 db 59 00 8b 45 e4 50 ff 15 04 04 5a 00","actualBytes":"6a 00 8d 45 e8 50 68 00 02 00 00 68 60 db 59 00 8b 45 e4 50 ff 15 04 04 5a 00","matches":true}]},"routeBridgeGates":[{"gate":"consumer mechanism","status":"grounded","evidence":"opcode 0x08 reads 0x0059de30 at 0x0040adfe and stores it into context+0x40","blocksRouteProof":false},{"gate":"save/load selected-root restore","status":"grounded","evidence":"function 0x00423319 reads 0x4576d8/0x457750/0x59db60 on load, then 0x004234a3 reconstructs 0x0059de30 from 0x4576da/0x4576db","blocksRouteProof":false},{"gate":"save/load as live route producer","status":"blocked","evidence":"the same routine is a persisted-state restore/write path; it does not prove a normal scene/event route chose selector 2:0","blocksRouteProof":true},{"gate":"selected root external proof","status":"blocked","evidence":"selectedRootExternalProofFound=False; real selector 2:0 saves=0","blocksRouteProof":true},{"gate":"source/current bridge","status":"blocked","evidence":"source->current=0; predecessor->current=0; forward merge=0","blocksRouteProof":true},{"gate":"producer/hotspot","status":"blocked","evidence":"producerHotspotProofFound=False; source/predecessor current-range producers=0","blocksRouteProof":true},{"gate":"runtime consumer watchpoint","status":"blocked","evidence":"runtimeProof=False; consumer hits=0; route-value hits=0","blocksRouteProof":true}],"decisions":[{"item":"selected root consumer","promotion":"grounded","evidence":"opcode 0x08 handler 0x0040adc9 checks global 0x0059de30, reads it at 0x0040adfe, then writes context+0x40 at 0x0040ae06","remainingGap":"not route-specific by itself; the global value must be proven to be 0x00540714 on the route path"},{"item":"selected root producers","promotion":"grounded","evidence":"save/load restore, opcode 0x07, opcode 0x09 stores to 0x0059de30 are byte-verified","remainingGap":"save/load restore is not a live route producer; source/predecessor roots do not currently produce current selector 2:0 root/range"},{"item":"save/load selected-root restore","promotion":"grounded","evidence":"0x00423319 load mode reads state/descriptor/flag blocks, and 0x004234a3 rebuilds selected root from persisted selector bytes","remainingGap":"does not show which live event command originally wrote 0x4576da/0x4576db or selected selector 2:0"},{"item":"source/predecessor producer scan","promotion":"blocked","evidence":"opcode 0x08 activators=162, current-root producers=0, current-range producers=0","remainingGap":"needs captured selector 2:0 save, runtime selected-pointer trace, or strict map1_01a producer/hotspot"},{"item":"consumer-to-route bridge","promotion":"blocked","evidence":"consumer is grounded, but source/current bridge=0, predecessor/current bridge=0, runtime consumer proof=False","remainingGap":"prove 0x0040adfe consumes 0x00540714 on a normal map1_01a route path, not only that the consumer exists"},{"item":"map1 direct execution root","promotion":"gap","evidence":"directExecutionRootFound=False","remainingGap":"scene record to executed VM stream is still not proven"}],"remainingProofs":["runtime watchpoint at 0x0040adfe proving 0x0059de30 == 0x00540714 on the route path","captured gameplay save whose save bytes select group 2 slot 0","strict map1_01a hotspot/producer that sets selected pointer to selector 2:0 before opcode 0x08"],"sourceArtifacts":{"selectedPointerUsage":"/home/exedev/hwanse/out/save_selector_selected_pointer_usage.json","opcodePaths":"/home/exedev/hwanse/out/save_selector_selected_pointer_opcode_paths.json","activationWindows":"/home/exedev/hwanse/out/save_selector_opcode08_activation_windows.json","executionRoute":"/home/exedev/hwanse/out/scene_event_vm_execution_route_review.json","selectedExternal":"/home/exedev/hwanse/out/selected_root_execution_external_proof_packet.json","mergeBridge":"/home/exedev/hwanse/out/save_selector_merge_bridge_matrix.json","runtimeHandoff":"/home/exedev/hwanse/out/scene_event_runtime_evidence_handoff.json"}}