"Jjjg^dZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z mZddlmZeej%j&dZed z Zed z Zd Zd Zd ZdZdZdZeedZeedZdZ dZ!dZ"dZ#dZ$gdZ%e&dDcgc]}d| c}Z'ddddge'Z(dZ)dZ*dDdZ+dEdZ,dFd Z-dGd!Z.dHd"Z/dId#Z0dJd$Z1dKd%Z2dLd&Z3dMd'Z4dNd(Z5dOd)Z6dPd*Z7dQd+Z8dRd,Z9 dS dTd-Z:dUd.Z;dVd/ZdYd2Z?dZd3Z@d[d4ZAe#f d\d5ZBd]d6ZCd^d7ZDd_d8ZE d`d9ZFdad:ZGdbd;ZHdbd<ZIdcd=ZJddddddef ddd>ZKded?ZLded@ZMedfdfdAZNdgdBZOePdCk(reOyycc}w)hzTSummarize the selector 10:0 follow-up seen in the patched selector 2:0 runtime poll.) annotationsN)Path)Any)find_cns_strings read_sections va_to_offset) trace_streamoutz Hwanse2.exemap1_01amap2_02dz2:0z10:0 0x00540714 0x0053c4a4 0x0059de30@)activeOrderCount activeOrder0 activeOrder1 activeOrder2activeSlot0DescriptoractiveSlot1DescriptoractiveSlot2DescriptorruntimeSlotBaseTable0runtimeSlotBaseTable1runtimeSlotBaseTable2runtimeObjectTable0runtimeObjectTable1runtimeObjectTable2opcode24Mode1Sourceopcode24RuntimeFlagopcode24CurrentObjectIndex secondaryBranchStateactiveSelectionFlagr!r"r#i@icp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)pathfallbacks P/home/exedev/hwanse/tools/summarize_runtime_patched_selector_followup_context.py load_jsonr2As* ;;= ::dnngn6 77c|D]G}|jdxsg}|jd|k(s|jd|k(s||vsE|cSiS)NselectorLabelsselectorprimarySelectorget)rowsr6rowlabelss r1 find_selectorr=Gs\)*0b 77: ( *cgg6G.HH.TX`djXjJ Ir3c d|jddD\}}g}|jdxsijdxsgD]}|jd|k(s|jd|k(s-|j|jd|jd|jd|jd |d |S) Nc32K|]}t|ywN)int).0parts r1 z+find_selector_write_rows..Ps@3t9@s:r opcode4fDataScanr:groupslotvaHexmode)rIrGrHrJr6)splitr9append)runtime_selector_byte_writesr6rGrHr:r;s r1find_selector_write_rowsrNOs@Q)?@KE4 D,001CDJOOPVW][] 777 u $D)@ KK))$   Kr3ci}|D]}|jdxsijD]j\}}|j|i}|xsgD]J}|jd}||j|dt|jdxsdz||<Llt |jD cic]8\}}|t |jdD cgc] \}} || d c} }:c} }}}Scc} }wcc} }}}w)NuniqueWatchValuesvalueHexrcountc|d |dfS)Nr r)items r1z2aggregate_watch_values_from_rows..ksRVWXRYQY[_`a[bPcr3)key)rQrR)r9items setdefaultrAsorted) r: aggregater;namevaluestarget value_row value_hex value_rowsrRs r1 aggregate_watch_values_from_rowsrb^s%+-I` WW%89?RFFH `LD&))$3F#\r ` %MM*5 $$*JJy!$C"%377: /4/r3c t|||duSr@)rh)rfrgr\s r1watch_value_stablerls lL$ ?t KKr3cB|Dcgc]}t|||c}Scc}wr@)rj)rfrgnamesr\s r1stable_watch_hexesrosJO P$OL, = PP Psc|r|syt|d}t|d}||cxkr |tzkrnydt|z|z dSy)Nr0x08x)rA IMAGE_SIZE IMAGE_BASE)r`loaded_base_hexvalue loaded_bases r1runtime_to_static_hexrxsV O  2 Eor*Ke6kJ66 J&4S9:: r3cx|xsi}|sdddS|jdxsg}|Dcgc]}|jds|}}|xs|}td|Dt|t|Dchc]%}|jds|jd'c}}t |dk(r|d nd}gd }gd }gd } gd } t |} t d} | r t| dnd} | | d| ng}t |}t | }t | }tDcic]+}t ||t |t|d-}}iddddd|jdd|jddt |dd|Dcgc]%}|jds|jd'c}dtd t |t |z d|jddt|jdxsijdd|jdd |jd!xsgd"|jd"xsgd#|jd$xsgd%|jd&d'|jd(d|| | | |||Dcgc]}t||c}||Dcgc]}t||c}||Dcgc]}t||c}tfd)tD|dd*gd+d,Scc}wcc}wcc}wcc}wcc}wcc}wcc}w)-NFKruntime_selected_pointer_patched_public_selector_2_0_active_order_poll.json available sourcePollr:reachedRouteSelectorContextc3XK|]"}t|jdxsd$yw sampleCountrNrAr9rBr;s r1rDz6build_active_order_runtime_evidence..s#N#S!7!<1=N(* loadedBaseHexr r)rrr)rrr)rrr)rrr rrrQstabler|Tr}totalSequenceCount sequenceCounttotalSampleCountrrouteSequenceNamesr\nonRouteSequenceCountpreludecaseAliasesEnabled caseAliasesenabledstagedSaveKindstagedSelectorspublicSaveSelectorsobservedSelectorsobservedStagedSelectorsobservedPublicSaveSelectorsreachedCurrentRootanyReachedCurrentRootreachedRouteSelectoranyReachedRouteSelectorContextc3ZK|]"}j|rt|$ywr@r9rl)rBr\route_sample_countrfs r1rDz6build_active_order_runtime_evidence..s1& % |-? F& (+diagnostic-only)zZactive order/count was observed only while loading the patched public-base diagnostic savezthe poll keeps activeOrderCount at 0x01 and the active order at descriptor id 0, matching the public-base save shape rather than a captured selector 2:0 route savezstable active-order bytes explain the diagnostic runtime state but do not prove normal gameplay executes selector 2:0 or reaches the map1_01a source trigger)activeOrderCountHexrorderByteHexesactiveOrderHexesactiveSlotFirstDwordsHexactiveSlotFirstDwordsStaticHexruntimeSlotBaseTableHexesruntimeSlotBaseTableStaticHexesruntimeObjectTableHexesruntimeObjectTableStaticHexesallWatchedValuesStable watchedValuesnotRoutePromotionProofpromotionStatusnonPromotingBecause)r9sumrbrZrerorjrAACTIVE_ORDER_WATCH_NAMESrlmaxboolrxall)active_order_pollall_rowsr; route_rowsr: loaded_basesruorder_byte_namesactive_slot_namesslot_base_table_namesobject_table_namesorder_byte_hexesactive_order_count_hexactive_order_countactive_order_hexesslot_first_dwordsslot_base_table object_tabler\watched_valuesrvrrfs @@r1#build_active_order_runtime_evidencers)/R g  !$$V,2H!)T#SWW5R-S#TJT  !DNNN3D9Lt`swwG_377?3`aL),\):a)?l1oTOGcg^),8JL\],\;MOabfh*<9KM^_(7IK`aO%l4FHZ[L -   <);T B N ' 6H$O(7I4P  N/ T/ c/  /33OD/  -11-@ /  T /  ) /  $R3#''&/swwvR/  QH J(G!H/  $((3/  d$5$9$9-$H$NB#S#ST]#^_/  +//0@A/  ,001FGM2/  .223FGM2/  "#4#8#89V#W#][]/  /334KL/   1 5 56V W!/ " #/ $ 6.*.$5GX+ >C !% 9+ &5GV, >C !% 9, $0GS* >C !% 9* #&& 0& # ("&, U/ /3UaS + , * s;LL2L L*0L#L(2L(.L-L2"L7c  |xsi}|sdddS|jdxsg}|Dcgc]}|jds|}}t|jdxsd |jdxs t|td |D}t|}t  t }t ||t }t |t t k(xrtd |D}t|xr/t |t t k(xrtd |D} tD cic]+} t | | t | t | d -} } tD cic]+} t||| | t||| t||| d -} } id dddd|jdd dt |d|d|Dcgc]%}|jds|jd'c}dtdt |t |z d|jddt|jdxsijdd|jdd|jdxsgd|jdxsgd|jdxsgd |jd!d"|jd#d$t d%id&t||d%d't d(d)t d*d+t d,d-|d.|d/|d0| d1|rdndd2| rdndd3t fd4tDd5| d6| d7dd8d9d:gd;Scc}wcc} wcc} wcc}w).s#T#S!7!<1=Trc3&K|] }|dk( yw0x00NrTrBrvs r1rDz6build_branch_state_runtime_evidence..CECc3&K|] }|dk( ywrrTrs r1rDz6build_branch_state_runtime_evidence..rrrr|Tr}rrrrr\rrrrrrrrrrrrrrractiveSelectionFlagHexr&routeActiveSelectionFlagHexopcode24Mode1SourceHexr!opcode24RuntimeFlagHexr"opcode24CurrentObjectIndexHexr#secondaryBranchStateHexesrouteSecondaryBranchStateHexessecondaryBranchStateAllZero routeSecondaryBranchStateAllZero matchesPredecessorFillHypothesis%routeMatchesPredecessorFillHypothesisrc3ZK|]"}j|rt|$ywr@r)rBr\total_sample_counttotal_watch_valuess r1rDz6build_branch_state_runtime_evidence..8s2& !%%d+ 13Et L& rrrouteWatchedValuesrrrr)z\branch-state values were observed only while loading the patched public-base diagnostic savez`all secondary branch-state bytes stayed 0x00 across the constructed selector 2:0 diagnostic pollznan all-zero constructed diagnostic state does not prove normal gameplay executes the predecessor fill fragment) r9rArbrro"SECONDARY_BRANCH_STATE_WATCH_NAMESrerrBRANCH_STATE_WATCH_NAMESrjrlr)branch_state_pollrr;rrroute_watch_valuestotal_secondary_hexesroute_secondary_hexestotal_secondary_all_zeroroute_secondary_all_zeror\rroute_watched_valuesrrs @@r1#build_branch_state_runtime_evidencers)/R g  !$$V,2H!)T#SWW5R-S#TJT.22=AFQG*../DEsIijrIsTTT9*E.* /* !"c*L&MM D C-BC C Z D % &#.P*Q Q D C-BC C-   -/A4 H T '(: )*??2 @ &'?A2 B +,DC2 D +5MESWE2 F 0:RX\G2 H !#& 0& # I2 R S2 T 2U2 V !$W2 X ,Y2 Z  [2 2QU0Ys#M%M%40M*.0M/M4'M4c|xsi}|sdddS|jdxsg}|Dcgc]$}|jdr|jd&}}|Dcgc]$}|jdr|jd&}}|Dcgc]$}|jdr|jd&}}id d d dd |jd d |jd d|jdd|jdxsgd|Dcgc]}|jd|jdxsi|jd|jd|jd|jdxsg|jd|jd|jd|jd|jd|jdd c}dt|d|dt|d|dt|d|d|jdd |jd d!d d"d#d$gd%iScc}wcc}wcc}wcc}w)&NF2runtime_patched_selector_exit_candidates_poll.jsonr{ candidateRowsrsideanyReachedStagedSelectorbranchStateNonzeror|Tr} stagedKindbaseSavecandidateCountcandidateSaveRowstile autoTriggerrselectorCountsropcode24Mode1SourceValuesopcode24RuntimeFlagValues opcode24CurrentObjectIndexValues) rrrrrrrreachedStagedSelectorrrrrrouteSelectorSideCountrouteSelectorSidesstagedSelectorSideCountstagedSelectorSidesbranchStateNonzeroSideCountbranchStateNonzeroSides anyCandidateReachedRouteSelectoranyCandidateBranchStateNonzerorrrr)zCcandidate saves are constructed from edited selector/position byteszWonly observed selector 2:0 hit is from a patched diagnostic save, not captured gameplayzRbranch-state and opcode24 watch values stay zero across candidate movement sampleszetop/bottom/right candidate sequences did not even observe the staged selector in this calibration runrd)exit_candidate_pollr:r; route_sides staged_sidesbranch_nonzero_sidess r1%build_exit_candidate_runtime_evidencerIs-3 N    " "? 3 9rD  773 4 K  77- . L  77' (  ( T( J(  )--l;(  '++J7 (  -112BC (  0445HIOR (   -2"ww}5"ww}5"%''*:";%(WW-@%A%GR(+0P(Q),1K)L&)gg.B&C-0WW5P-Q-0WW5P-Q47GG<^4_  ( 0 !#k"21( 2 k3( 4 "3|#45( 6 |7( 8 &s+?'@9( : "#7;( < +,?,C,CDf,g=( > )*=*A*ABb*c?( @ !$A( B ,C( D  E( (   s)H;)I)ICI cd|j|xsg}djd|DxsdS)N,c3K|]:}|jd'|jdd|jd<yw)rQNxrRr8rs r1rDz%watch_value_counts..sF  77:  * 77:  q!1 23sAA-)r9join)rfr\r:s r1watch_value_countsr s?   D ! 'RD 88    r3c`djd|jdxsgDxsdS)Nrc3fK|])}|jdd|jd+yw)r6r rRNr8rBcontexts r1rDz*selector_context_counts..s7  ;;z " #1W[[%9$:;s/1uniqueSelectorContextsr )r r9r;s r1selector_context_countsrs9 88ww78>B    r3c|xsi}|sd|dS|jdxsg}|Dcgc]6}|jds!t|jdxsddkDr|8}}t|t|jdxsdidd d |d |jd d |jd d|jddt|d|Dcgc]%}|jds|jd'c}d|jdxsgd|jdxsgd|jdd|jddt d|Ddt ddt ddt ddt d d!t d"t d#t fd$d%Dd&Scc}wcc}w)'NFr{r:r~routeSelectorHitCountrrr|Tr}rrrrouteSequenceCountrr\rrrrrrrc3XK|]"}t|jdxsd$ywrrNrrs r1rDz1left_stability_recheck_summary..s%$`TWS1H)I)NQ%O$`rrr!rr"rr#activeOrderCountValuesractiveSlot0DescriptorValuesrrc3`K|]%}j|rt|dk('ywrr9rjrBr\rgrfs r1rDz1left_stability_recheck_summary..s5& % L, = G& +.r!r"r#)runtimeSlotBaseTable0ValuesallSamplesOpcode24Zero)r9rArbrerr r) source_pollpollr:r;rrgrfs @@r1left_stability_recheck_summaryr$sN :2D %   88F  !rD  770 1SAX9Y9^]^5_bc5c J 4D9Ltxx .3!4L T k  dhh/0  /2   txx .   c*o   *X3PVswwvX  TXX&9:@b  "488,I#J#Pb  dhh'>?  )I J  $`[_$`!`  $%7 F[%\  $%7 F[%\  +,>|Mi,j  !"4\CU"V! " &'9,H_'`# $(:,H_'`"%& d& # ' Ys;GG4Gc*|xsi}|sdddS|jdxsg}|Dcgc]6}|jds!t|jdxsddkDr|8}}|Dcgc] }||vs| }}t|jdxsdt|gd }tfd |D}t d |} t d |} t d |D} t | jd} t | jd} iddddd|jdd|jdd|jddt|d|Dcgc]%}|jds|jd'c}dt|d|Dcgc]%}|jds|jd'c}d|jdxsgd|jdxsgd|jdxsgd|jdd |jd!d| d"td#d$td%td&||Dcgc]s}|jd|jd'xsg|jdt||jd(|jd|jdd)uc}| | | | | r| s| sd*n| s| rd+nd,dd-gd.d/ Scc}wcc}wcc}wcc}wcc}w)0NF1runtime_patched_selector_left_stability_poll.jsonr{r:r~rrrrc3`K|]%}j|rt|dk('ywrrrs r1rDz8build_left_stability_runtime_evidence..s5    D !  lD9VCr9runtime_patched_selector_left_stability_recheck_poll.json4runtime_patched_selector_left_active_order_poll.jsonc3XK|]"}t|jdxsd$ywrrrs r1rDz8build_left_stability_runtime_evidence..s%"^RU3sww/F'G'L1#M"^rr|Tr}rrrrrr\rnonRouteSequenceNamesrrrrrrrrrrr!rr"r#keyscurrentRootHitCount)r\r,rrr-rrznot-reproduced reproducedz no-route-hitr)zIleft-exit stability poll uses a constructed public-base selector 2:0 savez6load-only and load-left variants stay at selector 50:0zYonly load-right observes selector 2:0/10:0, making the hit sequence-dependent calibrationz_selector-only and active-order rechecks did not reproduce the earlier left-load-right route hitz9opcode24 watch values stay 0x00 across the stability poll) ropcode24AllZero sequenceRowsrecheckactiveOrderRecheckrouteHitReproducedByRecheck&routeHitReproducedWithActiveOrderWatchrouteHitReproducibilityrrr) r9rArbrr$rrrer r)left_stability_pollleft_stability_recheck_pollleft_active_order_pollr:r;rnon_route_rowsopcode_watch_namesopcode24_all_zeror1active_order_recheckoriginal_route_hit_countroute_hit_reproduced_by_recheck&route_hit_reproduced_with_active_orderrgrfs @@r1%build_left_stability_runtime_evidencer@s .3 M    " "6 * 0bD  770 1SAX9Y9^]^5_bc5c J &*CcS -BcCNC*..}=BCL3D9L & -C#G:> #"^Y]"^^&*7;;7N+O&P#-12F2J2JKb2c-d*4 T4 I4  )--.>?4  ,00A 4  *..}= 4  c*o 4  *X3PVswwvX4  ^!44  ^!_cswwW]#''&/!_4  0445HIOR4  .223HIOR4  "#6#:#:;X#Y#_]_4  1556MN4   3 7 78X Y4  !94  $%7 F[%\!4 " $%7 F[%\#4 $-?|Mi,j,  -2"ww}5"9#">'*ww/D'E),1H)I(+0M(N   2'F2X(0OX~ /2X"&, [4 4; D>Y!_  s0;K<* L4L(L?L&L =L &A8L cj|rd|vry|jdd\}}t|dt|dfS)Nz..r r)rKrA)rvstartends r1parse_hex_rangerD%s: D%T1%JE3 ub>3sB< ''r3cV|D]$}|d}||dz}||cxkr|ksn|dcSy)Nvaraw_sizer\rT)sectionsrFsectionrBrCs r1section_name_for_varJ,sE# gj)) B  6? " # r3cvt||}||dzt|kDrytjd||dS)Nz"S]U3K( c 23')I~c&:&(Io-(4  G  CJ C!" Kr3c*g}|D]}|jd|jd|jd|jd|jd|jd|jdxsg|jd|jd |jd |jd |jd d }|j|jDcic]\}}|dgfvs ||c}}|Scc}}w)NsteprIrQ opcodeHex handlerVaHexhandlerSection fixedAdvances pointerHexrZbranchTargetHexfallthroughVaHex stopReason) rcrIrQrdrerfrgrhrZrirjrk)r9rLrX)tracer:r;compactrWrvs r1compact_trace_rowsrn\s D_GGFOWWW% +-GGN3!gg&67 WW_5;'',/775>"ww'89 #(: ;'',/   '--/]JCUSWY[R\E\S%Z]^_ K^s .D =D clt|D]&}|jds|jdcSy)Nrk)reversedr9)rlr;s r1trace_stop_reasonrqqs5) 77< 77<( () r3c|D]d}|jddk7r|jd}|s,t|ddz}t|||}|yd|dd|dt||dcSy) Nrd0x20rIrrLrqrr)descriptorVaHexdescriptorPointerHexdescriptorPointerSection)r9rArQrJ)rOrHrlr;va_hex descriptor_vadescriptor_values r1opcode20_descriptor_pointerrzxs  77; 6 ) ! FB!+ #C=A  #!#M##67&()9#(>$?(;HFV(W    r3c tg}|jdxsijdxsgD]}|jd}|st|d}||z |cxkr ||zks5n8|j||jd|jd|jd|jdd |S) NaliasToCurrenthits sourceVaHexrrQ targetClasssourceLocationRole metadataLike)r~rQrrr)r9rArL)followup_bridge pointer_varadiusr}hit source_hex source_vas r1find_nearby_current_bridge_hitsrs D $$%56<"AA&IOR WW]+   B'  ) BzF/B B KK)GGJ/"ww}5&)gg.B&C # 7    Kr3c,tfd|DS)Nc3rK|].}|jdk(xs|jdk(0yw)rQrhNr8)rBr;r`s r1rDz'trace_contains_value..s6gZ]swwz"i/U377<3HI3UUgs47any)rlr`s `r1trace_contains_valuers gafg ggr3c|sy|\}}|D]B}|jdxs|jd}|s*|t|dcxkr|ks@yDy)NFrQrhrT)r9rA)rl value_rangerBrCr;r`s r1trace_contains_range_pointerrs_ JE3GGJ'@377<+@ #i"4:s:; r3c,tfd|DS)Nc3LK|]}|jdxsdvyw)rZNr8)rBr;map_names r1rDz,trace_contains_map_string..s#CcxCGGEN0b1Cs!$r)rlrs `r1trace_contains_map_stringrs CUC CCr3c|js|Dcgc] }|dd|d c}S|j}t|}t||}t |j dxsij d}t |j d} t |j dxsij d} g} |D]9t d } t|||| t} t| }t||| xsi}t|| }tfd |D}id d d dt|| dt|| dnddtdd| tz ddt ddt"| z dd|j dd|j dxsij ddt%| xr| d| cxkxr| dkncdt%|xr|d| cxkxr|dkncd| tk(d|r|dj dnddt'|dkDr|dj dndd|j d d!|j d"d#|j d$t)| |t+| t,t+| t t/| | t1| t2t1| t4|t'|t%||t7|||| d%gd&d'}| j9|<| Scc}w)(NFzmissing executable ) pointerVaHexcontextAvailableunavailableReasonaddressPredecessorRoottailRangeAfterLastFillHexaddressPredecessorRangeHexr|targetRangeHexrc3FK|]}|jdk(yw)r~Nr8)rBr pointer_hexs r1rDz8build_exact_followup_pointer_contexts..scsww}5Dcs!rrT fileOffsetHexrq06xrootHex rootOffsetHexrrcurrentRootHexcurrentRootDeltaHexpredecessorRangeHexwithinAddressPredecessorRangerr withinAddressPredecessorTailstartsAtAliasRootfirstOpcodeHexrdsecondOpcodeHexopcode20DescriptorVaHexrtopcode20DescriptorPointerHexru opcode20DescriptorPointerSectionrvblocked)zthe sampled follow-up pointer lands inside the target-side address-predecessor tail, not at the 10:0 alias root or a map1_01a source recordzrthe exact selected dword is descriptor/script data and is not itself one of the nearby current-range bridge dwordszthe local stream trace stops before reaching a selected-pointer store, exact current-root reference, source map string, or target map stringzHthe pointer was observed only in the patched public-base diagnostic poll)traceStopReasonrl"traceContainsSelectedPointerGlobal traceContainsCurrentRootExactRef$traceContainsCurrentRootRangePointertraceContainsSourceMapStringtraceContainsTargetMapString-exactSelectedPointerDwordIsCurrentRangeBridge"nearbyCurrentRangeBridgeDwordCount!hasNearbyCurrentRangeBridgeDwordsnearbyCurrentRangeBridgeDwords dwordWindowrr)r+ read_bytesrrrDr9rAr FOLLOWUP_POINTER_TRACE_STEPSrnrzrrrFOLLOWUP_ROOT_HEXFOLLOWUP_ROOT_VACURRENT_ROOT_HEXCURRENT_ROOT_VArrerqrSELECTED_POINTER_GLOBAL_HEXrrSOURCETARGETrarL)exe_path pointer_hexesaddress_predecessor_contextrrrOrHr\ tail_rangepredecessor_range current_rangecontextsrrl compact_trace descriptornearby_bridge_hitsexact_bridge_hitrs ` r1%build_exact_followup_pointer_contextsrs ??  -   !,$)':8*%E       CS!HsH-G $ ( ()A B HbMMNijJ((C(G(GHd(ef#o&9&9:J&K&Qr%V%VWg%hjMH$3! b) S(GZA]^*51 0hFL" <_jYcPbcc+ K+ +  Hj1= ",x"DS!IJ + ( +  r*/?"?!DE+  .+  "R*(DS'I#J+  "#>#B#BC_#`+  (,001IJPbUUVqr+  ,&d+    % UHu     sB&cRg}i}|jdxsgD]}|jdxsg}g}|jdxsgD]}|jd}|tthvr#t|jdxsd}|j|d|z||<|j |||jd|jdxsgt |jdxsgvt |jdxsgvd td |Dd} d} | rt| jd xsd} |D cgc]P} | jd xsijdtk(r#t| jd xsd| kr| R} } | r| d } |j |jdt||jd|jd|t|t|t| t| d ||fScc} w)Nr:rrr6rRrr fieldMaps)r6rRrrcontainsSourcecontainsTargetc3vK|]1}|jdxsijdtk(r|3yw)rr6N)r9r)rBrs r1rDz%poll_row_summaries..Qs; II/06B;;JGK\\ s79rrr\r-r) r\ eventCountr-rrselectorTransitionsphaseSelectorCountsfirstFollowupEventlastCurrentEventBeforeFollowup) r9rrrArLrrnextrerrr)r#r:totalsr;rrrr6rRfirst_followup_event"last_current_event_before_followupfirst_followup_indexrcurrent_events_before_followups r1poll_row_summariesr<s= DFxx%2. "(bww78>B G{{:.H 02CDD G,12E%zz(A6>F8  OO$";;y1$[[5;"(W[[-E-K"L"(W[[-E-K"L    $ #    .2* #&';'?'? 'N'SRS#T $.II/06B;;JGK[[ -05A69MM. *. .5STV5W2 GGFOf+#&77+@#A%(WW-D%E #@#H#8#@"/0D"E.;<^._  I. ^ <'.s AH$cR t|\}}td|D}t|Dchc]V}|jdxsgD]<}|jdtk(r"|jdr|jd>Xc}}}|jdxsijdxsg}t |t}t |jdxsgt}t |jdxsgt}t |jdxsgt}t |t}|jd xsi}|jd xsg}|jd xsg}|jd xsg}|jd xs|jd xsg}|jdxsijd|jdxsijd|jd|jd|jd|jd|jd|jd|jd|jd|jdd }t| |||} t|}!t|}"t| }#t| | | }$|jd|jd|jd|jd|jd|jd |jd!d"}%gd#}&d$}'id%td&td'td(td)td*t d+id,|jd,d-|jd-d.|jd.d/|jd/d0t#|jd1xsijd2d3|jd3d4|d |d5|d6|jd7d8|jd9d:t|vd;|jd;d<|d=|d>|d?|d@t|jdA|jdB|jdC|jdDxsgt#|jdD|t|vt|v|jdE|jdF|jdGdH dI|jdJ|jdK|jdL|jdM|jdN|jdE|jdO|jdP|jdQ|jdR|jdS|jdT|jd;dU dV|jdW|jdX|jdY|jdZxsgd[d\|d]|%d^| d_|!d`|"da|#db|$|t%||jdc|jddxsijde|jdfdgt#|t|vxrt|v|dhkDdidj|&gdk|'dl Scc}}w)mNc3K|]H}|jdxsgDcgc]}|jdc}ddttgk(rdJycc}ww)rr6Nr )r9rr)rBr; transitions r1rDz build_summary..s\  9<AV9W9][] ^:JNN: & ^_a`a b / 0 1   _sAAArr6rtargetAliasGroupaliases aliasRowsselectorRootScansrrrrrr|hitCount dataHitCount&aliasToCurrentExecutionLikeBridgeFound#aliasToCurrentAfterLastFillHitCount'aliasToCurrentAfterLastFillDataHitCount,aliasToCurrentAfterLastFillPreWriterHitCount,aliasToCurrentAfterLastFillLeafTableHitCount5aliasToCurrentAfterLastFillTraceCurrentWriterHitCount5aliasToCurrentAfterLastFillTraceCurrentReaderHitCount8aliasToCurrentAfterLastFillTraceRouteSceneRecordHitCount3aliasToCurrentAfterLastFillExecutionLikeBridgeFound) aliasToCurrentHitCountaliasToCurrentDataHitCountrrrrrrr r r opcode07SelectsCurrentRootCount opcode07SelectsCurrentRangeCount'opcode08NearestCurrentRootProducerCount(opcode08NearestCurrentRangeProducerCountopcode09StoresCurrentRootCountopcode09StoresCurrentRangeCountpromotingCandidateCount)rrrrrrr) zVpatched public-base diagnostic save is constructed from edited selector/position byteszZsampled 2:0 -> 10:0 selected-pointer movement comes from that constructed diagnostic statez:selector 10:0 contains the target map set but not map1_01az0selector 10:0 has no public captured save samplezcselector 10:0 has no non-current selected-pointer producer/store candidate for the current 2:0 rootz]target-alias bridge scans do not find an execution-like bridge into the current writer/readerzVpoll rows do not provide a normal gameplay control-flow trace or strict source hotspotzwpatched diagnostic branch-state watch keeps secondary branch state all-zero and cannot prove predecessor fill executionzxpatched exit-candidate movement poll is constructed diagnostic-only and keeps branch-state/opcode24 watch values at 0x00zpatched left-exit stability poll is constructed diagnostic-only; its initial 2:0 load-right hit did not reproduce in selector-only or active-order rechecksaThe patched public-base diagnostic poll proves that the original input-path/case-alias load path can select a constructed selector 2:0 save-shaped file. Its sampled events show the selected pointer starting at the current 2:0 root and later moving to a 10:0-range address in both candidate sequences. Selector 10:0 matches the target-side address-adjacent alias before the current root, contains map2_02d but not map1_01a, and its modeled fill/state and bridge evidence remain conditional. The branch-state diagnostic keeps secondary branch-state bytes at 0x00 even in the constructed selector 2:0 run, which is calibration evidence rather than predecessor-fill execution proof. The patched exit-candidate poll exercises top/bottom/left/right constructed selector 2:0 saves; only the left candidate observed selector 2:0, and all candidate samples kept branch-state and opcode24 watch values at 0x00. This is useful follow-up context, but it is not a captured gameplay save, normal-route selected-pointer trace, strict hotspot, or route promotion proof. The left stability poll initially separated load-only/load-left from load-right, but selector-only and active-order rechecks both stayed at selector 50:0. The earlier 2:0/10:0 hit is therefore non-reproducible constructed calibration, not route evidence. sourcer^currentSelectorrfollowupSelectorfollowupRootHex runtimePollrrstartupWaitSecondsrrrrrrrrrrrreachedFollowupSelectorrruntimeSelectorSampleCountstransitionPairCount"followupSelectedPointerStaticHexesr: followupAliasrolerrootAddressOrderIndexpublicSampleIds fillCount firstFillHex lastFillHex) r6r rr!r"hasPublicSamplerrrr#r$r%addressPredecessorEvidenceaddressPredecessorSelectoraddressPredecessorRootHexr addressPredecessorContainsSource addressPredecessorContainsTarget4addressPredecessorLastFillAllStartsPassCurrentReader.addressPredecessorTailCurrentRootExactRefCount,addressPredecessorTailFrontierReaderRefCount*addressPredecessorTailSourceRecordRefCount*addressPredecessorTailTargetRecordRefCountexecutionOrderProven) r6rrangeHexrrr#"lastFillAllStartsPassCurrentReadertailExactCurrentRootRefCounttailFrontierReaderRefCounttailSourceRecordRefCounttailTargetRecordRefCountr1r stateEffectstateEffectStatusallStartSlotsPassCurrentReaderpassingStartSlotCountuniqueFillValuesHex)r9r:r;r<bridgeEvidence!globalSelectedPointerPathEvidenceexactFollowupPointerContextsactiveOrderRuntimeEvidencebranchStateRuntimeEvidenceexitCandidateRuntimeEvidenceleftStabilityRuntimeEvidence$selectorByteWriteMechanismIdentifiedrF crossWriteToCurrentSelectorCountselectorByteWritePromotesRoute)selectorWriteRowsselectorWriteRowCountrDrErFrTr)zXcapture a gameplay savedat or equivalent runtime selected-pointer trace for selector 2:0zfprove a normal control-flow path from selector 10:0 or another predecessor into the current 2:0 readerzOfind a strict map1_01a source hotspot or equivalent original transition trigger) selectorByteWriteEvidence"runtimeTransitionTimelineAvailable,coObservedCurrentAndFollowupInDiagnosticPoll+observedCurrentThenFollowupInDiagnosticPollrrnotRoutePromotionReasonsremainingProofs conclusion)rrrZr9rr=rNrrrrr@rrrrrrre)(r#mapset_aliasesrtarget_alias_state_effectstarget_alias_bridgesglobal_selected_pointer_pathsrMrrrr6r7r8r runtime_rowsruntime_selector_sample_countstransition_pair_countr;r&followup_selected_pointer_static_hexestarget_aliasesfollowup_aliasfollowup_staterfollowup_global_pathfollowup_selector_write_rowsaddress_predecessor_rootobserved_selectorsstaged_selectorsobserved_staged_selectorsfollowup_field_mapsfollowup_bridge_countsexact_followup_pointer_contextsactive_order_runtime_evidencebranch_state_runtime_evidenceexit_candidate_runtime_evidenceleft_stability_runtime_evidenceglobal_path_countsnot_route_promotion_reasonsrOs( r1 build_summaryrjqs 4Fd3K0L0   .45 ''"78>B5  >>* %): :z~~Nh?i 12525.* %(();<BGG RXVXN">3DEN"#=#A#A+#N#TRTVghN#$8$<$<[$I$ORQbcO(%))*=>D"$<>?WX^\^"56<"xx 56<" $)F G M2(,,[9h=Q=U=UVa=bhfh#2#6#67G#H#NB"S"ST^"_'6':':;K'L'RPR&W&WXf&g2A2E2EFn2o/>/B/BCh/i3B3F3FGp3q8G8K8KLz8{8G8K8KLz8{APATAT CB BQATAT CB ETDWDW FE @O?R?R A@ #*'L.# '# %HHY$Z!$GHY$Z!&KL_&`#&K#'# ,@+C+CDe+f,@,D,DEg,h3G3K3KLu3v4H4L4LMw4x*>*B*BCc*d+?+C+CDe+f#7#;#;)--m<  5_ P %3778TU2667RS3778TU9==>`a9==>`a155kB2M2Q2QF3-H,K,KL|,}*E*I*IJx*y(C(G(GHt(u(C(G(GHt(u$?$C$CDZ$[:>>?PQ' Q_ r !/!3!34G!H.<.@.@Aa.b%3%7%78O%P#1#5#56K#L#RPR  s_ ~ 0_ @ ,-?A_ B '(GC_ D %&CE_ F %&CG_ H '(GI_ J '(GK_ N">%()E%F4P4T4T652N1Q1QRd1e1kik0p0p21/K.N.NOo.p & /33H.I  2 2 ^7HL^7^7Lq7P"&$$? !}_ _w5sAZ# cT|d}|d}|d}|d}|d}|d}|d}|d}|d } |d } |d } |d } dd } ddd|dd|ddd|dd|ddd|dd|ddd|dd|dd d!j|d"xsd#dd$|d%dd!j|d&xsd#dd'|d(d)|d*d+d!j|d,xsd#dd-| jd.d/| | jd0d1| | jd2dd3| jd.d4| | jd5d6| | jd7d8| jd9d:| jd; d<|d=d>|d?dd|d@ddAddBdCg}|dDD]j}d!jdE|dFDxsd#}dGjdH|dIDxsd#}|jdJ|dKdL|dMdN|dOdP|dQ|dR l|jddSddTdUdV|dWdRdX|dYdRdZ|d[d|d\dRd]d!j|d^xsd#dRd_|d`da|dbdc|dddRde|dfdRdg|dhdRdi|djdk|dldmdn|dodp|dqdrds|dtdRdu|dvd|dwd|dxdRdy|dzdRd{| d|dRdd}dd~dg|D]}d|jdd|jdd|jdd|jdd|jd }|jdJ|ddQ|jddQ|jddQ|jddQ|jdd|jddQ|jddQ|jddQ|jddQ|jddQ|dR|jgd|D]}|jd|ddddg|jdxsgD]}|jd|jddP|jddQ|jddQ|jddQ|jddL|jdxsd#d |jd|jdddTdUd|jddRd|jd.dRd|jdd|jddd|jdd|jddd| |jd5dRd|jddRd| |jd"dRd| |jd&dRd|jdd|jddRd|jddRd|jddRd| |jddRd| |jddRd| |jddRd| |jddRd| |jd«dRd| |jdīdRd| |jdƫdRd| |jdȫdRd|jdʫdRd|jd?dRdg|jdddTdUd| jddRd| jd.dRd| jdd| jddd| jdd| jddd| | jd5dRd| jddRd| | jd"dRd| | jd&dRd| jdd| jddRd| jdΫdRd| jdЫdRd| jdҫd| jdӫd| jdԫdRd| | jd֫dRd| | jdثdRd| jdګdRd| jdܫdRd| jdޫdRd| jdʫdRd| jd?dRdg|jgdߢ| jdxsgD]}|jdxsi}|jd|jddP|jdd|jddL|jddP|jdxsd#dL|jddN|jddP|jddQ|jddQ|jddR|jd|jgd| jdxsgD]}|jdJ|jdKdQ| |jddL|jddP|jdxsd#dL|jdOdP| jddQ| jddQ| jddR|jdd| jdxsifd| jdxsiffD]\}}|jd|ddddJ|jdxsd#dL|jddP| |jd"dQ| |jd5dL|jdOdP|jdxsd#dQ|jdxsd#dQ|jdxsd#dL|jdddg|jddg|jd|dD|jgd|jd|dD|jddj|S(Nrrr'r8r=r>r?r@rArBrCrIcBdjd|xsgDxsdS)N, c38K|]}|t|ywr@rrs r1rDz0markdown..join_values..TSARUSr r r]s r1 join_valueszmarkdown..join_valuesS!yyS2SSZWZZr3z,# Runtime Patched Selector Follow-up Contextrz - route: `rz` -> `r^`z- current selector/root: `rz` / `rz- follow-up selector/root: `rrz- runtime poll: r sequence(s), rz sample(s), observed `rmrr z- staged kind/selectors: `rrz8- co-observed current and follow-up in diagnostic poll: rKz0- sampled current -> follow-up transition rows: rz"- follow-up selected pointer(s): `rz'- exit-candidate diagnostic: available=r|z routeSides=`rz` branchNonzeroSides=`rz'- left-stability diagnostic: available=z routeSequences=`rz` nonRouteSequences=`r+z` opcode24AllZero=r/z reproducibility=r5z)- runtime transition timeline available: rJz- promotion status: `rrOz## Runtime RowszR| sequence | current hits | route hits | selector contexts | sampled transitions |z!| --- | ---: | ---: | --- | --- |r:c3BK|]}|dd|dd|dywr6rErR@rNrTrs r1rDzmarkdown..ts; z"#1WW%5$6a 8J7K L r -> c3DK|]}|dd|dd|ddywr6rzrrErmsNrTrBrs r1rDzmarkdown..xsA" *%&a 3M(N'OqQ[\gQhPiik l"  rz| `r\z` | r-z | rz | `z` | `z` |z## Follow-up Selector 10:0z| property | value |z | --- | --- |z | role | `r z| root order | `r!z| contains source/target | `rrz| public samples | `r"z | fills | `r#z` from `r$z` to `r%z| address predecessor range | `r2z*| address predecessor execution proven | `r1z| modeled state effect | `r9z`, pass starts `r;z`/12 |z| alias->current hits | `r z ` total, `r z` data |z+| after-last-fill execution-like bridge | `r z;| after-last-fill trace writer/reader/scene-record hits | `rr r z+| selected-pointer promoting candidates | `rz| selector byte write rows | `rHz"## Exact Follow-up Pointer Contextz| pointer | root offset | tail | root start | opcodes | opcode20 descriptor | trace stop | exact bridge | nearby bridge dwords | trace refs |z?| --- | ---: | --- | --- | --- | --- | --- | --- | ---: | --- |zselectedGlobal=r, currentRoot=r, currentRange=r , sourceMap=r , targetMap=rrrrrrrrrrrr)rz### Exact Pointer Tracerz#### z/| step | va | value | opcode | handler | stop |z&| ---: | --- | --- | --- | --- | --- |rlz| rcrIrQrdrerkz |z## Runtime Active Order Watchz| source poll | `r}z| available | `z| route samples | `z ` across `z` route-reaching sequence(s) |z| total samples | `rrz` sequence(s) |z| route sequence names | `z| non-route sequences | `rz| observed selectors | `z| staged selectors | `z| reached current/route | `rrz| loaded base | `rz| active order count | `rz| active order bytes | `rz| active order used bytes | `rz| active slot first dwords | `rz%| active slot first dwords static | `rz| runtime slot-base table | `rz$| runtime slot-base table static | `rz| runtime object table | `rz!| runtime object table static | `rz| all watched values stable | `rz| promotion status | `z## Runtime Branch State Watchz| active selection flag | `rz!| route active selection flag | `rz"| opcode24 mode/runtime/object | `rrrz| secondary branch state | `rz"| route secondary branch state | `rz%| secondary branch state all zero | `rz+| route secondary branch state all zero | `rz)| matches predecessor fill hypothesis | `r)z## Exit-candidate Diagnosticrzh| side | tile | samples | selectors | route 2:0 | branch nonzero | mode1 | runtime flag | object index |z8| --- | --- | ---: | --- | --- | --- | --- | --- | --- |rrrr yrrrrr)z## Left-stability Diagnosticrz\| sequence | keys | samples | selectors | route hits | mode1 | runtime flag | object index |z3| --- | --- | ---: | --- | ---: | --- | --- | --- |r0r,selector-only recheckr1active-order recheckr2z### z| source poll | samples | selectors | route sequences | route hits | active order count | slot0 descriptor | runtime slot-base table0 | opcode24 all zero |z9| --- | ---: | --- | --- | ---: | --- | --- | --- | --- |rrr r!z## Non-promotion Reasonsc3&K|] }d| ywz- NrTrBreasons r1rDzmarkdown..*sQ62fXQrrM)rz## Remaining Proofsrc3&K|] }d| ywrrTrBproofs r1rDzmarkdown..,sF%2eWFrrN r]z list | Nonereturnr)r r9rLextend)rruntimealiasaddressstatebridge global_pathsexact_contexts active_order branch_stateexit_candidatesleft_stabilityselector_writesrtlinesr;rrr trace_refsrlrlabelr1s r1markdownrEsm$G O $E23G M "E % &F>?L;%?$@gN^F_E``ab &w/A'B&C5QbIcHddef 7?34N7=CYBZ[YYw':;<CDA G $W-=%>$?uTYYwWhOiEjEqnqDrrst B7KyCzB{| :7CX;Y:Z[ ,TYYw?c7d-e-lil,mmno 1/2E2Ek2R1ST"?#6#67K#LMNO*?+>+>?X+YZ[[\ ^ 2.2D2D[2Q1RS&~'9'9:N'OPQR).*<*<=T*UVWX)--.?@AB)--.GHI  K 4G<`4a3bc (9 :;1=    \+9 E<v  99 z?   kk" !"78"     #f+d3'<#=">c#F]B^A_`z{m3 0    LL $  U6]O3' 5!89:#> &u-='>&?uUK[E\D]]`a tyy/@)ABIcJ#N eK()%2G1HuUbOcNddgh )'**=)>cB 4W=S5T4UUXY $U+>%?$@@PQVWnQoPppvw #F+C$D#EZPVWsPtOuu}~ 5f=r6s5ttwx J K LM J K LM M N Os T 6lC\6]5^^ab (9P)Q(RRUV ,  XI58" gkk*NOPQ";;'IJKL#KK(NOPQ %CDEF %CDE  G   '.)*% O0L/MN :;+?uUYYzEZD[\IIk*+5>1J0K499\*1c2"6    R  LL'  L,,\:;3? ,**;78< l..}=>jIYIYZiIjHklJ K l../ABC:lN^N^_sNtMuvE F $[1A1ABV1W%X$YY\] #L$4$45L$M#NcR ";|/?/?@S/T#U"VVYZ \-=-=>O-P!Q RRUV %l&6&67K&L%MUS_ScScdzS{R|| A L,,_=>cB "<#3#34I#J"K3O ";|/?/?@P/Q#R"SSVW ' L4D4DEW4X(Y'ZZ]^ (\5E5EF`5a)b(ccfg / LjIYIYZiIjHklJ K l../ABC:lN^N^_sNtMuvE F $[1A1ABV1W%X$YY\] #L$4$45L$M#NcR ";|/?/?@S/T#U"VVYZ \-=-=>O-P!Q RRUV %l&6&67K&L%MUS_ScScdzS{R|| A %l&6&67O&P%QQTU +L,<,<=Z,[+\\_` ,\-=-=>V-W,XX]^j^n^npH_I^JJOP\P`P`a@PAOBBE F &{<3C3CD_3`'a&bbef ,[9I9IJj9k-l,mmpq / 0@0@A^0_/``cd 5l6F6FGi6j5kkno 3L4D4DEg4h3iilm ),*:*:;S*T)UUXY !1!12C!D ESI 14 LL ""?39r wwv$" !dhhsm_Adhhsm_DQ^I_H`a()0S1cgg>T6U5VVYww+,-T#'':U2V1WX345U377Ce;f:ggj l   LL LL !!.17R  #''&/"% CGGFO(D'ET#''R_J`Iab()0S1cgg>U6V5WX""#>?@A""#>?@A""#EFGs  L   LL ."4"4Y"?"E2F !3!34H!I!ORP w  5'N  j G'++l+2s34 M8R7STGKK(;<=>?GKK(<=>?t{{2345 45<=> 9:AcBC 9:AcB${{345R 9    & LL"  LLQW5O-PQQ LL01 LLF73D+EFF LL 99U r3cZ"|d}|d}|d}|d}|d}|d}|d}|d}|d } |d } |d |d } dd dddddjfd|dD} djd|D} g}|D]d}djd|jdxsgD}|jdtjt |dd|dfdjdtjt |jdddtjt |jdddtjt |jd d!tjt |jd"d#d$tjt |jd%d!tjt |jd&d'd(tj|jd)dd*tjt |jd+dd,tj|jd-dd.tj|jd/dd0tjt |jd1d2tjt |jd3dd4tjt |jd5dd6tjt |jd7dd8tj|jd9dd:tj|jd;ddtj|jd?dd@tj|jdAddBtj|jdCddDtj|jdEddFtj|jdGddHtjt |jdIddJtjt |jdKdg}djdtjt | jdddtjt | jdddtjt | jd d!tjt | jd"d#d$tjt | jd%d!tjt | jd&d'd(tj| jd)dd*tjt | jd+dd,tj| jd-dd.tj| jd/dd0tjt | jd1d2tjt | jd3ddLtjt | jdMddNtjt | jdOddPtjt | jdQd2tjt | jdRd2tjt | jdSddTtj| jdUddVtj| jdWddXtjt | jdYddZtjt | jd[dd\tjt | jd]ddHtjt | jdIddJtjt | jdKdg}djd^| jd_xsgD}djfd`jdaxsgD}djfdbdcjddxsifdejdfxsiffD}dgjdh|diD}dgjdj|dkD}djgdldmdndodptj|dqdrtj|dsdtdutj|dvd2tj|dwdtdxtj|dyd2tj|dzdtd{tjt |d"d|tjt |d d}tjd~j|d-xsddtdtjt |dd2tjd~j|d/xsddtd|dddtjt |dddtjd~j|dxsddtdtjt | jddtj| jddtj| jddtdtjt jddtjjd)dtjjddtjt jddtjt jddt d|dddtj|dKdtddtj|dddd| ddddtjt |dddtjt |ddd|dd2|dddtjd~j|dxsdddtjt |ddtjt |ddtjt |dddtjt |dddtjt |dddtjt |ddtjt |dddtjt |ddtjt |dddtjt |dddtjt |dd2tjt |dd2tjt |dddtjt |dddtjt | ddddȑdɑ| ddʑdj|dˑd|dd̑d|dd͑dΑ|ddϑdБ|ddёdґ|ddӑdo|ddԑdo|dS)Nrrr'r8r=r>r?r@rArBrCrIcBdjd|xsgDxsdS)Nrmc38K|]}|t|ywr@rors r1rDz1html_page..join_values..@rprqr rrrss r1rtzhtml_page..join_values?rur3c@djd|dDxsdS)Nrmc3BK|]}|dd|dd|dywryrTrs r1rDz2html_page..context_text..Cs; z"#1WW%5$6a 8J7K L r{rr rrrs r1 context_textzhtml_page..context_textBs.yy z?   r3c@djd|dDxsdS)Nr|c3DK|]}|dd|dd|ddywr~rTrs r1rDz5html_page..transition_text..IsA *%&a 3M(N'OqQ[\gQhPiik l rrr rrrs r1transition_textz"html_page..transition_textHs0{{ !"78   r3rc3`K|]}dtjt|ddtjt|ddtjt|ddtj|dtj|d y w) r\r- rN)htmlescaper)rBr;rrs r1rDzhtml_page..Ns   [[S[!1234{{3s#89:;<={{3s#:;<=>?[[c!2345[[!5678   sB+B.r:c 3K|]}djgdtjt|ddtjt|j ddtjt|j ddtjt|j ddtjt|j ddtjt|j d dtjt|j d dtjt|j d dtjt|j d dtjt|j d dtjt|j ddtjt|j ddtjt|j ddtjt|j ddtjt|j ddyw)rrrrrrrrrrrrrrz%selectedGlobal=rrrrrrrrrrN)r rrrr9rs r1rDzhtml_page..Xs#( '    [[W^%? @ [[W[[%A!BCD E [[W[[1O%P!QRS T [[W[[1D%E!FGH  I   [[W[[1A%B!CDE   FG   ;;s7;;'89: ; <   =  [[W[[1O%P!QRS T [[W[[1B%C!DEF G [[W[[1`%a!bcd e [[W[[1U%V!WXY Z ++c'++6Z*[&\]^ _ {{3w{{3U'V#WXY Z  C 4Z([$\]^ _ [[W[[1O%P!QRS T  [[W[[1O%P!QRS! " #  #sK#K%c3VK|] }dtjt|jddtjt|jddtjt|jddtjt|jddtjt|jddtjt|jd xsd d #y w) rcrrIrrQrdrerrkr  Nrrrr9)rBrls r1rDzhtml_page..ps   ;;s599V#45678S7);%<=>?S:)>%?@ABS;)?%@ABCS>)B%CDEF;;s599\#:#AcBCDE    sD'D)rlz

rz

z
stepvavalueopcodehandlerstop
z"source pollr}rz availabler|z$route samplesrz across rz, route-reaching sequence(s)z$total samplesrrz sequence(s)z+route sequence namesrz*non-route sequencesrz)observed selectorsrz'staged selectorsrz,reached current/routerz / rz"loaded baserz)active order countrz)active order bytesrz.active order used bytesrz/active slot first dwordsrz6active slot first dwords staticrz.runtime slot-base tablerz5runtime slot-base table staticrz+runtime object tablerz2runtime object table staticrz0all watched values stablerz'promotion statusrz,active selection flagrz2route active selection flagrz3opcode24 mode/runtime/objectrrrz-secondary branch staterz3route secondary branch staterz6secondary branch state all zerorz<route secondary branch state all zerorz:matches predecessor fill hypothesisrc3K|]}dtjt|jddtjt|jdxsijddzt|jdxsijdzdtjt|jddtjt|jd xsd dtjt|jd d tjt|jd dtjt|jddtjt|jddtjt|jddyw)rrrrr rrrrrr rrrrrrrrNrrs r1rDzhtml_page..s $  {{3swwv/012[[cggfo&;%@%@%E!F!LsTWT[T[\bTcTigiSnSnorSsOt!tuvw{{3sww}56789[[SWW-=%>%E#!FGHI{{3sww'=>?@AB{{3sww';<=>?@[[SWW-H%I!JKLM[[SWW-H%I!JKLM[[SWW-O%P!QRST  $sG5G7rc3 K|]y}dtjt|jddtj|jddtjt|jddtjt|jdxsddtjt|jd dtjtjd dtjtjd dtjtjd d |yw)rr\rr,rrrrr rrrrrNr)rBr;rtrs r1rDzhtml_page..sD $  [[SWWV_!5678[[SWWV_!=>?@{{3sww}56789[[SWW-=%>%E#!FGHI{{3sww'>?@ABC[[^%7%78S%T!UVWX[[^%7%78S%T!UVWX[[^%7%78Z%[!\]^_  $sFFr0c3K|]\}}dtj|dtjt|jdxsddtjt|jddtj|jddtj|jddtjt|jd dtjt|jd xsddtjt|jd xsddtjt|jd xsddtjt|jd dyw)rrr}r rrrrrrrrr r!rNr)rBrr1rts r1rDzhtml_page..s, E7 {{5!"#[[W[[%>%E#!FGHI{{3w{{=9:;<=[[W[[9L-M!NOPQ[[W[[9M-N!OPQR{{3w{{+BCDEFG[[W[[1I%J%Qc!RSTU[[W[[1N%O%VSV!WXYZ[[W[[1N%O%VSV!WXYZ{{3w{{+CDEFGH ,sGGrr1rr2rc3NK|]}dtj|dywz
  • 
    • Nrrrs r1rDzhtml_page..s#jFT[[017j#%rMc3NK|]}dtj|dywrrrs r1rDzhtml_page..s#^%tDKK./u5^rrNz^Runtime Patched Selector Follow-up Contextzz3

    Runtime Patched Selector Follow-up Context

    z
      z
    • route: rz -> r^z
      • z!
    • current selector/root: rrz#
    • follow-up selector/root: rrz
    • runtime poll: rwz sample(s), observed rmr z!
    • staged kind/selectors: rz:
    • co-observed current and follow-up in diagnostic poll: rKrz5
    • sampled current -> follow-up transition rows: rz)
    • follow-up selected pointer(s): rz)
    • exit-candidate diagnostic: available=z, routeSides=rz", branchNonzeroSides=rz)
    • left-stability diagnostic: available=z, routeSequences=z!, nonRouteSequences=r+z, opcode24AllZero=r/z, reproducibility=r5z+
    • runtime transition timeline available: rJz
    • promotion status: z
    z

    rOz

    z

    Runtime Rows

    zz

    Follow-up Selector 10:0

    z
    sequencecurrent hitsroute hitsselector contextssampled transitions
    zz-z<
    roler z!
    root orderr!z-
    contains source/targetrrz%
    public samplesr"z
    fillsr#z from r$z to r%z0
    address predecessor ranger2z;
    address predecessor execution provenr1z+
    modeled state effectr9z, pass starts r;z/12
    alias->current hitsr z total, r z data
    after-last-fill execution-like bridger zL
    after-last-fill trace writer/reader/scene-record hitsrr r z<
    selected-pointer promoting candidatesrz/
    selector byte write rowsrHz(

    Exact Follow-up Pointer Context

    zz

    Exact Pointer Trace

    z#

    Runtime Active Order Watch

    z#

    Runtime Branch State Watch

    z"

    Exit-candidate Diagnostic

    z
    pointerroot offsettailroot startopcodesopcode20 descriptortrace stopexact bridgenearby bridge dwordstrace refs
    z"

    Left-stability Diagnostic

    z
    sidetilesamplesselectorsroute 2:0branch nonzeromode1runtime flagobject index
    z

    Left-stability Rechecks

    a
    sequencekeyssamplesselectorsroute hitsmode1runtime flagobject index
    z

    Non-promotion Reasons

    z

    Remaining Proofs

    rr;dictrr)r r9rLrrr)rrrrrrrrrrrrrTexact_context_rowsexact_trace_sectionsr trace_rowsactive_order_rowsbranch_state_rowsexit_candidate_rowsleft_stability_rowsleft_stability_recheck_rowsreasonsproofsrrtrrs @@@@r1 html_pager1sm$G O $E23G M "E % &F>?L;FFW XDT[[Q\]i]m]moO^PRQFRESSd eE=FFW XCDKKP[\h\l\lnO]PQQERDSSd e9$++kR^RbRbc|R}F~::AAR S@eYiYikJZKNLBMANN_ `>t{{3|O_O_`xOyKz?{>|}N O5dkk#lFVFVWhFiBj6k5ll} ~+ 2 0SAQAQR^A_=`1a0bbs t.t{{3|?O?OP[?\;]/^.__p q24;;st{{3|O_O_`xOyKz?{>|}N O5dkk#lFVFVWhFiBj6k5ll} ~' .)) $#&&7=2 $ )) $"%%n5; $ #')),%n&8&8&C&Ir J #^%7%78L%M%SQS T ,#$ggjgNhFijjG WW^7K\C]^ ^F 99EjE GE >E  E DKK(9:;;OPTP[P[\cdl\mPnOoo{| E ,DKK@Q8R,S+TTdeiepepqxzJrKfLeMMY Z E .dkk'BT:U.V-WWghlhshst{}NuOiPhQQ] ^E T[[W_-E)FGHW[WbWbcfgno|g}c~WWAA\]a]h]himirirsz{NsOiPiWTW]X\YYe fE ,DKKGDTb6c5ddijE 't{{7;L3M'N&O|\!E" #E$ dkk',/0 16%E& 'E( `)E* +E, -E. +/E0 1E2 &dkk#eFm2D&E%FFWX3E4 ,DKKEBYN8O7PP`afgwax`yzK L7E8 0 DIIeL]F^<_ FdkkRUV]^tVuRvFwExyJ K?E@ 6dkk#eL_F`Ba6b5cc~@D@K@KLOPUVmPnLo@pqqE FAEB 8 COgHhDi8j7klABFBMBMNQRXYuRvNwBxAyyO PCED Gt{{SVW]_TXUTVHWGXXi jEEF WW[WbWbcfgmofhgdhXiWjjz{{F{FGJKQRIKJGK{LzMM]^b^i^ijmntuonpjq^r]ssD EGEH Gt{{SVWcd}W~SHAGBBS TIEJ :$++c/ZqJrFs:t9uvG HKEL MEN 3OEP yQER SET UEV 'WEX &'YEZ .[E\ ]E^ _E` aEb .cEd eEf gEh iEj -kEl NmEn oEp qEr -sEt |uEv wEx yEz +{E| N}E~ $E@ AEB )CED wiuEEF $GEH vheIEE Er3c|jdd|dz }|jtj|dddzd |9|jjdd|jt |d |S) NT)parentsexist_okz.runtime_patched_selector_followup_context.jsonFr) ensure_asciiindentrr(r))mkdir write_textr,dumpsparentr)rout_dirhtml_outjson_outs r1 write_outputsr's MM$M.IIH  7q9D@dT:Ig.A Or3ctjt}|jdtt dz |jdtt dz |jdtt dz |jd tt d z |jd tt d z |jd tt dz |jdtt dz |jdtt dz |jdtt dz |jdtt dz |jdtt dz |jdtt dz |jdtt dz |jdtt |jdtt |jdtdd !|j}tt|jit|jit|jit|jit|jit|jit|j it|j"it|j$it|j&it|j(it|j*it|j,i|j.}t1||j2|j4}t7d"|y)#N) descriptionz--pollzTruntime_selected_pointer_patched_public_selector_2_0_input_path_case_alias_poll.json)typedefaultz--mapset-aliasesz!save_selector_mapset_aliases.jsonz--address-predecessor-contextz.save_selector_address_predecessor_context.jsonz--target-alias-state-effectsz-save_selector_target_alias_state_effects.jsonz--target-alias-bridgesz'save_selector_target_alias_bridges.jsonz--global-selected-pointer-pathsz0save_selector_global_selected_pointer_paths.jsonz--runtime-selector-byte-writesz/save_selector_runtime_selector_byte_writes.jsonz--active-order-pollrzz--branch-state-pollrz--exit-candidate-pollrz--left-stability-pollr&z--left-stability-recheck-pollr(z--left-active-order-pollr)z--exez --out-dirz --html-outzHOptional legacy HTML output path. JSON is the default retained artifact.)rrhelpz4wrote runtime patched selector follow-up context -> )argparseArgumentParser__doc__ add_argumentrOUTEXE parse_argsrjr2r#rPrrQrRrSrMrrrr6r7r8rOrrrprint)parserargsrrs r1mainr4s6  $ $ 9F  ll  *sEh?hi ' FF  & EE  0tSKtEtu ) HH  ( GG   cc   cc   JJ   II  ' QQ  " LL  dC8  $<   W     D$))R $%%r*$22B7$1126$++R0$44b9$33R8$(("-$(("-$**B/$**B/$22B7$--r2 G WdllDMMBH @ KLr3__main__)r/rr0rrr)r: list[dict]r6rrr)rMrr6rrr)r:rrzdict[str, list[dict[str, Any]]])rfrrgrAr\rr dict | None)rfrrgrAr\rr str | None)rfrrgrAr\rrr)rfrrgrArn list[str]rzlist[str | None])r`rrurrr)rrrr)rrrr)rrrr)rfrr\rrrr)r"rr#rrr)NN)r6rr7rr8rrr)rvrrtuple[int, int] | None)rHrrFrArr)rObytesrHrrFrArz int | None)rOrrHrr\zdict[int, str]r]rAr^rAr_rArr)rlrrr)rlrrr)rOrrHrrlrrr)rrrrArrArr)rlrr`rrr)rlrrrrr)rlrrrrr) rrrrrrrrrr)rrrr)rrrr)r#rrz!tuple[list[dict], dict[str, int]])r#rrPrrrrQrrRrrSrrMrrrrrrrr6rr7rr8rrrrr)rrrr)rrrrrz Path | Nonerr)rNone)Qr __future__rrrr,rMpathlibrtypingrprobe_exe_scene_tablesrrr%summarize_save_selector_stream_tracesr __file__resolverROOTrrrrrrrrrArrrFOLLOWUP_POINTER_WINDOW_BEFOREFOLLOWUP_POINTER_WINDOW_AFTERFOLLOWUP_POINTER_BRIDGE_RADIUSrrr[rrrtrsr2r=rNrbrhrjrlrorxrrrr rr$r@rDrJrQrarnrqrzrrrrrrrrrrjrrrr__name__)indexs0r1rsZ" PP> H~''* Ul ]   &+("-*!% $!%!(r& 5'"&"   (   8  &0 LQPfbJ?D  'X04*.]$]!,](] ]@(41.       @*,1  ,hDLLL"&L L  L^.  $2z&*%)'+'+/3*.Q QQ"&Q!% Q  Q $( Q#'Q#Q#Q%Q%Q"-Q(QQ QhiXsl25d UMp zFu2&s F*
    kindsource pollsamplesselectorsroute sequencesroute hitsactive order countslot0 descriptorruntime slot-base table0opcode24 all zero