HUD Active Group Gate Frontier Review

0x574544/0x574543 are not a narrow ESC/X opener flag. They are written by the 0x6d VM handler and by descriptor/display setup code, and consumed heavily by the field actor/collision subsystem. 0x4576e8 is the active descriptor count. The 0x0047e688 gate is therefore a grounded active-object/display gate before the top menu wrapper, but it does not by itself identify the normal-field menu opener.

activeGroupARefCount14

activeGroupBRefCount5

activeDescriptorCountRefCount86

directGroupWriteCount6

descriptorCountDirectWriteCount1

fieldGroupConsumerCount13

descriptorRebuildCallCount1

displayVmRootCallCount4

topMenuGateVaHex0x0047e688

topMenuRejectLoopVaHex0x0047e67c

topMenuWrapperVaHex0x0047e6a0

topMenuSequenceVaHex0x004ddc6c

normalFieldEscOpenerPromotedFalse

classificationactive-group/descriptor gate grounded; opener producer still unproven

Pre-wrapper Gate Decode

VA	opcode	summary	raw
`0x0047e688`	`0x6e` active-group-key-branch	branch if active script group key equals (0x01,0x00) -> 0x0047e67c; else advances +0x08	`6e 01 00 00 7c e6 47 00`
`0x0047e690`	`0x6e` active-group-key-branch	branch if active script group key equals (0x01,0x01) -> 0x0047e67c; else advances +0x08	`6e 01 01 00 7c e6 47 00`
`0x0047e698`	`0xe6` active-descriptor-count-branch	branch on active descriptor count 0x004576e8; if count is zero -> 0x0047e67c, otherwise advances +0x08	`e6 00 00 00 7c e6 47 00`
`0x0047e6a0`	`0x4a` active-object-flag-mask	active-object flag set; filter object+0x14 mask=0x0001; flags=0x80000000	`4a 01 01 00 00 00 00 80`
`0x0047e6a8`	`0x10` byte-store/expression		`10 c0 3d 02`
`0x0047e6ac`	`0x04` call/push-continuation	call/push-continuation -> 0x004ddc6c; pushes return address 0x0047e6b4 to object return stack object+0x44[object+0x5c], increments object+0x5c, then jumps to target	`04 00 00 00 6c dc 4d 00`
`0x0047e6b4`	`0x11` resource/sprite-command	field arithmetic/write command; group=0xc0 field=+0x0002 literal=0 args=0x2f46,0x0001	`11 c0 02 00 00 00 00 00 46 2f 01 00`
`0x0047e6c0`	`0x18` dword-store/expression		`18 00 08 00 68 02 58 01`

Direct Group Writes

ref	owner	instruction	bytes
`0x0040905a`	`0x0040904a` VM opcode 0x6d handler	write AL	`08 8b 40 40 8a 40 01 a2 44 45 57 00 8b 45 08 8b 40 40 8a 40`
`0x00430142`	`0x00430130` field active-object/descriptor subsystem	direct byte store imm8	`05 31 45 57 00 00 c6 05 44 45 57 00 01 c6 05 43 45 57 00 00`
`0x004324db`	`0x00432323` active descriptor rebuild/materializer	direct byte store imm8	`00 e9 b8 fe ff ff c6 05 44 45 57 00 01 c6 05 43 45 57 00 00`
`0x00409068`	`0x0040904a` VM opcode 0x6d handler	write AL	`08 8b 40 40 8a 40 02 a2 43 45 57 00 8b 45 08 83 40 40 04 5f`
`0x00430149`	`0x00430130` field active-object/descriptor subsystem	direct byte store imm8	`05 44 45 57 00 01 c6 05 43 45 57 00 00 c6 05 e8 76 45 00 00`
`0x004324e2`	`0x00432323` active descriptor rebuild/materializer	direct byte store imm8	`05 44 45 57 00 01 c6 05 43 45 57 00 00 6a 00 68 21 23 40 00`

Descriptor Count Direct Writes

ref	owner	instruction	bytes
`0x00430150`	`0x00430130` field active-object/descriptor subsystem	direct byte store imm8	`05 43 45 57 00 00 c6 05 e8 76 45 00 00 c6 05 33 45 57 00 00`

Field Group Consumers

ref	owner	instruction	bytes
`0x00430142`	`0x00430130` field active-object/descriptor subsystem	direct byte store imm8	`05 31 45 57 00 00 c6 05 44 45 57 00 01 c6 05 43 45 57 00 00`
`0x00430346`	`0x0043022d` field actor input/collision controller	read byte into AL	`00 0a 03 43 00 33 c0 a0 44 45 57 00 85 c0 0f 85 18 01 00 00`
`0x004304ee`	`0x0043022d` field actor input/collision controller	read byte into AL	`84 0f 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 84 87 00 00 00`
`0x0043050d`	`0x0043022d` field actor input/collision controller	read byte into AL	`85 4b 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 85 3c 00 00 00`
`0x0043066f`	`0x0043022d` field actor input/collision controller	read byte into AL	`84 0f 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 84 87 00 00 00`
`0x0043068e`	`0x0043022d` field actor input/collision controller	read byte into AL	`85 4b 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 85 3c 00 00 00`
`0x00430815`	`0x0043022d` field actor input/collision controller	read byte into AL	`84 0f 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 84 87 00 00 00`
`0x00430834`	`0x0043022d` field actor input/collision controller	read byte into AL	`85 4b 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 85 3c 00 00 00`
`0x004309d7`	`0x0043022d` field actor input/collision controller	read byte into AL	`84 0f 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 84 87 00 00 00`
`0x004309f6`	`0x0043022d` field actor input/collision controller	read byte into AL	`85 4b 00 00 00 33 c0 a0 44 45 57 00 85 c0 0f 85 3c 00 00 00`
`0x00430dec`	`0x0043022d` field actor input/collision controller	read byte into AL	`00 36 0d 43 00 33 c0 a0 44 45 57 00 85 c0 0f 85 37 00 00 00`
`0x00430149`	`0x00430130` field active-object/descriptor subsystem	direct byte store imm8	`05 44 45 57 00 01 c6 05 43 45 57 00 00 c6 05 e8 76 45 00 00`
`0x00431167`	`0x0043022d` field actor input/collision controller	read byte into AL	`4d fc 89 41 24 33 c0 a0 43 45 57 00 85 c0 0f 85 ea 02 00 00`

Negative Evidence

active group globals are consumed inside the field actor/collision controller, so they are broader than menu-open state.
descriptor count 0x004576e8 is shared by save/object/battle/menu descriptor loops and is not unique to HUD.
the top-menu wrapper still has no direct pointer ref from a normal-field ESC/X input root.
the 0x0047e688 gate proves wrapper admission conditions, not the producer that schedules this wrapper from field mode.

Next Frontier

trace writers that attach or schedule the stream containing 0x0047e688/0x0047e6a0 from field mode.
separate descriptor/display setup calls that use 0x402321 from normal field vs intro/title contexts.
do not promote active group key writes alone as the ESC/X opener.