index opener frontier selected-root frontier HUD menu preview JSON

HUD Menu Top Sequence Context Review

0x004ddc6c top-menu sequence is grounded as the #6/#3/#4 menu construction stream, but its only direct reference is the inline operand of the 0x04 call command at 0x0047e6ac. The immediate pre-wrapper gate at 0x0047e688 is now decoded as two 0x6e active group-key branches and one 0xe6 active-descriptor-count branch, all targeting the stop/jump loop at 0x0047e67c when the gate fails. The nearby parent resource list contains intro/title assets such as compile.cns, aaa.cns, logo_00.cns, title.cns, and btl_k*. The wrapper 0x0047e6a0 and parent context 0x0047e624 have no direct pointer refs, so this pass does not prove the normal-field ESC/X opener.

statustop-menu-sequence-grounded-opener-unproven

top seq0x004ddc6c

top refs1

pre-gate refs1

wrapper refs0

parent refs0

parent classintro/title-resource-context

openerFalse

Reference Surfaces

surface	classification	refs
top menu object sequence `0x004ddc6c`	grounded sequence; only ref is wrapper operand	`0x0047e6b0`
pre-wrapper gate `0x0047e688`	active group-key / active-descriptor-count gate; target refs point to reject loop	`0x0047e678`
pre-wrapper reject loop `0x0047e67c`	stop-tick then jump back toward selected-root call	`0x0047e68c, 0x0047e694, 0x0047e69c, 0x0047e6d8, 0x0047e6f4, 0x0047e700`
top menu wrapper `0x0047e6a0`	unreferenced wrapper; not opener proof	`-`
top menu parent context `0x0047e624`	unreferenced parent context; adjacent resource list is intro/title-oriented	`-`
intro/title resource list `0x004a2cb0`	middata.mlk, compile.cns, aaa.cns, logo_00.cns, title.cns, map_k1.cns, map_k2.cns, btl_k1.cns, btl_k2.cns	`0x0047e668`
region #6 child script `0x004dee18`	referenced by top-menu sequence	`0x004ddc88`
region #3 child script `0x004dee58`	referenced by top-menu sequence	`0x004ddc94`
region #4 child script `0x004dee98`	referenced by top-menu sequence	`0x004ddca0, 0x004de83c, 0x004de990`
shifted/right-panel page script `0x004de468`	secondary page/menu payload context; not normal opener	`-`

Parent Context 0x0047e624

VA	opcode	summary	raw
`0x0047e624`	`0x40` bind/input-base		`40 00 00 00`
`0x0047e628`	`0x60` runtime-index-queue-reset	reset runtime descriptor index queue at 0x004576e8; handler advances +0x04	`60 00 00 00`
`0x0047e62c`	`0x07` create-child-object	create child object kind=0x00 script=0x0047e720; handler advances +0x08	`07 00 00 00 20 e7 47 00`
`0x0047e634`	`0x28` runtime-object-slot	store current child object slot=1 through 0x0059dd70[1]; handler advances +0x04	`28 00 01 00`
`0x0047e638`	`0x07` create-child-object	create child object kind=0x00 script=0x004ded88; handler advances +0x08	`07 00 00 00 88 ed 4d 00`
`0x0047e640`	`0x28` runtime-object-slot	store current child object slot=6 through 0x0059dd70[6]; handler advances +0x04	`28 00 06 00`
`0x0047e644`	`0x07` create-child-object	create child object kind=0x00 script=0x004dedd4; handler advances +0x08	`07 00 00 00 d4 ed 4d 00`
`0x0047e64c`	`0x28` runtime-object-slot	store current child object slot=10 through 0x0059dd70[10]; handler advances +0x04	`28 00 0a 00`
`0x0047e650`	`0x07` create-child-object	create child object kind=0x00 script=0x0047e75c; handler advances +0x08	`07 00 00 00 5c e7 47 00`
`0x0047e658`	`0x28` runtime-object-slot	store current child object slot=2 through 0x0059dd70[2]; handler advances +0x04	`28 00 02 00`
`0x0047e65c`	`0x07` create-child-object	create child object kind=0x00 script=0x0047e704; handler advances +0x08	`07 00 00 00 04 e7 47 00`
`0x0047e664`	`0x81` selected-root-store	store selected root from inline pointer table into 0x0059de30; slot=0x00 table=0x004a2cb0; handler advances +0x08	`81 00 00 00 b0 2c 4a 00`
`0x0047e66c`	`0x82` selected-root-call	call selected root if 0x0059de30 is set; handler first advances +0x04, pushes that continuation, then jumps to 0x0059de30	`82 00 00 00`
`0x0047e670`	`0x14` unknown		`14 c6 02 00`
`0x0047e674`	`0x00` destroy/stop		`00 02 00 00`

Reject Loop 0x0047e67c

VA	opcode	summary	raw
`0x0047e67c`	`0x01` stop-tick		`01 00 00 00`
`0x0047e680`	`0x03` jump	jump -> 0x0047e66c	`03 00 00 00 6c e6 47 00`

Pre-wrapper Gate 0x0047e688

VA	opcode	summary	raw
`0x0047e688`	`0x6e` active-group-key-branch	branch if active script group key equals (0x01,0x00) -> 0x0047e67c; else advances +0x08	`6e 01 00 00 7c e6 47 00`
`0x0047e690`	`0x6e` active-group-key-branch	branch if active script group key equals (0x01,0x01) -> 0x0047e67c; else advances +0x08	`6e 01 01 00 7c e6 47 00`
`0x0047e698`	`0xe6` active-descriptor-count-branch	branch on active descriptor count 0x004576e8; if count is zero -> 0x0047e67c, otherwise advances +0x08	`e6 00 00 00 7c e6 47 00`
`0x0047e6a0`	`0x4a` active-object-flag-mask	active-object flag set; filter object+0x14 mask=0x0001; flags=0x80000000	`4a 01 01 00 00 00 00 80`
`0x0047e6a8`	`0x10` byte-store/expression		`10 c0 3d 02`
`0x0047e6ac`	`0x04` call/push-continuation	call/push-continuation -> 0x004ddc6c; pushes return address 0x0047e6b4 to object return stack object+0x44[object+0x5c], increments object+0x5c, then jumps to target	`04 00 00 00 6c dc 4d 00`
`0x0047e6b4`	`0x11` resource/sprite-command	field arithmetic/write command; group=0xc0 field=+0x0002 literal=0 args=0x2f46,0x0001	`11 c0 02 00 00 00 00 00 46 2f 01 00`
`0x0047e6c0`	`0x18` dword-store/expression		`18 00 08 00 68 02 58 01`

Wrapper 0x0047e6a0

VA	opcode	summary	raw
`0x0047e6a0`	`0x4a` active-object-flag-mask	active-object flag set; filter object+0x14 mask=0x0001; flags=0x80000000	`4a 01 01 00 00 00 00 80`
`0x0047e6a8`	`0x10` byte-store/expression		`10 c0 3d 02`
`0x0047e6ac`	`0x04` call/push-continuation	call/push-continuation -> 0x004ddc6c; pushes return address 0x0047e6b4 to object return stack object+0x44[object+0x5c], increments object+0x5c, then jumps to target	`04 00 00 00 6c dc 4d 00`
`0x0047e6b4`	`0x11` resource/sprite-command	field arithmetic/write command; group=0xc0 field=+0x0002 literal=0 args=0x2f46,0x0001	`11 c0 02 00 00 00 00 00 46 2f 01 00`
`0x0047e6c0`	`0x18` dword-store/expression		`18 00 08 00 68 02 58 01`
`0x0047e6c8`	`0x10` byte-store/expression		`10 c0 3d 00`
`0x0047e6cc`	`0x4a` active-object-flag-mask	active-object flag clear; filter object+0x14 mask=0x0001; flags=0x80000000	`4a 00 01 00 00 00 00 80`
`0x0047e6d4`	`0x03` jump	jump -> 0x0047e67c	`03 00 00 00 7c e6 47 00`

Top Menu Sequence 0x004ddc6c

VA	opcode	summary	raw
`0x004ddc6c`	`0x40` bind/input-base		`40 00 00 00`
`0x004ddc70`	`0x10` byte-store/expression		`10 c0 2e 00`
`0x004ddc74`	`0x2f` prompt/text-command	prompt/text command mode=0x02 payload=0x004e842e; handler advances +0x08; text payload: ^껷 뒆N 텇N	`2f 02 00 00 2e 84 4e 00`
`0x004ddc7c`	`0x2f` prompt/text-command	prompt/text command mode=0x02 payload=0x004e8120; handler advances +0x08; text payload: 갢 쟼N 픹N 긏 $긏 F긏	`2f 02 00 00 20 81 4e 00`
`0x004ddc84`	`0x07` create-child-object	create child object kind=0x00 script=0x004dee18; handler advances +0x08	`07 00 00 00 18 ee 4d 00`
`0x004ddc8c`	`0x28` runtime-object-slot	store current child object slot=7 through 0x0059dd70[7]; handler advances +0x04	`28 00 07 00`
`0x004ddc90`	`0x07` create-child-object	create child object kind=0x00 script=0x004dee58; handler advances +0x08	`07 00 00 00 58 ee 4d 00`
`0x004ddc98`	`0x28` runtime-object-slot	store current child object slot=8 through 0x0059dd70[8]; handler advances +0x04	`28 00 08 00`
`0x004ddc9c`	`0x07` create-child-object	create child object kind=0x00 script=0x004dee98; handler advances +0x08	`07 00 00 00 98 ee 4d 00`
`0x004ddca4`	`0x28` runtime-object-slot	store current child object slot=9 through 0x0059dd70[9]; handler advances +0x04	`28 00 09 00`
`0x004ddca8`	`0x07` create-child-object	create child object kind=0x00 script=0x004deed8; handler advances +0x08	`07 00 00 00 d8 ee 4d 00`
`0x004ddcb0`	`0x28` runtime-object-slot	store current child object slot=11 through 0x0059dd70[11]; handler advances +0x04	`28 00 0b 00`
`0x004ddcb4`	`0x07` create-child-object	create child object kind=0x00 script=0x004def0c; handler advances +0x08	`07 00 00 00 0c ef 4d 00`
`0x004ddcbc`	`0x28` runtime-object-slot	store current child object slot=12 through 0x0059dd70[12]; handler advances +0x04	`28 00 0c 00`
`0x004ddcc0`	`0x2f` prompt/text-command	prompt/text command mode=0x02 payload=0x004e8190; handler advances +0x08; text payload: 갢 쟼N 픹N 긏 $긏 F긏	`2f 02 00 00 90 81 4e 00`
`0x004ddcc8`	`0x12` state-compare-or-store	dword field arithmetic/write command; group=0x80 field=+0x0000 literal=0	`12 80 00 00 00 00 00 00`
`0x004ddcd0`	`0x8a` unknown		`8a 01 03 00`
`0x004ddcd4`	`0x8a` unknown		`8a 00 04 00`
`0x004ddcd8`	`0xd5` unknown		`d5 03 2e 00`
`0x004ddcdc`	`0x86` unknown		`86 00 07 00`
`0x004ddce0`	`0x86` unknown		`86 00 08 00`
`0x004ddce4`	`0x86` unknown		`86 00 09 00`

Negative Evidence

No direct pointer refs to the wrapper stream at 0x0047e6a0.
No direct pointer refs to the parent context stream at 0x0047e624.
The sole 0x004ddc6c ref is 0x0047e6b0, an operand address inside the 0x04 command beginning at 0x0047e6ac.
The repeated 7c e6 47 00 bytes before the wrapper are not opcode 0x7c commands; they are little-endian target pointers to 0x0047e67c.
The adjacent resource list at 0x004a2cb0 is intro/title-oriented, not a normal-field HUD menu context.
This review does not find an input-edge, field-mode, or descriptor-add producer that schedules the wrapper from normal field state.

Next Frontier

Find the upstream selector/descriptor producer that schedules 0x0047e6a0 or its parent context without relying on direct pointer refs.
Prioritize field mode/state transitions after ESC/X edge handling, not menu-internal cursor handlers.
Do not promote 0x004ddc6c itself as the opener; it is the menu construction callee.