Selected Scene/Text Root Consumer
0x0059de30 selected pointer를 실제로 소비하는 handler와 아직 남은 route proof를 분리한다.
요약
0x0059de30selected pointer global
0x0040adc9consumer handler opcode 0x08
0x0040adfenarrow runtime proof point
0x004234a3save/load selected-root restore
0source/predecessor current-range producers
0source/current bridge hits
0runtime consumer hits
Pseudo Code
opcode07: selected = dword[dword[stream+4] + byte[stream+1] * 4]; global_0059de30 = selected; stream += 8opcode08: stream += 4; if global_0059de30 != 0 { stack.push(stream); stream = global_0059de30 }opcode09 mode0: stream += 4; global_0059de30 = streamopcode09 mode1: global_0059de30 = dword[stream+4]; stream += 8save/load restore: read 0x4576d8[0x72], 0x457750[0x288], 0x59db60[0x200]save/load restore: global_0059de30 = selectorGroupTable[byte[0x4576da]][byte[0x4576db]]
Handler Contexts
| name | role | handler | hooks | verified | effect | route implication |
|---|---|---|---|---|---|---|
| save-loader-selector-store | producer | 0x0042349c | 0x004234ba | True | save bytes 0x0002/0x0003 select a group/slot row, then store the selected root into 0x0059de30 | a captured save must contain selector group 2 slot 0 before this store can prove 0x00540714 |
| opcode07-indexed-store | producer | 0x0040ad9b | 0x0040adb8 | True | selected pointer = dword[[context+0x40]+4 + zero_extend(byte[[context+0x40]+1]) * 4] | non-current roots would need an opcode 0x07 row selecting 0x00540714; current scans find none |
| opcode08-activator | consumer | 0x0040adc9 | 0x0040add6, 0x0040adfe | True | if 0x0059de30 is nonzero, save the current stream and set context+0x40 = 0x0059de30 | 0x0040adfe is the narrowest runtime proof point for showing selector 2:0 becomes active bytecode |
| opcode09-stream-store | producer | 0x0040ae0e | 0x0040ae37, 0x0040ae4a | True | mode 0 stores the current active stream, mode 1 stores dword[stream+4], other modes fall through without a selected-pointer store | opcode 0x09 only promotes if the active stream or operand is already in selector 2:0; current evidence is internal only |
Consumer Byte Checks
| va | bytes | matches | label |
|---|---|---|---|
0x0040add2 | 83 40 40 04 | True | advance stream by 4 before selected-pointer test |
0x0040add6 | 83 3d 30 de 59 00 00 | True | test selected pointer global for zero |
0x0040adf3 | 89 44 8a 44 | True | push return stream into context stack |
0x0040adfe | a1 30 de 59 00 | True | read selected pointer global 0x0059de30 |
0x0040ae06 | 89 41 40 | True | replace context+0x40 with selected pointer |
Save/Load Restore Context
세이브 로드/저장 함수 0x00423319는 0x004576d8, 0x00457750, 0x0059db60 블록을 읽고/쓴다. 이후 0x004234a3에서 저장된 selector group/slot 바이트로 0x0059de30을 재구성한다.
This path restores 0x0059de30 after loading persisted selector bytes 0x4576da/0x4576db. It proves save/load selected-root reconstruction, not a normal live scene/event route producer.
| va | actual bytes | matches | label |
|---|---|---|---|
0x004233f3 | 6a 00 8d 45 e8 50 6a 72 68 d8 76 45 00 8b 45 e4 50 ff 15 1c 04 5a 00 | True | load state block 0x4576d8 size 0x72 |
0x0042341c | 6a 00 8d 45 e8 50 68 88 02 00 00 68 50 77 45 00 8b 45 e4 50 ff 15 1c 04 5a 00 | True | load descriptor block 0x457750 size 0x288 |
0x00423448 | 6a 00 8d 45 e8 50 68 00 02 00 00 68 60 db 59 00 8b 45 e4 50 ff 15 1c 04 5a 00 | True | load flag block 0x59db60 size 0x200 |
0x004234a3 | a0 da 76 45 00 8b 04 85 35 2d 44 00 33 c9 8a 0d db 76 45 00 8b 04 88 a3 30 de 59 00 | True | restore selected root from loaded selector group/slot |
0x0042352c | 6a 00 8d 45 e8 50 6a 72 68 d8 76 45 00 8b 45 e4 50 ff 15 04 04 5a 00 | True | save state block 0x4576d8 size 0x72 |
0x00423555 | 6a 00 8d 45 e8 50 68 88 02 00 00 68 50 77 45 00 8b 45 e4 50 ff 15 04 04 5a 00 | True | save descriptor block 0x457750 size 0x288 |
0x00423581 | 6a 00 8d 45 e8 50 68 00 02 00 00 68 60 db 59 00 8b 45 e4 50 ff 15 04 04 5a 00 | True | save flag block 0x59db60 size 0x200 |
Route Bridge Gates
| gate | status | evidence | blocks route proof |
|---|---|---|---|
| consumer mechanism | grounded | opcode 0x08 reads 0x0059de30 at 0x0040adfe and stores it into context+0x40 | False |
| save/load selected-root restore | grounded | function 0x00423319 reads 0x4576d8/0x457750/0x59db60 on load, then 0x004234a3 reconstructs 0x0059de30 from 0x4576da/0x4576db | False |
| save/load as live route producer | blocked | the same routine is a persisted-state restore/write path; it does not prove a normal scene/event route chose selector 2:0 | True |
| selected root external proof | blocked | selectedRootExternalProofFound=False; real selector 2:0 saves=0 | True |
| source/current bridge | blocked | source->current=0; predecessor->current=0; forward merge=0 | True |
| producer/hotspot | blocked | producerHotspotProofFound=False; source/predecessor current-range producers=0 | True |
| runtime consumer watchpoint | blocked | runtimeProof=False; consumer hits=0; route-value hits=0 | True |
Decisions
| item | promotion | evidence | remaining gap |
|---|---|---|---|
| selected root consumer | grounded | opcode 0x08 handler 0x0040adc9 checks global 0x0059de30, reads it at 0x0040adfe, then writes context+0x40 at 0x0040ae06 | not route-specific by itself; the global value must be proven to be 0x00540714 on the route path |
| selected root producers | grounded | save/load restore, opcode 0x07, opcode 0x09 stores to 0x0059de30 are byte-verified | save/load restore is not a live route producer; source/predecessor roots do not currently produce current selector 2:0 root/range |
| save/load selected-root restore | grounded | 0x00423319 load mode reads state/descriptor/flag blocks, and 0x004234a3 rebuilds selected root from persisted selector bytes | does not show which live event command originally wrote 0x4576da/0x4576db or selected selector 2:0 |
| source/predecessor producer scan | blocked | opcode 0x08 activators=162, current-root producers=0, current-range producers=0 | needs captured selector 2:0 save, runtime selected-pointer trace, or strict map1_01a producer/hotspot |
| consumer-to-route bridge | blocked | consumer is grounded, but source/current bridge=0, predecessor/current bridge=0, runtime consumer proof=False | prove 0x0040adfe consumes 0x00540714 on a normal map1_01a route path, not only that the consumer exists |
| map1 direct execution root | gap | directExecutionRootFound=False | scene record to executed VM stream is still not proven |
Remaining Proofs
- runtime watchpoint at 0x0040adfe proving 0x0059de30 == 0x00540714 on the route path
- captured gameplay save whose save bytes select group 2 slot 0
- strict map1_01a hotspot/producer that sets selected pointer to selector 2:0 before opcode 0x08