0x004576d8+0 selector의 소비 증거와 writer 후보/배제 후보를 분리합니다.
| candidate | status | evidence | decision |
|---|---|---|---|
| text/status consumer source | consumer-grounded-not-writer high | 40 1b mode1 route=0x40 0x1b payload uses=4; selector source grounded=True | This proves where the value is read: object+0xa8+0 after base bind to 0x004576d8. It does not write the value. |
| direct x86 store to 0x004576d8+0 | not-found high-negative | offset0 refs=6; write-like=0; direct writer proven=False | No absolute direct write to the selector byte is present in the current .text scan. |
| object-VM dynamic selector writers 0x8c/0x8d/0x8f | excluded-for-status-comment high-negative | dynamic candidates=673; target0=52; status-menu target0=0; status-comment target0=0; promoted target0 context=False | Target +0 dynamic writes are real in other active-object contexts, but their roots are field/battle object-local. They are not the status/comment story selector writer. |
| persistent save/load block restore | can-populate-on-load-not-live-producer high | block transfer refs=2; restore function=0x00423319; state block=0x004576d8 size=0x72; route promoted=False | 0x00423319 loads/saves the 0x72-byte block, so +0 can come from persisted state after load. This is excluded as the live chapter/scenario writer. |
| selected-root selector bytes +2/+3 | different-route-layer high | selector byte writer grounded=True; selected-root writer grounded=True; route producer promoted=False | The +2/+3 selector bytes reconstruct selected roots. They are adjacent in the backing block but are not the +0 chapter/status-comment selector. |
| cross-domain global mode/state frontier | no-live-producer-promoted medium-high-negative | cross-domain functions=19; review required=0; promoted producers=0; save/load bridge found=True | Broad scene/menu/field/encounter intersections did not reveal a live writer. The strongest intersection remains save/load restore, already excluded as live producer. |