board: lane B6 - no build orders exist at load, so shpt[0] is Rung B; build queue read; stack-built fptr tables are a third blind spot

campaign/board.md

@@ -273,3 +273,9 @@ Status flow: `backlog → in-progress → mapped → verified` (or `blocked`).
 | the last unmodelled output input: ship repair demand | verify | backlog | — | 0% | 2026-09-08 | Nine inputs to the turn path; EIGHT ARE ON THE WIRE (Rts, dsu, IdealSuit, TerraMod, Infra/ibon, BQ/ords/conleft, NumSnF, the output total). The ninth is **the repair demand of damaged ships in orbit**, needing Ship::RepairCost 0x00815180, which is UNREAD - it is taken as 0, so **a colony with a damaged fleet reads HIGH**. Also note this is the same repair pass that makes ComputeOutputFromRates unsafe to call for harvesting (the B1 replace double-run defect) |
 | the two RNG words: the blocker MOVED again | verify | mapped | high | 90% | 2026-09-08 | They still cannot enter the generator model and THE REASON HAS CHANGED AGAIN. The allocation is now computable - the money input was the whole gap. What blocks them is one step further out: **the only corpus player reaching ProcessResearch with a target is the AI**, whose research rate and target are generated during the same turn (Rung B). On turn1-state NO player has a target, so both words cost zero on the reference pair - **but rule 20 applies to that sentence**: a count cannot separate "not entered" from "entered and drew nothing". AN ENTRY PROBE ON ProcessResearch SETTLES IT IN MINUTES. Ledger unchanged at 16 words modelled |
 | two callees with NON-STANDARD conventions | objects | verified | high | 100% | 2026-09-08 | Recorded because they read WRONG as __thiscall and would silently mis-model: **0x0074c6f0 takes `this` in ESI**, and **0x007460b0 takes the system in EBX**. Same class of trap as lane P2's two helpers that read ebx/esi live-in without ever writing them |
+| shpt[0] CANNOT close from the build queue - the blocker moves to game/ai | verify | verified | high | 100% | 2026-09-08 | Lane B6 closed 0 and regressed 0 **and predicted exactly that before writing code**. MEASURED, NOT ARGUED: turn1-state and turn2-state each carry three BQ frames (players 16, 32, 576) and **ALL THREE HOLD ZERO ORDERS**; every `hbq` in both files is false; the only TurnCommands_v5 block is player 16's byte-identical empty one, the other three CDT blobs being AIAgent caches. **AT LOAD THERE IS NO BUILD ORDER ANYWHERE IN THE GAME**, so a faithful pass has nothing to advance. The destroyer is the AI's, created inside the turn: NumDes 5->6, NMnx 106->109 with ids issued design(1712), ship(1728), fleet(1744) IN THAT ORDER, FNGNum 0->1, Maint 0->500, srb[0] 0->1. **DECISIVE: PvSav 50,000 -> 38,100** - 11,900 left the treasury BETWEEN THE SAVE AND SPINE PHASE 0, the queue-time deduction of an order the input file does not contain. So lane E2's new blocker is Rung B, not S11 |
+| build queue read; prototype corrected | control-flow | verified | high | 95% | 2026-09-08 | S11 -> ServerSystem::ProcessTurn -> ProcessBuildQueue -> BuildQueue::ProcessTurn 0x00890d50, between the plague pass and population growth. Ghidra says 1230 bytes; the real body is **1264** and Ghidra's end lands INSIDE THE EPILOGUE (rule 17 again). **CORRECTED PROTOTYPE: arg0 is NOT the ServerSystem - it is [sys+0x10]-4, the StrategyServer S frame**, so the build-completed event goes on the SIM (S+0x2b0) and the hull's turn stamp is S+0xc = Frame. Per completion: create hull -> tblt = Frame -> vft[10](sim, ship) fleet routing -> owner->ShipRecords.built[hullClass]++ -> find-or-append the per-design record -> post event -> points -= conleft; conleft = 0. **`inc [owner + class*4 + 0x1b4]` has EXACTLY ONE WRITER in the whole image** (image-wide byte scan), and the encounter spawner that also creates ships touches no ShipRecords - so `srb` cleanly discriminates PLAYER-BUILT hulls |
+| CORRECTION to lane B5: FtFlg 0x400 is not retreat's | objects | verified | high | 100% | 2026-09-08 | **FtFlg |= 0x400 is set by EVERY fleet born through the create path, not by retreat** (build adds 0x20 on top). Also from the birth read: StarShip is 176 B, id from lane B5's allocator (model reproduced EXACTLY at the instruction level), FltID born NULL; a hull joins its system's CACHED HOME FLEET at ServerSystem+0x238 and a fleet is created only when that slot is empty; there is no scalar ship count (NShips is the vector length); FNGNum bumps once per GENERATED name |
+| NEW BLIND SPOT: stack-built function-pointer tables | meta | verified | high | 100% | 2026-09-08 | A third way this binary hides call edges, after inlining and vtables. The ship-borne build-queue wrapper 0x00789500 has **zero call sites AND no vtable slot** - its address is written into a **STACK-BUILT function-pointer table** at 0x007b9c4b. `tools/vtable_map.py` cannot see that class, so **"no vtable caller" is ALSO a lower bound**, not just "no direct caller". (Related: the base BuildQueue is pure from slot 4-10 and SystemBuildQueue binds slot 10 to the function that is literally the "next function start" bounding ProcessTurn - which is why the fleet half looked absent) |
+| AN ORACLE THE CAMPAIGN ALREADY OWNED | verify | verified | high | 100% | 2026-09-08 | Lane B6 noticed that **zuul-turn16-noderoute -> zuul-turn17-rollpending is a real CONSECUTIVE-TURN PAIR** - six completions and one partial advance across two systems - which nobody had used. Its test **SOLVES** for the point total (0..200,000) rather than assuming it, and **asserts the solution is UNIQUE** (4182 and 9782): a per-order budget, a non-FIFO drain, or skip-instead-of-stop each make the solution set come back EMPTY. The completions then reproduce the ShipRecs deltas both files carry. That refutes its falsification hypothesis 3 AND independently confirms lane B4's ProcessBuildQueue on all four rules the corpus can reach |
+| build-queue hypotheses (unexercised) | verify | backlog | — | 0% | 2026-09-08 | Labelled by lane B6: the slot-9 MONEY CHARGE (no design in the corpus costs money), a ship-borne queue WITH an order, srl/srk/sri (all zero in 11 saves), the four non-default routing handlers, and a corrected colony rule (**with points <= 0 the original skips the removal sweep too**) that is unobservable in this corpus. THE WORKLOAD THAT CLOSES ALL OF IT: load zuul-turn16-noderoute.sav on VM140, End Turn, keep the AUTOSAVE - that converts the fitted point totals into a full before/after oracle for the pass, the ship birth and the fleet birth at once |