board: lane W2 - multiplayer verified end to end, ModCount confirmed, rcex closed, Player.Status writer found

campaign/board.md

@@ -284,3 +284,11 @@ Status flow: `backlog → in-progress → mapped → verified` (or `blocked`).
 | rule 17, seventh instance - a clipped sweep would call it DEAD | meta | verified | high | 100% | 2026-09-08 | Lane T2's sole-caller claim EXISTS ONLY because it disassembled past Ghidra's function end. ApplyTurnCommands is sized 2965 B ending 0x007b2445; **its real body runs to `ret 0x10` at 0x007b248d and the call sits at 0x007b2461**. A sweep clipped at fva+size finds NO CALLER AND CALLS THE FUNCTION DEAD. Seven functions, seven lanes |
 | ROADMAP ITEM 6 WAS WRONG: there is no such writer | verify | verified | high | 100% | 2026-09-08 | backlog item 6 had Player.Status blocked on "the writer between tail 31 and the autosave - watchpoint". **THERE IS NO SUCH WRITER.** A whole-image scan for immediate stores to ServerPlayer+0x164 finds THREE: ProcessTurn's encounter loop writes 1; ResumePlaying writes 0 on load (the 4->0 the determinism note recorded); and StrategyServer_MarkPlayerTurnEnded 0x00821a40 writes 4 from the three End-Turn SUBMISSION paths, BEFORE the turn runs. **Item 6 needs one predicate, not a VM.** Lane T2 did NOT write it: only two corpus saves carry a non-zero Status at all, and `Species != 4` fits 8 observations on a 1-BIT PREDICATE THAT NINE SAVES DO NOT EXERCISE - rule 20. An entry probe on that function names the set directly |
 | the tail's own list is correct and UNACTIONABLE | meta | verified | high | 100% | 2026-09-08 | Lane T2 ranked the tail by leaves-closed-per-effort against the 158-leaf residual and found **every tail phase that moves a leaf in this corpus is blocked on someone else**: T24 (Maint/ShipRecs, 9+5 leaves) waits on ship construction; T31 and T36 are already Blocked on the budget; T05 writes deadhome/bty* and **NO BATTLE OCCURS ON EITHER PAIR** (every encounter result has res->+0x4 != 0); T02/T30 move no leaf at all; the SvSctOb cluster is the tail's tier-4 vtable blind spot; TShn/rcex are lane E3's named residual with a watchpoint already specified. So it took a HOST STEP instead and said so plainly. The ranked table is in findings/subsystems/treaty-turn-stamp.md 5 |
+| MULTIPLAYER TIER 0 WORKS - verified end to end | subsystems | verified | high | 95% | 2026-09-08 | Lane W2. **A two-player game was created, joined, launched and played for TWO TURNS IN LOCKSTEP on one Windows guest, with zero GameSpy traffic.** Capture was tcpdump on spicy's tap140i0 - OUTSIDE the guest, so it cannot perturb it - **44,319 packets, EXACTLY 0** to UDP 27900/27901 or TCP 28910/28900/6667/6500. Instrument removed (hooks=off) per rule 19. Host: Host Multi-Player -> Custom + LAN -> Create Game; joiner: `/concurrent /join 127.0.0.1:3369`. Joiner appeared in slot 2, Ready -> Launch -> Turn 1, both ended turn -> Turn 2 -> Turn 3, distinct treasuries. SOCKETS: host binds UDP 3369 + ephemeral, client binds ONLY ephemeral, **no TCP anywhere**, and **3370 is NOT bound at lobby time**. All five of lane G2's predictions confirmed, restated in docs/W2-predictions.md BEFORE the run. Also: LAN discovery listed the game on first open with no Refresh, browser-mediated join works and makes NO NatNeg attempt, and **G2's own caveat (a) is FALSIFIED** - Join Manually is enabled with every gamespy.com name dead |
+| the developer shipped the answer in the client | subsystems | verified | high | 100% | 2026-09-08 | Two things nobody had. The **MOTD is fetched live on every launch** from www.kerberos-productions.com (STILL ANSWERING, Last-Modified 2017-06-16, User-Agent GameSpyHTTP/1.0) - and its text is Kerberos telling players to **host in LAN mode and use direct connect**, i.e. the developer's own statement of lane G2's `+0x2c == 1` predicate, shipped inside the binary. Also: the Windows firewall prompt fires at **Create Game, on the host**, not at launch. AND a correction to the Tier-1 hosts list: the browser resolves **THREE** names, not one (available, ms5, peerchat); master/natneg are host-path only; exactly one DNS query each (the SDK's 2 s retry is a SOCKET retry and never runs). **Tier 1 is confirmed unnecessary** |
+| multiplayer: what is NOT covered | verify | backlog | — | 0% | 2026-09-08 | Stated loudly by lane W2: **loopback only** (no two-box or VPN test), **NO COMBAT** - 3370 and the combat lockstep are untested and are the likeliest remaining breakage - two turns only, two Human players, and sots_server.exe not run |
+| watchpoint module + ModCount CONFIRMED to the address | verify | verified | high | 100% | 2026-09-08 | New `src/shim/hooks/watchpoints.{h,cpp}`: DR0-DR3 4-byte write watchpoints armed from a SINGLE MinHook detour on ApplyAllTurnCommands, a VEH recording EIP/value/DR6/EBP-chain/stack-scan, a **CANARY SELF-TEST** (arm a word we own, write it once, require exactly one trap), and `watch=on|off` so the two configs differ only in that key. **RULE 19 CONTROL PASSED: with all four armed, one End Turn reproduced the oracle BYTE FOR BYTE - the armed run IS the oracle run.** ModCount: **exactly 12 per End Turn, twice** (13->24, 25->36), lane A2's prediction confirmed TO THE ADDRESS - both predicted sites exact, zero at the third, whole chain confirmed live. REFINEMENT: the ten command bumps PRECEDE ProcessTurn; the two driver bumps BRACKET it (A2's falsifier (c) fires as a refinement, not a refutation). **Four of the ten handler EIPs are unnamed** - 0x00821a84 fires 4x/turn and is the one to disassemble first. **And 12 is NOT a constant**: other corpus games run 15-25/turn |
+| CORRECTION to lane T2: the Player.Status writer EXISTS | verify | verified | high | 100% | 2026-09-08 | Lane T2 concluded from a whole-image scan that no writer sits between tail 31 and the autosave. **It does.** Full measured order per turn: MarkPlayerTurnEnded+0x35 writes 4 to each player -> Frame++ -> 10 ModCount -> ProcessTurn+0x5ca writes **1** (local player only) -> **StrategyNetworkClient::OnMessage+0xa15 writes 4** -> OnAllCombatDone_Tail -> AUTOSAVE -> ResumePlaying+0xb1 writes 0. A static scan for immediate stores missed it; the watchpoint found it. **Roadmap item 6's original premise was right and my correction of it was wrong** - restore it. (Lane AI3 separately notes 0x007ddd3f is also a Status writer, at the resume boundary AFTER the autosave) |
+| ModCount vs Frame settled | objects | verified | high | 100% | 2026-09-08 | S+0x8 took 12 writes; **S+0xc took exactly ONE**, from BeginProcessTurn+0x2a, value = the turn number. So S+0x8 IS ModCount and S+0xc is Frame, confirming lane A2 by measurement. `addresses.json` has the name on the wrong word and lane T's `PhaseCounter` IS ModCount - fix at the next fragment fold |
+| rcex CLOSED - with no VM time at all | objects | verified | high | 100% | 2026-09-08 | It is **sixteen 4-bit per-player counters**. Nibble p is set to **1** on the turn the system enters player p's AFlags, and the rcex tick in ServerSystem::ProcessTurn decrements it to 0 next turn. **7/7 across the corpus**, including human-turn2-orders.sav - a DIFFERENT game, different system, different player index (AFlags bit 3 <-> nibble 3). Falsifiers listed. `Bats2` is the same shape and remains a rule-6 hypothesis (0 everywhere) |
+| MY BRIEF GAVE THE WRONG ADDRESS for TShn | meta | verified | high | 100% | 2026-09-08 | I briefed the TShn watchpoint at `player+0x274`. **That is `observed_techs`; the TShn map is `ServerSystem+0x274`.** Lane W2 caught it - arming the briefed address would have watched the wrong object and **reported a confident nothing**. The real obstacle is separate: a std::map's nodes are heap-allocated so there is no fixed leaf to arm; the fix is to arm the MAP HEADER to trap the insertion, which is the better question anyway, ~20 lines. ALSO: both blocked containers are one add from the existing arming point - `*(S+4+0x154)+0x40` (trade routes) and `*(S+4+0x158)+0x14` (spy programs) - and for the spy vector the trapped return addresses would **name the UI nobody has found** |