{ "coverage_contradicted": [], "coverage_unstated": [], "format": 1, "hooks": { "Game::StrategyServer::MoveFleet": { "calls": 45, "compared": 45, "coverage": { "checked_regions": [ "pos", "prev_pos", "rng", "ship[0].range", "ship[1].range", "ship[2].range", "ship[3].range", "ship[4].range", "ship[5].range", "ship[6].range", "ship[7].range", "ship[8].range", "ship[9].range" ], "guarded_calls": 45, "guards": [ "fleet" ], "spans": { "compare": [ "fleet+0xa0:4", "fleet+0xdc:1", "fleet+0x10c:1", "fleet+0xcc:1", "fleet+0xdb:2", "fleet+0xe0:26" ] }, "state": "partial", "undeclared_calls": 15, "undeclared_writes": 42, "unmodelled": [ { "mitigation": "guard:fleet sees the fleet's own words; the event and the system do not", "risk": "high", "what": "on arrival: dispatches SEFleetArrived and runs one of three arrival handlers by destination kind (enter system / join fleet / stop at point)", "why": "declared input boundary -- an arriving call is expected to differ in all of it, and none of it is declared, so the compare says nothing about arrivals" }, { "mitigation": "", "risk": "high", "what": "on departure: cancels every still-acting ship (with a log line each) and calls ServerSystem::FleetDeparts, which rewrites the system's ownership bits", "why": "writes through pointers to ships and to the system" }, { "mitigation": "", "risk": "medium", "what": "the tanker top-up refuels other ships in the fleet", "why": "the per-ship range regions would show it, but ours does not model it, so a fleet with a tanker diverges for a known reason" }, { "mitigation": "declared gap: docs/B4.md", "risk": "medium", "what": "a node-line waypoint's step comes from the stutter profile", "why": "NodeLineStep / BuildStutterSegments are written and unit-tested but not wired in; the hook steps every waypoint type as speed x dt, so a node-line leg is knowingly mis-stepped and only its type is recorded" }, { "mitigation": "", "risk": "medium", "what": "a missed probabilistic jump scatters the fleet in a random direction", "why": "the direction is a second draw whose mapping is not modelled; ours leaves the position alone and reports the scatter distance, so the generator region diverges by one word on a miss" }, { "mitigation": "", "risk": "medium", "what": "the route revalidation and the waypoint list itself", "why": "declared input boundary; the waypoint vector is not a region" } ], "verdict": "partial", "why": "" }, "diffs": [], "diverged": 0, "diverged_call_ids": [], "errors": 0, "modes": { "compare": 45 } } }, "inputs": [ "../../traces/mf-after-compare.jsonl" ], "invalid": [], "kind": "report", "meta": [ { "build": "mf-45bdf7d-dirty-20260908T0721Z", "exe_sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841", "format": 1, "hooks": { "Game::SectionDictionary::SectionDictionary": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "see docs/M2.md; compare mode for this hook is not safe to run", "risk": "high", "what": "LoadSection registers each section with the string table and the live TechTree, and may append to the dictionary's own vector", "why": "M3 scope; ours delegates to the game's LoadSection after the original has already built all 885 definitions, so the second pass registers duplicates -- the leading hypothesis for this hook's compare-mode crash" }, { "mitigation": "", "risk": "medium", "what": "post-load validation pass over every definition's @-token against the string table", "why": "runs after the loop and touches no declared region" }, { "mitigation": "", "risk": "low", "what": "allocates 885 SectionDef objects (0x3d8 bytes each) on the game heap", "why": "they do not exist at hook entry; compared by index/species/id/token" }, { "mitigation": "guard:dict", "risk": "low", "what": "the word at dictionary+0x14", "why": "not modelled; emitted as an ignored pointer" }, { "mitigation": "", "risk": "medium", "what": "the before-snapshot of the object is uninitialised heap", "why": "the hook is on the constructor, so `before` is meaningless and only `after` carries information" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::ServerPlayer::ComputeBudget": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "declared input boundary; see budget_inputs.h", "risk": "high", "what": "slots 1, 2, 3, 4, 7 and 11 are produced by callees this milestone does not model (per-system output, trade, ship-carried population, a second manager, the build-queue spend)", "why": "they are copied out of the original's own output and back into the same slots, so they match BY CONSTRUCTION and prove nothing" }, { "mitigation": "guard:budget_object does not reach the ships; unverified", "risk": "high", "what": "ServerSystem::ComputeOutput repairs damaged ships in orbit", "why": "replace mode runs the original a second time on a scratch Budget to harvest the six unmodelled slots, so that repair happens TWICE per turn in replace mode and nothing in the trace would show it" }, { "mitigation": "", "risk": "medium", "what": "the difficulty-mods row from StrategyServer::GetDifficultyMods", "why": "not reachable from a ServerPlayer, so the two relevant entries are fitted constants measured from the B1 trace rather than snapshotted inputs" }, { "mitigation": "", "risk": "low", "what": "the research-allocation vector's heap block", "why": "only the element count is compared; the three words are heap pointers the default policy ignores" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::ServerPlayer::OnTechResearched": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "guard:player (EventStorage is inline at ServerPlayer+0x29c)", "risk": "high", "what": "posts EVENT_RESEARCH_COMPLETE / _UNDERBUDGET / _TEMPERANCE on the owner's EventStorage when !silent", "why": "the same class of write as B3's defect, and this hook has no replace-mode oracle that could catch it: gotcha 4 in docs/B2.md says a changed save hash on a completion turn is expected and therefore not a finding" }, { "mitigation": "", "risk": "high", "what": "writes every owned system's AI flag (CCC_AIVrus / CCC_AISlv), re-evaluates the arcology civilian cap, cures addiction and clears plague across systems AND ships", "why": "writes through pointers to other objects; compare mode must not touch live state, and no region reaches them" }, { "mitigation": "this is the extra draw B3 observed on a completion", "risk": "high", "what": "the pending plague-cure roll (ServerPlayer::RollResearchEvent)", "why": "it draws exactly one word from the strategic generator unconditionally; running it in compare mode would consume real randomness. The two words it guards are still cleared and the record says whether it would have fired" }, { "mitigation": "", "risk": "medium", "what": "TechTree::SetResearched for the Zuul boarding-pod grant", "why": "it would mutate the live tree, and it recurses" }, { "mitigation": "region:node_bore, declared only when the block already exists", "risk": "medium", "what": "allocates or frees the node-bore block at ServerPlayer+0x308", "why": "ours has no allocator the game's runtime could free, so replace mode calls the game's own updater -- which means replace mode never exercises our node-bore selection at all" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::ServerSystem::ProcessTurn": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "guard:system", "risk": "high", "what": "the addiction sweep raises MoraleEvents, which are constructed and appended to the system's capped morale history", "why": "the same class of write as B3's defect. sim::ProcessColonyTurn does compute the morale events (ColonyTurnResult), but the hook never emits them: DescribeMoraleEvents is dead code, so they are neither compared nor logged" }, { "mitigation": "guard:system covers the system object only, not the other objects", "risk": "high", "what": "every callee: the plague pass, imperial and civilian growth, the resource debit, in-orbit refuel, slaves, rebellion and the build queue", "why": "declared input boundary -- ProcessTurn is a dispatcher and only the words it writes itself are modelled. The callees raise EVENT_SLAVES_DEAD, EVENT_SYSTEM_REBELLION_CONTINUES, the plague events and SEBuildCompleted, create ships and bump per-player ShipRecords counters" }, { "mitigation": "", "risk": "medium", "what": "ApplyInfraBonus / ApplyPopBonus read the owner's home-system id, and the build queue writes the owning ServerPlayer", "why": "writes through a pointer to another object; no region reaches the player" }, { "mitigation": "", "risk": "low", "what": "ProcessRebellion is the pass's only RNG consumer and its draw count is data-dependent", "why": "the generator IS a declared region, so a moved post-state is visible and names the system whose rebellion fired -- it is reported, not modelled" }, { "mitigation": "", "risk": "medium", "what": "replace mode is refused for this hook", "why": "our side models the dispatcher's own writes and none of the callees, so a replace run would silently skip a colony's whole turn. There is therefore no oracle layer behind the compare for this hook" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::StrategyServer::MoveFleet": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "guard:fleet sees the fleet's own words; the event and the system do not", "risk": "high", "what": "on arrival: dispatches SEFleetArrived and runs one of three arrival handlers by destination kind (enter system / join fleet / stop at point)", "why": "declared input boundary -- an arriving call is expected to differ in all of it, and none of it is declared, so the compare says nothing about arrivals" }, { "mitigation": "", "risk": "high", "what": "on departure: cancels every still-acting ship (with a log line each) and calls ServerSystem::FleetDeparts, which rewrites the system's ownership bits", "why": "writes through pointers to ships and to the system" }, { "mitigation": "", "risk": "medium", "what": "the tanker top-up refuels other ships in the fleet", "why": "the per-ship range regions would show it, but ours does not model it, so a fleet with a tanker diverges for a known reason" }, { "mitigation": "declared gap: docs/B4.md", "risk": "medium", "what": "a node-line waypoint's step comes from the stutter profile", "why": "NodeLineStep / BuildStutterSegments are written and unit-tested but not wired in; the hook steps every waypoint type as speed x dt, so a node-line leg is knowingly mis-stepped and only its type is recorded" }, { "mitigation": "", "risk": "medium", "what": "a missed probabilistic jump scatters the fleet in a random direction", "why": "the direction is a second draw whose mapping is not modelled; ours leaves the position alone and reports the scatter distance, so the generator region diverges by one word on a miss" }, { "mitigation": "", "risk": "medium", "what": "the route revalidation and the waypoint list itself", "why": "declared input boundary; the waypoint vector is not a region" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::StrategyServer::ProcessFleetMovement": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "", "risk": "high", "what": "`ours` re-reads the LIVE fleet list after the original has run", "why": "the gate-traffic total is computed by the original at the very end of the pass, so a pre-call snapshot would diverge for the wrong reason. It breaks the compare invariant that ours never touches live memory, and it makes this hook's verdict partly self-fulfilling: the input to our arithmetic is the original's own post-move state" }, { "mitigation": "", "risk": "high", "what": "drives MoveFleet up to five times per fleet", "why": "every undeclared effect of MoveFleet happens inside this call too; the pass schedule is recorded in the arguments but never compared" }, { "mitigation": "", "risk": "high", "what": "writes FPdpos into every fleet and clears flags 0x2 and 0x100 on every fleet", "why": "no region covers the fleets, only the players' gate-traffic words" }, { "mitigation": "", "risk": "high", "what": "OnFleetArrived posts EVENT_FLEET_ARRIVED", "why": "the same class of write as B3's defect, and there is no replace mode for this hook, so nothing behind the compare could catch it either" }, { "mitigation": "", "risk": "medium", "what": "the original accumulates by player->index but writes back by the player's position in the server vector, into a fixed 32-int array with no bounds check", "why": "a real latent bug in the original that our side reproduces only while index == position; the reference save never separates them" }, { "mitigation": "", "risk": "medium", "what": "PassSchedule() is never called by the hook, and FleetSummary::targetFleetId / relation are never filled", "why": "the header claims ours predicts the call order for a trace to check; that prediction is not actually emitted" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::TechTree::ProcessResearch": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "region:events (EvNxID now diverges instead of passing silently)", "risk": "high", "what": "posts EVENT_RESEARCH_OVERBUDGET on the owner's EventStorage in the same branch that sets node.flag = 2", "why": "the message text is composed from the tech name, so ours cannot synthesise it; it would have to be posted through the game's own event API. This is the defect that made a clean compare false: replace mode's autosave differed from the oracle by exactly this one event" }, { "mitigation": "region:events", "risk": "medium", "what": "posts EVENT_TECHS_UNLOCKED for nodes that became available this turn", "why": "the trailing unlock loop makes no draw and writes no node, but it does build a names list and post an event" }, { "mitigation": "guard:player, guard:tree_header", "risk": "high", "what": "TechTree::SetResearched on completion: the turn/order stamps, the child unlock cascade, the recursive research of zero-cost children, and the owner's OnTechResearched callback", "why": "its own milestone (B2); the callback writes live player state that compare mode must not touch, and it consumes one extra RNG word" }, { "mitigation": "guard:tree_header", "risk": "medium", "what": "bumps the tree's completion-order counter (TechTree+0x20)", "why": "part of SetResearched; the per-node `order` word is compared but the counter it comes from was not a region" }, { "mitigation": "", "risk": "low", "what": "writes a completion line to the game log", "why": "log text is not simulation state" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Game::WeaponDictionary::Init": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "suspected cause of the sibling section hook's compare crash (docs/M2.md)", "risk": "high", "what": "LoadWeapon -> WeaponDef::ParseScript registers each weapon's name with the string table and resolves `requires` against the live TechTree", "why": "per-file parsing is M3 scope; ours delegates to the game's own LoadWeapon, so a compare run performs the registration a SECOND time and neither the string table nor the tech tree is a declared region" }, { "mitigation": "", "risk": "low", "what": "allocates 123 WeaponDef objects (0x278 bytes each) on the game heap", "why": "the definitions do not exist when the hook is entered, so they cannot be a before-snapshot; the dictionary region compares them by id/name/path" }, { "mitigation": "guard:dict", "risk": "low", "what": "the word at dictionary+0x14", "why": "not modelled; emitted as an opaque pointer, which the default policy ignores -- a change is visible in a trace but never a divergence" }, { "mitigation": "", "risk": "low", "what": "writes lines to the game log for a missing manifest", "why": "log text is not simulation state" }, { "mitigation": "", "risk": "low", "what": "std::sort tie order for equal weapon names", "why": "msvc_sort.h replays MSVC 2010's introsort, but the shipped data has no tied names, so the tie rule is unexercised rather than verified" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Mars::GlobalConsts::LoadFile": { "coverage": { "state": "partial", "unmodelled": [ { "mitigation": "LoadAll's post-state would have to be hooked to see it", "risk": "medium", "what": "erases each consumed key from the caller's std::map", "why": "the map is a LoadAll temporary; declaring a red-black tree as a region is not possible before the call. First-occurrence-wins is reproduced in game::config::apply instead, so the *effect* is modelled, the container is not" }, { "mitigation": "", "risk": "low", "what": "writes three kinds of line to the game log (unrecognised key, applied key, expected-but-not-found)", "why": "log text is not part of the simulation state" }, { "mitigation": "", "risk": "low", "what": "opens the file through the VFS and allocates/releases a refcounted buffer", "why": "ours performs the same two calls, so allocation behaviour matches by construction rather than by comparison" }, { "mitigation": "", "risk": "low", "what": "String slots assign through the engine's own std::string, leaking one heap block per long string in compare mode", "why": "start-up only; documented in docs/M1.md" } ], "why": "" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" }, "Shim::SelfTest::Fill": { "coverage": { "state": "complete", "unmodelled": [], "why": "Fill writes buf[0..n) and nothing else; the whole range is a declared region" }, "ftol": 0, "ftol_kind": "abs", "ptr": "ignore" } }, "inline_max": 256, "started": "2026-09-08T07:31:45Z" } ], "totals": { "calls": 45, "compared": 45, "coverage_contradicted": 0, "coverage_unstated": 0, "diverged": 0, "guarded_calls": 45, "invalid_records": 0, "undeclared_calls": 15, "undeclared_writes": 42 }, "warnings": [] }