{
  "entries": [
    {
      "name": "SVSOSwarmQueen_RegisterHives_DrawSite",
      "addr": "0x0052770f",
      "convention": "site",
      "prototype": "call RNG_NextInt (0x004271c0) inside SVSOSwarmQueen_RegisterHives, ECX = GetGame()->RNG(+0x16c) + 4, bound = HI - LO passed BY POINTER at [ebp-0x14]; return address 0x00527714, then `add eax,edi` where edi = frame + LO. ONE STRATEGIC-GENERATOR WORD PER NEW HIVE, taken inside StrategyServer::BeginProcessTurn -- outside BOTH turn drivers and before either. Corrects svsctob-writers.md, which put the call at 0x0052770c (that is the `mov [ebp-0x14],esi` storing the bound)",
      "status": "verified",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08); disassembled from dumps/sots.exe and measured live on turn1-state.sav"
    },
    {
      "name": "SVSOSwarmQueen_TickHives_SlipSite",
      "addr": "0x0052785a",
      "convention": "site",
      "prototype": "`inc DWORD PTR [esi+0x8]` -- the NextQ slip. FOUR gate-failure edges converge here: 0x005277e3 (frame <= *SwarmQueen_GateFrameFloor_ptr), 0x005277fe (queens count >= the per-turn allowance), 0x00527848 (age < *SwarmQueen_GateQueenAge_ptr), 0x0052784f (hive's system handle is 0). Consumes NO generator word on any of them; TickHives calls no RNG primitive anywhere in its body (0x00527770..0x005279a1 read whole)",
      "status": "verified",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SwarmQueen_HiveNextQOffsetLo_ptr",
      "addr": "0x00ae0204",
      "convention": "data",
      "prototype": "int* -- pointer to the LOW end of the new-hive queen-countdown offset. RegisterHives computes nextQ = frame + *this + RNG_NextInt(*SwarmQueen_HiveNextQOffsetHi_ptr - *this). Behind a pointer, so no .text or .data reference initialises it in a form a static reader can follow; the value is read live by the shim at RegisterHives entry",
      "status": "mapped",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SwarmQueen_HiveNextQOffsetHi_ptr",
      "addr": "0x00ae0208",
      "convention": "data",
      "prototype": "int* -- pointer to the HIGH end of the new-hive queen-countdown offset. The RNG_NextInt bound is (*this - *SwarmQueen_HiveNextQOffsetLo_ptr) and NextInt is INCLUSIVE of its bound, so the countdown lands in [frame+LO, frame+HI]",
      "status": "mapped",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SwarmQueen_GateFrameFloor_ptr",
      "addr": "0x00ae0210",
      "convention": "data",
      "prototype": "int* -- TickHives gate 1: `if (GetGame()->Frame(+0xc) <= *this) slip`. No queen can spawn at or below this frame",
      "status": "mapped",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SwarmQueen_SpawnListCap_ptr",
      "addr": "0x00ae0220",
      "convention": "data",
      "prototype": "int* -- read in TickHives' SPAWN arm (0x005278d8), after a queen has been created: when *this <= 0 the vector at queen+0x30 is trimmed to 0 entries, otherwise to *this. Never exercised on any corpus save (no hive has ever had a queen)",
      "status": "mapped",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SwarmQueen_GateQueenAge_ptr",
      "addr": "0x00ae0228",
      "convention": "data",
      "prototype": "int* -- TickHives gate 3: an age in turns, compared against `GetGame()->Frame - resolvedQueen->+0xc`; below it the hive slips instead of spawning",
      "status": "mapped",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SVSOSwarmQueen_off_Hives",
      "offset": "0x10",
      "convention": "field",
      "prototype": "std::vector<HiveInfo> -- {_Myfirst 0x10, _Mylast 0x14, _Myend 0x18, _Alval 0x1c}, element stride 0x10: {void* vptr = 0x009f1a68, StarSystem* sys(+4), int nextQ(+8), Queen* queen(+0xc)}. The WIRE order is HiveID / QueenID / NextQ, which is NOT the member order",
      "status": "verified",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SVSOSwarmQueen_off_Queens",
      "offset": "0x20",
      "convention": "field",
      "prototype": "std::vector<T> at +0x20..+0x24, element stride 0xc -- TickHives' second gate divides the byte span by 12. Empty on every corpus save",
      "status": "verified",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08)"
    },
    {
      "name": "SVSOSlaversRefuel_off_CDiff",
      "offset": "0x38",
      "convention": "field",
      "prototype": "int -- the difficulty tier, wire tag \"CDiff\". Set to -1 by the ctor 0x0051a820 and written ONLY by SVSOSlaversRefuel_UpdateDifficultyTier, which stores (scanIndex - 1) and only when it differs. Reachable values are 0 (frame 1..49) and 1 (frame 50..99) ONLY: frame <= 0 exits at index 0 and frame >= 100 walks off the end of the 3-entry threshold table, so BOTH edges store nothing and the tier can never reach 2",
      "status": "verified",
      "source": "findings/control-flow/hive-creation-rng.md (lane L1 2026-09-08); threshold table read off the stores at 0x00515868..0x0051588c"
    }
  ]
}