{
  "_note": "Lane SD 2026-09-08 -- THE SHIP-DESIGN COMPOSER 0x006ad700, where lane PAR localised the AI's RNG variance. Read from the instruction stream swept to the next function start (rule 17: the body ends at 0x006ae61a with int3 padding to 0x006ae620, and Ghidra's 3864-byte size is right here), plus a live sub-bracket on VM145. Nine of the AI turn's live draw sites are in this one function, including the only loop-carried one.",
  "entries": [
    {
      "name": "AIComposeShipBlueprint",
      "addr": "0x006ad700",
      "convention": "custom",
      "prototype": "int (ECX: StrategyAIAgent* agent, EDX: SectionContext parts[3], STACK: DesignRequest* req, STACK: char costOnly)  /* ECX+EDX in registers, TWO stack arguments, and the CALLER cleans them (`add esp,0x8` at 0x006ae719) -- neither cdecl nor MSVC __fastcall, but the private convention MSVC gives a static function whose address never escapes. Returns 0 on success and 1..8 for eight distinct bail-outs: 1 over budget, 2 no hull candidate, 3 no command section, 4 no engine section, 5/6/7 a forced-tech lookup failed for request-flag bit 4/8/0x10, 8 no weapon matched a bank. `req` = {int hullSize; float budget; int role; uint flags}. `parts` is the same 0x124-stride three-section array lane D2 found on the other side of the pipeline at Game::ShipDesign::AggregateSectionStats: +0 ShipSectionDef*, +4.. one weapon id per weapon BANK, +0xcc the bank count (min(hull banks, 0x32)). `costOnly` non-zero returns right after pricing, having already drawn at sites A/B/C -- which is why one AI design request can cost two composer calls */",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; instruction-stream read of dumps/sots.exe 0x006ad700..0x006ae61a plus a live MinHook sub-bracket on VM145"
    },
    {
      "name": "AIComposeShipDesign",
      "addr": "0x006ae620",
      "convention": "custom",
      "prototype": "void (ECX: ?, EDX: StrategyAIAgent* agent, STACK: ..., DesignRequest* req, char costOnly)  /* the composer's ONLY caller. Builds a list of 1..3 hull sizes from req.hullSize and request-flag bits 0 and 1 (bit 0 adds size-1, bit 1 adds size+1 when size<2), clears both bits, then calls AIComposeShipBlueprint once per size and BREAKS ON THE FIRST SUCCESS. So one design request costs 1..3 composer calls, and every failed attempt has already spent the RNG words it reached before failing. Three call sites: 0x006cdaa6 and 0x006cdb1c in 0x006cda40 (the real design pass) and 0x006b7ecb in 0x006b7e40, which passes costOnly=1 */",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; instruction-stream read of dumps/sots.exe"
    },
    {
      "name": "AIPickRandomElement",
      "addr": "0x00691e90",
      "convention": "custom",
      "prototype": "void* (EAX: int count, STACK: void** array)  /* 0x1f bytes whole: `if (!count) return 0; return array[cl_RandRange(0, count-1)];`. The count arrives in EAX. This is a LIVE DRAW SITE that lane PAR's 23-row table does not list -- PAR measured it live at return address 0x00691ea0 (2 calls, 2 words on turn 1) without adding it to the static inventory, so the AI turn has 22 live sites, not 21. The composer calls it once, at 0x006ada61, to pick the command section */",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; instruction-stream read, and live in verify/results/shim/airng/par-t1-br-p3.txt"
    },
    {
      "name": "AIShipSectionContext_stride",
      "offset": "0x00000124",
      "convention": "offset",
      "prototype": "size -- one entry of the three-section design context array the composer fills and Game::ShipDesign::AggregateSectionStats 0x00826af0 consumes. +0x000 ShipSectionDef* (null = empty slot), +0x004..+0x0cb up to 0x32 weapon ids, ONE PER BANK, which is exactly the DGbnk2 list the design record carries on the wire (SHIP_DESIGN_RULES B1: one weapon per bank{} block, in file order); +0x0cc the bank count = min((def+0x320 - def+0x31c)/0x30, 0x32); +0x0d0..+0x11f up to 20 candidate weapon ids gathered for that section; +0x120 that candidate count, capped at 20 -- the cap the string \"AIComposeShipBlueprint: SectionBlueprint::MAX_OPTIONS\" names. Slot order in memory is mission, command, engine (verify/design-rules/SHIP_DESIGN_RULES.md 1), NOT the on-disk order. Live: on turn 1 a Human destroyer design gives bank counts 3 / 1 / 2 for DEExtendedRange / DECommand / DEFission",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; agrees with lane D2's independent read of the same array at the aggregator"
    },
    {
      "name": "ShipSectionDef_off_Banks",
      "offset": "0x0000031c",
      "convention": "offset",
      "prototype": "std::vector<Bank> begin -- weapon-bank descriptors on a Game::ShipSectionDef, stride 0x30, end pointer at +0x320. Bank+0x00 = turretclass index (0 = `standard`, the class 1,533 of the 3,721 shipped banks carry; 0xc and 0x17 are two others the composer's large-bank pass also accepts), Bank+0x04 = turretsize index (1 = `small`, 3 = `large`). The composer's only loop-carried draw fires once per (class 0, size 1) bank -- a small standard bank -- and its job is to overwrite a fraction of them with a point-defence weapon",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; instruction-stream read at 0x006adec4 and 0x006ae533, class/size naming cross-checked against verify/design-rules/SHIP_DESIGN_RULES.md 3's bank census"
    },
    {
      "name": "ShipSectionDef_off_Name",
      "offset": "0x000001b4",
      "convention": "offset",
      "prototype": "Mars::String -- the section's file name on a Game::ShipSectionDef; capacity word at +0x1c8, so the payload is the inline buffer when capacity < 0x10 and *(char**)(def+0x1b4) otherwise. The composer compares it case-insensitively against \"DEPointDefence\" and \"CRPointDefence\" at 0x006ae4e6/0x006ae4fd: a section whose name matches gets a point-defence weapon in EVERY qualifying bank instead of every D'-th one",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; instruction-stream read"
    },
    {
      "name": "AIChooseWeaponForBank",
      "addr": "0x006ad2a0",
      "convention": "cdecl",
      "prototype": "int (StrategyAIAgent* agent, int hullClass, std::vector<int>* restrictTo, int bankClass, int bankSize, void* ctx, int flag)  /* seven stack arguments, caller cleans 0x38 for the two calls at 0x006ae3c1/0x006ae3dc. Returns a weapon id, or 0 when nothing fits. The composer calls it in the weapon-assignment loop and then TWICE more just before the point-defence pass: once with a one-element list holding the literal 0x25 (read as the point-defence weapon family -- INFERRED, from the DEPointDefence/CRPointDefence section names the same pass matches and the 0.2 probability it rolls) and once unrestricted. A null from the unrestricted call skips the whole point-defence block; a null from the restricted one makes every iteration short-circuit without drawing. Both make the loop-carried draw cost zero, which is why lane SD's probe records the two return values separately */",
      "status": "verified",
      "source": "findings/subsystems/ship-design-composer.md -- lane SD 2026-09-08; instruction-stream read of the two call sites and the gates they feed"
    }
  ]
}