# Current-source ABI static capture report — run-35e59053176da458d8b46fea ## Result and provenance The authoritative package is `verify/results/research-completion-abi/run-35e59053176da458d8b46fea-repair1/`; its manifest records 27 positive objdump executions, all return code zero with nonempty stdout and empty stderr (118,734 stdout bytes, zero stderr bytes), and no failed checks. Paired source identity remained engine `ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd` and RE `e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f` before/after. Binary, objdump, Python, save and parser identities are in the manifest and preflight. The sibling directory without `-repair1` is a preserved failed recipe run. Its streams are valid, but two checks incorrectly required the bad boundary stream to omit its terminal row. Actual objdump retains a one-byte terminal row (`c2` or `74`) and replaces it with the complete row when the stop is aligned. The repaired recipe tests equal preceding rows plus that replacement. This was a local test predicate defect, not contradictory binary behavior and not a retroactive pass. ## Measured static observations * Stop `0x00779913` emits truncated `779912: c2`; stop `0x00779915` emits complete `779912: c2 04 00`, and authority through `0x00779930` includes the complete return plus cleanup at `0x00779915`. Direct PE mapping independently reads `c20400` at VA `0x00779912`. * The second boundary family reproduces truncated `74` at stop `0x00779a20`, complete `74 10` at `0x00779a21`, then complete `8b cf` and `e8 28 6a ff ff` at stops `0x00779a23` and `0x00779a28`. Direct PE bytes are `74108bcfe8286affff`. * ObservedTech append/growth instructions use `0x2c`; PlayerEvent append/nested-copy/destruction use `0x74`; TurnEvents append/prune use `0x18`. These are distinct concrete element strides. * ObservedTech allocation multiplies count by `0x2c` and calls `0x00924fb6`; old-element growth and PlayerEvent/string destruction paths call `0x00924faa`. PlayerEvent append calls copy constructor `0x007693f0`; outer TurnEvents append calls nested copy `0x00779850`. * Nested copy zeros the destination three-pointer header, distinguishes empty count from allocation, allocates through `0x0078af40`, multiplies by `0x74`, calls range helper `0x007725a0`, writes the copied end pointer, returns destination in EAX, and ends `ret 4`. Its captured unwind edge calls `0x00629580` before the allocation-failure helper; this edge was exposed, not executed. * Get/create scans every `0x18` bucket and retains the last matching `+4` turn. On miss it establishes vptr and zero nested-vector pointers, calls outer append, calls nested-vector cleanup, then stores the requested stack turn into stored-last `+4`; both returns are `ret 4`. * Outer append separates capacity-growth and spare-capacity edges, copies source `+4`, advances source to nested vector `+8`, deep-copies it, then increments end by `0x18`; it ends `ret 4`. * Duplicate scan advances by `0x74`; after prior field comparisons it performs description comparison at `0x0046f8c0`, caller-cleans two arguments, and reaches match return only when AL is zero. Thus the fresh instructions remain consistent with description equality being required. * Direct PE mapping reads three `0x7f7fffff` words at constructor-default VA `0x00af0dc8`. This is a binary constant observation, not a newly parsed event record. The manifest's direct-PE entries named `observed-stride`, `player-stride`, and `turn-stride` sampled fixed addresses but were not used to establish strides; their names are overbroad. The stride facts above come from the archived instruction rows. This limitation does not affect the boundary-byte or constructor-default direct controls. ## Interpretation, dependencies, and limits The measurements support the prior static interpretation that vector elements require construction and nested/string ownership rather than raw header copy. Calling `0x00924fb6`, `0x00924faa`, or `0x0046f8c0` remains an original-helper dependency with the original CRT/string layout. A standalone implementation needs one coherent allocator/copy/destruction family; this capture does not show that original allocations can safely cross a replacement boundary. No game branch, allocation, constructor, destructor, throw, event post, ID assignment, record write, container mutation, or RNG draw executed. The save was hashed, not parsed. Existing/miss, spare/full-capacity, empty/nonempty, null/nonnull, short/long-string, normal/unwind, duplicate and description-only-different states are instruction exposures only. Exact PostEvent caller inputs, defaulting and total write order remain outside this bounded remeasurement. ## Independent falsification package A fresh verifier should use its own recipe and fail-if-exists directory, bind the current paired digest, repeat the negative/aligned/authority boundaries and direct PE reads, challenge at least one additional boundary, and parse the archived save independently for named player/event containers, elements, IDs, strings, FLT_MAX words, empty-player states and the actual RNG leaf. It must preserve all runtime residuals and must not count this analyst capture or archived prior verifier output as an independent cross-check.