sots-re/findings/control-flow
alex cb1ea723e1 lane W2: the three queue items not reached, with the reason and the cheapest next step for each
TShn: the brief's address was wrong -- player+0x274 is observed_techs; the TShn map is
ServerSystem+0x274. The real obstacle is that a std::map's nodes are heap-allocated, so there is
no fixed leaf to arm; arm the map header to trap the insertion instead.

rcex: closed from the corpus, no VM time needed (see rcex-explained.md).

Trade/spy workload: not attempted, and lane H's reasons still hold. What is new is that the
watchpoint module is the instrument for confirming the workload BEFORE spending a turn on it --
both containers are one add from the arming point, and for the spy vector the trapped return
addresses would name the UI nobody has found.
2026-09-08 15:25:53 -04:00
..
alliance-mask-and-modcount.md lane A2: the alliance mask read from the bytes, and every ModCount writer 2026-09-08 12:44:30 -04:00
combat-done-tail.md Z: the unnamed counter at S+0x8 is ModCount, and my players flag was my own error 2026-09-08 10:04:21 -04:00
combat-resolver.md lane J: the combat resolver, read from the instruction stream 2026-09-08 09:37:02 -04:00
combat-retreat-pipeline.md B5: the combat resolver's sub-dispatcher is RETREAT, and it is the largest 2026-09-08 12:00:14 -04:00
indirect-edges.md lane V2: vtable inversion — resolve indirect call edges image-wide 2026-09-08 12:05:05 -04:00
inlined-draws.md lane I: the complete inlined-draw inventory, and the seven RNG entry points 2026-09-08 10:03:33 -04:00
standalone-generator-and-turn-record.md lane Y: the standalone's generator against lane Z's calibrated oracle pairs, and the tail's turn record 2026-09-08 11:40:19 -04:00
standalone-scaffold.md lane S2: the standalone scaffold, and the measured distance to the byte-match 2026-09-08 10:35:56 -04:00
tail-probes.md lane H: five live probes, the oracle restored, and a harness perturbation bisected to one hook 2026-09-08 13:53:36 -04:00
tail-rng-ledger.md lane H: five live probes, the oracle restored, and a harness perturbation bisected to one hook 2026-09-08 13:53:36 -04:00
turn-driver.md lane A2: the alliance mask read from the bytes, and every ModCount writer 2026-09-08 12:44:30 -04:00
turn-spine.md tech effects (196-entry TechId table, OnTechResearched), 8 formula gaps answered, std::string settled 2026-09-07 22:05:49 -04:00
watchpoints-modcount-status.md lane W2: the three queue items not reached, with the reason and the cheapest next step for each 2026-09-08 15:25:53 -04:00