sots-re/findings/control-flow
alex 48db3cc425 lane AG: the gate-indexed RNG audit -- 31 unread-gate rows, 6 new draw sites, the SVSO generator named
One row per statically reachable draw site in BeginProcessTurn u ProcessTurn u
OnAllCombatDone_Tail, each carrying a measured firing or a decoded predicate on
save fields plus the 22-save corpus count. No total is reported: 31 rows (30
distinct sites plus one grouped SVSO row) are unread gates, and that visible
blank column is the deliverable.

Three gates decoded:
  0x0082cdb8 = the addiction spread roll (Chance ADDICTION_SPREAD_ODDS 0.2f);
    corpus 0 of 22 -- nadct is 0 on all 28 systems of all 22 saves. Writer found:
    ServerSystem_BeginAddiction has exactly two callers, both inside vslot15, so
    an INTER-EMPIRE route plus a species addict tech must seed it first.
  0x0088dc43 = the spy counter-mission roll, p = cmo accumulating 0.2f per turn,
    so Chance costs 0 words from the fifth turn on; corpus 0 of 22 by deat/cm.
  0x0088b613 = the raid target pick. RNG_NextInt has no zero-bound early-out, so
    a single-candidate list still draws -- which proves lane AC's B returned
    before the draw. Failed conjunct named: the raider sat on sector 832 while
    all four rt records source in 816/816/768/752. Next workload: sector 816.

Six draw sites no firing-indexed table could hold: five behind
CreateRaidEncounter's empty-candidate-list gate, and 0x00820c1b again from
Slot13RngCalleeB -- so B costs 2 words on a success, not 0.

SVSO generator closed: all 17 drawing overrides use GetGame()->+0x16c.
Rule 17 again: ServerSpyManager_vslot14 really ends at 0x0088dd2b, not 0x0088dd03.
2026-09-08 22:25:52 -04:00
..
alliance-mask-and-modcount.md lane A2: the alliance mask read from the bytes, and every ModCount writer 2026-09-08 12:44:30 -04:00
combat-done-tail.md Z: the unnamed counter at S+0x8 is ModCount, and my players flag was my own error 2026-09-08 10:04:21 -04:00
combat-resolver.md lane J: the combat resolver, read from the instruction stream 2026-09-08 09:37:02 -04:00
combat-retreat-pipeline.md B5: the combat resolver's sub-dispatcher is RETREAT, and it is the largest 2026-09-08 12:00:14 -04:00
gate-indexed-rng-audit.md lane AG: the gate-indexed RNG audit -- 31 unread-gate rows, 6 new draw sites, the SVSO generator named 2026-09-08 22:25:52 -04:00
hive-creation-rng.md L1: CDiff crosses at frame 50, and the AI client seed is fresh in every process 2026-09-08 18:23:19 -04:00
indirect-edges.md lane V2: vtable inversion — resolve indirect call edges image-wide 2026-09-08 12:05:05 -04:00
inlined-draws.md lane I: the complete inlined-draw inventory, and the seven RNG entry points 2026-09-08 10:03:33 -04:00
raid-gate-multiplicity.md AD: predictions for the trade-raid multiplicity probe, committed before the build 2026-09-08 21:58:50 -04:00
standalone-generator-and-turn-record.md lane Y: the standalone's generator against lane Z's calibrated oracle pairs, and the tail's turn record 2026-09-08 11:40:19 -04:00
standalone-scaffold.md lane S2: the standalone scaffold, and the measured distance to the byte-match 2026-09-08 10:35:56 -04:00
tail-probes.md lane H: five live probes, the oracle restored, and a harness perturbation bisected to one hook 2026-09-08 13:53:36 -04:00
tail-rng-ledger.md board: lane L5 - reference pair non-deterministic; interest literals verified with a failing control; verified column held at 0 on principle 2026-09-08 17:55:47 -04:00
trade-raid-rng-gate.md AC: guest-state and click-helper notes for VM141 2026-09-08 21:33:25 -04:00
turn-driver.md lane A2: the alliance mask read from the bytes, and every ModCount writer 2026-09-08 12:44:30 -04:00
turn-spine.md tech effects (196-entry TechId table, OnTechResearched), 8 formula gaps answered, std::string settled 2026-09-07 22:05:49 -04:00
w3-containers-status-handlers.md W3: NVO.TShn's writer trapped live, its gate named, and 158/158 on the corpus 2026-09-08 16:41:09 -04:00
watchpoints-modcount-status.md lane W2: the three queue items not reached, with the reason and the cheapest next step for each 2026-09-08 15:25:53 -04:00