Fresh static observations

Static evidence only. It does not establish live allocator safety, a compatible replacement allocator, or replacement acceptance. Raw local evidence and exact regeneration commands are in objdump-2026-09-09-ownership.txt; the owner-supplied input is dumps/sots.exe, SHA-256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 / MD5 9969481c39f4b33a8a21c48b62abee4c.

The original dedup archive's first-window provenance was overturned by independent review and Astra decision d-d2a9b8be6399a6abaa0e05a5. Fresh narrow/wide raw streams and complete identities are in objdump-2026-09-10-boundary-repair.md. The widened stream supplies the complete terminal bytes; semantic promotion still requires a new independent reproduction and challenge.

The ownership archive's selected terminal rows have the same superseded provenance limitation. Fresh full streams, narrow/wide repairs, section-byte dumps and an audit of all ten declared windows are in run-79357a65226f61d6a86c042d/. Six historical stops truncate ret imm16 after c2; the widened/static raw bytes establish five c2 04 00 encodings and one c2 08 00 encoding. This repairs terminal-byte provenance under decision d-d4c494ba02ada278030ef473; it does not convert the static interpretations below into live allocator-safety or accepted ABI claims.

Recorded instruction facts

ObservedTech::ObservedTech at 0x008562a0 is an ECX receiver, returns that receiver in EAX, and uses plain ret. It installs vtable 0x00a2439c; initializes the string rooted at +0x0c to _Myres=15, _Mysize=0, empty first byte; zeros +4 (therefore both 16-bit turns), +8, and +0x28; and calls 0x00425550 for the empty-string setup.
vector<ObservedTech>::push_back at 0x007b7320 is ECX receiver plus one stack word (ret 4). It grows only when _Mylast == _Myend, through 0x007b5820(this, 1), then invokes the 0x0079a150 element-copy helper and advances _Mylast by exactly 0x2c. The source-inside-vector and source-outside-vector branches both lead to this copy helper; the former recomputes the source from its pre-growth index. Thus append copies the temporary rather than adopting its string header.
The 0x0079a150 helper constructs a destination ObservedTech: vptr, words +4/+6, byte +8, string copy via 0x00425430, and word +0x28. It is a copy construction operation, not a raw 44-byte memcpy. Independent Astra cross-check pins a cdecl-style three-stack-argument ABI: unused allocator argument, destination at [ebp+0xc], source at [ebp+0x10]; plain ret and caller cleanup of 12 bytes. Incoming ECX is not a receiver (its initial push only allocates a local slot that is overwritten). Exact C++ template name is unnecessary for this machine boundary.
0x007b5820 computes required capacity as old size plus its one stack-word count and uses the 1.5x growth rule when sufficient. It calls 0x007b34e0; that reallocator calls 0x0057e590 with new element count. 0x0057e590 multiplies by 0x2c and calls 0x00924fb6 (scalar operator new import thunk). Reallocation copy-constructs old elements through 0x0085e650, calls each old element's virtual destructor slot 0 with pushed zero, then frees the old array through 0x00924faa (scalar operator delete import thunk), and updates all three vector pointers.
PlayerEvent vector append at 0x0086c580 is ECX receiver plus one stack word (ret 4), grows through 0x00869500 if full, copy-constructs the element through 0x007693f0, then advances _Mylast by 0x74. The copy helper copies scalar fields and independently assigns all three strings at +8, +0x24, +0x50 through 0x00425430; it is not a 116-byte header copy.
PlayerEvent destructor body at 0x0061ae90 tests each string capacity (+0x1c, +0x38, +0x64) against 0x10; for long strings it frees the buffer at +8, +0x24, +0x50 through 0x00924faa, then restores empty/SSO values. This establishes three independent owned-string cleanup paths in a copied event.
0x004249a0, called from the string assignment 0x00425430, allocates new character storage via 0x00924fb6 and frees an existing long destination buffer through 0x00924faa before installing the replacement pointer/size/capacity. The branch condition for long ownership is capacity >= 0x10; short strings stay inline. Per the independently captured PE imports, these thunks map to MSVCR100 scalar operator delete and scalar operator new respectively.

Nested TurnEvents machine boundary

0x00885380 is an ECX-receiver operation over the outer vector at receiver +4, takes one stack int turn, returns a TurnEvents* in EAX, and uses ret 4. It divides the outer byte span by 0x18, scans every element, and overwrites its candidate on every EvTurn match. Therefore a hit returns the last matching bucket and performs no construction, allocation, ID update, or RNG draw.
On a miss it initializes a stack TurnEvents with vptr 0x00a0f07c and zero nested-vector pointers, but does not initialize the temporary EvTurn at +4 ([EBP-0x20]). It then calls outer vector<TurnEvents>::push_back at 0x00884cb0; append copies that incoming stack word as its scalar EvTurn before deep-copying the nested vector. Get/create destroys the temporary's nested vector through 0x00629580, only then writes the requested turn to the stored element at _Mylast[-1]+4, and returns the new element. The transient word is not measured randomness or necessarily nonzero; do not infer a zero default. This correction and its fresh four-window reproduction are in run-16f8e9b6376b278c4870be09/ under decision d-b51f3f76803e852ed250846a.
0x00884cb0 is ECX receiver plus one source pointer and ret 4; stride is 0x18. It handles a source pointer inside its own vector separately so growth cannot invalidate the source. Both branches install the TurnEvents vptr, copy EvTurn, and copy-construct the nested PlayerEvent vector through 0x00779850; this is not a 24-byte header copy. It advances outer _Mylast only after the nested copy call returns.
Outer full-capacity growth is 0x008841a0 -> 0x00883a60. Capacity selection is old capacity plus half where sufficient, otherwise required size. 0x006e8f50 allocates count * 0x18 through 0x00924fb6. 0x0077fed0 copy-constructs every old TurnEvents, including an independent nested vector via 0x00779850; then 0x00883a60 invokes each old TurnEvents virtual destructor with deleting flag zero, frees the old outer allocation through 0x00924faa, and writes all three outer vector pointers.
The vtable bytes at 0x00a0f07c identify slot zero as 0x0062e120. That scalar-deleting destructor calls 0x00629580 on the nested vector at +8; with flag bit zero it does not free the inline TurnEvents object. 0x00629580 invokes every nested PlayerEvent virtual destructor in 0x74 steps, frees the nested allocation through 0x00924faa, and zeros all three nested vector pointers.
0x00779850 is ECX destination nested vector plus one source-vector pointer and ret 4. An empty source leaves three zero pointers. A nonempty source allocates count * 0x74 through 0x0078af40 -> 0x00924fb6, then 0x007725a0 copy-constructs each PlayerEvent through 0x007693f0. Its unwind destroys already completed PlayerEvents; 0x00779850 then calls 0x00629580, and outer range-copy unwind at 0x0077fed0 destroys already completed TurnEvents. Outer reallocation's landing path frees the newly allocated outer block before continuing the exception through 0x00924fbc. These are observed cleanup edges, not a claim that allocation failure has been executed live.

Duplicate and prune branches

0x00825d40 receives bucket and candidate pointers as two stack words, ignores incoming ECX, and uses ret 8. A null bucket or empty nested vector returns zero. It scans in 0x74 steps and checks, in order: EvAct, EvLoc, all three EvPos floats, EvMsg, EvImg, then calls 0x0046f8c0 with the strings rooted at EvDsc +8. Complete fresh capture establishes that 0x0046f8c0 is a two-stack-argument, caller-cleaned string-inequality operation: first argument is the stored string, second is the candidate string, EAX/AL is one iff the strings differ, and it uses plain ret. 0x00825e21 therefore reaches the matched-element return only when AL is zero, i.e. when descriptions are equal. A description-only difference continues the scan. This contradicts the inherited claim that EvDsc was excluded; decision d-2ff30c9f5355116bea822924 required this evidence repair after resolving surprise s-8996365dab2cd6dc0e17bb9f. The first element equal in every listed field returns its pointer; exhaustion returns zero. The wrapper performs no writes, allocation, destruction, ID change, event append, or RNG draw.
0x0046f8c0 selects the candidate's inline bytes when capacity is <0x10, otherwise its heap pointer, and passes candidate length/data plus stored length and offset zero to 0x004236a0. 0x004236a0 independently selects the stored string's inline/heap bytes, compares the minimum byte count through 0x00422720, then orders unequal lengths. Equal bytes and equal lengths return zero; any byte or length difference returns nonzero, which 0x0046f8c0 normalizes to one. Thus empty/short/long combinations are covered statically without allocation or copying. The imported failure helper at IAT slot 0x009dd154 is called only when offset exceeds stored length; it is unreachable for this offset-zero call, and no failure path was executed live. Its exact imported symbol remains unresolved in this package.
0x00879eb0 is ECX receiver plus one stack turn and ret 4. It computes cutoff turn-50 and inspects only the leading run with EvTurn < cutoff. Its selected pointer is the last stale member. No stale member, exactly one leading stale member, or an initially empty vector returns without writes. For two or more leading stale buckets, it copies from the last stale bucket through the old end into the old beginning: each destination gets source EvTurn, then its nested vector is deep-assigned by 0x0077a6b0. It destroys the trailing shifted-from TurnEvents through virtual slot zero and sets outer _Mylast to the end of the retained prefix. Thus it removes stale_count-1, deliberately retaining one stale bucket; a stale bucket after the first fresh bucket is never inspected. No outer allocation is visible in this wrapper, but nested assignment may allocate/free/copy/destroy PlayerEvents according to destination capacity.

Ordering and boundary

RecordObservedTech first tests for an existing matching name; name absence, not vector fullness, reaches the constructor/append sequence. The wrapper later destroys its temporary long string, so the stored element must already own an independent string allocation where applicable. Existing records retain first turn/name and update last turn/with mask; this wrapper itself does not expose a live allocation failure outcome. EventStorage::PostEvent constructs a temporary PlayerEvent, prunes/selects/deduplicates, and only its no-duplicate branch appends; IDs and event vector pointers remain part of the caller-level behavior documented in findings/subsystems/events.md.

Remaining blockers / minimum probes

0x0084ee30 remains covered only by the initial ReVa capture in this package; its full local instruction window should still be added by the independent verifier when checking default-field values. The nested construction/growth, duplicate, and prune helpers now have local raw captures.
Exact C++ template declarations and the runtime outcome of allocation failure remain unresolved. Static unwind edges are captured, but no live throw was induced and no allocator-safety claim is made.
A read-only synthetic long-string/full-capacity fixture (or a safe existing archived trace with pre/post memory) is required to falsify the static ownership interpretation. It cannot prove allocator compatibility by coherent parsing alone.
EvDsc equality participation is now statically pinned, but has not been exercised in a live same-bucket description-only fixture. Independent review must reproduce the complete helper and branch windows before this becomes accepted ABI evidence.
The corrected TurnEvents miss path has a fresh analyst reproduction, not independent reproduction. Full/spare outer capacity, nonempty nested copy, transient observation and failure/unwind remain unexecuted; final requested-turn publication does not certify those paths.

Independent cross-check captures: verify/results/research-callback/observed-copy-helper-objdump.txt and event-copy-helper-objdump.txt. The PlayerEvent copy operation is different: ECX is the destination, one stack argument is source, EAX returns destination and ret 4 cleans the argument. Do not reuse the ObservedTech copy-helper calling convention for PlayerEvent.

Nested raw capture: verify/results/research-completion-abi/objdump-2026-09-09-turnevents.txt. Complete dedup/helper/callee capture: verify/results/research-completion-abi/objdump-2026-09-09-dedup-helper.txt. Verifier falsifiers should include: otherwise-identical records with equal versus description-only different EvDsc, separately using empty/short and long descriptions (static prediction: only equal descriptions deduplicate); one versus two leading stale buckets; a stale bucket after a fresh one; existing duplicate turn buckets (last-match selection); and outer spare/full capacity with nested empty/nonempty PlayerEvent vectors.

14 KiB Raw Blame History