sots-re/verify/results/research-completion-abi/report-run-35e59053176da458d8b46fea.md

Current-source ABI static capture report — run-35e59053176da458d8b46fea

Result and provenance

The authoritative package is verify/results/research-completion-abi/run-35e59053176da458d8b46fea-repair1/; its manifest records 27 positive objdump executions, all return code zero with nonempty stdout and empty stderr (118,734 stdout bytes, zero stderr bytes), and no failed checks. Paired source identity remained engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f before/after. Binary, objdump, Python, save and parser identities are in the manifest and preflight.

The sibling directory without -repair1 is a preserved failed recipe run. Its streams are valid, but two checks incorrectly required the bad boundary stream to omit its terminal row. Actual objdump retains a one-byte terminal row (c2 or 74) and replaces it with the complete row when the stop is aligned. The repaired recipe tests equal preceding rows plus that replacement. This was a local test predicate defect, not contradictory binary behavior and not a retroactive pass.

Measured static observations

• Stop 0x00779913 emits truncated 779912: c2; stop 0x00779915 emits complete 779912: c2 04 00, and authority through 0x00779930 includes the complete return plus cleanup at 0x00779915. Direct PE mapping independently reads c20400 at VA 0x00779912.
• The second boundary family reproduces truncated 74 at stop 0x00779a20, complete 74 10 at 0x00779a21, then complete 8b cf and e8 28 6a ff ff at stops 0x00779a23 and 0x00779a28. Direct PE bytes are 74108bcfe8286affff.
• ObservedTech append/growth instructions use 0x2c; PlayerEvent append/nested-copy/destruction use 0x74; TurnEvents append/prune use 0x18. These are distinct concrete element strides.
• ObservedTech allocation multiplies count by 0x2c and calls 0x00924fb6; old-element growth and PlayerEvent/string destruction paths call 0x00924faa. PlayerEvent append calls copy constructor 0x007693f0; outer TurnEvents append calls nested copy 0x00779850.
• Nested copy zeros the destination three-pointer header, distinguishes empty count from allocation, allocates through 0x0078af40, multiplies by 0x74, calls range helper 0x007725a0, writes the copied end pointer, returns destination in EAX, and ends ret 4. Its captured unwind edge calls 0x00629580 before the allocation-failure helper; this edge was exposed, not executed.
• Get/create scans every 0x18 bucket and retains the last matching +4 turn. On miss it establishes vptr and zero nested-vector pointers, calls outer append, calls nested-vector cleanup, then stores the requested stack turn into stored-last +4; both returns are ret 4.
• Outer append separates capacity-growth and spare-capacity edges, copies source +4, advances source to nested vector +8, deep-copies it, then increments end by 0x18; it ends ret 4.
• Duplicate scan advances by 0x74; after prior field comparisons it performs description comparison at 0x0046f8c0, caller-cleans two arguments, and reaches match return only when AL is zero. Thus the fresh instructions remain consistent with description equality being required.
• Direct PE mapping reads three 0x7f7fffff words at constructor-default VA 0x00af0dc8. This is a binary constant observation, not a newly parsed event record.

The manifest's direct-PE entries named observed-stride, player-stride, and turn-stride sampled fixed addresses but were not used to establish strides; their names are overbroad. The stride facts above come from the archived instruction rows. This limitation does not affect the boundary-byte or constructor-default direct controls.

Interpretation, dependencies, and limits

The measurements support the prior static interpretation that vector elements require construction and nested/string ownership rather than raw header copy. Calling 0x00924fb6, 0x00924faa, or 0x0046f8c0 remains an original-helper dependency with the original CRT/string layout. A standalone implementation needs one coherent allocator/copy/destruction family; this capture does not show that original allocations can safely cross a replacement boundary.

No game branch, allocation, constructor, destructor, throw, event post, ID assignment, record write, container mutation, or RNG draw executed. The save was hashed, not parsed. Existing/miss, spare/full-capacity, empty/nonempty, null/nonnull, short/long-string, normal/unwind, duplicate and description-only-different states are instruction exposures only. Exact PostEvent caller inputs, defaulting and total write order remain outside this bounded remeasurement.

Independent falsification package

A fresh verifier should use its own recipe and fail-if-exists directory, bind the current paired digest, repeat the negative/aligned/authority boundaries and direct PE reads, challenge at least one additional boundary, and parse the archived save independently for named player/event containers, elements, IDs, strings, FLT_MAX words, empty-player states and the actual RNG leaf. It must preserve all runtime residuals and must not count this analyst capture or archived prior verifier output as an independent cross-check.