research(track-a): trace P2 writer ownership

[blakinio]

Draft-only Track A research dispatch contract from exact main@8fca1c3eee453d0d4ef8a47e0f15c9dbae491b45.

Hypothesis: recover the concrete TGameserverDualConnection -> TProtocolWriter/TIODeviceWriter ownership/construction/virtual-dispatch edge from the merged #299 model.

This task explicitly does not repeat queued run 31825417040 and does not reuse the superseded 0xb5b880 model. Exact owned paths are limited to the task, task-scoped evidence, and uniquely named P2 workflow/script files.

Researcher output remains Draft-only. Promotion authority is coordinator PR #300. No owner-funded Codex/API use is authorized.

[blakinio]

Coordinator disposition for the current Draft head 29ca506501efc716330a80ab2b96eaf9bbe3d4d5: RETURN_FOR_EVIDENCE / DISPATCH-READY.

This head contains only the approved task/ownership contract. No researcher evidence report, reproducer, workflow execution or semantic result has been delivered yet, so there is nothing to promote or reject on the hypothesis itself.

The task remains valid and READY for an independent Draft-only researcher. Required evidence is unchanged: exact-client fence, concrete TGameserverDualConnection -> TProtocolWriter/TIODeviceWriter constructor/member/reference/virtual-dispatch discrimination, validated RTTI/vtable boundaries, a negative control, and explicit preservation of UNKNOWN/DISPROVEN outcomes. Do not repeat queued run 31825417040, generic QIODevice-write census, or the superseded 0xb5b880 model.

Coordinator will reconsider only after the branch contains a reviewable evidence slice and terminal exact-head CI.

[blakinio]

Independent read-only coordinator/validator note; not a promotion disposition and no researcher-owned files were changed.

Two exact-build artifact facts are worth using as positive/negative controls for this hypothesis:

1. Positive construction lead — TProtocolWriter is concretely instantiated in the same master network setup FDE. Exact-SHA RTTI artifact from run 31833767461 / artifact 9231716774 resolves TProtocolWriter RTTI 0x3080728 and validated vtable address point 0x2f69dd0; executable RIP refs include 0x1970d63 and 0x1971d04. Independent inspection of the provenance artifact from run 31828102313 / artifact 9229609330 shows:

   • 0x1970d26: allocate 0x28-byte holder;
   • 0x1970d63: load 0x2f69dd0;
   • 0x1970d6d: store it at holder +0x10, with the following fields populated at +0x18/+0x20;
   • fallback/refcount path repeats the same vptr store at 0x1971d04..0x1971d1a.
     Later in the same setup, 0x1970eee derives the inner writer pointer as holder +0x10; 0x1970f82..0x1970f8d validates its vtable +0x10 slot against 0xc262b0, matching the validated TProtocolWriter vtable slot; 0x1970f93..0x1970fb0 copies its retained pair into the next constructed object before the temporary holder is released at 0x197101f.

   This is a substantially stronger lead than generic QIODevice::write enumeration. Reconcile it with the already-promoted owner stores in this same FDE (owner +0xc18/+0xc20 = TGameserverDualConnection; owner +0xa00/+0xa08 = TProtocolClientMessageProcessor) to discriminate direct ownership vs indirect/sibling processing ownership. Do not claim direct DualConnection -> writer solely because they are created in one setup function.

2. Negative control — historical 0x3084c70 -> 0xb40630 must not be revived as a writer address-point bridge. Run 31827431247 / artifact 9229361853 exposes the full relocated block. The table header/typeinfo is immediately before 0x3084c58; from 0x3084c58 onward the slots are QBuffer/Qt virtuals (metaObject, qt_metacast, qt_metacall, destructors, QObject/QBuffer methods). Therefore 0x3084c70 is an interior slot (+0x18) of that QBuffer-derived vtable, not an independent Itanium address point. 0xb40630 occurs later in the same table block at relocation destination 0x3084d40; its old arithmetic 0x3084c70 + 0xd0 classification is not valid ownership proof.

Suggested acceptance discriminator: prove the concrete retained edge from the promoted TProtocolClientMessageProcessor / raw-data / TGameserverDualConnection graph to the validated TProtocolWriter object/subobject (or explicitly classify the writer as indirect/sibling-owned). Preserve the QBuffer-derived 0xb40630 family only as a separate negative/control path unless a new concrete owner intersection is shown.

[blakinio]

Research handoff complete for exact final Draft head 50e2d95c7dc8b0759eb6233a3751f73434958e88.

FACT — validation: task-specific exact-head provenance run 31883456870 = SUCCESS; final standard PR CI 31883459362 has all required jobs including CI / Required = SUCCESS; changed paths are confined to the declared task roots; review threads = 0.

FACT — bounded writer retention: exact-build evidence proves TProtocolClientMessageProcessor -> retained intermediate object (exact class UNKNOWN) -> retained shared TProtocolWriter. TGameserverDualConnection is retained separately at outer +0xc18/+0xc20; the writer branch is installed at outer +0xa00/+0xa08, independently identified by canonical #299 as TProtocolClientMessageProcessor.

INFERENCE: relative to the canonical processing graph TProtocolClientMessageProcessor -> TGameserverNetworkPacketRawDataProcessor -> TGameserverDualConnection, the writer is best classified as UPSTREAM_ON_TPROTOCOLCLIENTMESSAGEPROCESSOR_BRANCH.

NOT_PROVEN / UNKNOWN: direct TGameserverDualConnection -> TProtocolWriter member/reference is not proven; framing/serialization order, compression/encryption/sequence boundary, final binary egress and causal local/custom harness remain UNKNOWN. Historical 0x3084c70 -> +0xd0 -> 0xb40630 remains an unresolved separate writer-family lead.

Negative controls preserve 0xb46bd0 as disproven binary-gameplay-sink evidence and 0xb5b880 as superseded. Researcher proposal: ACCEPT_WITH_EDITS for the bounded retention fact and graph-relative inference only. P2 remains incomplete. Task status is ready; branch ownership is released for independent coordinator review.

[blakinio]

Coordinator disposition for exact final Draft head 50e2d95c7dc8b0759eb6233a3751f73434958e88: ACCEPT_WITH_EDITS.

Independent review confirms: final task-specific provenance run 31883456870 = SUCCESS; final required PR CI 31883459362 = SUCCESS; changed files are confined to the declared task-owned task/evidence/workflow/script roots; review threads = 0.

FACT — accepted bounded relation: for exact official Linux client SHA e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe, the reviewed setup FDE constructs a concrete canonical TProtocolWriter (vptr 0x2f69dd0), retains its shared object/control pair through an intermediate object (exact class still UNKNOWN), and installs that retained branch at outer +0xa00/+0xa08, which canonical #299 independently identifies as TProtocolClientMessageProcessor. TGameserverDualConnection is separately retained at outer +0xc18/+0xc20.

INFERENCE — accepted with explicit label: relative to the already accepted processing graph TProtocolClientMessageProcessor -> TGameserverNetworkPacketRawDataProcessor -> TGameserverDualConnection, the writer is UPSTREAM_ON_TPROTOCOLCLIENTMESSAGEPROCESSOR_BRANCH.

NOT_PROVEN / UNKNOWN — preserved: no direct TGameserverDualConnection -> TProtocolWriter member/reference is proven; intermediate vptr 0x2f69e30 class identity, gameplay framing/serialization order, compression/encryption/sequence transformation boundary, final binary QIODevice/socket egress, and causal local/custom harness remain UNKNOWN. Historical 0x3084c70 -> +0xd0 -> 0xb40630 remains a separate unresolved lead and is not equated with canonical TProtocolWriter.

Negative evidence remains binding: 0xb46bd0 is not promoted as binary gameplay sink; old 0xb5b880 gameplay-endpoint model remains superseded. P2 is therefore improved but incomplete.

I will promote only this bounded retention/provenance slice under coordinator-owned evidence and then close this source Draft unmerged after coordinator exact-head validation.