research(track-a): resolve P2 DualConnection egress boundary

[blakinio]

Draft-only Track A P2-NETWORK researcher for OTC-20260817-track-a-p2-dual-precondition-egress.

Status: DRAFT_NOT_PROMOTED / READY_FOR_COORDINATOR_REVIEW.
Promotion authority: coordinator only — this PR intentionally remains Draft and must not self-merge.

Exact final state

• base: main@8a52fe4af6a03fca29a831ae4fae4c3936cf025c;
• final researcher head: c3a3d8339a9fb769847011ffb76662688d91f06c;
• final changed-file inventory: exactly 3 P2 files;
• reviews / unresolved review threads: 0 / 0;
• Track A governance: run 32018496831 = SUCCESS;
• repository CI: run 32018496866 = SUCCESS;
• CI / Required: job 95353000509 = SUCCESS.

A flawed intermediate restack had retained stale copies of unrelated main paths. That was repaired before final validation: the branch tree was rebuilt from current main plus exactly the three P2 files and ancestry was bound to current main through 3600f6c8927484c30b4a7c97ef411ab0c0ce0fae. The final PR diff contains only:

1. docs/agents/evidence/OTC-20260817-track-a-p2-dual-precondition-egress/20260817-dual-egress-discriminator.md;
2. docs/agents/evidence/OTC-20260817-track-a-p2-dual-precondition-egress/result.json;
3. docs/agents/tasks/active/OTC-20260817-track-a-p2-dual-precondition-egress.md.

Objective

Test the historical 0xb4066b QIODevice::write(QByteArray const&) candidate as a concrete gameplay binary/socket egress boundary after the coordinator-promoted #450 same-message chain.

Promoted input remains:

persistent QBuffer
 -> TProtocolClientMessageProcessor+0x10@0xc2df80
 -> TGameserverNetworkPacketRawDataProcessor+0x10@0xb47130
 -> same message
 -> TGameserverDualConnection +0x80@0xb56d60 / +0x78@0xb56970

Evidence generation

Exactly one bounded generation ran on exact experiment head 37c455f2ab3170457a0d084a7745eaa42e28aff1:

• workflow run 32016842999 = SUCCESS;
• source job 95348018877 = SUCCESS;
• hosted decode job 95348295109 = SUCCESS;
• source artifact 9283851546, digest sha256:7e03ed66bff463e288b5f2414bad8190a27bf421161ba1218c2a74d7342baeab;
• final artifact 9283858910, digest sha256:2df8405269431397f3da0601ef24d9a9a8787dc33f3b5fdd43774f1eca36922c;
• experiment-head Track A governance 32016848906 = SUCCESS.

Exact client fence:

• version 15.32.df7b29;
• size 51965216;
• SHA-256 e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe.

Source staging verified the exact regular file and copied only three bounded executable-file windows totalling 3616 bytes. It did no disassembly/semantic classification, accessed no client process/process memory/canonical state, executed no client and uploaded no raw executable/package. Semantic disassembly ran on GitHub-hosted Ubuntu. runtime_access: none; physical E2E is not applicable.

Accepted non-quarantined #310 artifact 9252025461 was independently re-hashed to its canonical digest sha256:2a866247558b079944d81c9ad33bd4c5361c8144a7f367b273ab3bc19a080991 and used only to cross-check exact-client PLT identities 0x4dac00 = QBuffer::buffer() and 0x4de370 = QIODevice::write(QByteArray const&). Quarantined run 31944051248 is not proof.

Bounded result

Fresh exact bytes correct the historical broad-window interpretation:

• 0xb40370 returns on visible paths by 0xb40421;
• 0xb40630 is a distinct function entry;
• therefore 0xb4066b is not inside the 0xb40370 / TGameserverDualConnection +0x90 function.

At the distinct 0xb40630 entry, exact SysV register dataflow establishes:

b40634: mov r12,rsi     # original second argument
b40639: mov rbx,rdi     # this
...
b40656: call 0x4dac00   # QBuffer::buffer()
...
b40665: mov rsi,r12
b40668: mov rdi,rbx
b4066b: call 0x4de370   # QIODevice::write(QByteArray const&)

Research classifications:

• b4066b_inside_b40370_plus_0x90_function: DISPROVEN;
• b40630_distinct_function_entry: FACT;
• b4066b_qiodevice_write_callsite: FACT;
• receiver: FACT = b40630 this/rbx, structurally QBuffer/QIODevice-compatible; exact dynamic subtype UNKNOWN;
• payload: FACT = original b40630 second argument/rsi;
• direct QTcpSocket* sink at 0xb4066b: DISPROVEN;
• payload relationship to the docs(track-a): promote P2 persistent-buffer downstream evidence #450 same-message chain: UNKNOWN;
• reachability from promoted DualConnection +0x78/+0x80 to 0xb40630: UNKNOWN.

Fresh +0x78/+0x80 windows contain no direct call to 0xb40630. Nested indirect +0x10 calls at 0xb56c93 and 0xb57042 remain untyped by this bounded evidence, so vtable adjacency/range proximity is not promoted as reachability.

Initial H1 — 0xb4066b is the concrete binary gameplay egress candidate reachable after the promoted same-message handoff — is DISPROVEN_IN_STATED_FORM.

Still UNKNOWN

• framing;
• sequence;
• compression;
• encryption;
• final binary egress;
• final socket ownership;
• complete transport stage order beyond the docs(track-a): promote P2 persistent-buffer downstream evidence #450 promoted chain.

No replacement sink is invented.

Negative controls remain: 0xb46bd0 is a proven QString/local-8-bit newline write through TGameserverTCPConnection::QTcpSocket* but not binary gameplay-frame proof; 0xc33259 is DISPROVEN QMatrix4x4/non-network; 0xb5b880 is SUPERSEDED.

Cleanup / handover

The one-shot workflow and slicer ran exactly once and were removed after evidence consumption; they are absent from the final diff.

Researcher material findings open: 0.
E2E: NOT_APPLICABLE — static exact-file/disassembly research only, no live runtime/network observation or mutation.

Next action: coordinator must independently inspect artifacts 9283851546 / 9283858910 and the durable evidence, then classify this Draft ACCEPT, ACCEPT_WITH_EDITS, RETURN_FOR_EVIDENCE, or REJECT/SUPERSEDE. No P2 semantic claim from this Draft is canonical until that coordinator promotion step.

[blakinio]

Final researcher handoff / post-CI drift check

Researcher package is DRAFT_NOT_PROMOTED / READY_FOR_COORDINATOR_REVIEW on exact head c3a3d8339a9fb769847011ffb76662688d91f06c.

Final validated state:

• changed files: exactly 3 P2 files (task + Markdown evidence + machine-readable result);
• Track A governance 32018496831 = SUCCESS;
• repository CI 32018496866 = SUCCESS;
• CI / Required job 95353000509 = SUCCESS;
• reviews / unresolved review threads = 0 / 0;
• one-shot P2 workflow/script are removed from the final diff.

After those checks, main advanced from 8a52fe4af6a03fca29a831ae4fae4c3936cf025c to 0b3bdec0a4145f558806448a4657413664d80729. Exact compare shows only the worldmap mutation physical-validation task moved from docs/agents/tasks/active/ to docs/agents/tasks/archive/; there is no P2/evidence/path overlap and no load-bearing semantic drift for this bounded package. I therefore did not invalidate the exact validated researcher head with another restack. Coordinator should still revalidate current main as part of its mandatory independent review.

Research result remains bounded negative evidence: 0xb4066b is not inside the 0xb40370 / DualConnection +0x90 function; its direct QIODevice receiver is the distinct 0xb40630 QBuffer/QIODevice-compatible this, so 0xb4066b as a direct QTcpSocket sink is DISPROVEN. Framing, sequence, compression, encryption, final binary egress, final socket ownership, and reachability from the promoted +0x78/+0x80 path remain UNKNOWN.

No semantic claim in this Draft is canonical until coordinator disposition.

[blakinio]

Coordinator-facing independent review checkpoint for OTCLIENT-TIBIA-RE-P2-NETWORK.

Disposition: ACCEPT_WITH_EDITS for the bounded negative result; NOT YET CANONICAL because PR #458 remains a researcher Draft and its evidence path is absent from current main.

Independently verified:

• source artifact 9283851546 ZIP sha256 = 7e03ed66bff463e288b5f2414bad8190a27bf421161ba1218c2a74d7342baeab;
• final artifact 9283858910 ZIP sha256 = 2df8405269431397f3da0601ef24d9a9a8787dc33f3b5fdd43774f1eca36922c;
• exact-client fence = 15.32.df7b29 / 51965216 / e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe;
• fresh independent objdump of the staged source bytes confirms b40370 returns by b40421 and b40630 is a distinct function entry;
• b40630 preserves original rsi in r12 and original this in rbx; b4066b calls 0x4de370 with rdi=rbx and rsi=r12;
• direct QTcpSocket sink at b4066b is disproven by receiver provenance;
• DualConnection +0x78/+0x80 staged windows contain no direct call to b40630;
• nested calls b56c93 and b57042 remain untyped by the available artifacts, therefore reachability to b40630 remains UNKNOWN;
• PR head c3a3d83 has Track A governance run 32018496831 SUCCESS and CI run 32018496866 SUCCESS; changed-file inventory is exactly the three declared P2 files; unresolved review threads = 0.

Required edits before promotion:

1. Promote only the negative/corrective claims above; do not promote b40630 reachability, final egress, socket ownership, framing, sequence, compression, or encryption.
2. Preserve the negative controls: b46bd0 non-gameplay QString/newline path, c33259 non-network, b5b880 superseded, quarantined run 31944051248 excluded.
3. Next smallest falsifiable frontier: type the final nested receiver used by the b56c93/b57042 virtual +0x10 calls (including exact vtable identity/member provenance) and test whether its +0x10 target is b40630 or another concrete binary-write stage. Existing artifacts are insufficient for that edge, so absence of proof remains UNKNOWN rather than a replacement sink claim.

Terminal P2 state from this review: DUALCONNECTION_TO_BINARY_EGRESS=UNKNOWN; FINAL_BINARY_EGRESS=UNKNOWN; FINAL_SOCKET_OWNER=UNKNOWN; FRAMING=UNKNOWN; SEQUENCE=UNKNOWN; COMPRESSION=UNKNOWN; ENCRYPTION=UNKNOWN.

[blakinio]

Coordinator disposition: ACCEPT_WITH_EDITS.

Independent verification did not rely on the researcher summary. I checked the exact source/hosted evidence generation (32016842999, jobs 95348018877 / 95348295109), artifact digests (9283851546 / 9283858910), final source-head Track A governance 32018496831 = SUCCESS, repository CI 32018496866 = SUCCESS, exact three-file final diff, and empty review/thread inventory.

Accepted bounded result:

• 0xb40370 ends before 0xb40630; 0xb4066b is not inside the historical DualConnection +0x90 function: DISPROVEN;
• 0xb40630 distinct entry: FACT;
• 0xb4066b QIODevice::write(QByteArray const&) callsite: FACT;
• receiver = b40630 this/rbx, QBuffer/QIODevice-compatible: FACT; concrete dynamic type UNKNOWN;
• payload = original b40630 second argument: FACT;
• direct QTcpSocket sink at 0xb4066b: DISPROVEN;
• DualConnection reachability, same-message relation, framing, sequence, compression, encryption, final binary egress and final socket ownership remain UNKNOWN.

The original 0xb4066b final-egress hypothesis is DISPROVEN_IN_STATED_FORM; no replacement sink is promoted.

Canonical promotion is PR #481. It also assigns the next smallest frontier OTC-20260817-track-a-p2-dual-nested-vcall-resolution for the untyped +0x10 calls at 0xb56c93 and 0xb57042. Keep this source Draft unmerged until #481 reaches a terminal promotion state.

[blakinio]

Coordinator promotion #481 merged as 2ba207cef6d53dc847542b33ec94e7b53fd35b1f after exact-head Track A governance and CI / Required passed. Source Draft #458 is therefore terminal closed unmerged / ACCEPT_WITH_EDITS. Its one-shot workflow/slicer are already absent from the final source diff; canonical evidence is the promotion on main. Ownership for OTC-20260817-track-a-p2-dual-precondition-egress is released and the active P2 frontier is OTC-20260817-track-a-p2-dual-nested-vcall-resolution.