research(track-a): trace f50090 downstream message path

[blakinio]

Draft-only Track A P2-NETWORK researcher for OTC-20260817-track-a-p2-f50090-downstream.

Status: DRAFT_NOT_PROMOTED / READY_FOR_COORDINATOR_REVIEW.
Promotion authority: coordinator only; this Draft must not self-merge.

Exact client

• version 15.32.df7b29
• size 51965216
• SHA-256 e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe

Base: canonical promotion main@696db6ce34acd23a3d0081b9b1b94e1eabbe1cbe from #487.
Execution: exact-file static only; runtime_access:none; no world-map, live client/session, process memory, login/gameplay or owner-funded AI.

Final bounded result

Canonical same message enters 0xf50090 in SysV rsi, is saved in rbp, decomposed into structured fields and serialized through an exact TIODeviceWriter:

... -> 0xf50090
 -> message field decomposition
 -> TIODeviceWriter AP 0x2f69d48 / RTTI 0x3080718
 -> QDataStream object at writer+0x18
 -> scalar QDataStream writes
 -> QDataStream::writeRawData(char const*, qint64) @ 0x4dd250

Exact raw payload edge:

• payload pointer = value copied from canonical message +0x10;
• payload length = value copied from canonical message +0x18;
• receiver = TIODeviceWriter+0x18 exact QDataStream;
• target = QDataStream::writeRawData@0x4dd250.

Accepted exact-SHA predecessor #308 artifact 9251725866 (sha256:f669df2ace3db0e269f60287d82c51b69eff11eaf7c7f5b932e049492632bd1e) independently supplies the exact identities 0x1960340 = TIODeviceWriter helper, AP 0x2f69d48, RTTI 0x3080718, QDataStream member +0x18, and 0x4dd250 = QDataStream::writeRawData(char const*, qint64).

Classifications:

F50090_REPRESENTATION_BOUNDARY=FACT:STRUCTURED_MESSAGE_FIELDS_TO_TIODEVICEWRITER_QDATASTREAM
F50090_DIRECT_SOCKET_SINK=DISPROVEN
F50090_IS_PROVEN_FINAL_BINARY_EGRESS=DISPROVEN
CURRENT_TIODEVICE_CONCRETE_TYPE=UNKNOWN
FINAL_BINARY_EGRESS=UNKNOWN
FINAL_SOCKET_OWNER=UNKNOWN
FRAMING=UNKNOWN
SEQUENCE=UNKNOWN
COMPRESSION=UNKNOWN
ENCRYPTION=UNKNOWN

F50090_IS_PROVEN_FINAL_BINARY_EGRESS=DISPROVEN means this exact function is positively typed as a serialization stage, not a terminal socket sink. It does not rule out downstream effects inside the bound QIODevice.

Evidence generations

The original checkout-dependent source run failed before client/source access because GitHub codeload returned HTTP 429 while downloading pinned actions/checkout; one allowed identical retry reproduced that external failure. The producer was then materially changed to eliminate marketplace actions rather than retry indefinitely.

Successful bounded generations:

1. run 32037248323 = SUCCESS; source 95410048084; hosted 95410072413; 0xf50040..0xf50480, SHA 1d14d72f683455daa3ab065bd48c3588f8755798ce63e70b838569353c3e2cea.
2. run 32037533068 = SUCCESS; source 95410828633; hosted 95410901806; main window above plus constructor 0x1960300..0x1960600 SHA bc03c482e3ae04c0f9a91288d5f79612b2f0f08680ef10ffecdf9a927ec0371f and writer-wrapper 0xcb2900..0xcb29c0 SHA dc04038b7740f39095ed6ab599bc10048c368fab9eff126c3d0853930c62af14.

Both source jobs re-fenced the exact retained regular ELF and performed only bounded file-backed byte copying; source-side disassembly/semantic classification, runtime/process access, client execution/mutation and raw executable upload were absent. All semantic decode ran on GitHub-hosted Ubuntu.

All temporary workflow/script producer surfaces are removed. Final diff is exactly 3 durable P2 files.

Final validation

Final researcher head: ebda1b1c01a801e749d3ec2ed5973705e8140969.

• Track A governance 32038034263 = SUCCESS;
• repository CI 32038034467 = SUCCESS;
• CI / Required job 95412354038 = SUCCESS;
• reviews / unresolved threads: 0 / 0;
• changed files: exactly 3 P2 task/evidence paths.

Next frontier

After independent coordinator promotion, resolve only the concrete dynamic type/provenance of the QIODevice shared pair supplied to the current TIODeviceWriter at b4b273 -> 0x1960340, then follow its first post-serialization consumer. Do not broaden into generic Qt/socket census.

E2E: NOT_APPLICABLE — static exact-file/disassembly research only.

[blakinio]

Coordinator verdict — ACCEPT_WITH_EDITS

Independent coordinator review of final researcher head 76460840d583218dde1b268f4e46e17a074f0abf accepts the bounded P2 result with conservative semantic edits.

Primary evidence checked directly:

• generation 2 run 32037248323: source 95410048084 = SUCCESS, hosted 95410072413 = SUCCESS, exact main window 0xf50040..0xf50480 SHA-256 1d14d72f683455daa3ab065bd48c3588f8755798ce63e70b838569353c3e2cea;
• generation 3 run 32037533068: source 95410828633 = SUCCESS, hosted 95410901806 = SUCCESS; exact main/ctor/vcall windows and hashes match the durable evidence;
• source logs prove exact client size/SHA fence, file-only byte staging, runtime_access:none, no process/process-memory/canonical-runtime/client-execution/client-mutation/raw-client upload;
• hosted disassembly independently proves f50090 preserves the canonical entry pointer in rbp, decomposes its fields, guards writer slot +0x58 against exact 0xcb2960, then carries message+0x10 payload pointer and message+0x18 length through underlying receiver writer+0x18 to exact target 0x4dd250;
• exact wrapper 0xcb2960 independently cross-checks the same +0x08 data / +0x10 length / this+0x18 / 0x4dd250 contract;
• constructor 0x1960340 is accepted only as supporting structural ownership evidence (vptr 0x2f69d48, nested member +0x18, owner/control member +0x20), not as proof of the current writer dynamic type.

Accepted classifications:

• f50090_decomposes_message_into_fields: FACT;
• whole original message pointer forwarded downstream: DISPROVEN;
• writer guard +0x58 == 0xcb2960: FACT;
• raw payload pointer/length continuation to underlying receiver +0x18 -> 0x4dd250: FACT.

Retained UNKNOWN:

• writer exact dynamic type;
• underlying receiver exact dynamic type;
• semantic role of 0x4dd250;
• whether 0x4dd250 is the final binary/socket write;
• final socket ownership, framing, sequence, compression, encryption.

Final researcher validation on exact head 76460840d583218dde1b268f4e46e17a074f0abf:

• Track A governance run 32037873578 = SUCCESS;
• CI run 32037873878, CI / Required job 95411808828 = SUCCESS;
• final changed-file inventory: exactly 3 durable task/evidence files;
• reviews/unresolved threads: 0/0;
• one-shot workflow/script removed.

E2E: NOT_APPLICABLE — static exact-file/disassembly evidence only.

Promotion must archive this task and must not start another research frontier in this invocation. The later exact frontier is 0x4dd250 identity/downstream semantics.

[blakinio]

Coordinator disposition: ACCEPT_WITH_EDITS.

I independently re-read the final three-file diff, exact-hosted disassembly from runs 32037248323 and 32037533068, exact source-fence logs, and accepted exact-SHA predecessor #308 artifact identities rather than treating the researcher summary as proof.

Accepted bounded result:

• canonical same message enters 0xf50090 as the original second argument and is decomposed into fields: FACT;
• writer member this+0x08 is the object initialized by helper 0x1960340: FACT;
• accepted #308 exact evidence types that object as TIODeviceWriter, AP 0x2f69d48, RTTI 0x3080718, with QIODevice shared pair +0x08/+0x10 and QDataStream shared pair +0x18/+0x20: FACT;
• 0xf50090 raw payload pointer comes from canonical message +0x10, length from +0x18, receiver is writer +0x18 QDataStream, exact target 0x4dd250 = QDataStream::writeRawData(char const*, qint64): FACT;
• therefore 0xf50090 is a structured-field -> TIODeviceWriter/QDataStream serialization stage: FACT;
• direct socket sink at 0xf50090: DISPROVEN;
• 0xf50090 as proven final binary egress: DISPROVEN in that stated form;
• exact concrete QIODevice for this writer, final binary egress/socket owner, framing, sequence, compression and encryption remain UNKNOWN.

No class-name-only, adjacency or generic Qt census reasoning is used as transport proof. No world-map/runtime/process-memory evidence is involved.

Exact-head validation: Track A governance 32038034263 = SUCCESS; CI 32038034467 = SUCCESS; CI / Required 95412354038 = SUCCESS; final diff exactly 3 durable P2 files; temporary workflow/script absent; reviews/threads before this disposition 0/0.

Fresh coordinator audit: PASS_BOUNDED, material findings open 0. E2E: NOT_APPLICABLE — static exact-file/disassembly evidence only.

Next smallest frontier after promotion: resolve only the concrete QIODevice shared-pair provenance supplied to the current TIODeviceWriter at b4b273 -> 0x1960340, then follow its first post-serialization consumer; do not broaden into a generic socket/Qt sweep.