research(track-a): resolve 4dd250 QIODevice provenance

[blakinio]

Draft-only Track A P2-NETWORK researcher for OTC-20260817-track-a-p2-4dd250-qiodevice-provenance.

Status: DRAFT_NOT_PROMOTED / READY_FOR_COORDINATOR_REVIEW.
Promotion authority: coordinator only; this Draft must not self-merge.

Exact client: 15.32.df7b29 / 51965216 / SHA-256 e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe.
Base: main@5068b220aef571805a72c4d8f9293dcaa43ee90c after #489.
Execution: exact-file static only; runtime_access:none; no world-map, live process/session, process memory, login/gameplay or owner-funded AI.

Final bounded result

The canonical binary gameplay payload is now bound by exact object/member provenance to a concrete QTcpSocket-backed QDataStream:

canonical same message
 -> 0xf50090 field decomposition
 -> canonical payload pointer/length
 -> TIODeviceWriter AP 0x2f69d48
 -> QDataStream at writer+0x18
 -> QDataStream::writeRawData(char const*, qint64) @ 0x4dd250
 -> QDataStream constructed on TGameserverTCPConnection::QTcpSocket*

Load-bearing proof:

• accepted research(track-a): trace post-serialization buffer boundary #308 exact-SHA artifact 9251725866 (sha256:f669df2ace3db0e269f60287d82c51b69eff11eaf7c7f5b932e049492632bd1e) proves helper 0x1960340 = TIODeviceWriter construction, QIODevice pair +0x08/+0x10, QDataStream pair +0x18/+0x20, and 0x4dd250 = QDataStream::writeRawData(char const*, qint64);
• merged Track A: reconcile TCP writer RTTI evidence (rebased slice) #299 (8fca1c3eee453d0d4ef8a47e0f15c9dbae491b45) proves TGameserverTCPConnection AP 0x3084b38, RTTI 0x3080630, both QTcpSocket constructor paths, and concrete socket member TGameserverTCPConnection this+0x10;
• generation 2 independently re-resolves AP 0x3084b38 to RTTI name N5tibia7network24TGameserverTCPConnectionE for both direct callers of 0xb4aea0;
• generation 3 proves the current source pair: b4b1ee loads TGameserverTCPConnection, b4b1f2/b4b1f6 load its +0x10/+0x18 QTcpSocket shared pair, b4b230..b4b26f rebuild that exact pair, and b4b273 passes it to helper 0x1960340.

Classifications:

CURRENT_WRITER_TYPE=FACT:TIODeviceWriter
CURRENT_QIODEVICE_TYPE=FACT:QTcpSocket
CURRENT_QIODEVICE_OWNER=FACT:TGameserverTCPConnection
0x4DD250=FACT:QDataStream::writeRawData(char const*, qint64)
CANONICAL_PAYLOAD_POINTER_TO_0x4DD250=FACT
CANONICAL_PAYLOAD_LENGTH_TO_0x4DD250=FACT
QT_QTCPSOCKET_BOUND_BINARY_BOUNDARY=PROVEN
FINAL_BINARY_EGRESS=PROVEN_AT_QT_QTCPSOCKET_BOUNDARY
FINAL_SOCKET_OWNER=FACT:TGameserverTCPConnection
FINAL_OS_SOCKET_SYSCALL=UNKNOWN
FRAMING=UNKNOWN
SEQUENCE=UNKNOWN
COMPRESSION=UNKNOWN
ENCRYPTION=UNKNOWN

The proven Qt QTcpSocket boundary must not be reworded as proof of a specific Linux send/write syscall or kernel descriptor transition.

New exact evidence

1. Run 32038672531 = SUCCESS; source 95413976848; hosted 95414062445; exact direct calls to 0xb4aea0 = 0x1970285, 0x1970608. Initial RTTI substring method yielded no candidates and was explicitly superseded.
2. Run 32038917855 = SUCCESS; source 95414621259; hosted 95414649302; bundle digest sha256:3fa3b3118c0a988000de6c77fc9c52514f9670f9f3d7b52f2d07f63ba53071b7; AP 0x3084b38 -> typeinfo 0x3080630 -> exact RTTI name TGameserverTCPConnection.
3. Run 32039061786 = SUCCESS; source 95415015967; hosted 95415041166; bridge 0xb4ae90..0xb4b290, digest sha256:4bc45e68bc7c1530579860dfb7769d48e162a82f80fad17a098d2a695760f596; exact TCPConnection +0x10/+0x18 pair -> 0x1960340 bridge proven.

All source stages were exact-fenced file-only/nonsemantic. Semantic decode was GitHub-hosted. No raw executable/package was uploaded. One-shot workflow is removed; final diff is exactly 3 durable P2 files.

Final validation

Final researcher head: 6d6211b89c802600ab7e749d3b08ba3f7a60840f.

• Track A governance 32039404811 = SUCCESS;
• repository CI 32039405213 = SUCCESS after one evidence-based retry of an external codeload.github.com HTTP 429 on dorny/paths-filter;
• CI / Required 95416178014 = SUCCESS;
• changed files: exactly 3 durable P2 paths;
• reviews / unresolved review threads before coordinator disposition: 0 / 0.

E2E: NOT_APPLICABLE — static exact-file/disassembly evidence only.

This is the final research task allowed in the current autonomous invocation. After coordinator promotion/closeout, do not start another task. Future independent frontiers are: OS-level syscall/kernel transition below Qt if specifically required, and separately framing/sequence/compression/encryption ordering.

[blakinio]

Coordinator disposition: ACCEPT_WITH_EDITS.

Independent review basis: exact final three-file diff; exact-source/hosted logs for runs 32038672531, 32038917855, 32039061786; accepted exact-SHA #308 artifact identity; merged canonical #299 TCPConnection/QTcpSocket member evidence. Researcher summary was not used as proof.

Accepted bounded result:

• current writer = TIODeviceWriter, AP 0x2f69d48: FACT;
• 0x4dd250 = QDataStream::writeRawData(char const*, qint64): FACT;
• both direct 0xb4aea0 construction sources are TGameserverTCPConnection (AP 0x3084b38, RTTI 0x3080630): FACT;
• canonical #299 proves TGameserverTCPConnection this+0x10 is the concrete QTcpSocket member: FACT;
• generation-3 exact bridge proves current TCPConnection +0x10/+0x18 QTcpSocket shared pair is rebuilt and passed to TIODeviceWriter helper 0x1960340: FACT;
• therefore current QDataStream is constructed on concrete TGameserverTCPConnection::QTcpSocket*: FACT;
• canonical gameplay payload pointer/length reaches QDataStream::writeRawData on that QTcpSocket-backed stream: FACT;
• Qt QTcpSocket-bound binary serialization/write boundary: PROVEN;
• final socket owner: FACT:TGameserverTCPConnection.

Precision boundary: this does not inspect Qt internals below the QTcpSocket abstraction. FINAL_OS_SOCKET_SYSCALL remains UNKNOWN. Framing, sequence, compression and encryption remain UNKNOWN. Legacy FINAL_BINARY_EGRESS may only be stated as PROVEN_AT_QT_QTCPSOCKET_BOUNDARY, not as a Linux syscall/kernel-descriptor claim.

Exact-head validation after governance-field repair: Track A governance 32039404811 = SUCCESS; CI 32039405213 = SUCCESS; CI / Required 95416178014 = SUCCESS; final diff exactly 3 durable P2 files; reviews/threads before this disposition 0/0; one-shot workflow removed.

Fresh coordinator audit: PASS_BOUNDED; material findings open 0. E2E: NOT_APPLICABLE — static exact-file/disassembly evidence only.

This is the final research task permitted in the current autonomous invocation. Coordinator promotion/archive is required closeout; do not start another research task after promotion.