research(track-a): prove native game-login credential fields

[blakinio]

Terminal source disposition — superseded by clean coordinator promotion #589

Status: CLOSED UNMERGED AS SUPERSEDED. Source head 6b814f90d4e6d72238651b48be0621dd4c9fa6f3.

Coordinator review 4971650428 = ACCEPT_WITH_EDITS; zero material factual findings after repair. All addresses/vtables/offsets remain historical exact-build evidence for 15.32.df7b29 / 51965216 / e6c244bd..., never current-build addresses.

Accepted historical facts: GameclientMessageLogin nested LoginRSAEncryptedBlock field 7, bounded exact protobuf wire tag/types, TLoginProtocolMessageHandler -> TProtocolMessageQueue::sendLogin(GameclientMessageLogin), producer state sourced from TAuthenticationAndEncryptionInfo, and distinct secondary-login message family.

Canonical semantic correction:

DIRECT_TO_CHARACTER_SELECTION_ROUTE_FOR_VALID_RETAINED_STATE=YES
CAN_SKIP_LOGIN_FORM_GENERALIZED=PARTIAL
PASSWORD_REQUIRED_FOR_GAME_LOGIN=UNKNOWN
PASSWORD_PRESENT_IN_GAME_LOGIN=NOT_PROVEN
PASSWORD_ABSENT_FROM_GAME_LOGIN=NOT_PROVEN

Source exact-head governance 32066665095=SUCCESS, CI 32066665482=SUCCESS, final provenance producer 32066254378=SUCCESS with no runtime/login/secret access.

Initial coordinator promotion #588 was closed unmerged when main advanced concurrently. Clean restack #589 used one commit directly on main@c056a38aeecb3f88b9c8b140997933d23c51027f, ahead_by=1, behind_by=0, exactly 8 docs/evidence/archive paths, CI 32248884463=SUCCESS, promotion review 4971696699, zero review threads, and squash-merged as db5fdefbd205d5acdf31b0f5ebc893a2da7c357c.

No client execution, credentials, login, GUI input, gameplay, transaction or runtime mutation occurred during coordinator audit/promotion.

[blakinio]

Fresh coordinator audit: ACCEPT_WITH_EDITS.

The source contains unique historical exact-build evidence at head 6b814f90d4e6d72238651b48be0621dd4c9fa6f3, fenced to 15.32.df7b29 / 51965216 / e6c244bd.... Exact-head governance/CI are green, and final provenance producer 32066254378 independently re-fenced the historical client and passed its bounded PlaySessionData/auth-state probe with runtime_access=none, no login and no secret access.

Accepted historical facts include:

• native GameclientMessageLogin has nested LoginRSAEncryptedBlock at field 7;
• the recovered wire-shape of top-level login and nested RSA block is stable for this exact binary;
• native producer is a TLoginProtocolMessageHandler path feeding TProtocolMessageQueue::sendLogin(GameclientMessageLogin);
• producer state is sourced from TAuthenticationAndEncryptionInfo (historical vtable 0x2f63240);
• secondary login is a distinct message/RSA-block family;
• the exact semantic names of RSA fields and the causal map TPlaySessionData field -> TAuthenticationAndEncryptionInfo field -> specific LoginRSAEncryptedBlock field remain unproven;
• PASSWORD_REQUIRED_FOR_GAME_LOGIN=UNKNOWN, with neither password presence nor password absence proven.

Required edits:

1. All addresses/vtables/producer offsets remain historical exact-build only, never current-build addresses.
2. The research prose line CAN_SKIP_LOGIN_FORM: YES when client has suitable valid retained state is too broad when read as a generalized capability. Canonical interpretation is: a native direct-to-character-selection route exists conditionally for suitable retained state, while generalized CAN_SKIP_LOGIN_FORM remains PARTIAL, consistent with parent #498.
3. Preserve field semantics as UNKNOWN; wire tag/type recovery must not be renamed into email/password/session-token fields without causal proof.

Source is behind_by=50, so use clean current-main promotion. Open material factual findings after these edits: 0.