From 086fedc65862bda77983bb6cfa3b8808fdd9deb6 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:34:39 +0200 Subject: [PATCH 01/22] docs(track-a): claim S1 unfiltered static census --- ...818-track-a-s1-unfiltered-static-census.md | 205 ++++++++++++++++++ 1 file changed, 205 insertions(+) create mode 100644 docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md diff --git a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md new file mode 100644 index 0000000000..cddced80c5 --- /dev/null +++ b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md @@ -0,0 +1,205 @@ +--- +task_id: OTC-20260818-track-a-s1-unfiltered-static-census +status: investigating +agent: ChatGPT +session_id: chatgpt-s1-static-census-20260818 +session_role: researcher +project_lane: otclient +lane: P2-NETWORK +track_id: official-client-re +task_kind: discovery +phase: investigate +execution_mode: github_only +execution_reason: exhaustive deterministic exact-client protocol/QMeta census without touching the serialized physical runtime +branch: research/OTC-20260818-track-a-s1-unfiltered-static-census +base_branch: main +base_main: ed09418b431c28087775b419f85bed404fa85d70 +related_pr: pending +created: 2026-08-18T09:29:00+02:00 +updated: 2026-08-18T09:29:00+02:00 +risk: medium +implementation_authorized: true +credentials_allowed: false +login_allowed: false +gameplay_allowed: false +mutation_authorized: false +ROUTING_CONTRACT: docs/agents/programs/OTCLIENT_TIBIA_RE_HYBRID_EXECUTION_ROUTING.md +EXECUTION_CLASS: github_hosted +RUNTIME_ACCESS: none +PERSISTENT_SESSION_ROLE: none +PHYSICAL_E2E_REQUIRED: false +runtime_access: none +runtime_owner_task: NOT_APPLICABLE +runtime_namespace: NOT_APPLICABLE +canonical_registration: NOT_APPLICABLE +canonical_lease_generation: NOT_APPLICABLE +registration_lease_generation: NOT_APPLICABLE +gate_a: NOT_APPLICABLE +generation_rebind: NOT_APPLICABLE +gate_b: NOT_APPLICABLE +bootstrap: NOT_APPLICABLE +target_uniqueness: NOT_APPLICABLE +owned_paths: + - .github/workflows/track-a-s1-unfiltered-static-census.yml + - docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md + - docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/** + - docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md +modules_touched: + - official-client-static-re +reuses: + - docs/agents/tasks/archive/OTC-20260814-official-client-capability-experiment-sweep.md + - docs/agents/evidence/OTC-20260817-track-a-worldmap-server-delivery-extent/20260817-complete-message-census.md + - historical exact-client static producer pattern from PR #473 / commit 553e447c0662892b0c1b9cab994c4545d09f22c8 +depends_on: [] +blocks: [] +non_overlap: + - PR #475 runtime branch, task record, workflow surfaces, Synology state, lease, display, login budget and physical session are read-only/non-targeted and will not be touched. + - PR #498/#499 predecessor auth/session branches are not modified. + - Track B PR #284 and OTC2 protocol work are outside scope. +policy_version: 2 +context_pressure: medium +context_growth: stable +context_score: 7 +estimate_confidence: high +decomposition_decision: single +decomposition_reason: one exact-build static S1 census with one bounded producer and one durable evidence package +feature_scope: + type: documentation + user_facing: false + backend_required: false + frontend_required: false + integration_required: false + e2e_required: false +validation_level: focused +invocation_started_at: 2026-08-18T09:29:00+02:00 +last_progress_at: 2026-08-18T09:29:00+02:00 +ci_checks_for_current_head: 0 +ci_check_generation: draft +terminal_ci_wait_started_at: null +terminal_ci_checks_for_current_generation: 0 +unchanged_state_checks: 0 +identical_failure_retries: 0 +repair_cycles_for_current_gate: 0 +context_reconstruction_attempts: 0 +stall_warnings: 0 +--- + +# Objective + +Execute the archived capability-sweep programme's next safe static step without consuming or observing the active physical Track A runtime: + +```text +exact official Linux client 15.32.df7b29 + -> exhaustive unfiltered generated-message census + -> exhaustive inbound-oriented QMeta/handler string census + -> bounded static xref/dispatch candidate extraction where directly provable + -> machine-readable S1 registries and ranked S2 follow-up edges +``` + +This task is deliberately independent of the currently active PR #475 runtime/world-entry/worldmap mutation work. + +# Exact client fence + +```yaml +version: 15.32.df7b29 +size: 51965216 +sha256: e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe +packed_client_lzma_sha256: 496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b +platform: official_native_linux_only +``` + +A mismatched size/hash/build fails closed. + +# Scope + +The bounded S1 producer may: + +- fetch the exact public Linux client on a disposable GitHub-hosted runner using the already-reviewed exact-hash/WARP producer pattern; +- decompress only in runner scratch space; +- inspect ELF sections, printable strings, RTTI/type names, Qt/QMeta metadata/string surfaces and bounded disassembly/xrefs; +- write only sanitized text/JSON registries and summaries; +- delete compressed/unpacked proprietary client bytes before artifact upload. + +It may not: + +- launch the official client; +- access process memory, X11, VNC, Synology, PR #475 runtime state, credentials, account/session values or packet captures; +- upload/commit the raw proprietary executable or secret-bearing material; +- infer live behavior from static names alone. + +# Questions + +1. Revalidate the complete generated protocol denominator (`349 = 160 client -> server + 189 server -> client`) on the exact client. +2. Persist the complete **189-name server -> client** registry, grouped by stable lexical families without dropping unmatched names. +3. Enumerate all exact-binary inbound-oriented handler/QMeta strings without the historical narrow capability regex, including `handle*Message`, `received*Message`, protocol-handler/controller/storage class names and message-related method names. +4. Where bounded static evidence directly supports it, associate a generated server message family with handler/QMeta surfaces and concrete static code/xref candidates. +5. Keep all unsupported message->handler or handler->storage edges explicitly `UNKNOWN`; do not force a single common inbound dispatcher hypothesis. +6. Produce ranked S2 candidates for later dependency-graph proof, prioritizing session/world entry, player state, creatures, inventory/containers, chat/world events and non-worldmap protocol surfaces. + +# Acceptance inventory + +- [ ] exact client compressed and unpacked hashes revalidated on hosted runner; +- [ ] generated-message denominator revalidated and complete 160/189 registries persisted; +- [ ] all 189 inbound names preserved in machine-readable evidence; +- [ ] unfiltered inbound-oriented handler/QMeta census persisted with counts and exact string evidence; +- [ ] bounded static xref/dispatch candidates persisted with evidence strength labels; +- [ ] no absence claim is made from a filtered subset; +- [ ] no live/runtime/worldmap mutation or #475-owned surface is touched; +- [ ] no raw client bytes are committed or uploaded; +- [ ] temporary producer workflow removed before final merge; +- [ ] result report distinguishes FACT / INFERENCE / UNKNOWN / DISPROVEN; +- [ ] E2E = NOT_APPLICABLE with reason: static exact-file discovery only; +- [ ] fresh audit, exact-head required CI and zero unresolved material review findings before completion. + +# Admission + +```yaml +track_id: official-client-re +runtime_access: none +runtime_owner_task: NOT_APPLICABLE +runtime_namespace: NOT_APPLICABLE +canonical_registration: NOT_APPLICABLE +canonical_lease_generation: NOT_APPLICABLE +registration_lease_generation: NOT_APPLICABLE +gate_a: NOT_APPLICABLE +generation_rebind: NOT_APPLICABLE +gate_b: NOT_APPLICABLE +bootstrap: NOT_APPLICABLE +target_uniqueness: NOT_APPLICABLE +mutation_authorized: false +``` + +# Initial evidence boundary + +Already canonical/current-main inputs: + +```text +PROTOCOL_MESSAGE_TOTAL=349 +CLIENT_TO_SERVER_MESSAGE_SYMBOLS=160 +SERVER_TO_CLIENT_MESSAGE_SYMBOLS=189 +``` + +Those counts are accepted historical exact-build evidence from #473, but this task revalidates them as part of a fresh exhaustive S1 run. Static presence never becomes a live capability claim. + +# Checkpoint + +```yaml +checkpoint_version: 1 +status: investigating +phase: investigate +base_main: ed09418b431c28087775b419f85bed404fa85d70 +last_completed_step: claimed a non-overlapping hosted/static S1 census frontier after live ownership and governance preflight +proven: + - PR #475 owns the current physical runtime/worldmap login lane and is outside this task's mutation/observation scope. + - The archived capability experiment task explicitly names exhaustive unfiltered S1 protocol/QMeta/runtime census as the next programme action. + - Current routing sends deterministic static Track A work to GitHub-hosted runners with runtime_access none. +unknown: + - complete unfiltered inbound QMeta/handler denominator on the exact client + - number and strength of direct static message-to-handler associations recoverable in one bounded producer + - whether inbound handling is one dispatcher or several independent handler families +rejected_hypotheses: + - reuse PR #475 physical runtime for this census: rejected because static hosted evidence is sufficient and runtime is separately owned. + - treat the old 98 capability-filtered protocol list as exhaustive: rejected by the accepted 349-name denominator. +blockers: [] +next_action: open the required Draft PR, then add one bounded GitHub-hosted exact-client S1 producer and inspect its first result before any repair. +``` From 86bb32ffc0c06940cd76169a9f7123de1ff3c275 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:39:21 +0200 Subject: [PATCH 02/22] ci(track-a): add bounded S1 unfiltered static census --- .../track-a-s1-unfiltered-static-census.yml | 393 ++++++++++++++++++ 1 file changed, 393 insertions(+) create mode 100644 .github/workflows/track-a-s1-unfiltered-static-census.yml diff --git a/.github/workflows/track-a-s1-unfiltered-static-census.yml b/.github/workflows/track-a-s1-unfiltered-static-census.yml new file mode 100644 index 0000000000..f3ff67af31 --- /dev/null +++ b/.github/workflows/track-a-s1-unfiltered-static-census.yml @@ -0,0 +1,393 @@ +name: Track A S1 unfiltered static census + +on: + pull_request: + branches: [main] + paths: + - .github/workflows/track-a-s1-unfiltered-static-census.yml + - docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md + - docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/** + - docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md + workflow_dispatch: + +permissions: + contents: read + +jobs: + census: + name: Recover exact inbound protocol and handler census + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + persist-credentials: false + + - name: Fetch exact client and emit sanitized S1 evidence + shell: bash + run: | + set -Eeuo pipefail + sudo apt-get update -qq + sudo apt-get install -y --no-install-recommends curl binutils python3-pyelftools python3-capstone + + r="$RUNNER_TEMP/track-a-s1-static" + mkdir -p "$r/bin" "$r/state" "$r/client" "$r/evidence" + cd "$r/bin" + + curl -fsSL -o wgcf https://github.com/ViRb3/wgcf/releases/download/v2.2.32/wgcf_2.2.32_linux_amd64 + echo '2ff97f2201972ce582a424455d50a3719a380eef0cd1f3144f7779348e122a2c wgcf' | sha256sum -c - + curl -fsSL -o wireproxy.tgz https://github.com/windtf/wireproxy/releases/download/v1.1.3/wireproxy_linux_amd64.tar.gz + echo 'e88c1d090740373fc606c1bafd81d9a5eadc642cce5667616e20e9d7a444f51c wireproxy.tgz' | sha256sum -c - + mkdir wireproxy-unpack + tar -xzf wireproxy.tgz -C wireproxy-unpack + cp "$(find wireproxy-unpack -type f -name wireproxy -print -quit)" wireproxy + chmod 755 wgcf wireproxy + + cd "$r/state" + "$r/bin/wgcf" register --accept-tos >/dev/null + "$r/bin/wgcf" generate >/dev/null + printf 'WGConfig = %s\n\n[Socks5]\nBindAddress = 127.0.0.1:25346\n' "$r/state/wgcf-profile.conf" > wireproxy.conf + nohup "$r/bin/wireproxy" -c wireproxy.conf >"$r/wireproxy.log" 2>&1 "$r/trace" 2>/dev/null; then + break + fi + sleep 2 + done + grep -Eq '^warp=(on|plus)$' "$r/trace" + echo 'S1_WARP_PATH=PASS' + + client_url=https://static.tibia.com/launcher/tibiaclient-linux-current/bin/client.lzma + curl --socks5-hostname 127.0.0.1:25346 --compressed -fL \ + -A 'Mozilla/5.0 (X11; Linux x86_64)' -e "$client_url" -H 'Accept: */*' \ + "$client_url" -o "$r/client/client.lzma" + echo '496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b '"$r"'/client/client.lzma' | sha256sum -c - + echo 'S1_EXACT_PACKED_SHA=PASS' + + python3 - "$r/client/client.lzma" "$r/client/client" "$r/evidence" <<'PY' + from __future__ import annotations + + import collections + import hashlib + import json + import lzma + import pathlib + import re + import struct + import subprocess + import sys + + from capstone import Cs, CS_ARCH_X86, CS_MODE_64 + from capstone.x86_const import X86_OP_IMM, X86_OP_MEM, X86_REG_RIP + from elftools.elf.elffile import ELFFile + + packed_path = pathlib.Path(sys.argv[1]) + raw_path = pathlib.Path(sys.argv[2]) + evidence = pathlib.Path(sys.argv[3]) + evidence.mkdir(parents=True, exist_ok=True) + + packed = packed_path.read_bytes() + props = packed[32] + lc = props % 9 + rest = props // 9 + lp = rest % 5 + pb = rest // 5 + dict_size = int.from_bytes(packed[33:37], 'little') + raw = lzma.decompress( + packed[45:], + format=lzma.FORMAT_RAW, + filters=[{'id': lzma.FILTER_LZMA1, 'dict_size': dict_size, 'lc': lc, 'lp': lp, 'pb': pb}], + ) + exact_sha = hashlib.sha256(raw).hexdigest() + assert len(raw) == 51965216, len(raw) + assert exact_sha == 'e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe', exact_sha + raw_path.write_bytes(raw) + print('S1_EXACT_CLIENT_SHA=PASS') + print('S1_CLIENT_EXECUTED=false') + print('S1_RUNTIME_ACCESS=none') + + with raw_path.open('rb') as handle: + elf = ELFFile(handle) + sections = [ + { + 'name': section.name, + 'offset': int(section['sh_offset']), + 'size': int(section['sh_size']), + 'va': int(section['sh_addr']), + 'flags': int(section['sh_flags']), + } + for section in elf.iter_sections() + ] + + def offset_to_va(offset: int) -> int | None: + for section in sections: + if section['offset'] <= offset < section['offset'] + section['size']: + return section['va'] + offset - section['offset'] + return None + + printable_records: list[dict[str, object]] = [] + printable_values: list[str] = [] + for match in re.finditer(rb'[ -~]{4,220}', raw): + value = match.group().decode('ascii', 'ignore') + va = offset_to_va(match.start()) + if va is None: + continue + printable_records.append({'value': value, 'va': va, 'offset': match.start()}) + printable_values.append(value) + + text = '\n'.join(printable_values) + protocol_names = sorted(set(re.findall(r'\b(?:GameclientMessage|GameserverMessage)[A-Za-z0-9_]{2,100}\b', text))) + client_names = [name for name in protocol_names if name.startswith('GameclientMessage')] + server_names = [name for name in protocol_names if name.startswith('GameserverMessage')] + assert len(protocol_names) == 349, len(protocol_names) + assert len(client_names) == 160, len(client_names) + assert len(server_names) == 189, len(server_names) + assert len(set(server_names)) == 189 + + (evidence / 'protocol-all.txt').write_text('\n'.join(protocol_names) + '\n', encoding='utf-8') + (evidence / 'protocol-client-to-server.txt').write_text('\n'.join(client_names) + '\n', encoding='utf-8') + (evidence / 'protocol-server-to-client.txt').write_text('\n'.join(server_names) + '\n', encoding='utf-8') + + FAMILY_RULES = [ + ('session_auth_world', re.compile(r'(Login|Session|World|Pending|Enter|Disconnect|Connection|Challenge|Token|Ping|Pong)', re.I)), + ('world_map', re.compile(r'(Map|Field|Floor|Row|Column|Tile|Coordinate|Effect|Missile)', re.I)), + ('creature_combat', re.compile(r'(Creature|Attack|Follow|Combat|Death|Skull|Party|Outfit|Health|Light|Speed|Unpass|Mark)', re.I)), + ('player_state', re.compile(r'(Player|Skill|Vocation|State|Capacity|Mana|Soul|Cooldown|Experience|Level)', re.I)), + ('inventory_container_item', re.compile(r'(Inventory|Container|Object|Item|Depot|Stash|Loot|Goods|Store|Market)', re.I)), + ('chat_channel_npc', re.compile(r'(Talk|Channel|Npc|Message|Text|Modal)', re.I)), + ('trade_social_party', re.compile(r'(Trade|Friend|Vip|Social|Party|Guild|Team|Shared)', re.I)), + ('cyclopedia_progression', re.compile(r'(Cyclopedia|Bestiary|Bosstiary|Prey|Task|Wheel|Forge|Imbu|Quest|Reward|Proficiency|Bonus)', re.I)), + ] + + families: dict[str, list[str]] = collections.OrderedDict((name, []) for name, _ in FAMILY_RULES) + families['other'] = [] + for full_name in server_names: + stem = full_name.removeprefix('GameserverMessage') + selected = 'other' + for family, regex in FAMILY_RULES: + if regex.search(stem): + selected = family + break + families[selected].append(full_name) + assert sum(len(values) for values in families.values()) == 189 + assert sorted(name for values in families.values() for name in values) == server_names + (evidence / 'protocol-server-families.json').write_text( + json.dumps(families, indent=2, sort_keys=False) + '\n', encoding='utf-8' + ) + + method_regex = re.compile( + r'^(?:handle|received|receive|process|dispatch|parse|decode|on)[A-Z][A-Za-z0-9_]{1,120}(?:Message|Data|Event|Update|Changed|Received)$' + ) + generic_handler_regex = re.compile(r'(?:ProtocolMessageHandler|MessageHandler|ProtocolMessageQueue|GameserverGameSession|MessageQueue)') + storage_controller_regex = re.compile(r'(?:Storage|Controller|DataModel)$') + + inbound_method_strings = sorted(set(value for value in printable_values if method_regex.match(value))) + handler_type_strings = sorted(set(value for value in printable_values if generic_handler_regex.search(value))) + + # Demangle relevant Itanium RTTI strings in one bounded batch. The resulting names are only exact-binary + # type-presence evidence; they do not establish object lifetime or runtime wiring. + mangled = sorted(set(value for value in printable_values if re.fullmatch(r'_?Z?N[0-9A-Za-z_]+E', value))) + if mangled: + proc = subprocess.run( + ['c++filt'], + input='\n'.join(mangled) + '\n', + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + check=True, + ) + demangled_all = [line.strip() for line in proc.stdout.splitlines()] + else: + demangled_all = [] + relevant_types = sorted(set( + value for value in demangled_all + if generic_handler_regex.search(value) + or re.search(r'(?:CreatureStorage|ContainerStorage|PlayerData|Inventory|Chat|Channel|GameSession|Protocol)', value) + )) + + # Exhaustive name-surface association. This is explicitly lexical/static and never promoted to a + # message->handler FACT by itself. + normalized_strings: dict[str, list[str]] = collections.defaultdict(list) + for value in printable_values: + normalized = re.sub(r'[^a-z0-9]+', '', value.lower()) + if normalized: + normalized_strings[normalized].append(value) + + associations: list[dict[str, object]] = [] + unmatched: list[str] = [] + for full_name in server_names: + stem = full_name.removeprefix('GameserverMessage') + stem_norm = re.sub(r'[^a-z0-9]+', '', stem.lower()) + exact_candidates = [ + f'handle{stem}Message', + f'received{stem}Message', + f'receive{stem}Message', + f'process{stem}Message', + f'on{stem}Message', + ] + hits = sorted(set(candidate for candidate in exact_candidates if candidate in printable_values)) + broader = sorted(set( + value for value in inbound_method_strings + if stem_norm and stem_norm in re.sub(r'[^a-z0-9]+', '', value.lower()) + )) + all_hits = sorted(set(hits + broader)) + if not all_hits: + unmatched.append(full_name) + associations.append({ + 'message': full_name, + 'stem': stem, + 'lexical_handler_surfaces': all_hits, + 'evidence_strength': 'STATIC_LEXICAL_ASSOCIATION' if all_hits else 'UNKNOWN', + 'semantic_handler_edge_proven': False, + }) + + (evidence / 'inbound-lexical-associations.json').write_text( + json.dumps(associations, indent=2, sort_keys=True) + '\n', encoding='utf-8' + ) + (evidence / 'inbound-method-strings.txt').write_text( + '\n'.join(inbound_method_strings) + ('\n' if inbound_method_strings else ''), encoding='utf-8' + ) + (evidence / 'inbound-handler-type-strings.txt').write_text( + '\n'.join(handler_type_strings) + ('\n' if handler_type_strings else ''), encoding='utf-8' + ) + (evidence / 'relevant-demangled-types.txt').write_text( + '\n'.join(relevant_types) + ('\n' if relevant_types else ''), encoding='utf-8' + ) + + # Direct code-to-string xrefs are a bounded structural candidate signal only. We scan executable + # sections and retain xrefs only to exact starts of protocol/handler strings. This does not claim + # that the referring function is the semantic dispatcher. + interesting_values = set(server_names) | set(inbound_method_strings) | set(handler_type_strings) + interesting_va_to_value: dict[int, str] = {} + for record in printable_records: + value = str(record['value']) + if value in interesting_values: + interesting_va_to_value[int(record['va'])] = value + + md = Cs(CS_ARCH_X86, CS_MODE_64) + md.detail = True + xrefs: dict[str, list[dict[str, object]]] = collections.defaultdict(list) + xref_limit_per_string = 8 + for section in sections: + if not (section['flags'] & 0x4) or section['size'] == 0: + continue + start = section['offset'] + end = start + section['size'] + code = raw[start:end] + for ins in md.disasm(code, section['va']): + targets: set[int] = set() + for operand in ins.operands: + if operand.type == X86_OP_MEM and operand.mem.base == X86_REG_RIP: + targets.add(ins.address + ins.size + operand.mem.disp) + elif operand.type == X86_OP_IMM: + targets.add(int(operand.imm)) + for target in targets: + value = interesting_va_to_value.get(target) + if value is None or len(xrefs[value]) >= xref_limit_per_string: + continue + xrefs[value].append({ + 'instruction_va': f'0x{ins.address:x}', + 'mnemonic': ins.mnemonic, + 'op_str': ins.op_str, + 'target_string_va': f'0x{target:x}', + 'evidence_strength': 'DIRECT_CODE_TO_STRING_XREF', + 'semantic_dispatcher_edge_proven': False, + }) + + xref_payload = [ + {'string': value, 'xrefs': refs} + for value, refs in sorted(xrefs.items()) + ] + (evidence / 'direct-code-string-xrefs.json').write_text( + json.dumps(xref_payload, indent=2, sort_keys=True) + '\n', encoding='utf-8' + ) + + # Reuse the repository's relocation-aware primary-vptr resolver for known exact-build static anchors. + profile = pathlib.Path('tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json') + resolver = pathlib.Path('tools/tibia_runtime_bridge/resolver.py') + resolver_proc = subprocess.run( + [sys.executable, str(resolver), '--profile', str(profile), str(raw_path)], + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + check=False, + ) + (evidence / 'known-anchor-vptr-resolution.json').write_text(resolver_proc.stdout, encoding='utf-8') + (evidence / 'known-anchor-vptr-resolution.stderr.txt').write_text(resolver_proc.stderr, encoding='utf-8') + assert resolver_proc.returncode == 0, resolver_proc.stderr + resolved = json.loads(resolver_proc.stdout) + assert all(item['unique'] for item in resolved['targets'].values()) + + priority_terms = re.compile(r'(WorldEntered|Pending|PlayerData|PlayerState|Creature|Inventory|Container|Talk|Channel|Modal|Death|Disconnect|Session)', re.I) + s2_priority = [] + assoc_by_message = {entry['message']: entry for entry in associations} + for message in server_names: + if not priority_terms.search(message): + continue + entry = assoc_by_message[message] + s2_priority.append({ + 'message': message, + 'lexical_handler_surfaces': entry['lexical_handler_surfaces'], + 'next_proof': 'resolve concrete QMeta/handler dispatch and downstream owner/storage edge from exact static code', + 'runtime_required': False, + 'worldmap_runtime_overlap': bool(re.search(r'(FullMap|FieldData|Column|Row|Floor|CreateOnMap|ChangeOnMap|DeleteOnMap)', message)), + }) + (evidence / 's2-priority-candidates.json').write_text( + json.dumps(s2_priority, indent=2, sort_keys=True) + '\n', encoding='utf-8' + ) + + summary = { + 'schema': 'track-a-s1-unfiltered-static-census-v1', + 'client': { + 'version': '15.32.df7b29', + 'size': len(raw), + 'sha256': exact_sha, + }, + 'runtime_access': 'none', + 'client_executed': False, + 'protocol_message_total': len(protocol_names), + 'client_to_server_total': len(client_names), + 'server_to_client_total': len(server_names), + 'all_inbound_names_preserved': len(server_names) == 189, + 'server_family_counts': {name: len(values) for name, values in families.items()}, + 'inbound_method_string_total': len(inbound_method_strings), + 'handler_type_string_total': len(handler_type_strings), + 'relevant_demangled_type_total': len(relevant_types), + 'messages_with_lexical_handler_surface': sum(bool(entry['lexical_handler_surfaces']) for entry in associations), + 'messages_without_lexical_handler_surface': len(unmatched), + 'direct_code_string_xref_string_total': len(xrefs), + 'direct_code_string_xref_total': sum(len(refs) for refs in xrefs.values()), + 'known_anchor_resolver_pass': True, + 'semantic_common_inbound_dispatcher': 'UNKNOWN', + 'raw_client_uploaded': False, + 'secret_access': False, + 'worldmap_runtime_access': False, + 'pr475_runtime_touched': False, + } + (evidence / 'summary.json').write_text(json.dumps(summary, indent=2, sort_keys=True) + '\n', encoding='utf-8') + (evidence / 'messages-without-lexical-handler-surface.txt').write_text( + '\n'.join(unmatched) + ('\n' if unmatched else ''), encoding='utf-8' + ) + + print('S1_CENSUS_SUMMARY=' + json.dumps(summary, sort_keys=True)) + print('S1_PROTOCOL_DENOMINATOR=PASS') + print('S1_ALL_189_INBOUND_NAMES_PRESERVED=PASS') + print('S1_KNOWN_ANCHOR_RESOLVER=PASS') + print('S1_COMMON_INBOUND_DISPATCHER=UNKNOWN') + print('S1_PR475_RUNTIME_TOUCHED=false') + print('S1_SECRET_ACCESS=false') + PY + + # Proprietary client bytes are never part of uploaded evidence. + rm -f "$r/client/client" "$r/client/client.lzma" + test ! -e "$r/client/client" + test ! -e "$r/client/client.lzma" + echo 'S1_RAW_CLIENT_REMOVED_BEFORE_UPLOAD=PASS' + + - name: Upload sanitized text and JSON evidence only + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + with: + name: track-a-s1-static-${{ github.run_id }} + path: ${{ runner.temp }}/track-a-s1-static/evidence + if-no-files-found: error + retention-days: 7 From d4666383ae4bae6524d2b47a70ed0a9e0efc4c51 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:42:34 +0200 Subject: [PATCH 03/22] fix(track-a): resolve S1 checkout paths exactly --- .../track-a-s1-unfiltered-static-census.yml | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/.github/workflows/track-a-s1-unfiltered-static-census.yml b/.github/workflows/track-a-s1-unfiltered-static-census.yml index f3ff67af31..b66c3cc3b1 100644 --- a/.github/workflows/track-a-s1-unfiltered-static-census.yml +++ b/.github/workflows/track-a-s1-unfiltered-static-census.yml @@ -71,9 +71,9 @@ jobs: import hashlib import json import lzma + import os import pathlib import re - import struct import subprocess import sys @@ -84,6 +84,7 @@ jobs: packed_path = pathlib.Path(sys.argv[1]) raw_path = pathlib.Path(sys.argv[2]) evidence = pathlib.Path(sys.argv[3]) + workspace = pathlib.Path(os.environ['GITHUB_WORKSPACE']) evidence.mkdir(parents=True, exist_ok=True) packed = packed_path.read_bytes() @@ -148,7 +149,7 @@ jobs: (evidence / 'protocol-client-to-server.txt').write_text('\n'.join(client_names) + '\n', encoding='utf-8') (evidence / 'protocol-server-to-client.txt').write_text('\n'.join(server_names) + '\n', encoding='utf-8') - FAMILY_RULES = [ + family_rules = [ ('session_auth_world', re.compile(r'(Login|Session|World|Pending|Enter|Disconnect|Connection|Challenge|Token|Ping|Pong)', re.I)), ('world_map', re.compile(r'(Map|Field|Floor|Row|Column|Tile|Coordinate|Effect|Missile)', re.I)), ('creature_combat', re.compile(r'(Creature|Attack|Follow|Combat|Death|Skull|Party|Outfit|Health|Light|Speed|Unpass|Mark)', re.I)), @@ -159,12 +160,12 @@ jobs: ('cyclopedia_progression', re.compile(r'(Cyclopedia|Bestiary|Bosstiary|Prey|Task|Wheel|Forge|Imbu|Quest|Reward|Proficiency|Bonus)', re.I)), ] - families: dict[str, list[str]] = collections.OrderedDict((name, []) for name, _ in FAMILY_RULES) + families: dict[str, list[str]] = collections.OrderedDict((name, []) for name, _ in family_rules) families['other'] = [] for full_name in server_names: stem = full_name.removeprefix('GameserverMessage') selected = 'other' - for family, regex in FAMILY_RULES: + for family, regex in family_rules: if regex.search(stem): selected = family break @@ -179,17 +180,16 @@ jobs: r'^(?:handle|received|receive|process|dispatch|parse|decode|on)[A-Z][A-Za-z0-9_]{1,120}(?:Message|Data|Event|Update|Changed|Received)$' ) generic_handler_regex = re.compile(r'(?:ProtocolMessageHandler|MessageHandler|ProtocolMessageQueue|GameserverGameSession|MessageQueue)') - storage_controller_regex = re.compile(r'(?:Storage|Controller|DataModel)$') inbound_method_strings = sorted(set(value for value in printable_values if method_regex.match(value))) handler_type_strings = sorted(set(value for value in printable_values if generic_handler_regex.search(value))) - # Demangle relevant Itanium RTTI strings in one bounded batch. The resulting names are only exact-binary - # type-presence evidence; they do not establish object lifetime or runtime wiring. - mangled = sorted(set(value for value in printable_values if re.fullmatch(r'_?Z?N[0-9A-Za-z_]+E', value))) + # Demangle relevant Itanium RTTI strings in one bounded batch. c++filt -t accepts type encodings + # such as N5tibia...E that appear in RTTI. Type presence is still only static evidence. + mangled = sorted(set(value for value in printable_values if re.fullmatch(r'N[0-9A-Za-z_]+E', value))) if mangled: proc = subprocess.run( - ['c++filt'], + ['c++filt', '-t'], input='\n'.join(mangled) + '\n', text=True, stdout=subprocess.PIPE, @@ -207,12 +207,6 @@ jobs: # Exhaustive name-surface association. This is explicitly lexical/static and never promoted to a # message->handler FACT by itself. - normalized_strings: dict[str, list[str]] = collections.defaultdict(list) - for value in printable_values: - normalized = re.sub(r'[^a-z0-9]+', '', value.lower()) - if normalized: - normalized_strings[normalized].append(value) - associations: list[dict[str, object]] = [] unmatched: list[str] = [] for full_name in server_names: @@ -266,6 +260,7 @@ jobs: md = Cs(CS_ARCH_X86, CS_MODE_64) md.detail = True + md.skipdata = True xrefs: dict[str, list[dict[str, object]]] = collections.defaultdict(list) xref_limit_per_string = 8 for section in sections: @@ -302,9 +297,12 @@ jobs: json.dumps(xref_payload, indent=2, sort_keys=True) + '\n', encoding='utf-8' ) - # Reuse the repository's relocation-aware primary-vptr resolver for known exact-build static anchors. - profile = pathlib.Path('tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json') - resolver = pathlib.Path('tools/tibia_runtime_bridge/resolver.py') + # Reuse current-main relocation-aware resolver through an absolute checkout path, because this + # producer deliberately executes from runner scratch rather than from the repository directory. + profile = workspace / 'tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json' + resolver = workspace / 'tools/tibia_runtime_bridge/resolver.py' + assert profile.is_file(), profile + assert resolver.is_file(), resolver resolver_proc = subprocess.run( [sys.executable, str(resolver), '--profile', str(profile), str(raw_path)], text=True, From cb575cec2077c8002bb6712ffac4d4dc77420499 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:43:36 +0200 Subject: [PATCH 04/22] docs(track-a): checkpoint S1 producer repair --- ...818-track-a-s1-unfiltered-static-census.md | 78 ++++++++++++++----- 1 file changed, 59 insertions(+), 19 deletions(-) diff --git a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md index cddced80c5..63fd5c498a 100644 --- a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md +++ b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md @@ -14,9 +14,9 @@ execution_reason: exhaustive deterministic exact-client protocol/QMeta census wi branch: research/OTC-20260818-track-a-s1-unfiltered-static-census base_branch: main base_main: ed09418b431c28087775b419f85bed404fa85d70 -related_pr: pending +related_pr: 509 created: 2026-08-18T09:29:00+02:00 -updated: 2026-08-18T09:29:00+02:00 +updated: 2026-08-18T09:43:00+02:00 risk: medium implementation_authorized: true credentials_allowed: false @@ -49,7 +49,10 @@ modules_touched: reuses: - docs/agents/tasks/archive/OTC-20260814-official-client-capability-experiment-sweep.md - docs/agents/evidence/OTC-20260817-track-a-worldmap-server-delivery-extent/20260817-complete-message-census.md + - tools/tibia_runtime_bridge/resolver.py + - tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json - historical exact-client static producer pattern from PR #473 / commit 553e447c0662892b0c1b9cab994c4545d09f22c8 + - historical exact QMeta parser pattern from PR #505 / commit d0c1360b649fd8c4a92587b7713644c49162694c depends_on: [] blocks: [] non_overlap: @@ -72,14 +75,14 @@ feature_scope: e2e_required: false validation_level: focused invocation_started_at: 2026-08-18T09:29:00+02:00 -last_progress_at: 2026-08-18T09:29:00+02:00 +last_progress_at: 2026-08-18T09:43:00+02:00 ci_checks_for_current_head: 0 ci_check_generation: draft terminal_ci_wait_started_at: null terminal_ci_checks_for_current_generation: 0 unchanged_state_checks: 0 identical_failure_retries: 0 -repair_cycles_for_current_gate: 0 +repair_cycles_for_current_gate: 1 context_reconstruction_attempts: 0 stall_warnings: 0 --- @@ -116,7 +119,8 @@ The bounded S1 producer may: - fetch the exact public Linux client on a disposable GitHub-hosted runner using the already-reviewed exact-hash/WARP producer pattern; - decompress only in runner scratch space; -- inspect ELF sections, printable strings, RTTI/type names, Qt/QMeta metadata/string surfaces and bounded disassembly/xrefs; +- inspect ELF sections, printable strings, RTTI/type names, QMeta-oriented string surfaces and bounded disassembly/xrefs; +- reuse the current-main relocation-aware exact-build resolver for known static anchors; - write only sanitized text/JSON registries and summaries; - delete compressed/unpacked proprietary client bytes before artifact upload. @@ -131,8 +135,8 @@ It may not: 1. Revalidate the complete generated protocol denominator (`349 = 160 client -> server + 189 server -> client`) on the exact client. 2. Persist the complete **189-name server -> client** registry, grouped by stable lexical families without dropping unmatched names. -3. Enumerate all exact-binary inbound-oriented handler/QMeta strings without the historical narrow capability regex, including `handle*Message`, `received*Message`, protocol-handler/controller/storage class names and message-related method names. -4. Where bounded static evidence directly supports it, associate a generated server message family with handler/QMeta surfaces and concrete static code/xref candidates. +3. Enumerate exact-binary inbound-oriented handler/QMeta strings without the historical narrow capability regex, including `handle*Message`, `received*Message`, protocol-handler/message-queue types and relevant RTTI types. +4. Where bounded static evidence directly supports it, associate a generated server message family with lexical/QMeta surfaces and concrete code-to-string xref candidates. 5. Keep all unsupported message->handler or handler->storage edges explicitly `UNKNOWN`; do not force a single common inbound dispatcher hypothesis. 6. Produce ranked S2 candidates for later dependency-graph proof, prioritizing session/world entry, player state, creatures, inventory/containers, chat/world events and non-worldmap protocol surfaces. @@ -142,7 +146,8 @@ It may not: - [ ] generated-message denominator revalidated and complete 160/189 registries persisted; - [ ] all 189 inbound names preserved in machine-readable evidence; - [ ] unfiltered inbound-oriented handler/QMeta census persisted with counts and exact string evidence; -- [ ] bounded static xref/dispatch candidates persisted with evidence strength labels; +- [ ] bounded static code-to-string xref candidates persisted with evidence strength labels; +- [ ] known current-main exact-build vptr anchors revalidated using the repository resolver; - [ ] no absence claim is made from a filtered subset; - [ ] no live/runtime/worldmap mutation or #475-owned surface is touched; - [ ] no raw client bytes are committed or uploaded; @@ -169,37 +174,72 @@ target_uniqueness: NOT_APPLICABLE mutation_authorized: false ``` -# Initial evidence boundary +# Existing independent denominator control -Already canonical/current-main inputs: +The sanitized exact-build artifact from #473 remains available and was independently re-opened during this task: + +```yaml +run: 32022209943 +artifact: 9285763750 +artifact_digest: sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 +artifact_expired: false +observed_files: + - protocol-all.txt + - protocol-client-to-server.txt + - protocol-server-to-client.txt + - summary.json +control_counts: + protocol_total: 349 + client_to_server: 160 + server_to_client: 189 +``` + +That artifact is a comparison control, not a substitute for the fresh S1 producer. + +# Repair history + +## Repair 1 — checkout/scratch path fence + +The first producer implementation changed the shell working directory to runner scratch before invoking the repository resolver through a relative `tools/...` path. Self-review identified that this would make known-anchor validation depend on the wrong current directory. + +Repair: ```text -PROTOCOL_MESSAGE_TOTAL=349 -CLIENT_TO_SERVER_MESSAGE_SYMBOLS=160 -SERVER_TO_CLIENT_MESSAGE_SYMBOLS=189 +profile/resolver relative path + -> explicit $GITHUB_WORKSPACE absolute paths + -> assert both files exist before invoking resolver ``` -Those counts are accepted historical exact-build evidence from #473, but this task revalidates them as part of a fresh exhaustive S1 run. Static presence never becomes a live capability claim. +The same repair also uses `c++filt -t` for RTTI type encodings and enables Capstone skipdata for the bounded executable-section xref scan. No runtime or evidence claim was promoted from the pre-repair run. # Checkpoint ```yaml -checkpoint_version: 1 +checkpoint_version: 2 status: investigating phase: investigate base_main: ed09418b431c28087775b419f85bed404fa85d70 -last_completed_step: claimed a non-overlapping hosted/static S1 census frontier after live ownership and governance preflight +pr: 509 +producer_workflow: .github/workflows/track-a-s1-unfiltered-static-census.yml +pre_repair_head: 86bb32ffc0c06940cd76169a9f7123de1ff3c275 +repaired_producer_head: d4666383ae4bae6524d2b47a70ed0a9e0efc4c51 +first_producer_run: 32112477071 +last_completed_step: implemented the bounded hosted producer, independently re-opened the #473 sanitized denominator artifact, and repaired a checkout/scratch resolver-path defect before accepting any result proven: - PR #475 owns the current physical runtime/worldmap login lane and is outside this task's mutation/observation scope. - The archived capability experiment task explicitly names exhaustive unfiltered S1 protocol/QMeta/runtime census as the next programme action. - Current routing sends deterministic static Track A work to GitHub-hosted runners with runtime_access none. + - The independent #473 sanitized artifact still contains 349 generated names split 160 client-to-server / 189 server-to-client. + - The current-main resolver/profile provide exact-build static anchors including TPlayerProtocolMessageHandler, TPlayerData, TCreatureStorage and TContainerStorage. unknown: - - complete unfiltered inbound QMeta/handler denominator on the exact client - - number and strength of direct static message-to-handler associations recoverable in one bounded producer + - fresh repaired-producer result and artifact identity + - complete unfiltered inbound handler/method denominator on the exact client + - number and strength of direct code-to-string xrefs recoverable in one bounded producer - whether inbound handling is one dispatcher or several independent handler families rejected_hypotheses: - reuse PR #475 physical runtime for this census: rejected because static hosted evidence is sufficient and runtime is separately owned. - treat the old 98 capability-filtered protocol list as exhaustive: rejected by the accepted 349-name denominator. + - invoke the repository resolver relative to scratch cwd: rejected by self-review; checkout location is now explicit. blockers: [] -next_action: open the required Draft PR, then add one bounded GitHub-hosted exact-client S1 producer and inspect its first result before any repair. +next_action: inspect the next exact-head S1 workflow result/artifact; if it is green, persist sanitized evidence and remove the temporary producer, otherwise repair only the first concrete failure within the bounded repair budget. ``` From 5c8d99627cd75e8d445d2e257cb27ac4e5a8a1ff Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:50:03 +0200 Subject: [PATCH 05/22] docs(track-a): persist exhaustive inbound protocol registry --- .../protocol-server-to-client.txt | 189 ++++++++++++++++++ 1 file changed, 189 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt new file mode 100644 index 0000000000..85eac79a83 --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt @@ -0,0 +1,189 @@ +GameserverMessageAmbientLight +GameserverMessageBestiaryTracker +GameserverMessageBlessings +GameserverMessageBlessingsDialog +GameserverMessageBossDifficultySelection +GameserverMessageBossSlots +GameserverMessageBossTracking +GameserverMessageBosstiary +GameserverMessageBosstiaryHighlight +GameserverMessageBosstiaryStaticData +GameserverMessageBottomFloor +GameserverMessageBottomRow +GameserverMessageBuddyData +GameserverMessageBuddyGroupData +GameserverMessageBuddyStatusChange +GameserverMessageBugReportsAllowed +GameserverMessageChangeInContainer +GameserverMessageChangeOnMap +GameserverMessageChannelEvent +GameserverMessageChannels +GameserverMessageCharacterTradeConfiguration +GameserverMessageClientCheck +GameserverMessageCloseChannel +GameserverMessageCloseContainer +GameserverMessageCloseDepotSearch +GameserverMessageCloseExaltationDialog +GameserverMessageCloseImbuingDialog +GameserverMessageCloseNPCTrade +GameserverMessageCloseRewardWall +GameserverMessageCloseTrade +GameserverMessageConfigureCreaturePodium +GameserverMessageContainer +GameserverMessageCounterOffer +GameserverMessageCreateInContainer +GameserverMessageCreateOnMap +GameserverMessageCreatureData +GameserverMessageCreatureHealth +GameserverMessageCreatureLight +GameserverMessageCreatureMarks +GameserverMessageCreatureOutfit +GameserverMessageCreatureParty +GameserverMessageCreatureSkull +GameserverMessageCreatureSpeed +GameserverMessageCreatureType +GameserverMessageCreatureUnpass +GameserverMessageCreatureUpdate +GameserverMessageCreditBalance +GameserverMessageCyclopediaCharacterInfo +GameserverMessageCyclopediaCurrentHouseData +GameserverMessageCyclopediaHouseActionResult +GameserverMessageCyclopediaMapData +GameserverMessageCyclopediaStaticHouseData +GameserverMessageDailyRewardBasic +GameserverMessageDailyRewardCollectionState +GameserverMessageDailyRewardHistory +GameserverMessageDead +GameserverMessageDeleteInContainer +GameserverMessageDeleteInventory +GameserverMessageDeleteOnMap +GameserverMessageDepotSearchDetailList +GameserverMessageDepotSearchResult +GameserverMessageEditGuildMessage +GameserverMessageEditList +GameserverMessageEditText +GameserverMessageExaltationBaseData +GameserverMessageExaltationDialogRefresh +GameserverMessageExaltationHistory +GameserverMessageExaltationResult +GameserverMessageExivaSuppressed +GameserverMessageFieldData +GameserverMessageFriendSystemData +GameserverMessageFullMap +GameserverMessageGameEvent +GameserverMessageGemAtelierGemRevealed +GameserverMessageGraphicalEffects +GameserverMessageHighscores +GameserverMessageHirelingNameChange +GameserverMessageImbuementDurations +GameserverMessageImbuingDialogRefresh +GameserverMessageImpactTracking +GameserverMessageInspectionList +GameserverMessageInspectionState +GameserverMessageItemLooted +GameserverMessageItemWasted +GameserverMessageKillTracking +GameserverMessageLeftColumn +GameserverMessageLoginAdvice +GameserverMessageLoginChallenge +GameserverMessageLoginError +GameserverMessageLoginSuccess +GameserverMessageLoginWait +GameserverMessageMarketBrowse +GameserverMessageMarketDetail +GameserverMessageMarketEnter +GameserverMessageMarketLeave +GameserverMessageMarketStatistics +GameserverMessageMessage +GameserverMessageMonsterCyclopedia +GameserverMessageMonsterCyclopediaBonusEffects +GameserverMessageMonsterCyclopediaMonsters +GameserverMessageMonsterCyclopediaNewDetails +GameserverMessageMonsterCyclopediaRace +GameserverMessageMoveCreature +GameserverMessageMultiUseDelay +GameserverMessageNPCOffer +GameserverMessageNpcTalkParters +GameserverMessageObjectInfo +GameserverMessageOfferDescription +GameserverMessageOpenChannel +GameserverMessageOpenOwnChannel +GameserverMessageOpenRewardWall +GameserverMessageOutfit +GameserverMessageOutfitMemorial +GameserverMessageOwnOffer +GameserverMessagePartyHuntAnalyser +GameserverMessagePassiveAbilityData +GameserverMessagePendingStateEntered +GameserverMessagePing +GameserverMessagePingBack +GameserverMessagePlayerDataBasic +GameserverMessagePlayerDataCurrent +GameserverMessagePlayerGoods +GameserverMessagePlayerInventory +GameserverMessagePlayerSkills +GameserverMessagePlayerState +GameserverMessagePremiumTrigger +GameserverMessagePreyData +GameserverMessagePreyPrices +GameserverMessagePreyTimeLeft +GameserverMessagePrivateChannel +GameserverMessagePvpSituations +GameserverMessageQuestLine +GameserverMessageQuestLog +GameserverMessageReadyForSecondaryConnection +GameserverMessageRemoveGraphicalEffect +GameserverMessageRequestPurchaseData +GameserverMessageResourceBalance +GameserverMessageRestingAreaState +GameserverMessageRightColumn +GameserverMessageSessionDumpStart +GameserverMessageSessionEndInformation +GameserverMessageSetInventory +GameserverMessageSetStoreButtonDeeplink +GameserverMessageSetTactics +GameserverMessageShapedPerkReshapeOffers +GameserverMessageShowGameNews +GameserverMessageShowMessageDialog +GameserverMessageShowModalDialog +GameserverMessageShowMultiOfflineTrainingDialog +GameserverMessageSkillWheel +GameserverMessageSnapBack +GameserverMessageSoulSealsDialog +GameserverMessageSoundTrigger +GameserverMessageSpecialContainersAvailable +GameserverMessageSpellDataModification +GameserverMessageSpellDelay +GameserverMessageSpellGroupDelay +GameserverMessageStash +GameserverMessageStop +GameserverMessageStoreButtonIndicators +GameserverMessageStoreCategories +GameserverMessageStoreError +GameserverMessageStoreOffers +GameserverMessageStoreSuccess +GameserverMessageSwitchPreset +GameserverMessageTalk +GameserverMessageTaskboard +GameserverMessageTeamFinderTeamLeader +GameserverMessageTeamFinderTeamMember +GameserverMessageTextForReport +GameserverMessageTibiaTime +GameserverMessageTopFloor +GameserverMessageTopRow +GameserverMessageTrackQuestFlags +GameserverMessageTransactionDetails +GameserverMessageTransactionHistory +GameserverMessageTutorialHint +GameserverMessageUnjustifiedPoints +GameserverMessageUnlockedSpells +GameserverMessageUpdateExivaOptions +GameserverMessageUpdateManagedContainers +GameserverMessageUpdateTarget +GameserverMessageUpdatingShopBalance +GameserverMessageVocationSpecificPlayerData +GameserverMessageWait +GameserverMessageWeaponProficiency +GameserverMessageWeaponProficiencyNotification +GameserverMessageWorldEntered +GameserverMessageXpChanged From 65fcf9862d558cde67549ab7f4c32999063e5c1e Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:50:18 +0200 Subject: [PATCH 06/22] docs(track-a): persist exhaustive outbound protocol registry --- .../protocol-client-to-server.txt | 160 ++++++++++++++++++ 1 file changed, 160 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt new file mode 100644 index 0000000000..077c4bf2d5 --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt @@ -0,0 +1,160 @@ +GameclientMessageAcceptTrade +GameclientMessageAddBuddy +GameclientMessageAnswerModalDialog +GameclientMessageApplyClearingCharm +GameclientMessageApplyImbuement +GameclientMessageApplySkillWheel +GameclientMessageAttack +GameclientMessageBlessingsDialog +GameclientMessageBossDifficultySelection +GameclientMessageBrowseField +GameclientMessageBuddyGroup +GameclientMessageBugReport +GameclientMessageBuyObject +GameclientMessageBuyStoreOffer +GameclientMessageCancel +GameclientMessageCharacterTradeConfigurationAction +GameclientMessageClientCheck +GameclientMessageClientDetails +GameclientMessageCloseContainer +GameclientMessageCloseDepotSearch +GameclientMessageCloseImbuingDialog +GameclientMessageCloseNPCChannel +GameclientMessageCloseNPCTrade +GameclientMessageCollectDailyReward +GameclientMessageConfigureShowOffSocket +GameclientMessageConnectionPingBack +GameclientMessageContainerAction +GameclientMessageCyclopediaHouseAction +GameclientMessageCyclopediaMapAction +GameclientMessageDailyRewardHistory +GameclientMessageDepotSearchRetrieve +GameclientMessageDepotSearchType +GameclientMessageDisbandParty +GameclientMessageEditBossSlot +GameclientMessageEditBuddy +GameclientMessageEditGuildMessage +GameclientMessageEditList +GameclientMessageEditText +GameclientMessageEnterWorld +GameclientMessageEquipObject +GameclientMessageExaltationAction +GameclientMessageExcludeFromChannel +GameclientMessageFollow +GameclientMessageFriendSystemAction +GameclientMessageGatherAll +GameclientMessageGemAtelier +GameclientMessageGetChannels +GameclientMessageGetObjectInfo +GameclientMessageGetOfferDescription +GameclientMessageGetOutfit +GameclientMessageGetQuestLine +GameclientMessageGetQuestLog +GameclientMessageGetTextForReport +GameclientMessageGetTransactionDetails +GameclientMessageGetTransactionHistory +GameclientMessageGoEast +GameclientMessageGoNorth +GameclientMessageGoNorthEast +GameclientMessageGoNorthWest +GameclientMessageGoPath +GameclientMessageGoSouth +GameclientMessageGoSouthEast +GameclientMessageGoSouthWest +GameclientMessageGoWest +GameclientMessageGreet +GameclientMessageGuildMessage +GameclientMessageHighscores +GameclientMessageInspectObject +GameclientMessageInspectPlayer +GameclientMessageInviteToChannel +GameclientMessageInviteToParty +GameclientMessageJoinAggression +GameclientMessageJoinChannel +GameclientMessageJoinParty +GameclientMessageLeaveChannel +GameclientMessageLeaveParty +GameclientMessageLogin +GameclientMessageLook +GameclientMessageLookAtCreature +GameclientMessageLookNPCTrade +GameclientMessageLookTrade +GameclientMessageManagedContainer +GameclientMessageMarketAccept +GameclientMessageMarketBrowse +GameclientMessageMarketCancel +GameclientMessageMarketCreate +GameclientMessageMarketLeave +GameclientMessageMarketStatistics +GameclientMessageMonsterBonusEffectAction +GameclientMessageMount +GameclientMessageMoveObject +GameclientMessageOpenBossSlots +GameclientMessageOpenBosstiary +GameclientMessageOpenChannel +GameclientMessageOpenCyclopediaCharacterInfo +GameclientMessageOpenDepotSearch +GameclientMessageOpenExaltationHistory +GameclientMessageOpenMonsterCyclopedia +GameclientMessageOpenMonsterCyclopediaMonsters +GameclientMessageOpenMonsterCyclopediaRace +GameclientMessageOpenParentContainer +GameclientMessageOpenRewardWall +GameclientMessageOpenTransactionHistory +GameclientMessagePartyHuntAnalyser +GameclientMessagePassLeadership +GameclientMessagePickObjectToImbue +GameclientMessagePing +GameclientMessagePingBack +GameclientMessagePreyAction +GameclientMessagePrivateChannel +GameclientMessageQuickLoot +GameclientMessageQuickLootBlackWhitelist +GameclientMessageQuitGame +GameclientMessageRejectTrade +GameclientMessageRemoveBuddy +GameclientMessageRequestResourceBalance +GameclientMessageRequestSkillWheel +GameclientMessageRequestStoreCategories +GameclientMessageRequestStoreOffers +GameclientMessageRevokeInvitation +GameclientMessageRotateEast +GameclientMessageRotateNorth +GameclientMessageRotateSouth +GameclientMessageRotateWest +GameclientMessageRuleViolationReport +GameclientMessageSecondaryLogin +GameclientMessageSeekInContainer +GameclientMessageSellObject +GameclientMessageSetClientOptions +GameclientMessageSetCreaturePodiumConfiguration +GameclientMessageSetHirelingName +GameclientMessageSetOutfit +GameclientMessageSetTactics +GameclientMessageSetVocation +GameclientMessageShareExperience +GameclientMessageSoulSealsFightMonster +GameclientMessageSpellTargetConfig +GameclientMessageStartOfflineTraining +GameclientMessageStashAction +GameclientMessageStop +GameclientMessageStoreEvent +GameclientMessageTalk +GameclientMessageTaskboard +GameclientMessageTeamFinderAssembleTeam +GameclientMessageTeamFinderJoinTeam +GameclientMessageTeleport +GameclientMessageToggleWrapState +GameclientMessageTrackBestiaryRace +GameclientMessageTrackImbuements +GameclientMessageTrackQuestFlags +GameclientMessageTradeObject +GameclientMessageTransferCurrency +GameclientMessageTurnObject +GameclientMessageType +GameclientMessageUpContainer +GameclientMessageUpdateExivaOptions +GameclientMessageUseObject +GameclientMessageUseOnCreature +GameclientMessageUseTwoObjects +GameclientMessageWeaponProficiencyCommand From 78fa5a28365b01d069dc70cf47f029baea7f39f4 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:50:53 +0200 Subject: [PATCH 07/22] docs(track-a): persist unfiltered inbound method census --- .../inbound-method-strings.txt | 542 ++++++++++++++++++ 1 file changed, 542 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt new file mode 100644 index 0000000000..2444cb1bb0 --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt @@ -0,0 +1,542 @@ +handleAmbientLightMessage +handleAnyMessage +handleAssetData +handleBestiaryTrackerMessage +handleBlessingsDialogMessage +handleBossDifficultySelectionMessage +handleBossSlotsMessage +handleBossTrackingMessage +handleBosstiaryHighlightMessage +handleBosstiaryMessage +handleBosstiaryStaticDataMessage +handleBottomFloorMessage +handleBottomRowMessage +handleBuddyData +handleBuddyGroupData +handleBugReportsAllowedMessage +handleChangeInContainerMessage +handleChangeOnMapMessage +handleChannelEventMessage +handleChannelsMessage +handleCharacterTradeConfigurationMessage +handleClientCheckMessage +handleCloseChannelMessage +handleCloseContainerMessage +handleCloseDepotSearchMessage +handleCloseExaltationDialogMessage +handleCloseImbuingDialogMessage +handleCloseNPCTradeMessage +handleCloseRewardWallMessage +handleCloseTradeMessage +handleContainerMessage +handleCounterOfferMessage +handleCreateInContainerMessage +handleCreateOnMapMessage +handleCreditBalanceMessage +handleCyclopediaCharacterInfoMessage +handleCyclopediaCurrentHouseDataMessage +handleCyclopediaHouseActionResulMessage +handleCyclopediaMapDataMessage +handleCyclopediaMapMessage +handleCyclopediaStaticHouseDataMessage +handleDailyRewardBasicMessage +handleDailyRewardCollectionStateMessage +handleDailyRewardHistoryMessage +handleDeadMessage +handleDeleteInContainerMessage +handleDeleteInventoryMessage +handleDeleteOnMapMessage +handleDepotSearchDetailListMessage +handleDepotSearchResultMessage +handleEditGuildMessageMessage +handleEditListMessage +handleEditTextMessage +handleExaltationBaseDataMessage +handleExaltationDialogRefreshMessage +handleExaltationHistoryMessage +handleExaltationResultMessage +handleExivaSuppressedMessage +handleFieldDataMessage +handleFriendSystemDataMessage +handleFullMapMessage +handleGameEventMessage +handleGemAtelierGemRevealedMessage +handleGetGuildMessage +handleGraphicalEffectsMessage +handleHighscoresMessage +handleImbuementDurationsMessage +handleImbuingDialogRefreshMessage +handleImpactTrackingMessage +handleInspectionListMessage +handleItemLootedMessage +handleItemWastedMessage +handleKillTrackingMessage +handleLeftColumnMessage +handleLoginSuccessMessage +handleMarketBrowseMessage +handleMarketDetailMessage +handleMarketEnterMessage +handleMarketLeaveMessage +handleMarketStatisticsMessage +handleMessageMessage +handleMonsterCyclopediaBonusEffectsMessage +handleMonsterCyclopediaMessage +handleMonsterCyclopediaMonstersMessage +handleMonsterCyclopediaNewDetailsMessage +handleMonsterCyclopediaRaceMessage +handleNPCOfferMessage +handleNpcTalkPartersMessage +handleObjectInfoMessage +handleOfferDescriptionMessage +handleOpenChannelMessage +handleOpenOwnChannelMessage +handleOpenRewardWallMessage +handleOutfitMemorialMessage +handleOwnOfferMessage +handlePartyHuntAnalyserMessage +handlePendingStateEnteredMessage +handlePlayerDataBasicMessage +handlePlayerGoodsMessage +handlePlayerInventoryMessage +handlePremiumTriggerMessage +handlePreyDataMessage +handlePreyPricesMessage +handlePreyTimeLeftMessage +handlePrivateChannelMessage +handleQuestLineMessage +handleQuestLogMessage +handleRemoveGraphicalEffectMessage +handleRequestPurchaseDataMessage +handleResourceBalanceMessage +handleRestingAreaStateMessage +handleRightColumnMessage +handleSessionDumpStartMessage +handleSessionEndInformationMessage +handleSetInventoryMessage +handleSetStoreButtonDeeplinkMessage +handleShapedPerkReshapeOffersMessage +handleShowGameNewsMessage +handleShowMessageDialogMessage +handleShowModalDialogMessage +handleShowMultiOfflineTrainingDialogMessage +handleSkillWheelMessage +handleSoulSealsDialogMessage +handleSoundTriggerMessage +handleSpecialContainersAvailableMessage +handleStashMessage +handleStoreButtonIndicatorsMessage +handleStoreCategoriesMessage +handleStoreErrorMessage +handleStoreOffersMessage +handleStoreSuccessMessage +handleTalkMessage +handleTaskboardMessage +handleTeamFinderTeamLeaderMessage +handleTeamFinderTeamMemberMessage +handleTextForReportMessage +handleTibiaTimeMessage +handleTopFloorMessage +handleTopRowMessage +handleTrackedQuestFlagsMessage +handleTransactionDetailsMessage +handleTransactionHistoryMessage +handleTutorialHintMessage +handleUpdateExivaOptionsMessage +handleUpdateManagedContainersMessage +handleUpdatingShopBalanceMessage +handleWeaponProficiencyMessage +handleWeaponProficiencyNotificationMessage +handleXpChangedMessage +onActionBarCharacterOptionsChanged +onActionBarOptionsChanged +onActionBarsOptionsChanged +onActiveFilterTagChanged +onActiveOfferCountChanged +onActiveRaidsChanged +onActiveTabChanged +onAllowEveryoneChanged +onAllowedGroupsChanged +onAmbienceObjectStreamCountChanged +onAntialiasingChanged +onApplicationStateChanged +onAreaDonationsChanged +onAreaOrSubAreaChanged +onAsyncEmitObjectInfosChanged +onAuthenticatedChanged +onAutoTrackLootValueChanged +onBossCooldownsChanged +onBossTrackingEntriesChanged +onBountyTaskDataChanged +onButtonOptionsChanged +onCameraViewportChanged +onCategoriesChanged +onCharacterBasedLootWasteOptionsChanged +onCharacterConfigurationChanged +onCharacterHousesInfoChanged +onCharacterPresetsChanged +onChatChannelControllerOptionsChanged +onChatProtocolMessageHandlerOptionsChanged +onClickedAreaChanged +onConfigurationChanged +onConnectionsUsedChanged +onControlOptionsChanged +onControlOrLootSchemeOptionsChanged +onCounterOfferChanged +onCurrentlyHoveredCreatureChanged +onCyclopediaMapImminentRaidsChanged +onDailyRewardHistoryChanged +onDamageValuesChanged +onDataChanged +onDeadMessage +onDelayedCliendWindowChanged +onDetailListChanged +onDialogVisibleChanged +onDisplayResultMessage +onDragAndDropMousePositionChanged +onDragChanged +onEffectSoundsChanged +onEmptySearchResultReceived +onEnableConditionsChanged +onEntryFormatChanged +onErrorReceived +onExaltedCurrencyBalanceChanged +onExperienceInProgressStorageChanged +onFilterOptionChanged +onFocusChanged +onFpsTrackingActiveChanged +onFriendsInviteReceived +onFriendshipEstablishedReceived +onFusionGroupsChanged +onGameLoginChallengeMessage +onGameLoginErrorMessage +onGameLoginWaitMessage +onGameserverNetworkPacketReceived +onGamesessionChanged +onGaugeTargetValueChanged +onGoldBalanceChanged +onGraphValuesChanged +onGreaterFragmentsChanged +onGroupNameEditedReceived +onGroupNameToAddToVipListReceived +onHistoryChanged +onHomePageChanged +onHotkeyOptionsChanged +onHouseInformationChanged +onHouseViewportChanged +onHousesLimitsChanged +onIdRangeChanged +onImbuedObjectsChanged +onImbuingStorageDataChanged +onImplicitSizeChanged +onIndexChanged +onInspectObjectDataReceived +onInventoryChanged +onInventoryOptionsChanged +onIsVisibleChanged +onItemPriceConfigurationChanged +onItemPriceVisualizationChanged +onItemTrackingChanged +onItemTrackingStorageOptionsChanged +onItemsChanged +onItemsMetricsChanged +onKeyboardStatusStorageChanged +onKeywordButtonsChanged +onLeftAndRightStatusActionBarWidthChanged +onLesserFragmentsChanged +onLootBlackWhitelisteChanged +onLunarAscensionOrbsAmountChanged +onManualSortModeChanged +onMapWindowControllerOptionsChanged +onMarketHistoryChanged +onMarketItemDetailsChanged +onMarketOffersChanged +onMarketOwnOffersChanged +onMessageAtEndOfLoginRampUpReceived +onMinimapDataChanged +onMinimapMarkersChanged +onMonsterBonusEffectsChanged +onMonsterClassificationSummaryChanged +onMonsterCyclopediaNewDetailsMessage +onMonsterListChanged +onMonsterRaceDetailsChanged +onMonsterRaceListChanged +onMonsterRacesChanged +onMonsterRacesUnlockedForCharmsChanged +onNPCTradeOptionsChanged +onNewsStorageContentsChanged +onNpcDialogOptionsChanged +onNpcTalkPartnersChanged +onNpcTradeOptionsChanged +onNumberOfSidebarsChanged +onObjectCountsChanged +onObjectInfosChanged +onObjectProficiencyXPChanged +onOfferDescriptionReceived +onOffersChanged +onOptimizeConnectionStabilityOptionChanged +onOptionChanged +onOptionsChanged +onOptionsTrackingActiveChanged +onOwnOfferChanged +onPacketReceived +onPartyHuntDataChanged +onPartyLeaderIDChanged +onPassagesChanged +onPinnedChanged +onPlayerBonusPointsChanged +onPlayerDataChanged +onPlayerNameToAddToVipListReceived +onPlayerNameToExcludeFromChatChannelReceived +onPlayerNameToInviteToChatChannelReceived +onPlayerPositionChanged +onPlayerSkillStatsChanged +onPositionChanged +onPremiumStatusChanged +onPremiumTimeChanged +onPreyHuntingTaskTokensChanged +onPreyWildcardsChanged +onProficiencyDataChanged +onQuestLinePartsChanged +onQuestLinesChanged +onQuickLootBlackWhitelistConfigurationChanged +onRecentLootDropsChanged +onRemainingNumberOfAssignableBonusEffectsChanged +onRenderInfosChanged +onResourceBalanceChanged +onRestingAreaChanged +onRestingAreaStateChanged +onScreenshotMangerOptionsChanged +onSearchResultsChanged +onSelectedCharmChanged +onSelectedItemChanged +onSessiondumpNewMessage +onSettingHintsFromServerChanged +onShapedPerkReshapeOffersChanged +onShowGameNewsMessage +onShowInfoBannerOptionChanged +onShowLockerOnlyChanged +onSizeChanged +onSoundManagerPlayableSoundsChanged +onSoundMetadataChanged +onSoundOptionsChanged +onSoundsToPlayChanged +onStashContentChanged +onStatusBarVisibilityChanged +onStoreBalanceChanged +onStoreButtonIndicatorsChanged +onStoreDeeplinkChanged +onStoreImageBaseUrlChanged +onTabHighlightChanged +onTeamMembersChanged +onTeamParametersChanged +onTeamsChanged +onTextPropertiesChanged +onThisWidgetOptionsChanged +onTopLeftCoordinateChanged +onTrackedCreaturesChanged +onTrackedQuestFlagsChanged +onTradeFocusChanged +onTraderInventoryChanged +onTransactionHistoryChanged +onTransferGroupsChanged +onTriggerUpdateImpactData +onUnusedWidthChanged +onViewpointsChanged +onVipGroupDataChanged +onVipRenderInfoChanged +onVipStateChanged +onWeeklyTaskDataChanged +onWidgetDragChanged +onWidgetOptionsChanged +onWindowChanged +onWindowSizeChanged +onWorldTypeReceived +receivedAmbientLightMessage +receivedBestiaryTrackerMessage +receivedBlessingsDialogMessage +receivedBlessingsMessage +receivedBossDifficultySelectionMessage +receivedBossSlotsMessage +receivedBossTrackingMessage +receivedBosstiaryHighlightMessage +receivedBosstiaryMessage +receivedBosstiaryStaticDataMessage +receivedBottomFloorMessage +receivedBottomRowMessage +receivedBuddyDataMessage +receivedBuddyGroupDataMessage +receivedBuddyStatusChangeMessage +receivedBugReportsAllowedMessage +receivedChangeInContainerMessage +receivedChangeOnMapMessage +receivedChannelEventMessage +receivedChannelsMessage +receivedCharacterTradeConfigurationMessage +receivedClientCheckMessage +receivedCloseChannelMessage +receivedCloseContainerMessage +receivedCloseDepotSearchMessage +receivedCloseExaltationDialogMessage +receivedCloseImbuingDialogMessage +receivedCloseNPCTradeMessage +receivedCloseRewardWallMessage +receivedCloseTradeMessage +receivedConfigureCreaturePodiumMessage +receivedContainerMessage +receivedCounterOfferMessage +receivedCreateInContainerMessage +receivedCreateOnMapMessage +receivedCreatureDataMessage +receivedCreatureHealthMessage +receivedCreatureLightMessage +receivedCreatureMarksMessage +receivedCreatureOutfitMessage +receivedCreaturePartyMessage +receivedCreatureSkullMessage +receivedCreatureSpeedMessage +receivedCreatureTypeMessage +receivedCreatureUnpassMessage +receivedCreatureUpdateMessage +receivedCreditBalanceMessage +receivedCyclopediaCharacterInfoMessage +receivedCyclopediaCurrentHouseDataMessage +receivedCyclopediaHouseActionResultMessage +receivedCyclopediaMapDataMessage +receivedCyclopediaStaticHouseDataMessage +receivedDailyRewardBasicMessage +receivedDailyRewardCollectionStateMessage +receivedDailyRewardHistoryMessage +receivedDeadMessage +receivedDeleteInContainerMessage +receivedDeleteInventoryMessage +receivedDeleteOnMapMessage +receivedDepotSearchDetailListMessage +receivedDepotSearchResultMessage +receivedEditGuildMessageMessage +receivedEditListMessage +receivedEditTextMessage +receivedExaltationBaseDataMessage +receivedExaltationDialogRefreshMessage +receivedExaltationHistoryMessage +receivedExaltationResultMessage +receivedExivaSuppressedMessage +receivedFieldDataMessage +receivedFriendSystemDataMessage +receivedFullMapMessage +receivedGameEventMessage +receivedGemAtelierGemRevealedMessage +receivedGraphicalEffectsMessage +receivedHighscoresMessage +receivedHirelingNameChangeMessage +receivedImbuementDurationsMessage +receivedImbuingDialogRefreshMessage +receivedImpactTrackingMessage +receivedInspectionListMessage +receivedInspectionStateMessage +receivedItemLootedMessage +receivedItemWastedMessage +receivedKillTrackingMessage +receivedLeftColumnMessage +receivedLoginAdviceMessage +receivedLoginChallengeMessage +receivedLoginErrorMessage +receivedLoginSuccessMessage +receivedLoginWaitMessage +receivedMarketBrowseMessage +receivedMarketDetailMessage +receivedMarketEnterMessage +receivedMarketLeaveMessage +receivedMarketStatisticsMessage +receivedMessageMessage +receivedMonsterCyclopediaBonusEffectsMessage +receivedMonsterCyclopediaMessage +receivedMonsterCyclopediaMonstersMessage +receivedMonsterCyclopediaNewDetailsMessage +receivedMonsterCyclopediaRaceMessage +receivedMoveCreatureMessage +receivedMultiUseDelayMessage +receivedNPCOfferMessage +receivedNpcTalkPartersMessage +receivedObjectInfoMessage +receivedOfferDescriptionMessage +receivedOpenChannelMessage +receivedOpenOwnChannelMessage +receivedOpenRewardWallMessage +receivedOutfitMemorialMessage +receivedOutfitMessage +receivedOwnOfferMessage +receivedPartyHuntAnalyserMessage +receivedPassiveAbilityDataMessage +receivedPendingStateEnteredMessage +receivedPingBackMessage +receivedPingMessage +receivedPlayerDataBasicMessage +receivedPlayerDataCurrentMessage +receivedPlayerGoodsMessage +receivedPlayerInventoryMessage +receivedPlayerSkillsMessage +receivedPlayerStateMessage +receivedPremiumTriggerMessage +receivedPreyDataMessage +receivedPreyPricesMessage +receivedPreyTimeLeftMessage +receivedPrivateChannelMessage +receivedPvpSituationsMessage +receivedQuestLineMessage +receivedQuestLogMessage +receivedReadyForSecondaryConnectionMessage +receivedRemoveGraphicalEffectMessage +receivedRequestPurchaseDataMessage +receivedResourceBalanceMessage +receivedRestingAreaStateMessage +receivedRightColumnMessage +receivedSessionDumpStartMessage +receivedSessionEndInformationMessage +receivedSetInventoryMessage +receivedSetStoreButtonDeeplinkMessage +receivedSetTacticsMessage +receivedShapedPerkReshapeOffersMessage +receivedShowGameNewsMessage +receivedShowMessageDialogMessage +receivedShowModalDialogMessage +receivedShowMultiOfflineTrainingDialogMessage +receivedSkillWheelMessage +receivedSnapBackMessage +receivedSoulSealsDialogMessage +receivedSoundTriggerMessage +receivedSpecialContainersAvailableMessage +receivedSpellDataModificationMessage +receivedSpellDelayMessage +receivedSpellGroupDelayMessage +receivedStashMessage +receivedStopMessage +receivedStoreButtonIndicatorsMessage +receivedStoreCategoriesMessage +receivedStoreErrorMessage +receivedStoreOffersMessage +receivedStoreSuccessMessage +receivedSwitchPresetMessage +receivedTalkMessage +receivedTaskboardMessage +receivedTeamFinderTeamLeaderMessage +receivedTeamFinderTeamMemberMessage +receivedTextForReportMessage +receivedTibiaTimeMessage +receivedTopFloorMessage +receivedTopRowMessage +receivedTrackedQuestFlagsMessage +receivedTransactionDetailsMessage +receivedTransactionHistoryMessage +receivedTutorialHintMessage +receivedUnjustifiedPointsMessage +receivedUnlockedSpellsMessage +receivedUpdateExivaOptionsMessage +receivedUpdateManagedContainersMessage +receivedUpdateTargetMessage +receivedUpdatingShopBalanceMessage +receivedVocationSpecificPlayerDataMessage +receivedWaitMessage +receivedWeaponProficiencyMessage +receivedWeaponProficiencyNotificationMessage +receivedWorldEnteredMessage +receivedXpChangedMessage From e6ecd355ad8dff74c69fedd1101bf092fe2b8323 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:51:19 +0200 Subject: [PATCH 08/22] docs(track-a): persist protocol-handler code xrefs --- .../protocol-handler-code-xrefs.tsv | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv new file mode 100644 index 0000000000..54bd275e9d --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv @@ -0,0 +1,48 @@ +instruction_va type_string evidence_strength semantic_dispatcher_edge_proven +0xd0e22d tibia::authentication::TLoginProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd0e2dd tibia::bossbestiary::TBossBestiaryProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd0e50d tibia::chat::TChatProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd290dd tibia::container::TContainerProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2943d tibia::creatures::TCreatureProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2952d tibia::creatures::TUnjustifiedPointsProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2961d tibia::creatures::TVipProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2989d tibia::cyclopedia::TBestiaryTrackerProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd29a3d tibia::cyclopedia::TCyclopediaProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd29ffd tibia::dailyreward::TDailyRewardProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a0ed tibia::effects::TEffectProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a1dd tibia::exaltation::TExaltationProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a2cd tibia::exivaoptions::TExivaOptionsProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a45d tibia::friends::TFriendsProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a5ed tibia::game::TBlessingsProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a69d tibia::game::TBossDifficultySelectionProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a73d tibia::game::TEditTextProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a87d tibia::game::TGameEventProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2a8cd tibia::game::TGameProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2ad4d tibia::game::TPlayerProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2ae4d tibia::game::TPremiumProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2af1d tibia::game::TServerModalDialogProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xd2b04d tibia::game::TSpellBookProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd493d tibia::highscores::THighscoresProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd4a2d tibia::imbuing::TImbuingProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd4e8d tibia::input::TGatherAllProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd536d tibia::quickloot::TManagedContainersProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd556d tibia::market::TMarketProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd583d tibia::minimap::TMinimapProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd5bad tibia::network::TNetworkQualityProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd5cfd tibia::news::TNewsProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd5f4d tibia::prey::TPreyProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdd5fed tibia::proficiency::TProficiencyProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfe0ed tibia::questlog::TQuestLogProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfe30d tibia::reporting::TBugReportProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfe35d tibia::reporting::TRuleViolationProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfe5dd tibia::skillwheel::TSkillWheelProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfea5d tibia::sound::TSoundProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfebad tibia::spells::TSpellsProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdfeebd tibia::store::TStoreProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdff27d tibia::taskboard::TTaskboardProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdff36d tibia::teamfinder::TTeamFinderProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdff4ad tibia::trade::TCharacterTradeProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdff54d tibia::trade::TNPCTradeProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdff68d tibia::trade::TPlayerTradeProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdff7dd tibia::tutorial::TTutorialProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false +0xdffb2d tibia::worldmap::TWorldmapProtocolMessageHandler DIRECT_CODE_TO_STRING_XREF false From 8277334832b5bddc97c7d4a64ed666b4cebfbc5f Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:51:32 +0200 Subject: [PATCH 09/22] docs(track-a): persist exact-build anchor resolution --- .../known-anchor-vptr-resolution.json | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json new file mode 100644 index 0000000000..c7166174a6 --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json @@ -0,0 +1,41 @@ +{ + "schema": "otclient.tibia-runtime-bridge.discovery.v1", + "binary": "/client", + "targets": { + "container_storage": { + "expected_qt_class": "tibia::container::TContainerStorage", + "primary_vptr_candidates": ["0x308a1a0"], + "unique": true + }, + "creature_storage": { + "expected_qt_class": "tibia::creatures::TCreatureStorage", + "primary_vptr_candidates": ["0x308d078"], + "unique": true + }, + "game_client": { + "expected_qt_class": "tibia::client::TGameClient", + "primary_vptr_candidates": ["0x3076908"], + "unique": true + }, + "gameserver_game_session": { + "expected_qt_class": "tibia::game::TGameserverGameSession", + "primary_vptr_candidates": ["0x3078ba0"], + "unique": true + }, + "player_data": { + "expected_qt_class": "tibia::game::TPlayerData", + "primary_vptr_candidates": ["0x308ca70"], + "unique": true + }, + "player_protocol_handler": { + "expected_qt_class": "tibia::game::TPlayerProtocolMessageHandler", + "primary_vptr_candidates": ["0x308a008"], + "unique": true + }, + "worldmap_handler": { + "expected_qt_class": "tibia::worldmap::TWorldmapProtocolMessageHandler", + "primary_vptr_candidates": ["0x30871d8"], + "unique": true + } + } +} From ea4e70329d18643d71e6d0e343e69b176cfdfbcc Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:51:57 +0200 Subject: [PATCH 10/22] docs(track-a): record S1 static census summary --- .../summary.json | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json new file mode 100644 index 0000000000..38d2afbcbc --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json @@ -0,0 +1,75 @@ +{ + "schema": "track-a-s1-unfiltered-static-census-result-v1", + "task": "OTC-20260818-track-a-s1-unfiltered-static-census", + "pr": 509, + "exact_client": { + "version": "15.32.df7b29", + "size": 51965216, + "sha256": "e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe", + "packed_lzma_sha256": "496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b" + }, + "execution": { + "class": "github_hosted", + "runtime_access": "none", + "client_executed": false, + "secret_access": false, + "pr475_runtime_touched": false, + "raw_client_committed_or_uploaded": false + }, + "fresh_producer": { + "head": "cb575cec2077c8002bb6712ffac4d4dc77420499", + "run": 32112814216, + "job": 95635760592, + "conclusion": "SUCCESS", + "artifact": 9315562574, + "artifact_digest": "sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860" + }, + "independent_control": { + "source_pr": 473, + "run": 32022209943, + "artifact": 9285763750, + "artifact_digest": "sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6", + "protocol_all_sha256": "55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b", + "client_to_server_sha256": "621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0", + "server_to_client_sha256": "e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96" + }, + "protocol": { + "total": 349, + "client_to_server": 160, + "server_to_client": 189, + "fresh_lists_byte_identical_to_control": true, + "all_189_inbound_names_persisted": true, + "all_160_outbound_names_persisted": true + }, + "inbound_static_surface": { + "inbound_oriented_method_strings": 542, + "messages_with_lexical_handler_surface": 188, + "messages_without_lexical_handler_surface": 1, + "sole_unmatched_generated_message": "GameserverMessageTrackQuestFlags", + "relevant_demangled_types_in_artifact": 148, + "direct_code_to_string_xref_strings": 51, + "direct_code_to_string_xrefs": 52, + "protocol_message_handler_classes_with_direct_code_string_xref": 47, + "semantic_common_inbound_dispatcher": "UNKNOWN" + }, + "exact_build_anchor_resolution": { + "player_protocol_handler": "0x308a008", + "player_data": "0x308ca70", + "creature_storage": "0x308d078", + "container_storage": "0x308a1a0", + "gameserver_game_session": "0x3078ba0", + "game_client": "0x3076908", + "worldmap_handler": "0x30871d8", + "all_unique": true + }, + "classification": { + "generated_message_denominator": "FACT", + "handler_class_type_presence": "FACT", + "direct_code_to_handler_class_string_xrefs": "FACT", + "message_name_to_similar_received_or_handle_method_name": "INFERENCE_STATIC_LEXICAL_ONLY", + "message_to_concrete_handler_dispatch": "UNKNOWN", + "handler_to_storage_or_controller_edge": "UNKNOWN", + "one_common_inbound_dispatcher": "UNKNOWN" + }, + "diagnostic_family_bucket_warning": "Producer protocol-server-families.json used substring-only diagnostics and is not promoted as semantic evidence; e.g. Market names can collide with Mark/row substrings. Durable conclusions use exact names and explicit evidence classes instead." +} From 8fce3dd0ac5bc1825ee9c980e6873a3635efcf67 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:52:47 +0200 Subject: [PATCH 11/22] docs(track-a): synthesize S1 inbound census --- .../result.md | 193 ++++++++++++++++++ 1 file changed, 193 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md new file mode 100644 index 0000000000..0bbaaa54a7 --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md @@ -0,0 +1,193 @@ +# Track A S1 unfiltered static census — result + +Task: `OTC-20260818-track-a-s1-unfiltered-static-census` +PR: `#509` +Execution: `github_hosted`, `runtime_access: none` +Exact client: `15.32.df7b29` / `51965216` / `e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe` + +## Result + +The bounded exact-file producer completed successfully without launching or observing the official client: + +```text +run 32112814216 +job 95635760592 +result SUCCESS +artifact 9315562574 +sha256 583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 +``` + +The raw compressed/unpacked official client was deleted before artifact upload. The artifact contains sanitized text/JSON only. No Synology, X11/VNC, process memory, credential/session value, login, gameplay, packet capture or PR #475 runtime surface was accessed. + +## FACT — exhaustive generated-message denominator + +Fresh exact-build census: + +```text +PROTOCOL_MESSAGE_TOTAL=349 +CLIENT_TO_SERVER=160 +SERVER_TO_CLIENT=189 +``` + +The fresh lists are byte-for-byte identical to the independent sanitized #473 control artifact (`run 32022209943`, artifact `9285763750`): + +```text +protocol-all.txt +sha256 55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b + +protocol-client-to-server.txt +sha256 621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0 + +protocol-server-to-client.txt +sha256 e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96 +``` + +The complete 160/189 registries are persisted beside this report. The old 98-message capability-regex subset is therefore conclusively not an exhaustive protocol denominator. + +## FACT — unfiltered inbound-oriented static surface + +The fresh exact binary contains: + +```text +542 inbound-oriented handle/received/on/process-style method strings +148 relevant demangled protocol/storage/session/data types in the producer artifact +51 interesting strings with direct executable code xrefs +52 total retained direct code-to-string xrefs +47 distinct *ProtocolMessageHandler class names with direct code-to-class-string xrefs +``` + +Examples of directly present handler classes include: + +```text +tibia::authentication::TLoginProtocolMessageHandler +tibia::chat::TChatProtocolMessageHandler +tibia::container::TContainerProtocolMessageHandler +tibia::creatures::TCreatureProtocolMessageHandler +tibia::game::TGameProtocolMessageHandler +tibia::game::TPlayerProtocolMessageHandler +tibia::game::TServerModalDialogProtocolMessageHandler +tibia::market::TMarketProtocolMessageHandler +tibia::network::TNetworkQualityProtocolMessageHandler +tibia::quickloot::TManagedContainersProtocolMessageHandler +tibia::trade::TPlayerTradeProtocolMessageHandler +tibia::worldmap::TWorldmapProtocolMessageHandler +``` + +All 47 direct class-string xrefs are persisted in `protocol-handler-code-xrefs.tsv`. These xrefs prove exact code references to the class-name strings. They do **not** by themselves prove that the referring instruction is the semantic message dispatcher. + +## FACT — current-main exact-build anchors still resolve + +The repository's relocation-aware resolver re-resolved every configured exact-build target uniquely: + +```text +TGameClient primary vptr 0x3076908 +TGameserverGameSession primary vptr 0x3078ba0 +TPlayerProtocolMessageHandler primary vptr 0x308a008 +TPlayerData primary vptr 0x308ca70 +TContainerStorage primary vptr 0x308a1a0 +TCreatureStorage primary vptr 0x308d078 +TWorldmapProtocolMessageHandler primary vptr 0x30871d8 +``` + +This is exact-file structural evidence only; no current runtime instance is claimed. + +## INFERENCE — generated message names align strongly with native receive surfaces + +A deliberately name-only pass found an exact/broader lexical `handle*` / `received*` / related method surface for `188 / 189` generated server messages. + +High-value non-worldmap examples: + +```text +GameserverMessagePlayerDataCurrent + -> receivedPlayerDataCurrentMessage + +GameserverMessagePlayerState + -> receivedPlayerStateMessage + +GameserverMessagePlayerInventory + -> handlePlayerInventoryMessage + -> receivedPlayerInventoryMessage + +GameserverMessageCreatureHealth + -> receivedCreatureHealthMessage + +GameserverMessageCreatureUpdate + -> receivedCreatureUpdateMessage + +GameserverMessageMoveCreature + -> receivedMoveCreatureMessage + +GameserverMessageCreateInContainer + -> handleCreateInContainerMessage + -> receivedCreateInContainerMessage + +GameserverMessageChangeInContainer + -> handleChangeInContainerMessage + -> receivedChangeInContainerMessage + +GameserverMessageDeleteInContainer + -> handleDeleteInContainerMessage + -> receivedDeleteInContainerMessage + +GameserverMessageTalk + -> handleTalkMessage + -> receivedTalkMessage + +GameserverMessageChannels + -> handleChannelsMessage + -> receivedChannelsMessage +``` + +These are **STATIC_LEXICAL_ASSOCIATIONS**, not proven call edges. The only generated name not matched by the automatic stem rule was: + +```text +GameserverMessageTrackQuestFlags +``` + +The binary separately contains `handleTrackedQuestFlagsMessage`, `receivedTrackedQuestFlagsMessage` and `onTrackedQuestFlagsChanged`, so the difference is consistent with a naming variant (`Track` vs `Tracked`) but is not promoted to a direct message-handler FACT here. + +## UNKNOWN — exact inbound dispatch graph + +This task does not prove: + +```text +GameserverMessageX -> exact concrete handler function +handler -> exact storage/controller mutation +one global/common inbound dispatcher +runtime delivery or causal state mutation +``` + +The producer deliberately reports `semantic_common_inbound_dispatcher = UNKNOWN`. + +The direct class-string xrefs occur in several address clusters and are compatible with generated Qt metaobject/metacast-related code, but that role is not promoted without a bounded instruction/control-flow discriminator. + +## Diagnostic family-bucket correction + +The producer also emitted convenience lexical family buckets. They are **not promoted** because naive substring rules can create false grouping, for example `Mark` inside `Market` or `row` inside `Browse`. Exact generated names, method names, class types and xrefs are the durable evidence; future semantic grouping must be explicit or dependency-derived. + +## Ranked non-conflicting S2 frontiers + +The best next static frontiers that do not require or consume PR #475's physical runtime are: + +1. `TPlayerProtocolMessageHandler` QMeta/dispatch graph for `PlayerDataCurrent`, `PlayerState`, `PlayerInventory`, `PlayerSkills`, followed by the static edge into `TPlayerData` where provable. +2. `TCreatureProtocolMessageHandler` dispatch graph for `CreatureData/Health/Update/MoveCreature`, followed by the static edge into `TCreatureStorage` where provable. +3. `TContainerProtocolMessageHandler` dispatch graph for `Container/Create/Change/DeleteInContainer`, followed by the static edge into `TContainerStorage` where provable. +4. `TChatProtocolMessageHandler` graph for `Talk/Channels/ChannelEvent/Open/Close/PrivateChannel`, followed by chat-storage/controller ownership where provable. + +Worldmap semantic/runtime work remains excluded because PR #475 currently owns that physical frontier. Login/session runtime propagation is also not selected as the immediate follow-up while #475 is actively working the native world-entry chain. + +## Classification + +```yaml +GENERATED_MESSAGE_DENOMINATOR: FACT +COMPLETE_160_OUTBOUND_REGISTRY: FACT +COMPLETE_189_INBOUND_REGISTRY: FACT +UNFILTERED_INBOUND_METHOD_STRING_CENSUS: FACT +PROTOCOL_HANDLER_TYPE_PRESENCE: FACT +DIRECT_CODE_TO_HANDLER_CLASS_STRING_XREFS: FACT +MESSAGE_TO_SIMILAR_METHOD_NAME: INFERENCE_STATIC_LEXICAL_ONLY +MESSAGE_TO_CONCRETE_HANDLER_DISPATCH: UNKNOWN +HANDLER_TO_STORAGE_CONTROLLER_EDGE: UNKNOWN +COMMON_INBOUND_DISPATCHER: UNKNOWN +RUNTIME_BEHAVIOR: NOT_OBSERVED +``` From 1aae2fc0e9278c0bf26b0f68a5699cd5987a0b16 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:53:05 +0200 Subject: [PATCH 12/22] ci(track-a): remove temporary S1 producer --- .../track-a-s1-unfiltered-static-census.yml | 391 ------------------ 1 file changed, 391 deletions(-) delete mode 100644 .github/workflows/track-a-s1-unfiltered-static-census.yml diff --git a/.github/workflows/track-a-s1-unfiltered-static-census.yml b/.github/workflows/track-a-s1-unfiltered-static-census.yml deleted file mode 100644 index b66c3cc3b1..0000000000 --- a/.github/workflows/track-a-s1-unfiltered-static-census.yml +++ /dev/null @@ -1,391 +0,0 @@ -name: Track A S1 unfiltered static census - -on: - pull_request: - branches: [main] - paths: - - .github/workflows/track-a-s1-unfiltered-static-census.yml - - docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md - - docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/** - - docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md - workflow_dispatch: - -permissions: - contents: read - -jobs: - census: - name: Recover exact inbound protocol and handler census - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - with: - persist-credentials: false - - - name: Fetch exact client and emit sanitized S1 evidence - shell: bash - run: | - set -Eeuo pipefail - sudo apt-get update -qq - sudo apt-get install -y --no-install-recommends curl binutils python3-pyelftools python3-capstone - - r="$RUNNER_TEMP/track-a-s1-static" - mkdir -p "$r/bin" "$r/state" "$r/client" "$r/evidence" - cd "$r/bin" - - curl -fsSL -o wgcf https://github.com/ViRb3/wgcf/releases/download/v2.2.32/wgcf_2.2.32_linux_amd64 - echo '2ff97f2201972ce582a424455d50a3719a380eef0cd1f3144f7779348e122a2c wgcf' | sha256sum -c - - curl -fsSL -o wireproxy.tgz https://github.com/windtf/wireproxy/releases/download/v1.1.3/wireproxy_linux_amd64.tar.gz - echo 'e88c1d090740373fc606c1bafd81d9a5eadc642cce5667616e20e9d7a444f51c wireproxy.tgz' | sha256sum -c - - mkdir wireproxy-unpack - tar -xzf wireproxy.tgz -C wireproxy-unpack - cp "$(find wireproxy-unpack -type f -name wireproxy -print -quit)" wireproxy - chmod 755 wgcf wireproxy - - cd "$r/state" - "$r/bin/wgcf" register --accept-tos >/dev/null - "$r/bin/wgcf" generate >/dev/null - printf 'WGConfig = %s\n\n[Socks5]\nBindAddress = 127.0.0.1:25346\n' "$r/state/wgcf-profile.conf" > wireproxy.conf - nohup "$r/bin/wireproxy" -c wireproxy.conf >"$r/wireproxy.log" 2>&1 "$r/trace" 2>/dev/null; then - break - fi - sleep 2 - done - grep -Eq '^warp=(on|plus)$' "$r/trace" - echo 'S1_WARP_PATH=PASS' - - client_url=https://static.tibia.com/launcher/tibiaclient-linux-current/bin/client.lzma - curl --socks5-hostname 127.0.0.1:25346 --compressed -fL \ - -A 'Mozilla/5.0 (X11; Linux x86_64)' -e "$client_url" -H 'Accept: */*' \ - "$client_url" -o "$r/client/client.lzma" - echo '496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b '"$r"'/client/client.lzma' | sha256sum -c - - echo 'S1_EXACT_PACKED_SHA=PASS' - - python3 - "$r/client/client.lzma" "$r/client/client" "$r/evidence" <<'PY' - from __future__ import annotations - - import collections - import hashlib - import json - import lzma - import os - import pathlib - import re - import subprocess - import sys - - from capstone import Cs, CS_ARCH_X86, CS_MODE_64 - from capstone.x86_const import X86_OP_IMM, X86_OP_MEM, X86_REG_RIP - from elftools.elf.elffile import ELFFile - - packed_path = pathlib.Path(sys.argv[1]) - raw_path = pathlib.Path(sys.argv[2]) - evidence = pathlib.Path(sys.argv[3]) - workspace = pathlib.Path(os.environ['GITHUB_WORKSPACE']) - evidence.mkdir(parents=True, exist_ok=True) - - packed = packed_path.read_bytes() - props = packed[32] - lc = props % 9 - rest = props // 9 - lp = rest % 5 - pb = rest // 5 - dict_size = int.from_bytes(packed[33:37], 'little') - raw = lzma.decompress( - packed[45:], - format=lzma.FORMAT_RAW, - filters=[{'id': lzma.FILTER_LZMA1, 'dict_size': dict_size, 'lc': lc, 'lp': lp, 'pb': pb}], - ) - exact_sha = hashlib.sha256(raw).hexdigest() - assert len(raw) == 51965216, len(raw) - assert exact_sha == 'e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe', exact_sha - raw_path.write_bytes(raw) - print('S1_EXACT_CLIENT_SHA=PASS') - print('S1_CLIENT_EXECUTED=false') - print('S1_RUNTIME_ACCESS=none') - - with raw_path.open('rb') as handle: - elf = ELFFile(handle) - sections = [ - { - 'name': section.name, - 'offset': int(section['sh_offset']), - 'size': int(section['sh_size']), - 'va': int(section['sh_addr']), - 'flags': int(section['sh_flags']), - } - for section in elf.iter_sections() - ] - - def offset_to_va(offset: int) -> int | None: - for section in sections: - if section['offset'] <= offset < section['offset'] + section['size']: - return section['va'] + offset - section['offset'] - return None - - printable_records: list[dict[str, object]] = [] - printable_values: list[str] = [] - for match in re.finditer(rb'[ -~]{4,220}', raw): - value = match.group().decode('ascii', 'ignore') - va = offset_to_va(match.start()) - if va is None: - continue - printable_records.append({'value': value, 'va': va, 'offset': match.start()}) - printable_values.append(value) - - text = '\n'.join(printable_values) - protocol_names = sorted(set(re.findall(r'\b(?:GameclientMessage|GameserverMessage)[A-Za-z0-9_]{2,100}\b', text))) - client_names = [name for name in protocol_names if name.startswith('GameclientMessage')] - server_names = [name for name in protocol_names if name.startswith('GameserverMessage')] - assert len(protocol_names) == 349, len(protocol_names) - assert len(client_names) == 160, len(client_names) - assert len(server_names) == 189, len(server_names) - assert len(set(server_names)) == 189 - - (evidence / 'protocol-all.txt').write_text('\n'.join(protocol_names) + '\n', encoding='utf-8') - (evidence / 'protocol-client-to-server.txt').write_text('\n'.join(client_names) + '\n', encoding='utf-8') - (evidence / 'protocol-server-to-client.txt').write_text('\n'.join(server_names) + '\n', encoding='utf-8') - - family_rules = [ - ('session_auth_world', re.compile(r'(Login|Session|World|Pending|Enter|Disconnect|Connection|Challenge|Token|Ping|Pong)', re.I)), - ('world_map', re.compile(r'(Map|Field|Floor|Row|Column|Tile|Coordinate|Effect|Missile)', re.I)), - ('creature_combat', re.compile(r'(Creature|Attack|Follow|Combat|Death|Skull|Party|Outfit|Health|Light|Speed|Unpass|Mark)', re.I)), - ('player_state', re.compile(r'(Player|Skill|Vocation|State|Capacity|Mana|Soul|Cooldown|Experience|Level)', re.I)), - ('inventory_container_item', re.compile(r'(Inventory|Container|Object|Item|Depot|Stash|Loot|Goods|Store|Market)', re.I)), - ('chat_channel_npc', re.compile(r'(Talk|Channel|Npc|Message|Text|Modal)', re.I)), - ('trade_social_party', re.compile(r'(Trade|Friend|Vip|Social|Party|Guild|Team|Shared)', re.I)), - ('cyclopedia_progression', re.compile(r'(Cyclopedia|Bestiary|Bosstiary|Prey|Task|Wheel|Forge|Imbu|Quest|Reward|Proficiency|Bonus)', re.I)), - ] - - families: dict[str, list[str]] = collections.OrderedDict((name, []) for name, _ in family_rules) - families['other'] = [] - for full_name in server_names: - stem = full_name.removeprefix('GameserverMessage') - selected = 'other' - for family, regex in family_rules: - if regex.search(stem): - selected = family - break - families[selected].append(full_name) - assert sum(len(values) for values in families.values()) == 189 - assert sorted(name for values in families.values() for name in values) == server_names - (evidence / 'protocol-server-families.json').write_text( - json.dumps(families, indent=2, sort_keys=False) + '\n', encoding='utf-8' - ) - - method_regex = re.compile( - r'^(?:handle|received|receive|process|dispatch|parse|decode|on)[A-Z][A-Za-z0-9_]{1,120}(?:Message|Data|Event|Update|Changed|Received)$' - ) - generic_handler_regex = re.compile(r'(?:ProtocolMessageHandler|MessageHandler|ProtocolMessageQueue|GameserverGameSession|MessageQueue)') - - inbound_method_strings = sorted(set(value for value in printable_values if method_regex.match(value))) - handler_type_strings = sorted(set(value for value in printable_values if generic_handler_regex.search(value))) - - # Demangle relevant Itanium RTTI strings in one bounded batch. c++filt -t accepts type encodings - # such as N5tibia...E that appear in RTTI. Type presence is still only static evidence. - mangled = sorted(set(value for value in printable_values if re.fullmatch(r'N[0-9A-Za-z_]+E', value))) - if mangled: - proc = subprocess.run( - ['c++filt', '-t'], - input='\n'.join(mangled) + '\n', - text=True, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - check=True, - ) - demangled_all = [line.strip() for line in proc.stdout.splitlines()] - else: - demangled_all = [] - relevant_types = sorted(set( - value for value in demangled_all - if generic_handler_regex.search(value) - or re.search(r'(?:CreatureStorage|ContainerStorage|PlayerData|Inventory|Chat|Channel|GameSession|Protocol)', value) - )) - - # Exhaustive name-surface association. This is explicitly lexical/static and never promoted to a - # message->handler FACT by itself. - associations: list[dict[str, object]] = [] - unmatched: list[str] = [] - for full_name in server_names: - stem = full_name.removeprefix('GameserverMessage') - stem_norm = re.sub(r'[^a-z0-9]+', '', stem.lower()) - exact_candidates = [ - f'handle{stem}Message', - f'received{stem}Message', - f'receive{stem}Message', - f'process{stem}Message', - f'on{stem}Message', - ] - hits = sorted(set(candidate for candidate in exact_candidates if candidate in printable_values)) - broader = sorted(set( - value for value in inbound_method_strings - if stem_norm and stem_norm in re.sub(r'[^a-z0-9]+', '', value.lower()) - )) - all_hits = sorted(set(hits + broader)) - if not all_hits: - unmatched.append(full_name) - associations.append({ - 'message': full_name, - 'stem': stem, - 'lexical_handler_surfaces': all_hits, - 'evidence_strength': 'STATIC_LEXICAL_ASSOCIATION' if all_hits else 'UNKNOWN', - 'semantic_handler_edge_proven': False, - }) - - (evidence / 'inbound-lexical-associations.json').write_text( - json.dumps(associations, indent=2, sort_keys=True) + '\n', encoding='utf-8' - ) - (evidence / 'inbound-method-strings.txt').write_text( - '\n'.join(inbound_method_strings) + ('\n' if inbound_method_strings else ''), encoding='utf-8' - ) - (evidence / 'inbound-handler-type-strings.txt').write_text( - '\n'.join(handler_type_strings) + ('\n' if handler_type_strings else ''), encoding='utf-8' - ) - (evidence / 'relevant-demangled-types.txt').write_text( - '\n'.join(relevant_types) + ('\n' if relevant_types else ''), encoding='utf-8' - ) - - # Direct code-to-string xrefs are a bounded structural candidate signal only. We scan executable - # sections and retain xrefs only to exact starts of protocol/handler strings. This does not claim - # that the referring function is the semantic dispatcher. - interesting_values = set(server_names) | set(inbound_method_strings) | set(handler_type_strings) - interesting_va_to_value: dict[int, str] = {} - for record in printable_records: - value = str(record['value']) - if value in interesting_values: - interesting_va_to_value[int(record['va'])] = value - - md = Cs(CS_ARCH_X86, CS_MODE_64) - md.detail = True - md.skipdata = True - xrefs: dict[str, list[dict[str, object]]] = collections.defaultdict(list) - xref_limit_per_string = 8 - for section in sections: - if not (section['flags'] & 0x4) or section['size'] == 0: - continue - start = section['offset'] - end = start + section['size'] - code = raw[start:end] - for ins in md.disasm(code, section['va']): - targets: set[int] = set() - for operand in ins.operands: - if operand.type == X86_OP_MEM and operand.mem.base == X86_REG_RIP: - targets.add(ins.address + ins.size + operand.mem.disp) - elif operand.type == X86_OP_IMM: - targets.add(int(operand.imm)) - for target in targets: - value = interesting_va_to_value.get(target) - if value is None or len(xrefs[value]) >= xref_limit_per_string: - continue - xrefs[value].append({ - 'instruction_va': f'0x{ins.address:x}', - 'mnemonic': ins.mnemonic, - 'op_str': ins.op_str, - 'target_string_va': f'0x{target:x}', - 'evidence_strength': 'DIRECT_CODE_TO_STRING_XREF', - 'semantic_dispatcher_edge_proven': False, - }) - - xref_payload = [ - {'string': value, 'xrefs': refs} - for value, refs in sorted(xrefs.items()) - ] - (evidence / 'direct-code-string-xrefs.json').write_text( - json.dumps(xref_payload, indent=2, sort_keys=True) + '\n', encoding='utf-8' - ) - - # Reuse current-main relocation-aware resolver through an absolute checkout path, because this - # producer deliberately executes from runner scratch rather than from the repository directory. - profile = workspace / 'tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json' - resolver = workspace / 'tools/tibia_runtime_bridge/resolver.py' - assert profile.is_file(), profile - assert resolver.is_file(), resolver - resolver_proc = subprocess.run( - [sys.executable, str(resolver), '--profile', str(profile), str(raw_path)], - text=True, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - check=False, - ) - (evidence / 'known-anchor-vptr-resolution.json').write_text(resolver_proc.stdout, encoding='utf-8') - (evidence / 'known-anchor-vptr-resolution.stderr.txt').write_text(resolver_proc.stderr, encoding='utf-8') - assert resolver_proc.returncode == 0, resolver_proc.stderr - resolved = json.loads(resolver_proc.stdout) - assert all(item['unique'] for item in resolved['targets'].values()) - - priority_terms = re.compile(r'(WorldEntered|Pending|PlayerData|PlayerState|Creature|Inventory|Container|Talk|Channel|Modal|Death|Disconnect|Session)', re.I) - s2_priority = [] - assoc_by_message = {entry['message']: entry for entry in associations} - for message in server_names: - if not priority_terms.search(message): - continue - entry = assoc_by_message[message] - s2_priority.append({ - 'message': message, - 'lexical_handler_surfaces': entry['lexical_handler_surfaces'], - 'next_proof': 'resolve concrete QMeta/handler dispatch and downstream owner/storage edge from exact static code', - 'runtime_required': False, - 'worldmap_runtime_overlap': bool(re.search(r'(FullMap|FieldData|Column|Row|Floor|CreateOnMap|ChangeOnMap|DeleteOnMap)', message)), - }) - (evidence / 's2-priority-candidates.json').write_text( - json.dumps(s2_priority, indent=2, sort_keys=True) + '\n', encoding='utf-8' - ) - - summary = { - 'schema': 'track-a-s1-unfiltered-static-census-v1', - 'client': { - 'version': '15.32.df7b29', - 'size': len(raw), - 'sha256': exact_sha, - }, - 'runtime_access': 'none', - 'client_executed': False, - 'protocol_message_total': len(protocol_names), - 'client_to_server_total': len(client_names), - 'server_to_client_total': len(server_names), - 'all_inbound_names_preserved': len(server_names) == 189, - 'server_family_counts': {name: len(values) for name, values in families.items()}, - 'inbound_method_string_total': len(inbound_method_strings), - 'handler_type_string_total': len(handler_type_strings), - 'relevant_demangled_type_total': len(relevant_types), - 'messages_with_lexical_handler_surface': sum(bool(entry['lexical_handler_surfaces']) for entry in associations), - 'messages_without_lexical_handler_surface': len(unmatched), - 'direct_code_string_xref_string_total': len(xrefs), - 'direct_code_string_xref_total': sum(len(refs) for refs in xrefs.values()), - 'known_anchor_resolver_pass': True, - 'semantic_common_inbound_dispatcher': 'UNKNOWN', - 'raw_client_uploaded': False, - 'secret_access': False, - 'worldmap_runtime_access': False, - 'pr475_runtime_touched': False, - } - (evidence / 'summary.json').write_text(json.dumps(summary, indent=2, sort_keys=True) + '\n', encoding='utf-8') - (evidence / 'messages-without-lexical-handler-surface.txt').write_text( - '\n'.join(unmatched) + ('\n' if unmatched else ''), encoding='utf-8' - ) - - print('S1_CENSUS_SUMMARY=' + json.dumps(summary, sort_keys=True)) - print('S1_PROTOCOL_DENOMINATOR=PASS') - print('S1_ALL_189_INBOUND_NAMES_PRESERVED=PASS') - print('S1_KNOWN_ANCHOR_RESOLVER=PASS') - print('S1_COMMON_INBOUND_DISPATCHER=UNKNOWN') - print('S1_PR475_RUNTIME_TOUCHED=false') - print('S1_SECRET_ACCESS=false') - PY - - # Proprietary client bytes are never part of uploaded evidence. - rm -f "$r/client/client" "$r/client/client.lzma" - test ! -e "$r/client/client" - test ! -e "$r/client/client.lzma" - echo 'S1_RAW_CLIENT_REMOVED_BEFORE_UPLOAD=PASS' - - - name: Upload sanitized text and JSON evidence only - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 - with: - name: track-a-s1-static-${{ github.run_id }} - path: ${{ runner.temp }}/track-a-s1-static/evidence - if-no-files-found: error - retention-days: 7 From b25ea25b732154e273ef4182cbe9c14429acbbf6 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:53:56 +0200 Subject: [PATCH 13/22] docs(track-a): add S1 inbound static census report --- ...818-track-a-s1-unfiltered-static-census.md | 279 ++++++++++++++++++ 1 file changed, 279 insertions(+) create mode 100644 docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md diff --git a/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md new file mode 100644 index 0000000000..2a2eddb841 --- /dev/null +++ b/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md @@ -0,0 +1,279 @@ +# OTCLIENT Track A — exhaustive inbound static census + +Date: 2026-08-18 +Task: `OTC-20260818-track-a-s1-unfiltered-static-census` +PR: `#509` +Track: `official-client-re` +Execution: GitHub-hosted static exact-file analysis only (`runtime_access: none`) + +## Executive result + +The exact official Linux Tibia `15.32.df7b29` client contains a stable generated protocol denominator of: + +```text +349 total generated protocol message types +160 client -> server +189 server -> client +``` + +A fresh producer on run `32112814216` independently reproduced the same three protocol registries byte-for-byte as the earlier exact-build #473 sanitized artifact. This removes the historical 98-message capability regex as an exhaustive denominator: it was only a filtered discovery subset. + +The same fresh pass recovered a much broader inbound-oriented static surface: + +```text +542 handle/received/on/process-style method strings +148 relevant demangled protocol/storage/session/data types in the producer artifact +47 distinct *ProtocolMessageHandler class names with direct executable code-to-class-string xrefs +``` + +The resulting picture is not one monolithic inbound handler. The client contains many domain-specific native protocol handler classes, including dedicated player, creature, container, chat, market, store, quest, prey, sound, tutorial, trade and worldmap handlers. The exact wiring from generated message type to concrete handler dispatch remains a separate S2 proof problem. + +## Exact client fence + +```yaml +version: 15.32.df7b29 +size: 51965216 +sha256: e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe +packed_lzma_sha256: 496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b +platform: official_native_linux_only +``` + +Fresh producer markers: + +```text +run 32112814216 +job 95635760592 +result SUCCESS +artifact 9315562574 +digest sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 +``` + +The producer did not execute the client and deleted the packed/unpacked proprietary bytes before artifact upload. + +## Independent denominator control + +The prior #473 sanitized artifact is still available: + +```text +run 32022209943 +artifact 9285763750 +digest sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 +``` + +Fresh versus control registry hashes: + +| Registry | SHA-256 | Fresh == control | +|---|---|---| +| all 349 | `55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b` | yes | +| 160 client -> server | `621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0` | yes | +| 189 server -> client | `e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96` | yes | + +## Inbound generated-message coverage + +All 189 generated `GameserverMessage*` names are now durably persisted in: + +```text +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt +``` + +The corresponding 160 outbound names are persisted separately for denominator completeness. + +A name-surface comparison found at least one plausible inbound-oriented native method string for 188/189 generated server message names. This is a discovery correlation only; matching names do not prove dispatch. + +The automatic stem matcher missed only: + +```text +GameserverMessageTrackQuestFlags +``` + +The exact binary independently contains: + +```text +handleTrackedQuestFlagsMessage +receivedTrackedQuestFlagsMessage +onTrackedQuestFlagsChanged +``` + +This is a strong lexical naming variant (`Track` vs `Tracked`), but the direct generated-message -> method edge remains `UNKNOWN` until static control/dataflow proves it. + +## Domain-specific handler architecture + +Forty-seven distinct `*ProtocolMessageHandler` class-name strings have direct executable code xrefs in the exact binary. Representative handlers: + +```text +tibia::authentication::TLoginProtocolMessageHandler +tibia::chat::TChatProtocolMessageHandler +tibia::container::TContainerProtocolMessageHandler +tibia::creatures::TCreatureProtocolMessageHandler +tibia::game::TGameProtocolMessageHandler +tibia::game::TPlayerProtocolMessageHandler +tibia::game::TServerModalDialogProtocolMessageHandler +tibia::market::TMarketProtocolMessageHandler +tibia::network::TNetworkQualityProtocolMessageHandler +tibia::quickloot::TManagedContainersProtocolMessageHandler +tibia::questlog::TQuestLogProtocolMessageHandler +tibia::sound::TSoundProtocolMessageHandler +tibia::store::TStoreProtocolMessageHandler +tibia::trade::TPlayerTradeProtocolMessageHandler +tibia::worldmap::TWorldmapProtocolMessageHandler +``` + +The complete 47-entry address catalogue is persisted in `protocol-handler-code-xrefs.tsv`. + +The xrefs cluster in several generated-code regions and are compatible with Qt metaobject/metacast-related code, but this task does not promote that role. A later S2 discriminator should locate the exact surrounding function boundary, metaobject metadata and invoke dispatch table before assigning a semantic role. + +## High-value non-worldmap static correlations + +The exact binary contains the following generated-message and receive/handle string pairs or families. + +### Player state + +```text +GameserverMessagePlayerDataBasic + -> handlePlayerDataBasicMessage + -> receivedPlayerDataBasicMessage + +GameserverMessagePlayerDataCurrent + -> receivedPlayerDataCurrentMessage + +GameserverMessagePlayerState + -> receivedPlayerStateMessage + +GameserverMessagePlayerInventory + -> handlePlayerInventoryMessage + -> receivedPlayerInventoryMessage + +GameserverMessagePlayerSkills + -> receivedPlayerSkillsMessage + -> onPlayerSkillStatsChanged +``` + +The current-main relocation-aware resolver also uniquely confirms: + +```text +TPlayerProtocolMessageHandler vptr 0x308a008 +TPlayerData vptr 0x308ca70 +``` + +What remains unknown is the exact static handler dispatch and handler -> `TPlayerData` mutation edge. + +### Creatures + +```text +GameserverMessageCreatureData -> receivedCreatureDataMessage +GameserverMessageCreatureHealth -> receivedCreatureHealthMessage +GameserverMessageCreatureUpdate -> receivedCreatureUpdateMessage +GameserverMessageMoveCreature -> receivedMoveCreatureMessage +``` + +Static class/type evidence independently contains `tibia::creatures::TCreatureProtocolMessageHandler`, and the current-main resolver uniquely confirms `TCreatureStorage` primary vptr `0x308d078`. + +The handler -> storage edge remains `UNKNOWN`. + +### Containers and inventory + +```text +GameserverMessageContainer +GameserverMessageCreateInContainer +GameserverMessageChangeInContainer +GameserverMessageDeleteInContainer +GameserverMessageCloseContainer +GameserverMessagePlayerInventory +GameserverMessageSetInventory +GameserverMessageDeleteInventory +``` + +correlate with exact `handle*Message` / `received*Message` surfaces. Static type evidence contains `tibia::container::TContainerProtocolMessageHandler`; the current-main resolver uniquely confirms `TContainerStorage` primary vptr `0x308a1a0`. + +The handler -> storage edge remains `UNKNOWN`. + +### Chat/channel + +```text +GameserverMessageTalk -> handleTalkMessage / receivedTalkMessage +GameserverMessageChannels -> handleChannelsMessage / receivedChannelsMessage +GameserverMessageChannelEvent -> handleChannelEventMessage / receivedChannelEventMessage +GameserverMessageOpenChannel -> handleOpenChannelMessage / receivedOpenChannelMessage +GameserverMessagePrivateChannel -> handlePrivateChannelMessage / receivedPrivateChannelMessage +``` + +Static RTTI/type census contains both `tibia::chat::TChatProtocolMessageHandler` and chat storage/controller families. Concrete dispatch/storage wiring remains `UNKNOWN`. + +## Exact-build resolver revalidation + +All current profile targets re-resolved uniquely on the fresh exact client: + +| Target | Primary vptr | +|---|---:| +| `TGameClient` | `0x3076908` | +| `TGameserverGameSession` | `0x3078ba0` | +| `TPlayerProtocolMessageHandler` | `0x308a008` | +| `TPlayerData` | `0x308ca70` | +| `TContainerStorage` | `0x308a1a0` | +| `TCreatureStorage` | `0x308d078` | +| `TWorldmapProtocolMessageHandler` | `0x30871d8` | + +These are static exact-build anchors, not current runtime addresses or live-object proof. + +## Family-bucket negative control + +The producer emitted rough convenience family buckets. Full review rejected those buckets as semantic evidence because substring-only grouping creates collisions such as: + +```text +Mark inside Market +row inside Browse +``` + +No result in this report depends on those buckets. Exact generated names, exact native method strings, exact class names and explicit xrefs remain the evidence sources. + +## What is proven versus still open + +```yaml +FACT: + exact_generated_protocol_denominator: 349 + client_to_server_registry: 160 + server_to_client_registry: 189 + fresh_lists_match_independent_control_byte_for_byte: true + inbound_oriented_method_strings: 542 + protocol_handler_classes_with_direct_code_string_xref: 47 + current_profile_vptr_anchors_unique: true + +INFERENCE: + generated_message_to_similar_handle_received_method_name: static_lexical_only + handler_architecture: domain_partitioned_by_many_protocol_handler_types + +UNKNOWN: + exact_generated_message_to_handler_dispatch + exact_handler_to_storage_controller_mutation_edge + common_global_inbound_dispatcher + runtime_object_identity + runtime_message_delivery +``` + +## Next safe static work + +While PR #475 owns the physical native-login/worldmap runtime lane, the highest-value independent S2 work is: + +```text +1. Player inbound QMeta/dispatch graph + TPlayerProtocolMessageHandler + -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills + -> static TPlayerData ownership/mutation edge + +2. Creature inbound QMeta/dispatch graph + TCreatureProtocolMessageHandler + -> CreatureData / CreatureHealth / CreatureUpdate / MoveCreature + -> static TCreatureStorage ownership/mutation edge + +3. Container inbound QMeta/dispatch graph + TContainerProtocolMessageHandler + -> Container / Create / Change / DeleteInContainer + -> static TContainerStorage ownership/mutation edge + +4. Chat inbound QMeta/dispatch graph + TChatProtocolMessageHandler + -> Talk / Channels / ChannelEvent / PrivateChannel + -> chat storage/controller edge +``` + +These are static exact-file tasks and do not need to consume the serialized physical runtime. Worldmap semantics and native-login runtime propagation remain with #475. From cd10ecf0f7e8cb9752af884074bb81f1a1132f0a Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:54:56 +0200 Subject: [PATCH 14/22] docs(track-a): checkpoint completed S1 research --- ...818-track-a-s1-unfiltered-static-census.md | 266 +++++++++++------- 1 file changed, 157 insertions(+), 109 deletions(-) diff --git a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md index 63fd5c498a..d26298e34d 100644 --- a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md +++ b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md @@ -1,6 +1,6 @@ --- task_id: OTC-20260818-track-a-s1-unfiltered-static-census -status: investigating +status: validating agent: ChatGPT session_id: chatgpt-s1-static-census-20260818 session_role: researcher @@ -8,7 +8,7 @@ project_lane: otclient lane: P2-NETWORK track_id: official-client-re task_kind: discovery -phase: investigate +phase: exact-head-validation execution_mode: github_only execution_reason: exhaustive deterministic exact-client protocol/QMeta census without touching the serialized physical runtime branch: research/OTC-20260818-track-a-s1-unfiltered-static-census @@ -16,7 +16,7 @@ base_branch: main base_main: ed09418b431c28087775b419f85bed404fa85d70 related_pr: 509 created: 2026-08-18T09:29:00+02:00 -updated: 2026-08-18T09:43:00+02:00 +updated: 2026-08-18T09:54:00+02:00 risk: medium implementation_authorized: true credentials_allowed: false @@ -40,7 +40,6 @@ gate_b: NOT_APPLICABLE bootstrap: NOT_APPLICABLE target_uniqueness: NOT_APPLICABLE owned_paths: - - .github/workflows/track-a-s1-unfiltered-static-census.yml - docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md - docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/** - docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md @@ -56,8 +55,8 @@ reuses: depends_on: [] blocks: [] non_overlap: - - PR #475 runtime branch, task record, workflow surfaces, Synology state, lease, display, login budget and physical session are read-only/non-targeted and will not be touched. - - PR #498/#499 predecessor auth/session branches are not modified. + - PR #475 runtime branch, task record, workflow surfaces, Synology state, lease, display, login budget and physical session were not touched or observed. + - PR #498/#499 predecessor auth/session branches were not modified. - Track B PR #284 and OTC2 protocol work are outside scope. policy_version: 2 context_pressure: medium @@ -75,7 +74,7 @@ feature_scope: e2e_required: false validation_level: focused invocation_started_at: 2026-08-18T09:29:00+02:00 -last_progress_at: 2026-08-18T09:43:00+02:00 +last_progress_at: 2026-08-18T09:54:00+02:00 ci_checks_for_current_head: 0 ci_check_generation: draft terminal_ci_wait_started_at: null @@ -95,8 +94,8 @@ Execute the archived capability-sweep programme's next safe static step without exact official Linux client 15.32.df7b29 -> exhaustive unfiltered generated-message census -> exhaustive inbound-oriented QMeta/handler string census - -> bounded static xref/dispatch candidate extraction where directly provable - -> machine-readable S1 registries and ranked S2 follow-up edges + -> bounded static xref candidate extraction + -> durable S1 registries and ranked S2 follow-up edges ``` This task is deliberately independent of the currently active PR #475 runtime/world-entry/worldmap mutation work. @@ -111,135 +110,184 @@ packed_client_lzma_sha256: 496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a80704 platform: official_native_linux_only ``` -A mismatched size/hash/build fails closed. +# Acceptance inventory -# Scope +- [x] exact client compressed and unpacked hashes revalidated on hosted runner; +- [x] generated-message denominator revalidated: 349 total / 160 client->server / 189 server->client; +- [x] complete 160/189 registries persisted in Git; +- [x] fresh registries independently compared byte-for-byte with #473 sanitized control and all three hashes match exactly; +- [x] all 189 inbound names preserved; +- [x] unfiltered inbound-oriented method census persisted: 542 exact strings; +- [x] 47 distinct `*ProtocolMessageHandler` class names with direct code-to-class-string xrefs persisted; +- [x] bounded xref evidence strength explicitly stops at `DIRECT_CODE_TO_STRING_XREF` and does not claim a dispatcher edge; +- [x] current-main exact-build vptr anchors revalidated: 7/7 unique; +- [x] generated-message-to-similar-method correlations classified only as static lexical inference; +- [x] sole automatic lexical miss identified as `GameserverMessageTrackQuestFlags`; nearby `TrackedQuestFlags` methods recorded without overclaim; +- [x] no common inbound dispatcher was invented; status remains `UNKNOWN`; +- [x] producer substring-family grouping was independently falsified as semantic evidence (`Mark`/`Market`, `row`/`Browse`) and excluded from promoted conclusions; +- [x] no live/runtime/worldmap mutation or #475-owned surface touched; +- [x] no raw client bytes committed or uploaded; +- [x] temporary producer workflow removed from final branch diff; +- [x] result/report distinguish FACT / INFERENCE / UNKNOWN; +- [x] E2E = NOT_APPLICABLE: static exact-file discovery only; no product/runtime behavior changed; +- [ ] fresh final diff audit on current final head; +- [ ] exact-head required repository CI/governance green; +- [ ] zero unresolved material review findings and coordinator/promotion disposition where required; -The bounded S1 producer may: +# Fresh producer evidence -- fetch the exact public Linux client on a disposable GitHub-hosted runner using the already-reviewed exact-hash/WARP producer pattern; -- decompress only in runner scratch space; -- inspect ELF sections, printable strings, RTTI/type names, QMeta-oriented string surfaces and bounded disassembly/xrefs; -- reuse the current-main relocation-aware exact-build resolver for known static anchors; -- write only sanitized text/JSON registries and summaries; -- delete compressed/unpacked proprietary client bytes before artifact upload. +```yaml +producer_pre_checkpoint_head: cb575cec2077c8002bb6712ffac4d4dc77420499 +workflow_run: 32112814216 +job: 95635760592 +conclusion: SUCCESS +artifact: 9315562574 +artifact_digest: sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 +client_executed: false +runtime_access: none +secret_access: false +pr475_runtime_touched: false +raw_client_uploaded: false +``` -It may not: +Primary durable evidence: -- launch the official client; -- access process memory, X11, VNC, Synology, PR #475 runtime state, credentials, account/session values or packet captures; -- upload/commit the raw proprietary executable or secret-bearing material; -- infer live behavior from static names alone. +```text +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json +docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md +``` -# Questions +# Independent denominator control -1. Revalidate the complete generated protocol denominator (`349 = 160 client -> server + 189 server -> client`) on the exact client. -2. Persist the complete **189-name server -> client** registry, grouped by stable lexical families without dropping unmatched names. -3. Enumerate exact-binary inbound-oriented handler/QMeta strings without the historical narrow capability regex, including `handle*Message`, `received*Message`, protocol-handler/message-queue types and relevant RTTI types. -4. Where bounded static evidence directly supports it, associate a generated server message family with lexical/QMeta surfaces and concrete code-to-string xref candidates. -5. Keep all unsupported message->handler or handler->storage edges explicitly `UNKNOWN`; do not force a single common inbound dispatcher hypothesis. -6. Produce ranked S2 candidates for later dependency-graph proof, prioritizing session/world entry, player state, creatures, inventory/containers, chat/world events and non-worldmap protocol surfaces. +The sanitized exact-build #473 artifact was independently re-opened during this task: -# Acceptance inventory +```yaml +run: 32022209943 +artifact: 9285763750 +artifact_digest: sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 +protocol_all_sha256: 55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b +client_to_server_sha256: 621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0 +server_to_client_sha256: e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96 +fresh_lists_byte_identical: true +``` -- [ ] exact client compressed and unpacked hashes revalidated on hosted runner; -- [ ] generated-message denominator revalidated and complete 160/189 registries persisted; -- [ ] all 189 inbound names preserved in machine-readable evidence; -- [ ] unfiltered inbound-oriented handler/QMeta census persisted with counts and exact string evidence; -- [ ] bounded static code-to-string xref candidates persisted with evidence strength labels; -- [ ] known current-main exact-build vptr anchors revalidated using the repository resolver; -- [ ] no absence claim is made from a filtered subset; -- [ ] no live/runtime/worldmap mutation or #475-owned surface is touched; -- [ ] no raw client bytes are committed or uploaded; -- [ ] temporary producer workflow removed before final merge; -- [ ] result report distinguishes FACT / INFERENCE / UNKNOWN / DISPROVEN; -- [ ] E2E = NOT_APPLICABLE with reason: static exact-file discovery only; -- [ ] fresh audit, exact-head required CI and zero unresolved material review findings before completion. - -# Admission +# Material findings -```yaml -track_id: official-client-re -runtime_access: none -runtime_owner_task: NOT_APPLICABLE -runtime_namespace: NOT_APPLICABLE -canonical_registration: NOT_APPLICABLE -canonical_lease_generation: NOT_APPLICABLE -registration_lease_generation: NOT_APPLICABLE -gate_a: NOT_APPLICABLE -generation_rebind: NOT_APPLICABLE -gate_b: NOT_APPLICABLE -bootstrap: NOT_APPLICABLE -target_uniqueness: NOT_APPLICABLE -mutation_authorized: false +## FACT — protocol denominator + +```text +349 generated protocol message names +160 GameclientMessage* +189 GameserverMessage* ``` -# Existing independent denominator control +The historical 98-message capability-regex list was only a filtered subset and is not the denominator. -The sanitized exact-build artifact from #473 remains available and was independently re-opened during this task: +## FACT — inbound-oriented native surface -```yaml -run: 32022209943 -artifact: 9285763750 -artifact_digest: sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 -artifact_expired: false -observed_files: - - protocol-all.txt - - protocol-client-to-server.txt - - protocol-server-to-client.txt - - summary.json -control_counts: - protocol_total: 349 - client_to_server: 160 - server_to_client: 189 +```text +542 inbound-oriented method strings +148 relevant demangled protocol/storage/session/data types in the producer artifact +51 interesting strings with direct executable code xrefs +52 retained direct xrefs +47 distinct *ProtocolMessageHandler class names with direct executable xrefs +``` + +Representative exact handler classes include player, creature, container, chat, game, login, market, quickloot, quest, sound, store, trade and worldmap domains. + +## FACT — current exact-build anchors + +```text +TGameClient 0x3076908 +TGameserverGameSession 0x3078ba0 +TPlayerProtocolMessageHandler 0x308a008 +TPlayerData 0x308ca70 +TContainerStorage 0x308a1a0 +TCreatureStorage 0x308d078 +TWorldmapProtocolMessageHandler 0x30871d8 ``` -That artifact is a comparison control, not a substitute for the fresh S1 producer. +All seven were re-resolved uniquely by the current-main relocation-aware resolver on the fresh exact binary. + +## INFERENCE — lexical message/method alignment + +188/189 generated inbound names have at least one exact/broader `handle*` / `received*` / related method surface under the bounded static matcher. This is not a call edge. + +The one automatic miss is `GameserverMessageTrackQuestFlags`; `handleTrackedQuestFlagsMessage`, `receivedTrackedQuestFlagsMessage` and `onTrackedQuestFlagsChanged` exist separately and are retained as a naming-variant hypothesis only. + +## UNKNOWN — semantic wiring + +```text +GameserverMessageX -> exact handler dispatch +handler -> storage/controller mutation +single/global inbound dispatcher +runtime delivery/state mutation +``` # Repair history -## Repair 1 — checkout/scratch path fence +## Repair 1 — checkout/scratch resolver path + +Self-review found that the first producer implementation changed cwd to runner scratch but called the repository resolver through a relative `tools/...` path. The producer was repaired to use exact `$GITHUB_WORKSPACE` paths and assert resolver/profile existence before evidence was accepted. `c++filt -t` was also used for RTTI type encodings. No pre-repair result was promoted. + +## Audit finding A1 — diagnostic family grouping rejected + +Post-artifact review found that substring-only convenience grouping could misclassify names (`Mark` inside `Market`, `row` inside `Browse`). Those buckets are not durable semantic evidence and no report conclusion depends on them. Exact names/types/xrefs are used instead. + +# Non-overlap / E2E -The first producer implementation changed the shell working directory to runner scratch before invoking the repository resolver through a relative `tools/...` path. Self-review identified that this would make known-anchor validation depend on the wrong current directory. +```yaml +pr475_runtime_observed: false +pr475_runtime_mutated: false +synology_used: false +x11_or_vnc_used: false +process_memory_used: false +credentials_used: false +login_performed: false +gameplay_performed: false +physical_e2e: + result: NOT_APPLICABLE + reason: static exact-file discovery only; no runtime/product behavior changed +``` -Repair: +# Ranked next static frontier + +While #475 owns live native-login/worldmap runtime, next independent S2 priority is: ```text -profile/resolver relative path - -> explicit $GITHUB_WORKSPACE absolute paths - -> assert both files exist before invoking resolver +TPlayerProtocolMessageHandler + -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills + -> exact QMeta/dispatch targets + -> exact static owner/mutation edge into TPlayerData where provable ``` -The same repair also uses `c++filt -t` for RTTI type encodings and enables Capstone skipdata for the bounded executable-section xref scan. No runtime or evidence claim was promoted from the pre-repair run. +Then, independently: + +```text +TCreatureProtocolMessageHandler -> TCreatureStorage +TContainerProtocolMessageHandler -> TContainerStorage +TChatProtocolMessageHandler -> chat storage/controller +``` # Checkpoint ```yaml -checkpoint_version: 2 -status: investigating -phase: investigate -base_main: ed09418b431c28087775b419f85bed404fa85d70 +checkpoint_version: 3 +status: validating +phase: exact-head-validation +base_main_at_claim: ed09418b431c28087775b419f85bed404fa85d70 pr: 509 -producer_workflow: .github/workflows/track-a-s1-unfiltered-static-census.yml -pre_repair_head: 86bb32ffc0c06940cd76169a9f7123de1ff3c275 -repaired_producer_head: d4666383ae4bae6524d2b47a70ed0a9e0efc4c51 -first_producer_run: 32112477071 -last_completed_step: implemented the bounded hosted producer, independently re-opened the #473 sanitized denominator artifact, and repaired a checkout/scratch resolver-path defect before accepting any result -proven: - - PR #475 owns the current physical runtime/worldmap login lane and is outside this task's mutation/observation scope. - - The archived capability experiment task explicitly names exhaustive unfiltered S1 protocol/QMeta/runtime census as the next programme action. - - Current routing sends deterministic static Track A work to GitHub-hosted runners with runtime_access none. - - The independent #473 sanitized artifact still contains 349 generated names split 160 client-to-server / 189 server-to-client. - - The current-main resolver/profile provide exact-build static anchors including TPlayerProtocolMessageHandler, TPlayerData, TCreatureStorage and TContainerStorage. -unknown: - - fresh repaired-producer result and artifact identity - - complete unfiltered inbound handler/method denominator on the exact client - - number and strength of direct code-to-string xrefs recoverable in one bounded producer - - whether inbound handling is one dispatcher or several independent handler families -rejected_hypotheses: - - reuse PR #475 physical runtime for this census: rejected because static hosted evidence is sufficient and runtime is separately owned. - - treat the old 98 capability-filtered protocol list as exhaustive: rejected by the accepted 349-name denominator. - - invoke the repository resolver relative to scratch cwd: rejected by self-review; checkout location is now explicit. +pre_checkpoint_head: b25ea25b732154e273ef4182cbe9c14429acbbf6 +producer_workflow_removed: true +research_result: COMPLETE +promotion_status: PENDING_FINAL_AUDIT_AND_EXACT_HEAD_CHECKS +last_completed_step: persisted complete protocol registries, 542-method census, 47 handler xrefs, exact vptr anchors, result and report; removed the temporary producer blockers: [] -next_action: inspect the next exact-head S1 workflow result/artifact; if it is green, persist sanitized evidence and remove the temporary producer, otherwise repair only the first concrete failure within the bounded repair budget. +next_action: perform full final PR diff/changed-path audit against current main, reconcile only real base drift if necessary, then require exact-head CI/governance and review hygiene before promotion/merge. ``` From b96815551b9ea02d45250ac5d4feb1f9d556b9a5 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:56:04 +0200 Subject: [PATCH 15/22] docs(track-a): persist complete received-message method surface --- .../received-message-methods.txt | 189 ++++++++++++++++++ 1 file changed, 189 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt new file mode 100644 index 0000000000..894c9f09dc --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt @@ -0,0 +1,189 @@ +receivedAmbientLightMessage +receivedBestiaryTrackerMessage +receivedBlessingsDialogMessage +receivedBlessingsMessage +receivedBossDifficultySelectionMessage +receivedBossSlotsMessage +receivedBossTrackingMessage +receivedBosstiaryHighlightMessage +receivedBosstiaryMessage +receivedBosstiaryStaticDataMessage +receivedBottomFloorMessage +receivedBottomRowMessage +receivedBuddyDataMessage +receivedBuddyGroupDataMessage +receivedBuddyStatusChangeMessage +receivedBugReportsAllowedMessage +receivedChangeInContainerMessage +receivedChangeOnMapMessage +receivedChannelEventMessage +receivedChannelsMessage +receivedCharacterTradeConfigurationMessage +receivedClientCheckMessage +receivedCloseChannelMessage +receivedCloseContainerMessage +receivedCloseDepotSearchMessage +receivedCloseExaltationDialogMessage +receivedCloseImbuingDialogMessage +receivedCloseNPCTradeMessage +receivedCloseRewardWallMessage +receivedCloseTradeMessage +receivedConfigureCreaturePodiumMessage +receivedContainerMessage +receivedCounterOfferMessage +receivedCreateInContainerMessage +receivedCreateOnMapMessage +receivedCreatureDataMessage +receivedCreatureHealthMessage +receivedCreatureLightMessage +receivedCreatureMarksMessage +receivedCreatureOutfitMessage +receivedCreaturePartyMessage +receivedCreatureSkullMessage +receivedCreatureSpeedMessage +receivedCreatureTypeMessage +receivedCreatureUnpassMessage +receivedCreatureUpdateMessage +receivedCreditBalanceMessage +receivedCyclopediaCharacterInfoMessage +receivedCyclopediaCurrentHouseDataMessage +receivedCyclopediaHouseActionResultMessage +receivedCyclopediaMapDataMessage +receivedCyclopediaStaticHouseDataMessage +receivedDailyRewardBasicMessage +receivedDailyRewardCollectionStateMessage +receivedDailyRewardHistoryMessage +receivedDeadMessage +receivedDeleteInContainerMessage +receivedDeleteInventoryMessage +receivedDeleteOnMapMessage +receivedDepotSearchDetailListMessage +receivedDepotSearchResultMessage +receivedEditGuildMessageMessage +receivedEditListMessage +receivedEditTextMessage +receivedExaltationBaseDataMessage +receivedExaltationDialogRefreshMessage +receivedExaltationHistoryMessage +receivedExaltationResultMessage +receivedExivaSuppressedMessage +receivedFieldDataMessage +receivedFriendSystemDataMessage +receivedFullMapMessage +receivedGameEventMessage +receivedGemAtelierGemRevealedMessage +receivedGraphicalEffectsMessage +receivedHighscoresMessage +receivedHirelingNameChangeMessage +receivedImbuementDurationsMessage +receivedImbuingDialogRefreshMessage +receivedImpactTrackingMessage +receivedInspectionListMessage +receivedInspectionStateMessage +receivedItemLootedMessage +receivedItemWastedMessage +receivedKillTrackingMessage +receivedLeftColumnMessage +receivedLoginAdviceMessage +receivedLoginChallengeMessage +receivedLoginErrorMessage +receivedLoginSuccessMessage +receivedLoginWaitMessage +receivedMarketBrowseMessage +receivedMarketDetailMessage +receivedMarketEnterMessage +receivedMarketLeaveMessage +receivedMarketStatisticsMessage +receivedMessageMessage +receivedMonsterCyclopediaBonusEffectsMessage +receivedMonsterCyclopediaMessage +receivedMonsterCyclopediaMonstersMessage +receivedMonsterCyclopediaNewDetailsMessage +receivedMonsterCyclopediaRaceMessage +receivedMoveCreatureMessage +receivedMultiUseDelayMessage +receivedNPCOfferMessage +receivedNpcTalkPartersMessage +receivedObjectInfoMessage +receivedOfferDescriptionMessage +receivedOpenChannelMessage +receivedOpenOwnChannelMessage +receivedOpenRewardWallMessage +receivedOutfitMemorialMessage +receivedOutfitMessage +receivedOwnOfferMessage +receivedPartyHuntAnalyserMessage +receivedPassiveAbilityDataMessage +receivedPendingStateEnteredMessage +receivedPingBackMessage +receivedPingMessage +receivedPlayerDataBasicMessage +receivedPlayerDataCurrentMessage +receivedPlayerGoodsMessage +receivedPlayerInventoryMessage +receivedPlayerSkillsMessage +receivedPlayerStateMessage +receivedPremiumTriggerMessage +receivedPreyDataMessage +receivedPreyPricesMessage +receivedPreyTimeLeftMessage +receivedPrivateChannelMessage +receivedPvpSituationsMessage +receivedQuestLineMessage +receivedQuestLogMessage +receivedReadyForSecondaryConnectionMessage +receivedRemoveGraphicalEffectMessage +receivedRequestPurchaseDataMessage +receivedResourceBalanceMessage +receivedRestingAreaStateMessage +receivedRightColumnMessage +receivedSessionDumpStartMessage +receivedSessionEndInformationMessage +receivedSetInventoryMessage +receivedSetStoreButtonDeeplinkMessage +receivedSetTacticsMessage +receivedShapedPerkReshapeOffersMessage +receivedShowGameNewsMessage +receivedShowMessageDialogMessage +receivedShowModalDialogMessage +receivedShowMultiOfflineTrainingDialogMessage +receivedSkillWheelMessage +receivedSnapBackMessage +receivedSoulSealsDialogMessage +receivedSoundTriggerMessage +receivedSpecialContainersAvailableMessage +receivedSpellDataModificationMessage +receivedSpellDelayMessage +receivedSpellGroupDelayMessage +receivedStashMessage +receivedStopMessage +receivedStoreButtonIndicatorsMessage +receivedStoreCategoriesMessage +receivedStoreErrorMessage +receivedStoreOffersMessage +receivedStoreSuccessMessage +receivedSwitchPresetMessage +receivedTalkMessage +receivedTaskboardMessage +receivedTeamFinderTeamLeaderMessage +receivedTeamFinderTeamMemberMessage +receivedTextForReportMessage +receivedTibiaTimeMessage +receivedTopFloorMessage +receivedTopRowMessage +receivedTrackedQuestFlagsMessage +receivedTransactionDetailsMessage +receivedTransactionHistoryMessage +receivedTutorialHintMessage +receivedUnjustifiedPointsMessage +receivedUnlockedSpellsMessage +receivedUpdateExivaOptionsMessage +receivedUpdateManagedContainersMessage +receivedUpdateTargetMessage +receivedUpdatingShopBalanceMessage +receivedVocationSpecificPlayerDataMessage +receivedWaitMessage +receivedWeaponProficiencyMessage +receivedWeaponProficiencyNotificationMessage +receivedWorldEnteredMessage +receivedXpChangedMessage From b2f11d7171130006acfe317042aae9584a302376 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:56:33 +0200 Subject: [PATCH 16/22] docs(track-a): tighten S1 receive-surface classification --- .../summary.json | 24 ++++++++++++------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json index 38d2afbcbc..a70749559e 100644 --- a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json @@ -1,5 +1,5 @@ { - "schema": "track-a-s1-unfiltered-static-census-result-v1", + "schema": "track-a-s1-unfiltered-static-census-result-v2", "task": "OTC-20260818-track-a-s1-unfiltered-static-census", "pr": 509, "exact_client": { @@ -41,11 +41,18 @@ "all_189_inbound_names_persisted": true, "all_160_outbound_names_persisted": true }, - "inbound_static_surface": { - "inbound_oriented_method_strings": 542, - "messages_with_lexical_handler_surface": 188, - "messages_without_lexical_handler_surface": 1, - "sole_unmatched_generated_message": "GameserverMessageTrackQuestFlags", + "static_method_surface": { + "broad_candidate_method_strings": 542, + "handle_prefixed": 149, + "received_prefixed": 189, + "on_prefixed": 204, + "received_message_methods_persisted": 189, + "server_message_stems_matching_received_method_stems_exactly": 188, + "sole_stem_variant": { + "generated": "GameserverMessageTrackQuestFlags", + "received_method": "receivedTrackedQuestFlagsMessage" + }, + "received_surface_is_dispatch_proof": false, "relevant_demangled_types_in_artifact": 148, "direct_code_to_string_xref_strings": 51, "direct_code_to_string_xrefs": 52, @@ -64,10 +71,11 @@ }, "classification": { "generated_message_denominator": "FACT", + "complete_received_method_name_denominator": "FACT_STRING_PRESENCE", + "received_method_to_generated_message_name_alignment": "INFERENCE_STATIC_LEXICAL_ONLY", "handler_class_type_presence": "FACT", "direct_code_to_handler_class_string_xrefs": "FACT", - "message_name_to_similar_received_or_handle_method_name": "INFERENCE_STATIC_LEXICAL_ONLY", - "message_to_concrete_handler_dispatch": "UNKNOWN", + "generated_message_to_concrete_handler_dispatch": "UNKNOWN", "handler_to_storage_or_controller_edge": "UNKNOWN", "one_common_inbound_dispatcher": "UNKNOWN" }, From b36b6b275014d5f4ce0054d1e6af13c6b1423016 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:57:08 +0200 Subject: [PATCH 17/22] docs(track-a): tighten S1 evidence semantics --- .../result.md | 140 +++++++++--------- 1 file changed, 74 insertions(+), 66 deletions(-) diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md index 0bbaaa54a7..02c3f14a31 100644 --- a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md @@ -44,19 +44,51 @@ sha256 e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96 The complete 160/189 registries are persisted beside this report. The old 98-message capability-regex subset is therefore conclusively not an exhaustive protocol denominator. -## FACT — unfiltered inbound-oriented static surface +## FACT — complete `received*Message` string denominator -The fresh exact binary contains: +The broader producer selector retained `542` candidate method strings, but full review split that set rather than calling all 542 inbound handlers: + +```text +handle* 149 +received* 189 +on* 204 +TOTAL 542 +``` + +The exact result that matters for the inbound S1 denominator is: + +```text +GENERATED_SERVER_MESSAGES=189 +RECEIVED_MESSAGE_METHOD_STRINGS=189 +EXACT_STEM_MATCHES=188 +NAMING_VARIANTS=1 +``` + +The complete 189-method receive surface is persisted in `received-message-methods.txt`. + +For 188 entries the mapping obtained by removing `GameserverMessage` and `received...Message` wrappers is exactly equal. The sole name variant is: + +```text +GameserverMessageTrackQuestFlags +receivedTrackedQuestFlagsMessage +``` + +The binary also contains `handleTrackedQuestFlagsMessage` and `onTrackedQuestFlagsChanged`. + +Presence and denominator counts are **FACT**. The apparent one-to-one generated-message ↔ receive-method naming alignment is **INFERENCE_STATIC_LEXICAL_ONLY** until exact static dispatch/dataflow proves the edge. + +## FACT — protocol-handler type/code surface + +The fresh exact binary produced: ```text -542 inbound-oriented handle/received/on/process-style method strings 148 relevant demangled protocol/storage/session/data types in the producer artifact 51 interesting strings with direct executable code xrefs 52 total retained direct code-to-string xrefs 47 distinct *ProtocolMessageHandler class names with direct code-to-class-string xrefs ``` -Examples of directly present handler classes include: +Examples: ```text tibia::authentication::TLoginProtocolMessageHandler @@ -73,85 +105,59 @@ tibia::trade::TPlayerTradeProtocolMessageHandler tibia::worldmap::TWorldmapProtocolMessageHandler ``` -All 47 direct class-string xrefs are persisted in `protocol-handler-code-xrefs.tsv`. These xrefs prove exact code references to the class-name strings. They do **not** by themselves prove that the referring instruction is the semantic message dispatcher. +All 47 direct class-string xrefs are persisted in `protocol-handler-code-xrefs.tsv`. These xrefs prove exact executable references to the class-name strings. They do **not** prove that the referring instruction is the semantic message dispatcher. + +The many domain-specific handler types prove a partitioned native handler **type surface**. They do not prove or disprove a shared upstream dispatcher/queue that routes into those handlers; that remains `UNKNOWN`. ## FACT — current-main exact-build anchors still resolve The repository's relocation-aware resolver re-resolved every configured exact-build target uniquely: ```text -TGameClient primary vptr 0x3076908 -TGameserverGameSession primary vptr 0x3078ba0 -TPlayerProtocolMessageHandler primary vptr 0x308a008 -TPlayerData primary vptr 0x308ca70 -TContainerStorage primary vptr 0x308a1a0 -TCreatureStorage primary vptr 0x308d078 +TGameClient primary vptr 0x3076908 +TGameserverGameSession primary vptr 0x3078ba0 +TPlayerProtocolMessageHandler primary vptr 0x308a008 +TPlayerData primary vptr 0x308ca70 +TContainerStorage primary vptr 0x308a1a0 +TCreatureStorage primary vptr 0x308d078 TWorldmapProtocolMessageHandler primary vptr 0x30871d8 ``` This is exact-file structural evidence only; no current runtime instance is claimed. -## INFERENCE — generated message names align strongly with native receive surfaces +## High-value non-worldmap lexical correlations -A deliberately name-only pass found an exact/broader lexical `handle*` / `received*` / related method surface for `188 / 189` generated server messages. - -High-value non-worldmap examples: +These are name-surface correlations only, not proven call edges. ```text -GameserverMessagePlayerDataCurrent - -> receivedPlayerDataCurrentMessage - -GameserverMessagePlayerState - -> receivedPlayerStateMessage - -GameserverMessagePlayerInventory - -> handlePlayerInventoryMessage - -> receivedPlayerInventoryMessage - -GameserverMessageCreatureHealth - -> receivedCreatureHealthMessage - -GameserverMessageCreatureUpdate - -> receivedCreatureUpdateMessage - -GameserverMessageMoveCreature - -> receivedMoveCreatureMessage - -GameserverMessageCreateInContainer - -> handleCreateInContainerMessage - -> receivedCreateInContainerMessage - -GameserverMessageChangeInContainer - -> handleChangeInContainerMessage - -> receivedChangeInContainerMessage - -GameserverMessageDeleteInContainer - -> handleDeleteInContainerMessage - -> receivedDeleteInContainerMessage - -GameserverMessageTalk - -> handleTalkMessage - -> receivedTalkMessage - -GameserverMessageChannels - -> handleChannelsMessage - -> receivedChannelsMessage -``` - -These are **STATIC_LEXICAL_ASSOCIATIONS**, not proven call edges. The only generated name not matched by the automatic stem rule was: - -```text -GameserverMessageTrackQuestFlags +GameserverMessagePlayerDataCurrent -> receivedPlayerDataCurrentMessage +GameserverMessagePlayerState -> receivedPlayerStateMessage +GameserverMessagePlayerInventory -> receivedPlayerInventoryMessage +GameserverMessagePlayerSkills -> receivedPlayerSkillsMessage + +GameserverMessageCreatureData -> receivedCreatureDataMessage +GameserverMessageCreatureHealth -> receivedCreatureHealthMessage +GameserverMessageCreatureUpdate -> receivedCreatureUpdateMessage +GameserverMessageMoveCreature -> receivedMoveCreatureMessage + +GameserverMessageContainer -> receivedContainerMessage +GameserverMessageCreateInContainer -> receivedCreateInContainerMessage +GameserverMessageChangeInContainer -> receivedChangeInContainerMessage +GameserverMessageDeleteInContainer -> receivedDeleteInContainerMessage + +GameserverMessageTalk -> receivedTalkMessage +GameserverMessageChannels -> receivedChannelsMessage +GameserverMessageChannelEvent -> receivedChannelEventMessage +GameserverMessagePrivateChannel -> receivedPrivateChannelMessage ``` -The binary separately contains `handleTrackedQuestFlagsMessage`, `receivedTrackedQuestFlagsMessage` and `onTrackedQuestFlagsChanged`, so the difference is consistent with a naming variant (`Track` vs `Tracked`) but is not promoted to a direct message-handler FACT here. - ## UNKNOWN — exact inbound dispatch graph This task does not prove: ```text GameserverMessageX -> exact concrete handler function +receivedXMessage -> exact concrete handler owner handler -> exact storage/controller mutation one global/common inbound dispatcher runtime delivery or causal state mutation @@ -163,11 +169,11 @@ The direct class-string xrefs occur in several address clusters and are compatib ## Diagnostic family-bucket correction -The producer also emitted convenience lexical family buckets. They are **not promoted** because naive substring rules can create false grouping, for example `Mark` inside `Market` or `row` inside `Browse`. Exact generated names, method names, class types and xrefs are the durable evidence; future semantic grouping must be explicit or dependency-derived. +The producer emitted convenience lexical family buckets. They are **not promoted** because naive substring rules can create false grouping, for example `Mark` inside `Market` or `row` inside `Browse`. Exact generated names, received method names, class types and xrefs are the durable evidence. ## Ranked non-conflicting S2 frontiers -The best next static frontiers that do not require or consume PR #475's physical runtime are: +While PR #475 owns the physical native-login/worldmap runtime lane, the best next static frontiers are: 1. `TPlayerProtocolMessageHandler` QMeta/dispatch graph for `PlayerDataCurrent`, `PlayerState`, `PlayerInventory`, `PlayerSkills`, followed by the static edge into `TPlayerData` where provable. 2. `TCreatureProtocolMessageHandler` dispatch graph for `CreatureData/Health/Update/MoveCreature`, followed by the static edge into `TCreatureStorage` where provable. @@ -182,12 +188,14 @@ Worldmap semantic/runtime work remains excluded because PR #475 currently owns t GENERATED_MESSAGE_DENOMINATOR: FACT COMPLETE_160_OUTBOUND_REGISTRY: FACT COMPLETE_189_INBOUND_REGISTRY: FACT -UNFILTERED_INBOUND_METHOD_STRING_CENSUS: FACT +COMPLETE_189_RECEIVED_METHOD_STRING_SURFACE: FACT_STRING_PRESENCE +188_EXACT_STEM_MATCHES_PLUS_1_NAMING_VARIANT: FACT_STRING_COMPARISON +GENERATED_MESSAGE_TO_RECEIVED_METHOD_EDGE: INFERENCE_STATIC_LEXICAL_ONLY PROTOCOL_HANDLER_TYPE_PRESENCE: FACT DIRECT_CODE_TO_HANDLER_CLASS_STRING_XREFS: FACT -MESSAGE_TO_SIMILAR_METHOD_NAME: INFERENCE_STATIC_LEXICAL_ONLY MESSAGE_TO_CONCRETE_HANDLER_DISPATCH: UNKNOWN +RECEIVED_METHOD_TO_HANDLER_OWNER: UNKNOWN HANDLER_TO_STORAGE_CONTROLLER_EDGE: UNKNOWN -COMMON_INBOUND_DISPATCHER: UNKNOWN +COMMON_UPSTREAM_INBOUND_DISPATCHER: UNKNOWN RUNTIME_BEHAVIOR: NOT_OBSERVED ``` From ad91143aa61746b73a91df9f4edf6fba6d98ae6d Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:59:16 +0200 Subject: [PATCH 18/22] docs(track-a): correct S1 receive-surface report --- ...818-track-a-s1-unfiltered-static-census.md | 249 +++++++----------- 1 file changed, 97 insertions(+), 152 deletions(-) diff --git a/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md index 2a2eddb841..b141dacb24 100644 --- a/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md +++ b/docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md @@ -8,7 +8,7 @@ Execution: GitHub-hosted static exact-file analysis only (`runtime_access: none` ## Executive result -The exact official Linux Tibia `15.32.df7b29` client contains a stable generated protocol denominator of: +The exact official Linux Tibia `15.32.df7b29` client has a stable generated protocol denominator: ```text 349 total generated protocol message types @@ -16,19 +16,29 @@ The exact official Linux Tibia `15.32.df7b29` client contains a stable generated 189 server -> client ``` -A fresh producer on run `32112814216` independently reproduced the same three protocol registries byte-for-byte as the earlier exact-build #473 sanitized artifact. This removes the historical 98-message capability regex as an exhaustive denominator: it was only a filtered discovery subset. +Fresh run `32112814216` reproduced all three registries byte-for-byte against the independent sanitized #473 control artifact. The historical 98-message capability-regex set is therefore a discovery subset, not the protocol denominator. -The same fresh pass recovered a much broader inbound-oriented static surface: +The broad static method selector returned `542` strings, but they are not all inbound handlers: ```text -542 handle/received/on/process-style method strings -148 relevant demangled protocol/storage/session/data types in the producer artifact -47 distinct *ProtocolMessageHandler class names with direct executable code-to-class-string xrefs +handle* 149 +received* 189 +on* 204 +TOTAL 542 ``` -The resulting picture is not one monolithic inbound handler. The client contains many domain-specific native protocol handler classes, including dedicated player, creature, container, chat, market, store, quest, prey, sound, tutorial, trade and worldmap handlers. The exact wiring from generated message type to concrete handler dispatch remains a separate S2 proof problem. +The clean inbound receive-surface result is **189 exact `received*Message` strings** for **189 generated `GameserverMessage*` names**. Comparing stems gives `188` exact name matches and one naming variant: -## Exact client fence +```text +GameserverMessageTrackQuestFlags +receivedTrackedQuestFlagsMessage +``` + +This is FACT about exact-binary string presence and string comparison. It is not yet proof of a generated-message -> concrete receive-method dispatch edge. + +The client also contains at least `47` distinct `*ProtocolMessageHandler` class names with direct executable code-to-class-string xrefs. This proves a broad, domain-partitioned protocol-handler **type surface**. It neither proves nor disproves a shared upstream dispatcher; that remains `UNKNOWN`. + +## Exact client fence and producer ```yaml version: 15.32.df7b29 @@ -36,23 +46,18 @@ size: 51965216 sha256: e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe packed_lzma_sha256: 496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b platform: official_native_linux_only +producer_run: 32112814216 +producer_job: 95635760592 +producer_result: SUCCESS +producer_artifact: 9315562574 +producer_artifact_digest: sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 ``` -Fresh producer markers: - -```text -run 32112814216 -job 95635760592 -result SUCCESS -artifact 9315562574 -digest sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 -``` - -The producer did not execute the client and deleted the packed/unpacked proprietary bytes before artifact upload. +The producer did not execute the client. It deleted compressed/unpacked proprietary client bytes before artifact upload. It did not use Synology, X11/VNC, process memory, credentials, account/session values, login/gameplay or PR #475 runtime state. ## Independent denominator control -The prior #473 sanitized artifact is still available: +Prior sanitized exact-build control: ```text run 32022209943 @@ -60,45 +65,61 @@ artifact 9285763750 digest sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 ``` -Fresh versus control registry hashes: +Fresh and control registry hashes are identical: -| Registry | SHA-256 | Fresh == control | -|---|---|---| -| all 349 | `55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b` | yes | -| 160 client -> server | `621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0` | yes | -| 189 server -> client | `e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96` | yes | +| Registry | SHA-256 | +|---|---| +| all 349 | `55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b` | +| 160 client -> server | `621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0` | +| 189 server -> client | `e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96` | -## Inbound generated-message coverage - -All 189 generated `GameserverMessage*` names are now durably persisted in: +Complete durable registries: ```text +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt ``` -The corresponding 160 outbound names are persisted separately for denominator completeness. - -A name-surface comparison found at least one plausible inbound-oriented native method string for 188/189 generated server message names. This is a discovery correlation only; matching names do not prove dispatch. +## Receive-method name surface -The automatic stem matcher missed only: +For `188/189` generated inbound names, removing wrappers gives exactly the same stem: ```text -GameserverMessageTrackQuestFlags -``` +GameserverMessagePlayerDataCurrent -> receivedPlayerDataCurrentMessage +GameserverMessagePlayerState -> receivedPlayerStateMessage +GameserverMessagePlayerInventory -> receivedPlayerInventoryMessage +GameserverMessagePlayerSkills -> receivedPlayerSkillsMessage -The exact binary independently contains: +GameserverMessageCreatureData -> receivedCreatureDataMessage +GameserverMessageCreatureHealth -> receivedCreatureHealthMessage +GameserverMessageCreatureUpdate -> receivedCreatureUpdateMessage +GameserverMessageMoveCreature -> receivedMoveCreatureMessage -```text -handleTrackedQuestFlagsMessage -receivedTrackedQuestFlagsMessage -onTrackedQuestFlagsChanged +GameserverMessageContainer -> receivedContainerMessage +GameserverMessageCreateInContainer -> receivedCreateInContainerMessage +GameserverMessageChangeInContainer -> receivedChangeInContainerMessage +GameserverMessageDeleteInContainer -> receivedDeleteInContainerMessage + +GameserverMessageTalk -> receivedTalkMessage +GameserverMessageChannels -> receivedChannelsMessage +GameserverMessageChannelEvent -> receivedChannelEventMessage +GameserverMessagePrivateChannel -> receivedPrivateChannelMessage ``` -This is a strong lexical naming variant (`Track` vs `Tracked`), but the direct generated-message -> method edge remains `UNKNOWN` until static control/dataflow proves it. +The sole stem variant is `TrackQuestFlags` vs `TrackedQuestFlags`; the binary separately contains `handleTrackedQuestFlagsMessage` and `onTrackedQuestFlagsChanged`. + +Classification: + +```yaml +COMPLETE_189_RECEIVED_METHOD_STRING_SURFACE: FACT_STRING_PRESENCE +188_EXACT_STEM_MATCHES_PLUS_1_NAMING_VARIANT: FACT_STRING_COMPARISON +GENERATED_MESSAGE_TO_RECEIVED_METHOD_DISPATCH: INFERENCE_STATIC_LEXICAL_ONLY +``` -## Domain-specific handler architecture +## Protocol-handler type/code surface -Forty-seven distinct `*ProtocolMessageHandler` class-name strings have direct executable code xrefs in the exact binary. Representative handlers: +The producer retained `148` relevant demangled protocol/storage/session/data types and `47` distinct `*ProtocolMessageHandler` class strings with direct executable xrefs. Representative classes: ```text tibia::authentication::TLoginProtocolMessageHandler @@ -118,90 +139,18 @@ tibia::trade::TPlayerTradeProtocolMessageHandler tibia::worldmap::TWorldmapProtocolMessageHandler ``` -The complete 47-entry address catalogue is persisted in `protocol-handler-code-xrefs.tsv`. - -The xrefs cluster in several generated-code regions and are compatible with Qt metaobject/metacast-related code, but this task does not promote that role. A later S2 discriminator should locate the exact surrounding function boundary, metaobject metadata and invoke dispatch table before assigning a semantic role. - -## High-value non-worldmap static correlations - -The exact binary contains the following generated-message and receive/handle string pairs or families. - -### Player state +The complete 47-entry catalogue is `protocol-handler-code-xrefs.tsv`. Every row is explicitly classified only as: ```text -GameserverMessagePlayerDataBasic - -> handlePlayerDataBasicMessage - -> receivedPlayerDataBasicMessage - -GameserverMessagePlayerDataCurrent - -> receivedPlayerDataCurrentMessage - -GameserverMessagePlayerState - -> receivedPlayerStateMessage - -GameserverMessagePlayerInventory - -> handlePlayerInventoryMessage - -> receivedPlayerInventoryMessage - -GameserverMessagePlayerSkills - -> receivedPlayerSkillsMessage - -> onPlayerSkillStatsChanged -``` - -The current-main relocation-aware resolver also uniquely confirms: - -```text -TPlayerProtocolMessageHandler vptr 0x308a008 -TPlayerData vptr 0x308ca70 -``` - -What remains unknown is the exact static handler dispatch and handler -> `TPlayerData` mutation edge. - -### Creatures - -```text -GameserverMessageCreatureData -> receivedCreatureDataMessage -GameserverMessageCreatureHealth -> receivedCreatureHealthMessage -GameserverMessageCreatureUpdate -> receivedCreatureUpdateMessage -GameserverMessageMoveCreature -> receivedMoveCreatureMessage +DIRECT_CODE_TO_STRING_XREF +semantic_dispatcher_edge_proven=false ``` -Static class/type evidence independently contains `tibia::creatures::TCreatureProtocolMessageHandler`, and the current-main resolver uniquely confirms `TCreatureStorage` primary vptr `0x308d078`. +The xrefs are compatible with generated Qt/metaobject-related code, but this task does not promote that role without a bounded instruction/control-flow proof. -The handler -> storage edge remains `UNKNOWN`. +## Exact-build anchor revalidation -### Containers and inventory - -```text -GameserverMessageContainer -GameserverMessageCreateInContainer -GameserverMessageChangeInContainer -GameserverMessageDeleteInContainer -GameserverMessageCloseContainer -GameserverMessagePlayerInventory -GameserverMessageSetInventory -GameserverMessageDeleteInventory -``` - -correlate with exact `handle*Message` / `received*Message` surfaces. Static type evidence contains `tibia::container::TContainerProtocolMessageHandler`; the current-main resolver uniquely confirms `TContainerStorage` primary vptr `0x308a1a0`. - -The handler -> storage edge remains `UNKNOWN`. - -### Chat/channel - -```text -GameserverMessageTalk -> handleTalkMessage / receivedTalkMessage -GameserverMessageChannels -> handleChannelsMessage / receivedChannelsMessage -GameserverMessageChannelEvent -> handleChannelEventMessage / receivedChannelEventMessage -GameserverMessageOpenChannel -> handleOpenChannelMessage / receivedOpenChannelMessage -GameserverMessagePrivateChannel -> handlePrivateChannelMessage / receivedPrivateChannelMessage -``` - -Static RTTI/type census contains both `tibia::chat::TChatProtocolMessageHandler` and chat storage/controller families. Concrete dispatch/storage wiring remains `UNKNOWN`. - -## Exact-build resolver revalidation - -All current profile targets re-resolved uniquely on the fresh exact client: +The current-main relocation-aware resolver uniquely re-resolved all configured anchors: | Target | Primary vptr | |---|---:| @@ -213,20 +162,13 @@ All current profile targets re-resolved uniquely on the fresh exact client: | `TCreatureStorage` | `0x308d078` | | `TWorldmapProtocolMessageHandler` | `0x30871d8` | -These are static exact-build anchors, not current runtime addresses or live-object proof. - -## Family-bucket negative control +These are exact-file anchors, not current runtime addresses or live-object proof. -The producer emitted rough convenience family buckets. Full review rejected those buckets as semantic evidence because substring-only grouping creates collisions such as: - -```text -Mark inside Market -row inside Browse -``` +## Negative control: rejected family buckets -No result in this report depends on those buckets. Exact generated names, exact native method strings, exact class names and explicit xrefs remain the evidence sources. +The temporary producer emitted convenience substring family buckets. Final audit rejected them as semantic evidence because substring collisions exist, e.g. `Mark` inside `Market` and `row` inside `Browse`. No durable conclusion depends on those buckets. -## What is proven versus still open +## Proven / inferred / unknown ```yaml FACT: @@ -234,46 +176,49 @@ FACT: client_to_server_registry: 160 server_to_client_registry: 189 fresh_lists_match_independent_control_byte_for_byte: true - inbound_oriented_method_strings: 542 + broad_candidate_method_strings: 542 + handle_prefixed_strings: 149 + received_message_strings: 189 + on_prefixed_strings: 204 + exact_received_stem_matches: 188 + received_naming_variants: 1 protocol_handler_classes_with_direct_code_string_xref: 47 current_profile_vptr_anchors_unique: true INFERENCE: - generated_message_to_similar_handle_received_method_name: static_lexical_only - handler_architecture: domain_partitioned_by_many_protocol_handler_types + generated_message_to_received_method_name_alignment: static_lexical_only + native_protocol_handler_type_surface: domain_partitioned UNKNOWN: - exact_generated_message_to_handler_dispatch - exact_handler_to_storage_controller_mutation_edge - common_global_inbound_dispatcher + generated_message_to_concrete_handler_dispatch + received_method_to_handler_owner + handler_to_storage_controller_mutation_edge + common_upstream_inbound_dispatcher runtime_object_identity runtime_message_delivery ``` -## Next safe static work +## Next non-conflicting static work -While PR #475 owns the physical native-login/worldmap runtime lane, the highest-value independent S2 work is: +While PR #475 owns native-login/worldmap runtime work, the highest-value independent S2 frontiers are: ```text -1. Player inbound QMeta/dispatch graph - TPlayerProtocolMessageHandler +1. TPlayerProtocolMessageHandler -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills - -> static TPlayerData ownership/mutation edge + -> exact QMeta/dispatch targets + -> static TPlayerData owner/mutation edge where provable -2. Creature inbound QMeta/dispatch graph - TCreatureProtocolMessageHandler +2. TCreatureProtocolMessageHandler -> CreatureData / CreatureHealth / CreatureUpdate / MoveCreature - -> static TCreatureStorage ownership/mutation edge + -> static TCreatureStorage edge -3. Container inbound QMeta/dispatch graph - TContainerProtocolMessageHandler +3. TContainerProtocolMessageHandler -> Container / Create / Change / DeleteInContainer - -> static TContainerStorage ownership/mutation edge + -> static TContainerStorage edge -4. Chat inbound QMeta/dispatch graph - TChatProtocolMessageHandler +4. TChatProtocolMessageHandler -> Talk / Channels / ChannelEvent / PrivateChannel -> chat storage/controller edge ``` -These are static exact-file tasks and do not need to consume the serialized physical runtime. Worldmap semantics and native-login runtime propagation remain with #475. +These are exact-file static tasks. They do not need to consume or observe PR #475's physical runtime. From b381a2a614c503f3d021af98432df99a069305c7 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 10:00:08 +0200 Subject: [PATCH 19/22] docs(track-a): record final S1 audit corrections --- ...818-track-a-s1-unfiltered-static-census.md | 200 ++++++++---------- 1 file changed, 88 insertions(+), 112 deletions(-) diff --git a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md index d26298e34d..755145e262 100644 --- a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md +++ b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md @@ -16,7 +16,7 @@ base_branch: main base_main: ed09418b431c28087775b419f85bed404fa85d70 related_pr: 509 created: 2026-08-18T09:29:00+02:00 -updated: 2026-08-18T09:54:00+02:00 +updated: 2026-08-18T10:03:00+02:00 risk: medium implementation_authorized: true credentials_allowed: false @@ -74,9 +74,9 @@ feature_scope: e2e_required: false validation_level: focused invocation_started_at: 2026-08-18T09:29:00+02:00 -last_progress_at: 2026-08-18T09:54:00+02:00 +last_progress_at: 2026-08-18T10:03:00+02:00 ci_checks_for_current_head: 0 -ci_check_generation: draft +ci_check_generation: final-docs terminal_ci_wait_started_at: null terminal_ci_checks_for_current_generation: 0 unchanged_state_checks: 0 @@ -92,14 +92,13 @@ Execute the archived capability-sweep programme's next safe static step without ```text exact official Linux client 15.32.df7b29 - -> exhaustive unfiltered generated-message census - -> exhaustive inbound-oriented QMeta/handler string census - -> bounded static xref candidate extraction - -> durable S1 registries and ranked S2 follow-up edges + -> exhaustive generated-message census + -> complete inbound receive-method name surface + -> protocol-handler type/code xrefs + -> current exact-build anchor revalidation + -> ranked non-runtime S2 follow-up ``` -This task is deliberately independent of the currently active PR #475 runtime/world-entry/worldmap mutation work. - # Exact client fence ```yaml @@ -112,32 +111,33 @@ platform: official_native_linux_only # Acceptance inventory -- [x] exact client compressed and unpacked hashes revalidated on hosted runner; -- [x] generated-message denominator revalidated: 349 total / 160 client->server / 189 server->client; -- [x] complete 160/189 registries persisted in Git; -- [x] fresh registries independently compared byte-for-byte with #473 sanitized control and all three hashes match exactly; -- [x] all 189 inbound names preserved; -- [x] unfiltered inbound-oriented method census persisted: 542 exact strings; -- [x] 47 distinct `*ProtocolMessageHandler` class names with direct code-to-class-string xrefs persisted; -- [x] bounded xref evidence strength explicitly stops at `DIRECT_CODE_TO_STRING_XREF` and does not claim a dispatcher edge; -- [x] current-main exact-build vptr anchors revalidated: 7/7 unique; -- [x] generated-message-to-similar-method correlations classified only as static lexical inference; -- [x] sole automatic lexical miss identified as `GameserverMessageTrackQuestFlags`; nearby `TrackedQuestFlags` methods recorded without overclaim; -- [x] no common inbound dispatcher was invented; status remains `UNKNOWN`; -- [x] producer substring-family grouping was independently falsified as semantic evidence (`Mark`/`Market`, `row`/`Browse`) and excluded from promoted conclusions; -- [x] no live/runtime/worldmap mutation or #475-owned surface touched; -- [x] no raw client bytes committed or uploaded; +- [x] exact compressed/unpacked hashes revalidated on GitHub-hosted runner; +- [x] protocol denominator revalidated: 349 total / 160 client->server / 189 server->client; +- [x] complete 160/189 registries persisted; +- [x] fresh registries byte-identical to independent #473 sanitized control; +- [x] complete 189 `received*Message` string surface persisted; +- [x] broad candidate method census split correctly: 149 `handle*` + 189 `received*` + 204 `on*` = 542; +- [x] exact string comparison: 188 receive-method stems match generated server-message stems exactly; one `TrackQuestFlags` / `TrackedQuestFlags` variant; +- [x] no receive-method string is promoted to a concrete dispatch edge; +- [x] 47 distinct `*ProtocolMessageHandler` class strings with direct executable xrefs persisted; +- [x] xref evidence stops at `DIRECT_CODE_TO_STRING_XREF`; dispatcher role remains unproven; +- [x] current-main exact-build vptr anchors revalidated 7/7 unique; +- [x] common upstream inbound dispatcher remains `UNKNOWN`; +- [x] naive substring family buckets independently rejected as semantic evidence; +- [x] no #475/runtime/Synology/X11/process-memory/login/credential/gameplay access; +- [x] no raw proprietary client bytes committed or uploaded; - [x] temporary producer workflow removed from final branch diff; -- [x] result/report distinguish FACT / INFERENCE / UNKNOWN; -- [x] E2E = NOT_APPLICABLE: static exact-file discovery only; no product/runtime behavior changed; -- [ ] fresh final diff audit on current final head; -- [ ] exact-head required repository CI/governance green; -- [ ] zero unresolved material review findings and coordinator/promotion disposition where required; +- [x] E2E = `NOT_APPLICABLE`: static exact-file discovery only; +- [ ] final current-head diff/path audit after audit corrections; +- [ ] current-main freshness/reconciliation; +- [ ] exact-head required CI/governance; +- [ ] zero unresolved material review findings; +- [ ] coordinator/promotion disposition if required by current Track A governance. # Fresh producer evidence ```yaml -producer_pre_checkpoint_head: cb575cec2077c8002bb6712ffac4d4dc77420499 +producer_head: cb575cec2077c8002bb6712ffac4d4dc77420499 workflow_run: 32112814216 job: 95635760592 conclusion: SUCCESS @@ -150,22 +150,7 @@ pr475_runtime_touched: false raw_client_uploaded: false ``` -Primary durable evidence: - -```text -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json -docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md -``` - -# Independent denominator control - -The sanitized exact-build #473 artifact was independently re-opened during this task: +Independent #473 denominator control: ```yaml run: 32022209943 @@ -177,68 +162,65 @@ server_to_client_sha256: e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af fresh_lists_byte_identical: true ``` -# Material findings - -## FACT — protocol denominator - -```text -349 generated protocol message names -160 GameclientMessage* -189 GameserverMessage* -``` - -The historical 98-message capability-regex list was only a filtered subset and is not the denominator. - -## FACT — inbound-oriented native surface +# Durable evidence ```text -542 inbound-oriented method strings -148 relevant demangled protocol/storage/session/data types in the producer artifact -51 interesting strings with direct executable code xrefs -52 retained direct xrefs -47 distinct *ProtocolMessageHandler class names with direct executable xrefs +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv +docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json +docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md ``` -Representative exact handler classes include player, creature, container, chat, game, login, market, quickloot, quest, sound, store, trade and worldmap domains. - -## FACT — current exact-build anchors +# Material result -```text -TGameClient 0x3076908 -TGameserverGameSession 0x3078ba0 -TPlayerProtocolMessageHandler 0x308a008 -TPlayerData 0x308ca70 -TContainerStorage 0x308a1a0 -TCreatureStorage 0x308d078 -TWorldmapProtocolMessageHandler 0x30871d8 +```yaml +FACT: + generated_protocol_total: 349 + client_to_server: 160 + server_to_client: 189 + broad_candidate_method_strings: 542 + handle_prefixed: 149 + received_message_strings: 189 + on_prefixed: 204 + received_exact_stem_matches: 188 + received_naming_variants: 1 + protocol_message_handler_class_xrefs: 47 + exact_profile_vptr_targets_unique: 7 + +INFERENCE: + generated_message_to_received_method_name_alignment: static_lexical_only + native_protocol_handler_type_surface: domain_partitioned + +UNKNOWN: + generated_message_to_concrete_handler_dispatch + received_method_to_handler_owner + handler_to_storage_controller_mutation_edge + common_upstream_inbound_dispatcher + runtime_delivery_or_state_mutation ``` -All seven were re-resolved uniquely by the current-main relocation-aware resolver on the fresh exact binary. +# Repair and audit history -## INFERENCE — lexical message/method alignment +## R1 — resolver checkout/scratch path -188/189 generated inbound names have at least one exact/broader `handle*` / `received*` / related method surface under the bounded static matcher. This is not a call edge. +Initial producer changed cwd to runner scratch but referred to the repository resolver/profile relatively. Self-review repaired this before accepting evidence by using exact `$GITHUB_WORKSPACE` paths and asserting both files exist. RTTI demangling was also corrected to `c++filt -t`. No pre-repair result was promoted. -The one automatic miss is `GameserverMessageTrackQuestFlags`; `handleTrackedQuestFlagsMessage`, `receivedTrackedQuestFlagsMessage` and `onTrackedQuestFlagsChanged` exist separately and are retained as a naming-variant hypothesis only. +## A1 — diagnostic family buckets rejected -## UNKNOWN — semantic wiring +Substring-only grouping could misclassify names (`Mark` inside `Market`, `row` inside `Browse`). These buckets were excluded from all durable semantic conclusions. -```text -GameserverMessageX -> exact handler dispatch -handler -> storage/controller mutation -single/global inbound dispatcher -runtime delivery/state mutation -``` - -# Repair history +## A2 — broad 542-method set narrowed -## Repair 1 — checkout/scratch resolver path +Final diff review found the broad `handle/received/on` set was being described too strongly as an inbound-handler denominator. It was corrected to the actual prefix distribution `149/189/204`; the durable inbound receive-surface denominator is the exact 189 `received*Message` strings. The report/result/summary now preserve this distinction. -Self-review found that the first producer implementation changed cwd to runner scratch but called the repository resolver through a relative `tools/...` path. The producer was repaired to use exact `$GITHUB_WORKSPACE` paths and assert resolver/profile existence before evidence was accepted. `c++filt -t` was also used for RTTI type encodings. No pre-repair result was promoted. +## A3 — shared-upstream-dispatcher non-claim -## Audit finding A1 — diagnostic family grouping rejected - -Post-artifact review found that substring-only convenience grouping could misclassify names (`Mark` inside `Market`, `row` inside `Browse`). Those buckets are not durable semantic evidence and no report conclusion depends on them. Exact names/types/xrefs are used instead. +Many domain-specific `*ProtocolMessageHandler` types prove a broad partitioned handler type surface, but do not disprove a common upstream router/queue. Wording was corrected so `COMMON_UPSTREAM_INBOUND_DISPATCHER=UNKNOWN` remains explicit. # Non-overlap / E2E @@ -258,36 +240,30 @@ physical_e2e: # Ranked next static frontier -While #475 owns live native-login/worldmap runtime, next independent S2 priority is: - ```text -TPlayerProtocolMessageHandler - -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills - -> exact QMeta/dispatch targets - -> exact static owner/mutation edge into TPlayerData where provable +1. TPlayerProtocolMessageHandler + -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills + -> exact QMeta/dispatch targets + -> static TPlayerData owner/mutation edge where provable + +2. TCreatureProtocolMessageHandler -> TCreatureStorage +3. TContainerProtocolMessageHandler -> TContainerStorage +4. TChatProtocolMessageHandler -> chat storage/controller ``` -Then, independently: - -```text -TCreatureProtocolMessageHandler -> TCreatureStorage -TContainerProtocolMessageHandler -> TContainerStorage -TChatProtocolMessageHandler -> chat storage/controller -``` +All are exact-file static work and remain independent of PR #475 physical runtime. # Checkpoint ```yaml -checkpoint_version: 3 +checkpoint_version: 4 status: validating phase: exact-head-validation base_main_at_claim: ed09418b431c28087775b419f85bed404fa85d70 pr: 509 -pre_checkpoint_head: b25ea25b732154e273ef4182cbe9c14429acbbf6 -producer_workflow_removed: true research_result: COMPLETE -promotion_status: PENDING_FINAL_AUDIT_AND_EXACT_HEAD_CHECKS -last_completed_step: persisted complete protocol registries, 542-method census, 47 handler xrefs, exact vptr anchors, result and report; removed the temporary producer +producer_workflow_removed: true +last_completed_step: corrected final evidence semantics after A2/A3, including the exact 189 received-method denominator and shared-upstream-dispatcher non-claim blockers: [] -next_action: perform full final PR diff/changed-path audit against current main, reconcile only real base drift if necessary, then require exact-head CI/governance and review hygiene before promotion/merge. +next_action: perform current-head full diff/path audit, refresh current main and promotion authority, reconcile only if required, then require exact-head CI/governance and review hygiene before terminal disposition. ``` From f4dd6a648bdb1adaf68fc6c69fca45a4fcfa40b9 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 10:02:28 +0200 Subject: [PATCH 20/22] docs(track-a): archive completed S1 census task --- ...818-track-a-s1-unfiltered-static-census.md | 269 ------------------ 1 file changed, 269 deletions(-) delete mode 100644 docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md diff --git a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md deleted file mode 100644 index 755145e262..0000000000 --- a/docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md +++ /dev/null @@ -1,269 +0,0 @@ ---- -task_id: OTC-20260818-track-a-s1-unfiltered-static-census -status: validating -agent: ChatGPT -session_id: chatgpt-s1-static-census-20260818 -session_role: researcher -project_lane: otclient -lane: P2-NETWORK -track_id: official-client-re -task_kind: discovery -phase: exact-head-validation -execution_mode: github_only -execution_reason: exhaustive deterministic exact-client protocol/QMeta census without touching the serialized physical runtime -branch: research/OTC-20260818-track-a-s1-unfiltered-static-census -base_branch: main -base_main: ed09418b431c28087775b419f85bed404fa85d70 -related_pr: 509 -created: 2026-08-18T09:29:00+02:00 -updated: 2026-08-18T10:03:00+02:00 -risk: medium -implementation_authorized: true -credentials_allowed: false -login_allowed: false -gameplay_allowed: false -mutation_authorized: false -ROUTING_CONTRACT: docs/agents/programs/OTCLIENT_TIBIA_RE_HYBRID_EXECUTION_ROUTING.md -EXECUTION_CLASS: github_hosted -RUNTIME_ACCESS: none -PERSISTENT_SESSION_ROLE: none -PHYSICAL_E2E_REQUIRED: false -runtime_access: none -runtime_owner_task: NOT_APPLICABLE -runtime_namespace: NOT_APPLICABLE -canonical_registration: NOT_APPLICABLE -canonical_lease_generation: NOT_APPLICABLE -registration_lease_generation: NOT_APPLICABLE -gate_a: NOT_APPLICABLE -generation_rebind: NOT_APPLICABLE -gate_b: NOT_APPLICABLE -bootstrap: NOT_APPLICABLE -target_uniqueness: NOT_APPLICABLE -owned_paths: - - docs/agents/tasks/active/OTC-20260818-track-a-s1-unfiltered-static-census.md - - docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/** - - docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md -modules_touched: - - official-client-static-re -reuses: - - docs/agents/tasks/archive/OTC-20260814-official-client-capability-experiment-sweep.md - - docs/agents/evidence/OTC-20260817-track-a-worldmap-server-delivery-extent/20260817-complete-message-census.md - - tools/tibia_runtime_bridge/resolver.py - - tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json - - historical exact-client static producer pattern from PR #473 / commit 553e447c0662892b0c1b9cab994c4545d09f22c8 - - historical exact QMeta parser pattern from PR #505 / commit d0c1360b649fd8c4a92587b7713644c49162694c -depends_on: [] -blocks: [] -non_overlap: - - PR #475 runtime branch, task record, workflow surfaces, Synology state, lease, display, login budget and physical session were not touched or observed. - - PR #498/#499 predecessor auth/session branches were not modified. - - Track B PR #284 and OTC2 protocol work are outside scope. -policy_version: 2 -context_pressure: medium -context_growth: stable -context_score: 7 -estimate_confidence: high -decomposition_decision: single -decomposition_reason: one exact-build static S1 census with one bounded producer and one durable evidence package -feature_scope: - type: documentation - user_facing: false - backend_required: false - frontend_required: false - integration_required: false - e2e_required: false -validation_level: focused -invocation_started_at: 2026-08-18T09:29:00+02:00 -last_progress_at: 2026-08-18T10:03:00+02:00 -ci_checks_for_current_head: 0 -ci_check_generation: final-docs -terminal_ci_wait_started_at: null -terminal_ci_checks_for_current_generation: 0 -unchanged_state_checks: 0 -identical_failure_retries: 0 -repair_cycles_for_current_gate: 1 -context_reconstruction_attempts: 0 -stall_warnings: 0 ---- - -# Objective - -Execute the archived capability-sweep programme's next safe static step without consuming or observing the active physical Track A runtime: - -```text -exact official Linux client 15.32.df7b29 - -> exhaustive generated-message census - -> complete inbound receive-method name surface - -> protocol-handler type/code xrefs - -> current exact-build anchor revalidation - -> ranked non-runtime S2 follow-up -``` - -# Exact client fence - -```yaml -version: 15.32.df7b29 -size: 51965216 -sha256: e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe -packed_client_lzma_sha256: 496c5b3517c0996a1bbd0e76a7738d450f79d0bf4fef140a807044776042dc9b -platform: official_native_linux_only -``` - -# Acceptance inventory - -- [x] exact compressed/unpacked hashes revalidated on GitHub-hosted runner; -- [x] protocol denominator revalidated: 349 total / 160 client->server / 189 server->client; -- [x] complete 160/189 registries persisted; -- [x] fresh registries byte-identical to independent #473 sanitized control; -- [x] complete 189 `received*Message` string surface persisted; -- [x] broad candidate method census split correctly: 149 `handle*` + 189 `received*` + 204 `on*` = 542; -- [x] exact string comparison: 188 receive-method stems match generated server-message stems exactly; one `TrackQuestFlags` / `TrackedQuestFlags` variant; -- [x] no receive-method string is promoted to a concrete dispatch edge; -- [x] 47 distinct `*ProtocolMessageHandler` class strings with direct executable xrefs persisted; -- [x] xref evidence stops at `DIRECT_CODE_TO_STRING_XREF`; dispatcher role remains unproven; -- [x] current-main exact-build vptr anchors revalidated 7/7 unique; -- [x] common upstream inbound dispatcher remains `UNKNOWN`; -- [x] naive substring family buckets independently rejected as semantic evidence; -- [x] no #475/runtime/Synology/X11/process-memory/login/credential/gameplay access; -- [x] no raw proprietary client bytes committed or uploaded; -- [x] temporary producer workflow removed from final branch diff; -- [x] E2E = `NOT_APPLICABLE`: static exact-file discovery only; -- [ ] final current-head diff/path audit after audit corrections; -- [ ] current-main freshness/reconciliation; -- [ ] exact-head required CI/governance; -- [ ] zero unresolved material review findings; -- [ ] coordinator/promotion disposition if required by current Track A governance. - -# Fresh producer evidence - -```yaml -producer_head: cb575cec2077c8002bb6712ffac4d4dc77420499 -workflow_run: 32112814216 -job: 95635760592 -conclusion: SUCCESS -artifact: 9315562574 -artifact_digest: sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 -client_executed: false -runtime_access: none -secret_access: false -pr475_runtime_touched: false -raw_client_uploaded: false -``` - -Independent #473 denominator control: - -```yaml -run: 32022209943 -artifact: 9285763750 -artifact_digest: sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 -protocol_all_sha256: 55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b -client_to_server_sha256: 621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0 -server_to_client_sha256: e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96 -fresh_lists_byte_identical: true -``` - -# Durable evidence - -```text -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/summary.json -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/result.md -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-client-to-server.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-server-to-client.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/received-message-methods.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/inbound-method-strings.txt -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/protocol-handler-code-xrefs.tsv -docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census/known-anchor-vptr-resolution.json -docs/agents/reports/OTCLIENT-20260818-track-a-s1-unfiltered-static-census.md -``` - -# Material result - -```yaml -FACT: - generated_protocol_total: 349 - client_to_server: 160 - server_to_client: 189 - broad_candidate_method_strings: 542 - handle_prefixed: 149 - received_message_strings: 189 - on_prefixed: 204 - received_exact_stem_matches: 188 - received_naming_variants: 1 - protocol_message_handler_class_xrefs: 47 - exact_profile_vptr_targets_unique: 7 - -INFERENCE: - generated_message_to_received_method_name_alignment: static_lexical_only - native_protocol_handler_type_surface: domain_partitioned - -UNKNOWN: - generated_message_to_concrete_handler_dispatch - received_method_to_handler_owner - handler_to_storage_controller_mutation_edge - common_upstream_inbound_dispatcher - runtime_delivery_or_state_mutation -``` - -# Repair and audit history - -## R1 — resolver checkout/scratch path - -Initial producer changed cwd to runner scratch but referred to the repository resolver/profile relatively. Self-review repaired this before accepting evidence by using exact `$GITHUB_WORKSPACE` paths and asserting both files exist. RTTI demangling was also corrected to `c++filt -t`. No pre-repair result was promoted. - -## A1 — diagnostic family buckets rejected - -Substring-only grouping could misclassify names (`Mark` inside `Market`, `row` inside `Browse`). These buckets were excluded from all durable semantic conclusions. - -## A2 — broad 542-method set narrowed - -Final diff review found the broad `handle/received/on` set was being described too strongly as an inbound-handler denominator. It was corrected to the actual prefix distribution `149/189/204`; the durable inbound receive-surface denominator is the exact 189 `received*Message` strings. The report/result/summary now preserve this distinction. - -## A3 — shared-upstream-dispatcher non-claim - -Many domain-specific `*ProtocolMessageHandler` types prove a broad partitioned handler type surface, but do not disprove a common upstream router/queue. Wording was corrected so `COMMON_UPSTREAM_INBOUND_DISPATCHER=UNKNOWN` remains explicit. - -# Non-overlap / E2E - -```yaml -pr475_runtime_observed: false -pr475_runtime_mutated: false -synology_used: false -x11_or_vnc_used: false -process_memory_used: false -credentials_used: false -login_performed: false -gameplay_performed: false -physical_e2e: - result: NOT_APPLICABLE - reason: static exact-file discovery only; no runtime/product behavior changed -``` - -# Ranked next static frontier - -```text -1. TPlayerProtocolMessageHandler - -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills - -> exact QMeta/dispatch targets - -> static TPlayerData owner/mutation edge where provable - -2. TCreatureProtocolMessageHandler -> TCreatureStorage -3. TContainerProtocolMessageHandler -> TContainerStorage -4. TChatProtocolMessageHandler -> chat storage/controller -``` - -All are exact-file static work and remain independent of PR #475 physical runtime. - -# Checkpoint - -```yaml -checkpoint_version: 4 -status: validating -phase: exact-head-validation -base_main_at_claim: ed09418b431c28087775b419f85bed404fa85d70 -pr: 509 -research_result: COMPLETE -producer_workflow_removed: true -last_completed_step: corrected final evidence semantics after A2/A3, including the exact 189 received-method denominator and shared-upstream-dispatcher non-claim -blockers: [] -next_action: perform current-head full diff/path audit, refresh current main and promotion authority, reconcile only if required, then require exact-head CI/governance and review hygiene before terminal disposition. -``` From 6f323d80cf73432deefce006673ee66948fe6232 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 10:02:51 +0200 Subject: [PATCH 21/22] docs(track-a): persist S1 census closeout --- ...818-track-a-s1-unfiltered-static-census.md | 155 ++++++++++++++++++ 1 file changed, 155 insertions(+) create mode 100644 docs/agents/tasks/archive/OTC-20260818-track-a-s1-unfiltered-static-census.md diff --git a/docs/agents/tasks/archive/OTC-20260818-track-a-s1-unfiltered-static-census.md b/docs/agents/tasks/archive/OTC-20260818-track-a-s1-unfiltered-static-census.md new file mode 100644 index 0000000000..cc35790eb8 --- /dev/null +++ b/docs/agents/tasks/archive/OTC-20260818-track-a-s1-unfiltered-static-census.md @@ -0,0 +1,155 @@ +--- +task_id: OTC-20260818-track-a-s1-unfiltered-static-census +status: completed +agent: ChatGPT +session_role: researcher_then_coordinator_review +project_lane: otclient +lane: P2-NETWORK +track_id: official-client-re +task_kind: discovery +phase: archived +execution_mode: github_only +EXECUTION_CLASS: github_hosted +RUNTIME_ACCESS: none +PERSISTENT_SESSION_ROLE: none +PHYSICAL_E2E_REQUIRED: false +runtime_access: none +mutation_authorized: false +source_pr: 509 +source_branch: research/OTC-20260818-track-a-s1-unfiltered-static-census +source_final_head: b381a2a614c503f3d021af98432df99a069305c7 +base_main: ed09418b431c28087775b419f85bed404fa85d70 +completed: 2026-08-18T10:08:00+02:00 +risk: medium +owned_paths_released: true +--- + +# Terminal result + +```yaml +RESEARCH_RESULT: COMPLETE +PROMOTION_DECISION: ACCEPT_WITH_EDITS +EXACT_CLIENT: 15.32.df7b29 +EXACT_CLIENT_SIZE: 51965216 +EXACT_CLIENT_SHA256: e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe +PROTOCOL_MESSAGE_TOTAL: 349 +CLIENT_TO_SERVER_MESSAGE_TOTAL: 160 +SERVER_TO_CLIENT_MESSAGE_TOTAL: 189 +RECEIVED_MESSAGE_STRING_TOTAL: 189 +RECEIVED_EXACT_STEM_MATCHES: 188 +RECEIVED_NAMING_VARIANTS: 1 +PROTOCOL_MESSAGE_HANDLER_CLASS_XREFS: 47 +COMMON_UPSTREAM_INBOUND_DISPATCHER: UNKNOWN +RUNTIME_ACCESS: none +PR475_RUNTIME_TOUCHED: false +``` + +## Accepted evidence + +Fresh exact-client producer: + +```text +run 32112814216 +job 95635760592 +result SUCCESS +artifact 9315562574 +digest sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 +``` + +Independent #473 control: + +```text +run 32022209943 +artifact 9285763750 +digest sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 +``` + +Fresh and control protocol registries are byte-identical: + +```text +all 349 55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b +160 client -> server 621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0 +189 server -> client e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96 +``` + +## Accepted classification + +```yaml +FACT: + generated_protocol_denominator: 349 + client_to_server_registry: 160 + server_to_client_registry: 189 + broad_candidate_method_strings: 542 + handle_prefixed_strings: 149 + received_message_strings: 189 + on_prefixed_strings: 204 + received_exact_stem_matches: 188 + received_naming_variants: 1 + protocol_handler_classes_with_direct_code_string_xref: 47 + exact_profile_vptr_targets_unique: 7 + +INFERENCE: + generated_message_to_received_method_name_alignment: static_lexical_only + native_protocol_handler_type_surface: domain_partitioned + +UNKNOWN: + generated_message_to_concrete_handler_dispatch + received_method_to_handler_owner + handler_to_storage_controller_mutation_edge + common_upstream_inbound_dispatcher + runtime_delivery_or_state_mutation +``` + +## Coordinator edits / falsification + +Three overclaims were caught and repaired before promotion: + +1. substring-only diagnostic family buckets (`Mark`/`Market`, `row`/`Browse`) were rejected as semantic evidence; +2. the broad 542-method set was split into `149 handle* + 189 received* + 204 on*`; only the exact 189 `received*Message` strings are retained as the inbound receive-method string denominator; +3. many domain-specific handler types were not used to infer absence of a common upstream router; that topology remains `UNKNOWN`. + +## Source exact-head validation + +Source final head `b381a2a614c503f3d021af98432df99a069305c7`: + +```text +Track A agent runtime governance run 32114161352 = SUCCESS + Fresh admission behavior audit 95639845377 = SUCCESS + Deterministic admission-policy 95639845470 = SUCCESS +CI run 32114161531 = SUCCESS + CI / Required 95639907436 = SUCCESS +reviews = 0 +unresolved review threads = 0 +main freshness = PASS at ed09418b431c28087775b419f85bed404fa85d70 +``` + +Physical E2E is `NOT_APPLICABLE`: the task performed static exact-file discovery only and did not execute or observe the official client. + +## Safety / non-overlap + +```yaml +synology_used: false +x11_or_vnc_used: false +process_memory_used: false +credentials_used: false +login_performed: false +gameplay_performed: false +raw_client_committed_or_uploaded: false +pr475_runtime_observed: false +pr475_runtime_mutated: false +``` + +The temporary producer workflow was removed before promotion. + +## Next independent frontier + +The highest-value non-runtime continuation while PR #475 owns native login/worldmap runtime is: + +```text +TPlayerProtocolMessageHandler + -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills + -> exact static QMeta/dispatch targets + -> static TPlayerData owner/mutation edge where provable +``` + +Then creature, container and chat handler graphs may be resolved independently. From e4e1e09dfed1a739313f26e65a6a581729892978 Mon Sep 17 00:00:00 2001 From: blakinio <75369544+blakinio@users.noreply.github.com> Date: Tue, 18 Aug 2026 10:03:21 +0200 Subject: [PATCH 22/22] docs(track-a): record S1 census coordinator promotion --- .../20260818-coordinator-promotion.md | 171 ++++++++++++++++++ 1 file changed, 171 insertions(+) create mode 100644 docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census-promotion/20260818-coordinator-promotion.md diff --git a/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census-promotion/20260818-coordinator-promotion.md b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census-promotion/20260818-coordinator-promotion.md new file mode 100644 index 0000000000..b17610fc84 --- /dev/null +++ b/docs/agents/evidence/OTC-20260818-track-a-s1-unfiltered-static-census-promotion/20260818-coordinator-promotion.md @@ -0,0 +1,171 @@ +# Track A S1 unfiltered static census — coordinator promotion + +Date: 2026-08-18 +Source task: `OTC-20260818-track-a-s1-unfiltered-static-census` +Source Draft: PR #509 +Source final head: `b381a2a614c503f3d021af98432df99a069305c7` +Trusted integration base: `main@ed09418b431c28087775b419f85bed404fa85d70` +Decision: **ACCEPT_WITH_EDITS** + +## Independent review boundary + +The coordinator reviewed the full final source diff, exact changed-path inventory, fresh producer artifact, independent #473 denominator control, current-main exact-build resolver output and the final source CI/governance graph. + +The source diff is documentation/evidence only. It contains no workflow after finalization and no runtime/product mutation. It does not touch PR #475-owned paths or state. + +## Promoted FACTS + +Exact client: + +```yaml +version: 15.32.df7b29 +size: 51965216 +sha256: e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe +``` + +Generated protocol denominator: + +```text +349 total +160 GameclientMessage* +189 GameserverMessage* +``` + +The fresh run's three registries are byte-identical to the independent #473 sanitized control. + +Complete receive-method string surface: + +```text +189 received*Message strings +188 exact generated-message/received-method stem matches +1 naming variant: + GameserverMessageTrackQuestFlags + receivedTrackedQuestFlagsMessage +``` + +Broad static selector breakdown: + +```text +149 handle* +189 received* +204 on* +542 total broad candidate strings +``` + +Protocol-handler type/code surface: + +```text +47 distinct *ProtocolMessageHandler class-name strings +with direct executable code-to-class-string xrefs +``` + +Current exact-build resolver: + +```text +TGameClient 0x3076908 +TGameserverGameSession 0x3078ba0 +TPlayerProtocolMessageHandler 0x308a008 +TPlayerData 0x308ca70 +TContainerStorage 0x308a1a0 +TCreatureStorage 0x308d078 +TWorldmapProtocolMessageHandler 0x30871d8 +``` + +All seven resolve uniquely on the exact client. + +## Promoted inference / retained UNKNOWNs + +The 188 exact stems plus one naming variant are strong static lexical evidence for a generated-message / `received*Message` naming correspondence, but the coordinator does **not** promote a concrete dispatch edge from names alone. + +```yaml +GENERATED_MESSAGE_TO_RECEIVED_METHOD_NAME_ALIGNMENT: INFERENCE_STATIC_LEXICAL_ONLY +GENERATED_MESSAGE_TO_CONCRETE_HANDLER_DISPATCH: UNKNOWN +RECEIVED_METHOD_TO_HANDLER_OWNER: UNKNOWN +HANDLER_TO_STORAGE_CONTROLLER_EDGE: UNKNOWN +COMMON_UPSTREAM_INBOUND_DISPATCHER: UNKNOWN +RUNTIME_DELIVERY_OR_STATE_MUTATION: UNKNOWN +``` + +Many domain-specific handler types prove a broad partitioned handler **type surface**. They do not prove or disprove a shared upstream queue/router. + +## Falsification / accepted edits + +The coordinator accepts the research result only after the following source corrections: + +1. **Family bucket rejection.** Temporary substring buckets were found semantically unsafe (`Mark` inside `Market`, `row` inside `Browse`) and excluded from promoted evidence. +2. **542-method overclassification repair.** The broad selector output is not called an inbound-handler denominator. It is explicitly `149 handle* + 189 received* + 204 on*`; the durable receive-method string denominator is 189. +3. **Shared dispatcher non-claim.** Domain-specific handler types are not used to infer that no common upstream dispatcher exists. + +No material finding remains open after those edits. + +## Producer / control evidence + +Fresh producer: + +```text +run 32112814216 +job 95635760592 +result SUCCESS +artifact 9315562574 +digest sha256:583c8c217fa2eaa2411f79995473cd910b8803d8599f80574491ca27b8ab9860 +``` + +Independent control: + +```text +#473 run 32022209943 +artifact 9285763750 +digest sha256:0f71be3021885f3f8881199c5f74839fca6c6c5081594fab48998298abaadbd6 +``` + +Registry hashes: + +```text +all 349 55f7cf2d6d4a63df6e24b8b156e38f1a2a64a9d6394357aa914661ab48fd983b +client -> server 621ecb7aa1a62aae559e8d793d1aebe9289d84811bc43c4339a7153458b553f0 +server -> client e642f661546c2e6e89ddcd77ac5e8aa9cd517408a309f95a3a367af943550d96 +``` + +## Source exact-head validation + +```text +source head b381a2a614c503f3d021af98432df99a069305c7 +Track A governance 32114161352 = SUCCESS + Fresh admission behavior audit 95639845377 = SUCCESS + Deterministic admission audit 95639845470 = SUCCESS +CI 32114161531 = SUCCESS + CI / Required 95639907436 = SUCCESS +reviews 0 +unresolved review threads 0 +main freshness PASS +``` + +## Safety / nonclaims + +```yaml +runtime_access: none +client_executed: false +synology_used: false +x11_or_vnc_used: false +process_memory_used: false +credentials_used: false +login_performed: false +gameplay_performed: false +raw_client_committed_or_uploaded: false +pr475_runtime_observed: false +pr475_runtime_mutated: false +physical_e2e: NOT_APPLICABLE_STATIC_EXACT_FILE_DISCOVERY_ONLY +``` + +## Next frontier + +This promotion does not create or consume a physical runtime task. The next independent static S2 frontier is player inbound dispatch: + +```text +TPlayerProtocolMessageHandler + -> PlayerDataCurrent / PlayerState / PlayerInventory / PlayerSkills + -> exact QMeta/dispatch targets + -> static TPlayerData ownership/mutation edge where provable +``` + +Creature, container and chat handler graphs remain subsequent static candidates. Worldmap semantics and native-login runtime remain outside this promotion while PR #475 owns those surfaces.