engine-re.md: the write-log method, plaintext-value insight (store is obfuscated),
vm_operand_write ABI, the packer poll-until-unpacked fix, and the validation
(34k-global capture seeds the VM to match the engine's whole opening). Plus the
resync-tolerant align() / operand-hook blind-spot notes. tools-reference: the new
tool + trace --state.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
capture_global_writes.py hooks vm_operand_write@0x425fb0 (plaintext values,
before the obfuscated store — sidesteps the shelved flat-scan problem) and folds
the engine's global-int writes into a GameSession snapshot. --spawn captures from
boot (packer-aware: polls until the code unpacks, then attaches — AGE.EXE unpacks
in-place so a spawn-time hook hits packed bytes; also kills the spawned pid if
setup fails so no suspended orphan). Age.Cli 'trace ... --state <snap>' runs a
scene from the captured state.
Validated: a real boot->new-game->SC0000 capture (34008 globals incl. G[0x6c1]=1)
seeds the VM to match the engine's ENTIRE opening (542 ops, no non-realignable
fork) with zero manual seeding. Residual: a 2-op color detour (0x202/0x203)
unfixed by state = a real branch diff to chase. Engine 81/81, diff 5/5.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Strict lockstep over-reported: the operand hook misses any op whose operands
aren't fetched via vm_operand_fetch (comment 0x1a7, set-string 0x192, the
0x1c7/0x1cc/0x131/... string-op cluster) — the engine executes them (they sit
after non-branching ops) but they're absent from its trace. New align() resyncs
over such one-sided insertions and reports only NON-realignable forks; it
separates VM-only blind spots (artifacts) from engine-only detours (real,
reconverging branch/state gaps, surfaced honestly). +2 tests (7/7).
Result: with G[0x6c1] seeded the SC0000 opening has NO non-realignable fork
across all 539 VM ops (was: false 'diverge at 0x8d'); residual = a 2-op
engine-only color detour (0x202/0x203 @ 0x122d0). Cold's first real fork is a
later G[0x6c1] gate. Validates the pre-scene-state theory end-to-end.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
engine-re.md: the offset-path diff method, the working capture (operand hook
0x41b940; tick 0x410fb0 sees ecx!=ctx), the two capture caveats (hook-before-load
gating + operand-mode argc>=1 filter), SC0000 codebase id, and the first
divergence found (op 0xa0 jcc @ 0x8d on uninitialized G[0x6c1], the ADV-chrome
enable — a two-boot-gap state hole, not the predicted coroutine yield).
tools-reference.md: trace_engine_ops.py, diff_optrace.py, --trace-json.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Operand-hook captures skip zero-operand ops (stmt markers, script-entry 0x259),
so the VM offset trace is filtered to argc>=1 instructions before diffing — same
subsequence both sides. +1 unit test. Default on; --full for a tick-mode capture.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reads cur_ctx_index/frame_pc/frame_codebase from the engine ctx per executed op
and emits (codebase, offset=(pc-codebase)/4) to build/engine-optrace.jsonl.
Recon result: the tick hook (0x410fb0) does NOT expose ctx via ecx (0 entries);
the operand hook (0x41b940) is the working capture (100% of offsets land on valid
SC0000 instruction starts). Writes a tracer-live.flag so the capture can be gated
on hooks-installed before the scene loads (else the entry burst is missed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
