5eff724b17
capture_global_writes.py hooks vm_operand_write@0x425fb0 (plaintext values, before the obfuscated store — sidesteps the shelved flat-scan problem) and folds the engine's global-int writes into a GameSession snapshot. --spawn captures from boot (packer-aware: polls until the code unpacks, then attaches — AGE.EXE unpacks in-place so a spawn-time hook hits packed bytes; also kills the spawned pid if setup fails so no suspended orphan). Age.Cli 'trace ... --state <snap>' runs a scene from the captured state. Validated: a real boot->new-game->SC0000 capture (34008 globals incl. G[0x6c1]=1) seeds the VM to match the engine's ENTIRE opening (542 ops, no non-realignable fork) with zero manual seeding. Residual: a 2-op color detour (0x202/0x203) unfixed by state = a real branch diff to chase. Engine 81/81, diff 5/5. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>