Pointer Map v1

Target: KH2 Final Mix PC (Steam Global)
Module base: KINGDOM HEARTS II FINAL MIX.exe
Source of truth for current constants: runtime/include/kh2coop/KH2Offsets.hpp

Status Legend

• [CONFIRMED] = Verified live in Cheat Engine on target build
• [KH2LIB] = Pulled from KH2 Lua library, not fully live-verified in this project
• [GHIDRA] = Verified by static analysis of the target executable
• [LIVE] = Observed through the injected DLL/scenario rig; evidence linked alongside the claim
• [UNKNOWN] = Not mapped yet

---

Mapped vs Missing (Current Snapshot)

---

Known Offsets

World / room

NOW commit path (disassembly)

Live Steam Global build (Cheat Engine symbols). The authoritative world/room/program values in the NOW block are filled by a helper under the export KINGDOM HEARTS II FINAL MIX.axaAppMain:

RE implication: Trace callers of axaAppMain+0x37B0 (who sets rdi and the r8/rdx/r9 args) to find transition / request layer. rdi is the live location packet, not the static exe staging slot.

Call sites that call axaAppMain+0x37B0 (staging fill)

Captured 2026-03-25 via Cheat Engine MCP find_call_references on the function entry at axaAppMain+0x37B0 (same as disassembly prologue at +0x37B0). 23 distinct call sites in KINGDOM HEARTS II FINAL MIX.exe.

In CE: go to KINGDOM HEARTS II FINAL MIX.axaAppMain+37B0, then Find out what addresses call this address (e.g. Ctrl+R); the list below should match.

RVAs are relative to KINGDOM HEARTS II FINAL MIX.exe image base (use Ctrl+G → KINGDOM HEARTS II FINAL MIX.exe+<RVA>).

Absolute VAs are ASLR-dependent; only RVAs are stable across runs.

Tracing caller #1 (exe+0x15112C) — worked example

Disassembly around KINGDOM HEARTS II FINAL MIX.exe+0x15112C (live MCP capture, Steam Global):

1. call to staging fill — at exe+0x15112C: call → axaAppMain+0x37B0 (VA …492990).

2. Register args right before the call (read upward a few lines):

   • lea rcx,[rsp+30] at exe+0x151123 → rcx = pointer to a stack-local “location packet” (8-byte movsd shape + 16-bit field at [rsp+38], matching [rdi] / [rdi+8] inside the callee).
   • xor r8d,r8d / xor r9d,r9d on this merge path → then lea edx,[r8+1] at exe+0x151128 → edx = 1.
   • So this path calls staging fill with packed edx/r8/r9 = (1, 0, 0) and rcx = packet on stack.

3. Where the packet bytes come from (still above the call, same function):

   • One branch: call exe+0x3A0520 (helper just above exe+0x15108E in this capture), then movsd xmm0,[rax] / movzx from [rax+8] into [rsp+30] / [rsp+38] — so rax points at an in-memory source struct after that helper returns.
   • Another branch: movzx / mov from runtime globals (CE shows absolute 0x7FF7…C40719 range — heap / mutable, not a fixed exe+ offset) into [rsp+30]…[rsp+38].

4. Next RE step (go up the chain):

   • Who calls this function? Put cursor on exe+0x15112C, Find out what addresses call this function on the containing routine (scroll up to the function prologue — push / sub rsp — first; the first bytes at exe+0x151080 may be misaligned in a raw dump).
   • Then repeat: at the parent call, note rcx/rdx/r8/r9 and any rax filled by a child call.

Step 1 done: child function + direct parents (exe+0x151000)

Globals (runtime VAs in CE; names TBD): C406B8 = “call 0x151000” gate (dword). C406B4, C40724, C406B1, C406B0, C406C8/C406D0 appear in the same neighborhood.

Next (step 2 up): In CE, Find out what addresses call the routine at exe+0x150CA2 (or 0x150D44 for the wider function). If CE shows no xrefs, use “Find references” / AOB for the call E8 sequence or trace who sets [C406B8].

Step 2 automation (2026-03-25) — MCP + CE freeze

Safe alternatives: CE disassembler → Find out what addresses call this address on exe+0x150CA2. Or xref mov [C406B8] / hardware write watch on C406B8 (sparse). Or aob_scan MCP with a narrow +X region, not a Lua per-byte walk.

Game state

CONTROLLABLE reads 3 during cutscenes and 0 when a minigame starts (GoA ROM script). Writing 2 to PAUSE_STATUS disables pausing (GoA ROM script).

Save region (Steam Global)

OpenKH vs in-memory offsets: There is no universal eight-byte shift. OpenKH places world ID at +0x0C, after magic, version and checksum. Native readers/writers independently establish the story and visited ranges above. OpenKH's proposed twentieth story block overlaps native auxiliary state; that state is excluded until its schema is understood. The progress allow list in common/include/kh2coop/ProgressAllowList.hpp also masks unverified chest bits. The known chest extent comes from a local mod treasure table, corroborated by native addressing and the GoA chest entry; it is not proof of the complete installed archive or all story-setter side effects.

The GoA ROM's Warp(W,R,D,M,B,E) writes the NOW block (world, room, door, programs) and the saved location, but only redirects a transition already in progress (from the world map). It also swaps party costumes by rewriting objentry model-name strings before rooms load: with obj0 = the pointer read from OBJENTRY_POINTER, obj0+0x16F0 is Donald's model name and obj0+0x1750 Goofy's.

Room transition request (cold warp) — verified live 2026-10-02

LocationPacket uses u8 world, u8 room, u16 door, u16 map, u16 btl (8 bytes), then u16 evt at +8; the DLL pads the buffer to 16 bytes. The native commit consumes only the low door byte, so host-follow requests reject doors above 0xFF and read current door as u8. Programs of 0xFFFF take the save's per-room values. The inject DLL calls 0x152990(&packet, 1, 0, 0, 0) from the PerEntityUpdate hook at the start of a frame (Warp.cpp, kh2ctl warp). All three request/completion hook targets must match their first 24 executable bytes before installation. The earlier cold-warp test's 50 consecutive warps across 13 rooms in three worlds loaded cleanly.

Load signals. The request stages a target; the commit changes NOW before the new room has finished loading. 0x9BA928 (the load task pointer written by 0x152990), byte 0x9BA8D1 and LOADING_INDICATOR 0x8EC540 didn't change when sampled every 50 ms through a load. Earlier code inferred loading from a ~0.55 s entity-update stall. That heuristic is superseded: a pause can stall updates, and a same-room reload can leave all location fields unchanged. Native completion callbacks now provide the load generation; NOW equality or elapsed time alone never proves arrival.

Lifecycle and authority (VUH-1496). Warp.cpp increments a transition serial when accepting a request and a load serial after a native completion callback returns. Client-native calls to 0x152990 are blocked; only the host-command path bypasses that detour through its trampoline. The current session role is checked at the native call, so disconnect releases the client lock. EnemySync.cpp and EntityHook.cpp discard old enemy/puppet/clone and hit-target caches without restoring fields through stale actor pointers. They rebind from subsequent entity updates, including after same-room reloads. If the lifecycle hooks cannot be verified, these actor writers remain suspended.

Every accepted host epoch, including a join to an already matching location, queues a real reload. TransitionAck(arrived=true) is queued only after a later load generation, the safe gameplay gate, and exact equality of world, room, door, map, battle and event. The gate requires no frozen entity groups, IN_FIELD != 0, no open menu, idle native timeline state and no active event context. The elapsed cutscene timer is diagnostic only. The host advances its epoch when the new room instance becomes live; request acceptance alone is not client arrival. This establishes completion behavior, not proof that every native exit path is intercepted.

First live host-follow evidence, 2026-10-02. The smoke report records a passing initial 04/1A checkpoint with zero puppet position error on both connected instances. The host log then records load serial 3 and host epoch 2 at 02/00 with door/map/btl/evt all 0. The client log orders epoch-2 queued → issued (transition 3) → load complete (serial 4) → arrived at the same full target, and the relay log records TransitionAck slot=1 epoch=2 room=02/00 arrived=1.

That run failed the before_late_join checkpoint: captured state reports both native friend positions at zero and a 500-unit puppet error in Twilight Town. It is evidence for request/load/ACK ordering, not a passing multiplayer acceptance run or proof of late join, same-room reload, or native exit blocking. The missing bindings are consistent with the documented R12 party-slot limitation; the capture lacks an actor roster/raw friend pointers needed to conclusively identify that cause. Both completion hooks use the same log line, so this run cannot separately establish which completion RVA fired.

[KH2LIB] state flags on this build. PAUSE_STATUS 0xABB7F8 reads garbage (0xE5E04CA0). +0x80 (0xABB878) reads 0. CONTROLLABLE 0x2A17168 reads 142 in normal play, and CURRENT_OPEN_MENU 0x7435D0 reads FF. None of them changed when tested (no menu could be opened by script), so they stay unverified.

Static +0x80 corrections ([GHIDRA], not yet checked live). The game's code addresses these at the library value +0x80:

CURRENT_OPEN_MENU 0x7435D0 needs no shift. Current warp/arrival safe-state gate: 0x2A171E8 == 0 && 0x9BA8D0 != 0 && menu == 0xFF && 0xB65210 == 0 && 0x2A11478 == 0.

The native GoA map chest exposed the stale-timer gate on 2026-10-02: after the popup disappeared, frozen groups were 0, in-field 1 and menu 255, while the timer remained 90. Independent decompilation confirmed that the timer is retained. Runtime gate and event flags now use both lifecycle and context. The native chest calibration passed: an active popup had state 3 and a non-null context; completion left timer 90 with both predicates zero. Native warps then succeeded and ReadRoomState() reported no cutscene. Chest flag 409 initialized motion 152 after reload; the immediate native opening motion was 153. The separate three-instance chest run also passed client next-load mirroring, late join and a subsequent reload. All six client applies preserved personal bytes immediately around writes; full character/inventory/munny/EXP snapshots and four disk save hashes stayed unchanged. This establishes chest behavior, not all native story side effects.

Unit slot stat system

Actor object offsets (CE Dynamic Session — 2026-03-31, CONFIRMED)

Entity transform struct (relative to dynamic struct base)

Entity position buffer array

Entity discovery constants

Camera struct (relative to exe+0x718C60)

Camera actor pointer chain: camStruct+0x50 -> actorObj+0x640 -> entity+0x30 = position

Input / other

Input system (Ghidra RE Session — 2026-03-31, CONFIRMED)

Full input pipeline traced via Ghidra static analysis. See docs/INPUT_RE_SESSION.md for the complete disassembly walkthrough.

Architecture:

Hardware (XInput / Steam Input / DXInput)
  │
  ▼
exe+0x105810  — main input collector (FUN_140105810)
  │  reads raw gamepads/keyboard/mouse
  │  supports up to 4 XInput + 4 Steam Input controllers
  │  SWAPS active controller data into slot 0
  │  writes to raw input slots at struct_base+0x18 + slot*0x44
  │
  ▼
exe+0x39BF00  — game loop input callback (FUN_14039bf00)
  │  calls exe+0x39C720 per entry — maps raw buttons→game actions
  │  via mapping table at exe+0x5C3420
  │  writes processed button bitmask to fixed-address array
  │
  ▼
Processed button state at exe+0xBF31A0 (2 entries, stride 0x68)
  │  Entry 0: exe+0xBF31A0  (current buttons, new-press, release, repeat, analog)
  │  Entry 1: exe+0xBF3208
  │
  ▼
~30 game systems read processed state via exe+0x39B580 context switch

Input struct pointers

Raw input slot layout (0x44 bytes per slot, at struct_base + 0x18 + slot * 0x44)

The March labels for the two sticks were reversed. Native movement/menu calibration on2026-10-02 corrected the layout below; it matches KH2Offsets.hpp and the current kh2ctl player-input path. See raw slot calibration.

Processed entry layout (0x68 bytes per entry)

Key code addresses (stable)

Critical finding: friends do not use input

KH2 consolidates all active controller input into slot 0 only. Friend characters (Donald/Goofy) are entirely AI-driven. The game swaps whichever controller has activity into slot 0; there is no per-party-slot input buffer.

RTTI class hierarchy for friends:

Friend@kn → FRIEND@YS → PARTY@YS → BTLOBJ@YS → STDOBJ@YS → OBJ@YS

Related RTTI classes: FriendPersonality@kn, FRIEND_FORMATION@gb, ACTION_FRIEND_FLY@kn.

Debug strings found: "friend attack:", "gentle friend", " friend1:", " friend2:", " friend3:", "FRIEND RECOV %3d".

M3 injection strategies

Strategy A — Puppet Mode (implement first): Write directly to entity position/rotation/action fields. Already partially working via ApplyReplicaActorState(). Needs animation ID offset for visual sync.

Strategy B — AI Replacement Hook (future): Hook the friend AI tick function via DLL injection (Panacea-style). Replace AI output with player input. Requires finding the FRIEND@YS vtable dispatch and the per-frame AI decision function. Use CE hardware write breakpoint on friend entity position to find the callstack.

Friend entity discovery (RE Session — 2026-03-26, CONFIRMED)

The first friend unit slot (Slot 1, at SLOT0_BASE + SLOT_STRIDE) stores actor object pointers to both friend party members:

Entity struct is at actor + 0x640 (same as Sora). Friends share the exact same entity struct layout as the player — position, rotation, velocity, airborne flags all at the same offsets.

Key differences from player entity:

• Friends have moveState=0 (AI-controlled) vs player moveState=2 (ground) / 3 (air)
• Slot 0 and Slot 2 do not have actor pointers at +0x220/+0x228 — only Slot 1 stores both
• Actor addresses are dynamic and change per room transition (re-discover after each transition)

Verified in: TT Room 7, TT Room 8 (Dusk fight), Mysterious Tower Room 25. Friend entities were at different addresses in each room, but the Slot1+0x220/0x228 discovery path worked consistently.

Enemy entity layout (RE Session — 2026-03-26, PARTIAL)

Enemy entities use the same entity struct layout at actor + 0x640. Active enemies have moveState=8 (or 9 for alt state). Dead/freed enemy slots have garbage data.

Enemies of the same type are allocated in contiguous actor slots:

Stride varies by enemy type. A fixed stride cannot be assumed. The canonical runtime container is not a dedicated enemy array; it is the active-entity linked list headed by exe+0x2A171C8.

Actor objentry descriptor (CE Session — 2026-03-31, PARTIAL)

actor+0x918 points into the exe objentry/descriptor table:

Live validation on 2026-03-31 from the current process:

• P_EX100 -> id 84
• P_EX030 -> id 93
• F_EX030_BB -> id 321
• N_BB080_TSURU1 -> id 397

Important caveat: a live non-combat N_... actor in the current room had moveState=8, so moveState 8/9 alone is not a safe enemy filter. Runtime enemy traversal now uses the objentry name prefix and only accepts B_... / M_... actors after the moveState check.

Active entity list / handle resolver (Ghidra + CE Session — 2026-03-31, CONFIRMED)

EntityUpdateLoop walks a global linked list of all active actors:

• exe+0x2A171C8 — head pointer (DAT_142a171c8)
• exe+0x2A171D0 — tail pointer (DAT_142a171d0)
• actor+0xA90 — next-link handle for each actor node
• exe+0x2B0D720 — 64-entry qword region table used to resolve handles to pointers

Handle resolution from FUN_1404ad3f0:

masked = handle & 0x7fffffff;
bucket = masked >> 25;
ptr = HANDLE_REGION_TABLE[bucket] | (masked & 0x01ffffff);

Live CE validation on 2026-03-31:

• Current room: world 5, room 8
• Active-list head read from exe+0x2A171C8: 0x7FF6EE0C2F60
• First live links resolved cleanly through actor+0xA90:
  • 0x7FF6EE0C2F60 -> handle 0x8403A1B0 -> 0x7FF6EE03A1B0
  • 0x7FF6EE03A1B0 -> handle 0x84056FB0 -> 0x7FF6EE056FB0
  • 0x7FF6EE056FB0 -> handle 0x8407BA40 -> 0x7FF6EE07BA40
• The current room contained 18 active list nodes total and 1 moveState 8/9 false positive (N_BB080_TSURU1) in a non-combat room
• This established that active-list traversal needs an objentry-based class filter in addition to moveState

Result (superseded 2026-10-02, VUH-1486): an enemy is an active-list actor whose objentry type byte (actor+0x918 → record +0x04, OpenKH ObjectType) is 3 (BOSS) or 4 (ZAKO). Verified live in the Parlor Ambush: 8 M_EX020_RAW Shadows read type 4. Their team actor+0x4DC read 2; the party reads 1, props 0. The earlier moveState 8/9 + B_/M_ filter missed them because some enemies don't use the player's entity layout, so entity+0x100 reads garbage. kh2ctl entities lists every active actor with these fields. No enemy-only count global has been identified.

Entity update call chain (CE + Ghidra Session — 2026-03-31, CONFIRMED)

Traced via hardware write breakpoint on Friend1 entity position Y (actor+0x640+0x34). The breakpoint fired at exe+0x1A8E6F (inside MEMCPY_4FLOATS). Return address analysis + Ghidra xref tracing revealed the full call chain:

exe+0x3BF5E0  Entity Update Loop
  │  Iterates linked list at DAT_142a171c8 (all active entities)
  │
  ├─► exe+0x3BFD30  Per-Entity Update
  │     │  Dispatches to vtable virtual functions:
  │     │    vtable+0x08  — early update
  │     │    vtable+0x10  — main AI / action update (friend AI decision here)
  │     │    vtable+0x18  — post-main update
  │     │    vtable+0x20  — conditional update
  │     │    vtable+0x28  — pre-physics update
  │     │
  │     └─► exe+0x3B89A0  Position Physics
  │           │  Calculates velocity, gravity, applies movement delta
  │           │  Reads velocity from actor+0xB98, acceleration from actor+0xA58
  │           │  Live CE execution breakpoints confirmed both reads on Friend1:
  │           │    exe+0x3B8B85 (velocity) and exe+0x3B8C02 (acceleration)
  │           │
  │           └─► exe+0x3B9090  Position Calculator
  │                 │  Collision detection, final position computation
  │                 │  Writes to entity transform via MEMCPY_4FLOATS:
  │                 │    lea rcx,[rsi+0x670]  (entity+0x30 = position)
  │                 │    lea rdx,[rsi+0x700]  (computed position source)
  │                 │    call exe+0x1A8E60
  │                 │
  │                 └─► exe+0x1A8E60  MEMCPY_4FLOATS
  │
  └─► exe+0x3BEEC0  calc_motion (batch animation processing)

EntityPositionPhysics consumes several independent movement terms. Its native epilogue clears actor+0xA48 through +0xA67, including +0xA64, with four qword stores at RVAs 0x3B9042/0x3B905F/0x3B9066/0x3B906D. Post-physics zero values therefore do not establish that those terms contributed nothing during the update.

Static movement terms (checked 2026-10-05)

Existing-binary decompilation and instruction bytes distinguish the following terms; these are capabilities, not attribution of a live position change.

0x3B81D0 retrieves polygon geometry and transforms a global vector into a surface basis; its old actor-pair separation label was incorrect. The explicit other-actor loop is in 0x3B9090, calling 0x40AD70 with the two actors' +0xA00 objects. The final solved position is copied from +0x700 to +0x670 at 0x3B955C. Alternate or skipped branches can leave summary fields stale. Sparse sequential reads cannot reconstruct all within-frame contributors. See exact static output and field references. The upstream calculator audit resolves the call-site pointer roles and the S0 distinction; these static capabilities do not identify a live originating force.

Strategy B hook target: exe+0x3BFD30 — intercept for friend entities, replace the vtable AI dispatch (vtable+0x10) with player input processing, then let exe+0x3B89A0 (physics) run normally for full game integration.

Live M3 note (2026-04-01): vtable +0x10 suppression is enough to hand local movement to Friend1, but not enough to remove all vanilla friend behavior. Left-stick solo control now works in practice, and the remaining Donald→Sora pull is currently attributed to the friend vtable +0x28 pre-physics callback (0x1401B0050 on the current build, tail-calling 0x1403D6870). That callback is now the main tether-removal candidate for the next live retest.

Still unknown (blocks further milestones)

---

Runtime Bridge Coverage

File: runtime/src/GameBridgePC.cpp

Limit command gate ([GHIDRA], 2026-10-02, VUH-1491; not yet checked live)

To block limits while puppets are active, hook 0x3D88E0 and return 5 for any command 0x3E7C30 recognises.

Actor behaviour flags actor+0x18C ([GHIDRA], bit 6 corrected 2026-10-05; bit 6 effects not yet checked live)

The post-solver contact/notification branch requires handler +0x0C bits 0/1 clear, actor+0x18C & 0x1000020 == 0, and bit 6 clear; failure can enter alternative notification handling. Later support-handle handling requires 0x3BA9A0 false, handler bit 1 clear, actor bit 6 clear and nonnull actor+0x748. These are selective guards after the solved-position copy, not proof that all terrain correction or ground snap is suppressed. See the byte-check note and retained provenance.

The 2026-10-05 bounded no-reaction lookup found no validated setter or lifetime contract for bit 14. ResolveHit and Sora's OnHit can run before this helper, and retained Sora damage already reaches ApplyStatDelta with react=0. The serialized ActorState.invuln field is not populated from native state or applied by the bridge; its value is not evidence of native invulnerability.

Native enemy provenance and appearance cache ([GHIDRA], 2026-10-02)

Independently corroborated static reads, additionally observed in the checked native census. They are diagnostic fields, not a validated suppression or replication boundary. Equal SAVE progress hashes do not cover this cache.

Native emission wrappers 0x3FE590/0x3FE650 call factory 0x3DF930 and attach this provenance. Some callers dereference the result without a null check, so returning null from a broad spawn hook is not safe. Compare a checked native linked-list census, controller/record state and cache contents before choosing an authoritative emission strategy.

Ordinary spawn-controller hook and lookup ABI (2026-10-02)

Static disassembly and checked geometry establish the following module-relative RVAs. They define call mechanics and bounded scope, not authoritative spawn convergence.

0x3FF000 ABI: void (__fastcall*)(void* controller, const float* point4). RCX is the controller; RDX points to 16 readable bytes. The verified caller consumes no return value and returns to 0x3A5063. Use aligned local float[4] and call synchronously; native copies the vector and does not retain its pointer.

Exact installation fingerprints (verification spans, not manually selected trampoline overwrite lengths):

The update clears transient flags 0x18, respects disabled bit0/event gating, decrements cooldown, tests linked regions and performs emission/cache bookkeeping. Bit3 means a region accepted; type2 sets header+0xE and dispatches delayed records. Qualified-client Hold skips the whole tick, including cooldown; it is a scoped pause. Unsupported/unavailable scope cannot be claimed controlled.

Direct read-only lookup 0x3E0F10 has ABI const void* (__fastcall*)(int32_t directObjectId) (ECX ID, RAX pointer/null). It tries three table pointers at 0x2A25030, +8, +0x10 in order. Each nonnull table has i32 count +4 and entries +8, stride 0x60. Its comparator subtracts entry ID from the low32 bits of a pointer-sized numeric key, not a pointer to ID storage. Do not replace this with OBJ0-only or base+ID*stride. Verify bytes, checked nonnegative table counts/spans, then use a POD-only SEH leaf. Validate returned span/alignment, ID, type and name; recheck roots/counts and lifecycle. Faults/changed tables are unavailable; null is unresolved, not combat. Caps64 controllers, 256 records and 65536 object entries are safety bounds, not discovered native maxima.

General resolver 0x3DFEB0 also maps party/drive/save aliases. The static direct-ID boundary excludes zero, high-four-bit modifiers and hexadecimal aliases 236,237,238,23B,23C,23D,23F,240,2C0,319,31A,3EE,62A,62B. Qualify an entire ordinary type2 controller only when every record, including later-stage/cached records, has mode2, positionMode0, finite fixed XYZ and a direct objentry type3/4 with name prefix other than F_. Mixed/unsupported records exclude the whole controller; header30 is observed coverage, not the scope definition. Do not rewrite records or invoke a subset of emitters.

Runtime region nodes are 0x70 bytes: vtable +0, inverse float4x4 +8, extents XYZ +0x48/0x4C/0x50, next encoded handle u32 +0x58, descriptor pointer +0x68. Each source descriptor is 0x40 bytes: u16 kind/category +0/+2, float position XYZ +4/+8/+0xC, extents +0x10/0x14/0x18, Y rotation +0x20. Walk the actual list, since native setup excludes some categories; require aligned source pointers inside the checked descriptor array/count.

Predicates copy float4 and force w=1. Captured inverse matrix M transforms via q[j]=M[j]*x+M[j+4]*y+M[j+8]*z+M[j+12], j=0..2. Native accessor 0x3B5B40 selects actor+0x70 if parent handle u32 +0x6A0 resolves nonnull through 0x3DA520, otherwise +0x670. Generic resolution uses the 64-entry table at 0x2B0D720: table[(handle & 0x7FFFFFFF)>>25] | (handle & 0x01FFFFFF). Bit31 is ignored, raw handle0 is null, and invalid/failed reads cannot imply null.

The geometry03 artifact has eight valid native/causal captures out of nine; the overall run failed because snapshot0/client1 failed actor-identity stability. Later snapshots1/2 captured all seven header30 BOX regions on every peer. Source descriptor and inverse-matrix/extent bytes matched across valid captures. At snapshots1/2, each peer's geometry placed the host point outside all seven and both clients inside indices5/6, without edge uncertainty. This is offline float32 containment, not instrumented predicate returns or an authority-fix pass. See the extraction receipt and scenario limits.

Fixed type2 emission observation and replay limits (2026-10-02, static verified)

Successful fixed-wrapper return 0x3FE83F inside delayed type2 emitter 0x3FE6F0 is a verified creation boundary, not a complete replay API. The opt-in KH2COOP_SPAWN_TRACE=1 observer now covers all callers of fixed 0x3FE590 and generated 0x3FE650, plus explicit dispatcher/script scopes. It passes each original through once, preserves genuine returns and distinguishes checked nonnull, null and unavailable observations. Wrapper evidence outside an activation tick is retained separately; it cannot claim completed tick bookkeeping. Source and byte checks are offline evidence; native execution and diagnostic coverage still need a live run.

Verified fixed-wrapper entry (15 bytes): 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 30. At 0x3FE83A, E8 51 FD FF FF calls that wrapper; return 0x3FE83F is before caller-owned cooldown assignment at 0x3FE99E and stage advancement. Generated wrapper call 0x3FE984 instead returns 0x3FE989; do not merge scopes. Observe enclosing controller tick completion to obtain truthful post-state.

Live2302 run20261015-163914 found successful fixed-wrapper returns with a valid objentry but actor+0x5C0 status still null. Wrapper virtual+0x68 has already run provenance initialization; 0x3B4BD0 writes controller+record at actor+0x9E8/+0x9F0, not status. Do not require a nonzero combat-status pointer at this early boundary. Retain the successful-read zero and mandatory handle/object/controller/record roots, then complete status once from a fresh complete census after all captured roots and indexed definition still match. Freeze the nonzero pointer thereafter. The combat classifier successfully excludes status-null actors, so even a complete combat census can precede initialization. Pending birth checks must separately witness current linked-list membership (the existing watched-actor census), bounded to32 observations and granting no binding identity. First absence or root drift refuses. A wrapper-return trace alone cannot claim census-ready combat metadata.

Wrapper cache insertion uses objentry-type mask 0xA02010: it includes mob type4 (also 13/21/23), not boss type3. A successful boss creation need not insert its record ID. The wrapper does not perform the caller's region, occupancy, cache, stage, cooldown or count/event reconciliation. 0x3FF780 is unsafe as a replay convenience: it increments initialCount and resets currentCount to initialCount, destroying accumulated death bookkeeping. Calling the whole emitter or stage helpers lets divergent local state make new population decisions. No safe single-call bookkeeping reconciliation API has been verified.

Controller task 0x3A4F90 is scheduled at priority 12000 by 0x3A4E10; actor updating uses priority 20000. Executing creation from a head-actor callback is not proven equivalent to the native controller lane. No runtime/worker thread may call native creation. Native lethal/count/event behavior must remain on its verified path; do not compensate with HP/count/cache writes.

Cross-peer addressing requires epoch/full location/session plus unique ordinary controller groupKey/headerId, recordIndex/nativeRecordId/objectId and validated static descriptor content. GroupKey alone repeats (headers 30..33 share b_00); pointers/table indices are local, and controller reinitialization can occur within a room. Record ID is not a creation generation: lookup 0x3B41E0 maps ID0 to 0x70, searches without a controller discriminator, and filters actors. Cache routines compare signed int16 slots while wrappers load IDs unsigned; an initial replay proof must reject zero/high-bit IDs and room-wide collisions, using IDs 1..0x7FFF until broader semantics are proved. These are replay limits, not changes to existing activation qualification.

Successful wrapper order need not equal the next census's manifest netId order. Correlate the returned actor under checked native identity before publishing a creation event; repeated emissions need distinct host event identities and idempotent delivery. Matched initial cache/count enrollment, alive removal versus death, stage/refill progression, mid-room reinitialization and late-join history remain blockers. Creating the visible actor alone cannot establish that state.

Alive removal, native death and script bypasses (2026-10-02, static verified)

These Windows x64 ABIs were checked by decompilation and register-bearing bytes in the installed executable. They are observation/API candidates, not permission to invoke a repair on an arbitrary actor.

For a living delayed-mode-2 record, 3FFD90 clears its appearance-cache ID and resets controller cooldown without decrementing the battle count. Dead removal recognizes bit 2 and normally retains the record's cache ID. Native count events include 3AABE0(3, headerId) and aggregate-zero 3AABE0(2, 0). Other death wrappers reach count bookkeeping independently; neither HP alone nor a later census disappearance proves which lifecycle side effects ran. Never call bookkeeping alone, represent alive removal as HP zero, or repeat native count/cache changes after a disposal path already performed them.

Generic actor update 3BFD30 can dispatch type-handler virtual slot +0x38 at 3BFF58 from normalized fade state (actor+0xA08, +0xAAC) and flags. Those values are not HP. A removed actor can cease blocking occupancy before allocation is freed. Exact subtype/caller proof is needed before replay or selective suppression; broad suppression would also affect death and teardown.

Selected actor retirement, 2026-10-05 (saved PE; not live lifetime proof). The deletion marker is actor+120 bit 0x80000. 3BF300 first processes the previous deferred list, then unlinks marked actors from the active list using encoded +A90 links and queues them for a later sweep. Active-list absence is therefore earlier than allocator release. The selected ordinary Shadow handler is 7528E8 -> vtable 5D2D68, slot0 419AB0.

Binding writers 152450 and 152680 use constructor 19C3A0, which installs the kn::MemoryAllocator primary vtable 5B2BB0; slot +10 resolves to 19C470. Release header is pointer-20, size is read at pointer-10; do not infer that size from the factory's 0xD50 request. Helper 3A08F0 and the paired synchronization helpers remain uncharacterized. Null, changed live binding, unwind or partial execution cannot establish successful retirement.

The current lifecycle probes do not observe these completion boundaries. Encoded handles identify an address/region, with no creation generation; same-address reuse remains ambiguous. These static facts do not authorize absent-dead reconstruction. Exact bodies, callsites and limits are in the release audit and allocator binding audit.

The full 68-byte body of script callback 42DC10 verifies stage advancement 3FFE40, followed by tail jump 42DC49 -> 3FE320(controller, null), bypassing 3FF000 even for type 2. Its original trampoline can leave the dispatcher with a DLL return address: an unavailable executable caller RVA is expected in that case. Explicit script TLS records dynamic enclosure, not immediate dispatcher ancestry. Return 3FE83F identifies the fixed emitter branch, not the full producer path. All-caller fixed/generated observations outside the activation tick retain wrapper evidence without claiming tick bookkeeping.

The opt-in lifecycle module independently byte-gates 3FFD90, 3B45C0, 3D4A40, 3FED10 and 3FED40. Its installed mask exposes partial coverage; the other subtype wrappers and 3AABE0 events are not hooked. Pre/post actor, controller/cache and full native stamps retain nested entry/parent sequence. Disposal can invalidate poststate, and count decrement has no actor argument. Only the first registered game thread samples role/Warp callbacks; unknown threads retain raw NOW and unavailable serials. These probes are observations, not a replay or reconciliation API. Generic factory bypasses, actual allocation release and same-address/controller reincarnation remain unproven; current census/netId correlation is diagnostic. See SCENARIOS.md for saved-log auditing and ENEMY_PARITY.md for the retained wave failure and offline test scope.

Scoped predicate extension, 2026-10-03 (saved-PE verification; no live install). Admission 3A1F00(float XMM0) -> AL reads float32 limit/used at 2A0F7DC / 2A0F830; the factory passes unsigned-byte objentry weight +54, returning to 3DFA0B. Type-4 allocation calls 152430(size_t RCX) -> RAX with 0xD50, returning to 3DFA7D. That allocator entry tail-forwards through a vtable; its decompiler void return is incorrect. Scoped observers preserve actual arguments/results and never dereference returned allocation storage.

Removal predicate 3DAC30(actor RCX) -> AL is reached by the type-4 tail thunk 419B90, retaining ordinary caller 3BFD6F. Its script child 3B4420 returns to 3DAC3E; auxiliary child 3CE550 returns to 3DAC9C and tests dword +14 on its genuine argument. Actor boundary operands are qword +5B0, dword +5B8, qwords +80 / +98 and encoded dword handle +BB4. They are sampled operands, not extra native resolutions or immutable identity. New predicate events end before the later virtual removal/disposal call. Full byte guards and caller-site checks gate the observers; partial masks, foreign calls, unwinds, repeated children and loss cannot establish a branch conclusion. The static capture contract records exact bytes against PE SHA256 9002B2DE6A1F91A790BD0673DE125D1CF833F7942BFEC827CDCF6BA64D5849ED.

Empty-seat package qualification correction (9002b2de, 2026-10-07)

2A0F7A8, historically labelled ARD pointer, is a script visibility mask in this executable. Native 3A2030 reads the loaded ARD BAR root at 2A0F828; 3A2060 prepares it before 3E2EB0. Entry offsets are encoded handles after 3A6840, decoded with table 2B0D720. See party-empty2/rev1 research/package-gate.md for primary bytes, ordering, package hashes and restricted read-only gate.

Sparse party menu consumers (9002b2de, 2026-10-08)

Native 2FC360 compacts nonzero member entries (stride0x20) and preserves the original row seat at entry+8. Pause caller3065C8 must project its compact index through that saved seat before2FC5B0 (return3065CD). Only the two companion-history callers returning36A46A/36A727 project Sora/Roxas to the existing zero-skip through2FC6D0; player history stays native. Five hook entries and three caller CALL signatures are guarded. No SAVE write is added. Primary evidence and other-consumer limits: party-empty2/rev6/research/consumer-audit.md. Fixture10 run20261008-024646 qualified pause and first Items selection with remote/0/local members, not Party/change or deeper Items consumers.