"""Q1 decisive: the settings deserialiser's switch, read as a SWITCH not as immediates. WHY THE IMMEDIATE SCAN WAS ABANDONED: in q_mk_pile_4 the control atom 0x361 (untradeable), which is PROVEN to have an arm in the shared item deserialiser FUN_18013fe00, produced ZERO immediate hits inside that deserialiser. Dispatch there is a jump table, where the case value never appears as an immediate operand. An immediate scan therefore has a proven false-absence on exactly this dispatch form, so nothing may be concluded from it. Ghidra's decompiler DOES recover the jump table into a C `switch`, so I read the switch. HYPOTHESIS: FUN_18013c6d0 writes response+0xd0 (which FUN_180173e00 forwards to the capacity applier as S+0x08 -> model+0x1fd1c) from atom 0x1c0 maximumTradePileSize, and response+0x1c (the callback's abort gate) from an error/code atom. CONTROL inside the same function: the arms that write +0x50 (which FUN_180173e00 forwards as S2+0x28 -> model+0x1fd2e, the PROVEN tradingEnabled gate byte). If I can see that arm and its atom id, the offset->atom mapping method is validated on a field whose downstream effect is already established. """ import re, traceback try: for a, tag in [ (0x18013c6d0, "settings deserialiser"), (0x180174630, "the 0x2cd..0x370 dispatch caller"), ]: src = dec(a, 300) print("\n\n########## %#x %s len=%d FULL ##########" % (a, tag, len(src))) print(src) except Exception: traceback.print_exc()