"""DIMENSION 5 pass 7: close Q2. FUN_1800af3a0 returns 0x1c when the unopened-pack
count is > 0 and the model's claim vector (model+0x5a38, slot 0x160) is empty. What
consumes that return value, and can that path originate an HTTP request?

CONTROL: the same function returns 0x29 when the claim vector is NON-empty and 0xe
otherwise, so whatever consumes the value must treat all three as the same kind of
token (a state/screen id). If the caller uses it as something else (a count, a bool)
the "state id" reading is wrong.
"""
import traceback, os
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store"
try:
    print("### xrefs to FUN_1800af3a0")
    for frm, typ, fn, ent in xrefs_to(0x1800af3a0):
        print("  from %#x (%s) in %s @ %#x" % (frm, typ, fn, ent))
        if ent:
            s = dec(ent, 300)
            open(os.path.join(OUT, "dec_af3a0_caller_%x.c" % ent), "w").write(s)
            print("    len=%d -> dec_af3a0_caller_%x.c" % (len(s), ent))
            if len(s) < 4000:
                print(s)
    print("\n### FUN_1801a4cd0 (the message poster used by the 0x273d handlers)")
    print(dec(0x1801a4cd0, 300)[:1500])
except Exception:
    traceback.print_exc()