"""DIMENSION 1 / query 2. FUN_1800150d0 is now proven to be the display-group builder: it walks the 0x158 pack records at stride 0x158, calls FUN_180014380(model, rec+0x00) to find-or-create a group, FUN_180012950(tmp, ordinal, rec+0x30) to construct a 0x108 group, and FUN_18002c3c0(tmp2, rec, group+0x00, -1) to build the 0x1a8 pack model that is pushed into group+0x40. HYPOTHESIS: the group *lookup* FUN_180014380 keys on something that collides between our two GOLD packs, or a second consumer resolves group -> pack by a colliding key. Live memory already proves the built vector is CORRECT, so the fault is in a consumer. CONTROL: FUN_18002c3c0 is decompiled in full and its field writes compared to the live 0x1a8 record measured this run (inner+0x0a0 = 400/5000/15000, +0x0c0 = 5/7/11). If the decompile's offsets do not reproduce those, the decompile is being misread and nothing else here can be trusted. """ import traceback OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/q2_out.txt" buf = [] def P(*a): s = " ".join(str(x) for x in a) buf.append(s) print(s) def C(a, label): P("=" * 78) P(label, hex(a)) P("=" * 78) s = dec(a) P("len(src) =", len(s)) P(s) P("--- callers ---") for ent, nm in callers(a): P(" %-30s %s" % (nm, hex(ent))) try: C(0x180014380, "A. group LOOKUP FUN_180014380") C(0x180012950, "B. group CTOR FUN_180012950 (0x108)") C(0x18002c3c0, "C. pack model builder FUN_18002c3c0 (0x158 -> 0x1a8) [CONTROL]") P("=" * 78) P("D. callers of the group builder FUN_1800150d0") P("=" * 78) for ent, nm in callers(0x1800150d0): P(" %-30s %s" % (nm, hex(ent))) P("=" * 78) P("E. callers of 0x1801340e0 and 0x180132180 (vector grows)") P("=" * 78) for a in (0x1801340e0, 0x180132180, 0x180010160, 0x1800102d0): P(" -- %s" % hex(a)) for ent, nm in callers(a): P(" %-30s %s" % (nm, hex(ent))) except Exception: P(traceback.format_exc()) open(OUT, "w").write("\n".join(buf)) print("WROTE", OUT)