# Live convoy capture attempt: 04_009 / 7

These are partial DOSBox debugger captures, **not full-route validation**.
See [the discrepancy report](../../../docs/route-convoy-discrepancy.md).
All game execution used `/tmp/darker-convoy-live/game`, copied from `darker/`.
The original installation was not modified.

## Captured evidence

Each `*.bin.gz` contains a gzip-compressed 1 MiB physical-memory dump.
`captures.json` reports SHA-256 of the uncompressed memory, code identity,
loaded route prefix and object fields. Reproduce it with:

```sh
python3 tools/inspect_convoy_capture.py analysis/missions/convoy-live/attempt-*/*.bin.gz > analysis/missions/convoy-live/captures.json
```

The inspector decodes the expected object addresses even before construction;
`plausible_route_object: false` warns that those fields are not usable vehicle
state. In particular, `stage-patched` and `briefing-state` are startup evidence,
not movement captures. A true flag only checks the callback and route-pointer
range; it is not a general validity or activity guarantee.

At mission entry, CS/DS = `01A2`, SS = `2C42`; shared data starts at `CS:F000`.
Object 6 starts at `SS:DC26`, with next-route pointer at `SS:DC7E`.
The first route instruction at `CS:F136` maps to resource offset `42B5`.
`convoy-first-fetch2` and the later `first-fetch` captures show next pointer
`F137`, while the action byte is still zero: execution stopped at `8F78`,
before storing the new action. A similarly named earlier dump,
`convoy-first-fetch`, still has `F136`; it is not evidence of a completed fetch.

## Controlled-start interventions

The saved driver scripts depend on the temporary debugger path, Xvfb,
pexpect, xdotool and ImageMagick. They accept newline-delimited JSON commands
on stdin; they are preserved as capture provenance, not a portable test suite.
The terminal logs contain the debugger commands and register displays.

1. Run the temporary copy under DOSBox debug (normal CPU core, fixed 20,000
   cycles; per-attempt `dosbox.conf` retained).
2. Pass the intro with Escape, select menu option 1, pause with Alt+Pause,
   set `BP 01A2:BB12`, resume with terminal F5 and press Return in the game.
3. At the stage-reader breakpoint, write `SM 2C42:0FB0 50`. Internal stage
   80 decimal selects `04_009 / 7`.
4. Set a breakpoint at `01A2:D95C`, resume to the briefing loop, then set
   `SR EIP D9F8` to its normal return sequence. This bypasses the briefing;
   it is an intervention whose complete side effects have not been verified.
5. Attempts 3 and 4 additionally write `SM 01A2:C059 57 F4`, advancing the
   text cursor to `F457`, corresponding to resource `45D6`, the counted
   in-flight messages. Attempts 1 and 2 leave it at `F34A`, inside a briefing
   page. That earlier cursor is incorrect for subsequent message reading.
6. Break at `01A2:8F3B` to capture the first truck callback, then use
   `MEMDUMPBIN 0:0 100000` and compress the result.

Neither the movement code nor route bytes were intentionally edited.
Software breakpoints and debugger-controlled startup still make this an
instrumented run, not an untouched playthrough.

## Attempts and limitations

| Attempt | Conditions | Result |
| --- | --- | --- |
| 1 | `Mus=0`; route watchpoint; included an attempted Alt+F12 fast-forward | Initial callback and first pointer advance; later illegal-instruction loop |
| 2 | `Mus=1`; no fast-forward; route watchpoint | Same initial fetch; cockpit screenshot; later illegal-instruction loop |
| 3 | `Mus=1`; corrected message cursor; route watchpoint | Same initial fetch; later repeated unhandled interrupt 1 |
| 4 | `Mus=1`; corrected message cursor; all breakpoints removed after initial callback, no memory watchpoint | Initial callback captured; repeated unhandled interrupt 1 before timed pause/dump succeeded |

A memory watchpoint appeared to stop once without a pointer change, so those
stops are not counted as route fetches. No successful later movement capture
exists. Repeated interrupt/illegal-instruction output is preserved compressed
in `terminal.txt.gz`; its cause remains unknown. Removing fast-forward and
watchpoints did not resolve the failure, nor did correcting the text cursor.

The next decisive observation is object 6's second instruction fetch:
`F138` after reading `B1` would support sequential consumption of the prefix;
a different pointer or changed stream would identify a missing runtime
mechanism. At an approximately 500 Hz clock, the first 13-cell run alone
lasts about 106.5 seconds. Full off-map behaviour needs a longer observation.
A stable normal briefing transition or normal-play capture is preferable to
further conclusions from these failing controlled starts.