# Readable Script IR

This report joins descriptor neighborhoods to the verified 000d VM/runtime lane.
It stays conservative: opcode-family and mask-family evidence is carried forward only where the binary proves it.

## Verified Runtime Lane

- Owner path: `entity_vm_runtime_init_from_path_if_configured -> entity_vm_runtime_create -> entity_vm_runtime_owner_resource_create`
- Slot source: `(+0x10/+0x12) + 0x0d*slot + 4` inside the runtime owner/resource object
- Context seed: `entity_vm_context_create_from_slot_index` copies that source into `+0xd6/+0xd8` and mirrors it to `0x39ca[slot]`
- Selector status: `0x19/0x1a/0x1b` are proven inside `000d:0988`; `0x18` is still implied, and the upstream seed into `[BP-0x32]` remains unresolved

## Verified VM IR Operators

| Stage | IR | Opcode / Lane | Payload Shape |
|---|---|---|---|
| 000d:0988 | APPEND_UNIQUE_INLINE | opcode 0x18 (implied sibling) | inline referent-chain payload |
| 000d:0988 | APPEND_UNIQUE_INDIRECT | opcode 0x19 | indirect/string-like referent-chain payload |
| 000d:0988 | REMOVE_MATCHING_INDIRECT | opcode 0x1a | indirect/string-like referent-chain payload |
| 000d:0988 | REMOVE_MATCHING_INLINE | opcode 0x1b | inline referent-chain payload |
| 000d:177c | PUSH_FRAME_WORD_LITERAL | same FUN_000d_ebe3 sequencer family | word scalar pushed to stream stack |
| 000d:1acb | COMPARE_STREAM_DWORD_AND_PUSH_BOOL | same FUN_000d_ebe3 sequencer family | stream dword pair consumed, predicate word emitted |
| 000d:208b | MATERIALIZE_OR_FORWARD_VALUE | slot-backed context consumer | materialized slot value or forwarded object result |
| 000d:21ed | PREPEND_INLINE_PAYLOAD | inline payload substage | caller-owned blob copied into context +0x102 buffer |
| 000d:22bc | BUILD_ENTITY_LINK_MATRIX | inline payload follow-on stage | two signed metadata bytes plus streamed entity/link ids |
| 000d:22bc | EMIT_OR_PUSHBACK_RESULT | inline payload follow-on stage | stream writeback filter |
| 000d:2104 | FINALIZE_MIXED_VALUE_TO_OUTPTR | same FUN_000d_ebe3 sequencer family | mixed immediate/object scalar return |

## Verified Mask Ladder

| Wrapper | Mask | Caller Anchor | Descriptor Bias |
|---|---|---|---|
| 0005:27a4 | 0x0001:0000 | 000c:a09e entity +0x5b bit 0x0004 branch | generic active-event-biased lane; no direct class-id bridge |
| 0005:2867 | 0x0002:0001 | stores result into entity field +0x39 | active-event ecosystem bias stronger than referent-anchor bias |
| 0005:2ae2 | 0x0004:0002 | same verified local mask ladder around entity_vm_context_try_create_masked_for_entity | active-event ecosystem bias stronger than referent-anchor bias |
| 0005:2c9b | 0x0010:0004 | direct callers at 0005:5946 and 0005:59e9 | active-event ecosystem bias stronger than referent-anchor bias |
| 0005:2918 | 0x0020:0005 | +0x3c == 0x20b object lane, carries caller fields +0x36/+0x38 | candidate active-event field bridge; still not descriptor-specific |
| 0005:2c06 | 0x0200:0009 | direct caller anchor at 0005:0292 | active-event ecosystem bias stronger than referent-anchor bias |
| 0005:2c35 | 0x0400:000a | xref-dark signed slot-offset wrapper forwarding context +0x34 | offset-specialized masked context creation; descriptor family unresolved |
| 0005:2c68 | 0x0800:000b | xref-dark signed slot-offset wrapper forwarding context +0x34 | offset-specialized masked context creation; descriptor family unresolved |
| 0005:2cd2 | 0x1000:000c | direct caller anchor at 0005:0fee | active-event ecosystem bias stronger than referent-anchor bias |
| 0004:f05c | 0x2000:0015 | 0004:f2b3 overlap/proximity branch with entity byte +0x32 state checks | gameplay-state lane feeding runtime materialization, not direct descriptor switch |
| 0005:2d01 | 0x4000:000e | direct callers at 0007:814e and 0007:822e | active-event ecosystem bias stronger than referent-anchor bias |
| 0004:f033 | 0x8000:0007 | local wrapper seed recovered from direct instruction evidence | gameplay-side materialization lane; still descriptor-agnostic |
| 0005:2d30 | 0x8000:000f | entity id/class flag gate plus 0x0f16 / 0x20f dispatch-entry emission path | strongest current active-event ecosystem candidate in the ladder |

## JELYHACK anchor lane

### 277: JELYHACK

Descriptor focus: `anchor JELYHACK(referent)`

Descriptor-side attachments:
- Active event neighbors: REE_BOOT, SFXTRIG
- Callback neighbors: SURCAMNS, SURCAMEW
- Referent-side neighbors: BASEGUN, TIMER, SPECIAL, TRIGPAD, MONSTER, ELITE, D_ESTORM, DATALINK, SLIDEFLR, JELYH2, HOFFMAN, D_HOFFMA
- Event families present: callback-eventtrigger, boot-event-core, minimal-event-core

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: indirect-only active-event-biased ladder; no direct anchor-specific mask proven
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Referent-only anchors are now readable as payload owners, but the current mask ladder still correlates more strongly with active-event descriptors than with anchor-only rows.

```text
anchor JELYHACK(referent)
attach REE_BOOT(...)  # active event-bearing neighbor
attach SFXTRIG(...)  # active event-bearing neighbor
callback SURCAMNS(...)  # eventTrigger-bearing neighbor
callback SURCAMEW(...)  # eventTrigger-bearing neighbor
near BASEGUN(...)  # referent-side local context
near TIMER(...)  # referent-side local context
near SPECIAL(...)  # referent-side local context
near TRIGPAD(...)  # referent-side local context
near MONSTER(...)  # referent-side local context
near ELITE(...)  # referent-side local context
near D_ESTORM(...)  # referent-side local context
near DATALINK(...)  # referent-side local context
near SLIDEFLR(...)  # referent-side local context
near JELYH2(...)  # referent-side local context
near HOFFMAN(...)  # referent-side local context
near D_HOFFMA(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```

### 280: JELYH2

Descriptor focus: `anchor JELYH2(referent)`

Descriptor-side attachments:
- Active event neighbors: REE_BOOT, SFXTRIG
- Callback neighbors: SURCAMEW
- Referent-side neighbors: SPECIAL, TRIGPAD, MONSTER, ELITE, D_ESTORM, JELYHACK, DATALINK, SLIDEFLR, HOFFMAN, D_HOFFMA, SKILLBOX, D_GURDSQ, VETRON
- Event families present: boot-event-core, callback-eventtrigger, minimal-event-core

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: indirect-only active-event-biased ladder; no direct anchor-specific mask proven
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Referent-only anchors are now readable as payload owners, but the current mask ladder still correlates more strongly with active-event descriptors than with anchor-only rows.

```text
anchor JELYH2(referent)
attach REE_BOOT(...)  # active event-bearing neighbor
attach SFXTRIG(...)  # active event-bearing neighbor
callback SURCAMEW(...)  # eventTrigger-bearing neighbor
near SPECIAL(...)  # referent-side local context
near TRIGPAD(...)  # referent-side local context
near MONSTER(...)  # referent-side local context
near ELITE(...)  # referent-side local context
near D_ESTORM(...)  # referent-side local context
near JELYHACK(...)  # referent-side local context
near DATALINK(...)  # referent-side local context
near SLIDEFLR(...)  # referent-side local context
near HOFFMAN(...)  # referent-side local context
near D_HOFFMA(...)  # referent-side local context
near SKILLBOX(...)  # referent-side local context
near D_GURDSQ(...)  # referent-side local context
near VETRON(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```


## EVENT hub lane

### 189: COR_BOOT

Descriptor focus: `attach COR_BOOT(referent,event,counter,item)`

Descriptor-side attachments:
- Active event neighbors: EVENT, NPCTRIG
- Callback neighbors: none proven in window
- Referent-side neighbors: GRENADE, SCIENTIS, ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY
- Event families present: event-hub, npc-trigger

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.

```text
attach COR_BOOT(referent,event,counter,item)
attach EVENT(...)  # active event-bearing neighbor
attach NPCTRIG(...)  # active event-bearing neighbor
near GRENADE(...)  # referent-side local context
near SCIENTIS(...)  # referent-side local context
near ROLL_NS(...)  # referent-side local context
near REB_COUP(...)  # referent-side local context
near MEDIKIT(...)  # referent-side local context
near K(...)  # referent-side local context
near CRUZTRIG(...)  # referent-side local context
near NPC_ONLY(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```

### 190: EVENT

Descriptor focus: `hub EVENT(mva3b,referent,event,item,source,dest,door,counter,counter2,link,time,post1,post2,floor,flicMan)`

Descriptor-side attachments:
- Active event neighbors: COR_BOOT, NPCTRIG
- Callback neighbors: none proven in window
- Referent-side neighbors: SCIENTIS, ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY, VMAIL
- Event families present: boot-event-core, npc-trigger

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.

```text
hub EVENT(mva3b,referent,event,item,source,dest,door,counter,counter2,link,time,post1,post2,floor,flicMan)
attach COR_BOOT(...)  # active event-bearing neighbor
attach NPCTRIG(...)  # active event-bearing neighbor
near SCIENTIS(...)  # referent-side local context
near ROLL_NS(...)  # referent-side local context
near REB_COUP(...)  # referent-side local context
near MEDIKIT(...)  # referent-side local context
near K(...)  # referent-side local context
near CRUZTRIG(...)  # referent-side local context
near NPC_ONLY(...)  # referent-side local context
near VMAIL(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```

### 191: NPCTRIG

Descriptor focus: `attach NPCTRIG(referent,event,item,item2,typeNpc)`

Descriptor-side attachments:
- Active event neighbors: COR_BOOT, EVENT
- Callback neighbors: none proven in window
- Referent-side neighbors: ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY, VMAIL, STORMTRO
- Event families present: boot-event-core, event-hub

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.

```text
attach NPCTRIG(referent,event,item,item2,typeNpc)
attach COR_BOOT(...)  # active event-bearing neighbor
attach EVENT(...)  # active event-bearing neighbor
near ROLL_NS(...)  # referent-side local context
near REB_COUP(...)  # referent-side local context
near MEDIKIT(...)  # referent-side local context
near K(...)  # referent-side local context
near CRUZTRIG(...)  # referent-side local context
near NPC_ONLY(...)  # referent-side local context
near VMAIL(...)  # referent-side local context
near STORMTRO(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```


## Environmental event lane

### 229: FLAMEBOX

Descriptor focus: `attach FLAMEBOX(referent,event,flame,flame2,direction,count,newType)`

Descriptor-side attachments:
- Active event neighbors: none proven in window
- Callback neighbors: none proven in window
- Referent-side neighbors: WVENTNS, WVENTEW, REBEL_TV, SDOOR_N, SDOOR_E, EBRIDGE2, MCRATE, COPY_EW, COPY_NS
- Event families present: none

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.

```text
attach FLAMEBOX(referent,event,flame,flame2,direction,count,newType)
near WVENTNS(...)  # referent-side local context
near WVENTEW(...)  # referent-side local context
near REBEL_TV(...)  # referent-side local context
near SDOOR_N(...)  # referent-side local context
near SDOOR_E(...)  # referent-side local context
near EBRIDGE2(...)  # referent-side local context
near MCRATE(...)  # referent-side local context
near COPY_EW(...)  # referent-side local context
near COPY_NS(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```

### 237: NOSTRIL

Descriptor focus: `attach NOSTRIL(referent,event,fire,count,fire2)`

Descriptor-side attachments:
- Active event neighbors: none proven in window
- Callback neighbors: none proven in window
- Referent-side neighbors: COPY_EW, COPY_NS, FLAME1, REB_PAD, VARDESK, BLASER1, REB_BOOT, UPPLATE, KEYPADNS
- Event families present: none

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.

```text
attach NOSTRIL(referent,event,fire,count,fire2)
near COPY_EW(...)  # referent-side local context
near COPY_NS(...)  # referent-side local context
near FLAME1(...)  # referent-side local context
near REB_PAD(...)  # referent-side local context
near VARDESK(...)  # referent-side local context
near BLASER1(...)  # referent-side local context
near REB_BOOT(...)  # referent-side local context
near UPPLATE(...)  # referent-side local context
near KEYPADNS(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```

### 296: STEAMBOX

Descriptor focus: `attach STEAMBOX(referent,event,steam,steam2,direction,count)`

Descriptor-side attachments:
- Active event neighbors: none proven in window
- Callback neighbors: none proven in window
- Referent-side neighbors: BOUNCBOX, HOVER1, STEAM1, FADE, PHIR, FLAME2, STEAM2, FLAMELP, BBOX, GBOX_NS
- Event families present: none

Runtime bridge:
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.

```text
attach STEAMBOX(referent,event,steam,steam2,direction,count)
near BOUNCBOX(...)  # referent-side local context
near HOVER1(...)  # referent-side local context
near STEAM1(...)  # referent-side local context
near FADE(...)  # referent-side local context
near PHIR(...)  # referent-side local context
near FLAME2(...)  # referent-side local context
near STEAM2(...)  # referent-side local context
near FLAMELP(...)  # referent-side local context
near BBOX(...)  # referent-side local context
near GBOX_NS(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```


## Callback trigger lane

### 269: SURCAMNS

Descriptor focus: `callback SURCAMNS(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)`

Descriptor-side attachments:
- Active event neighbors: none proven in window
- Callback neighbors: none proven in window
- Referent-side neighbors: D_SOLD, D_VARG, D_COUR, D_SUSAN, D_THERM, BASEGUN, TIMER, SPECIAL, TRIGPAD, MONSTER
- Event families present: none

Runtime bridge:
- Runtime ops: MATERIALIZE_OR_FORWARD_VALUE, PUSH_FRAME_WORD_LITERAL, COMPARE_STREAM_DWORD_AND_PUSH_BOOL, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: no callback-specific mask pair proven; current ladder favors active event carriers
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Callback/eventTrigger descriptors are structurally distinct from the active event lane, so the runtime bridge is still generic slot-backed context flow rather than a callback-specific opcode family.

```text
callback SURCAMNS(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)
near D_SOLD(...)  # referent-side local context
near D_VARG(...)  # referent-side local context
near D_COUR(...)  # referent-side local context
near D_SUSAN(...)  # referent-side local context
near D_THERM(...)  # referent-side local context
near BASEGUN(...)  # referent-side local context
near TIMER(...)  # referent-side local context
near SPECIAL(...)  # referent-side local context
near TRIGPAD(...)  # referent-side local context
near MONSTER(...)  # referent-side local context

vm_effect:
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PUSH_FRAME_WORD_LITERAL(...)
    COMPARE_STREAM_DWORD_AND_PUSH_BOOL(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```

### 284: SURCAMEW

Descriptor focus: `callback SURCAMEW(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)`

Descriptor-side attachments:
- Active event neighbors: REE_BOOT, SFXTRIG
- Callback neighbors: none proven in window
- Referent-side neighbors: SLIDEFLR, JELYH2, HOFFMAN, D_HOFFMA, SKILLBOX, D_GURDSQ, VETRON, DEATHBOX
- Event families present: boot-event-core, minimal-event-core

Runtime bridge:
- Runtime ops: MATERIALIZE_OR_FORWARD_VALUE, PUSH_FRAME_WORD_LITERAL, COMPARE_STREAM_DWORD_AND_PUSH_BOOL, FINALIZE_MIXED_VALUE_TO_OUTPTR
- Mask pairs: no callback-specific mask pair proven; current ladder favors active event carriers
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
- Interpretation: Callback/eventTrigger descriptors are structurally distinct from the active event lane, so the runtime bridge is still generic slot-backed context flow rather than a callback-specific opcode family.

```text
callback SURCAMEW(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)
attach REE_BOOT(...)  # active event-bearing neighbor
attach SFXTRIG(...)  # active event-bearing neighbor
near SLIDEFLR(...)  # referent-side local context
near JELYH2(...)  # referent-side local context
near HOFFMAN(...)  # referent-side local context
near D_HOFFMA(...)  # referent-side local context
near SKILLBOX(...)  # referent-side local context
near D_GURDSQ(...)  # referent-side local context
near VETRON(...)  # referent-side local context
near DEATHBOX(...)  # referent-side local context

vm_effect:
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PUSH_FRAME_WORD_LITERAL(...)
    COMPARE_STREAM_DWORD_AND_PUSH_BOOL(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
```