Initial import of HEROLL source and design documents

2026-10-26 16:05:39 +08:00
commit fdb55672c1
1846 changed files with 290692 additions and 0 deletions
@@ -0,0 +1,60 @@
+# Stage 2.5.3 纠错报告
+
+## 1. Critical Rate
+
+### 已废止结论
+
+`0x549B934` 位于防御者侧 `BaseMonoCharacter.HitAndGetResult`，属于 Hit/Miss 判定。任何把它解释成 Critical Rate RNG 的结论均标记为 `SUPERSEDED`。
+
+### 新闭环
+
+`CRITICAL_RATE / EMonoStatus 11` → `CharacterStatus.GetFinalStatus(11)` → 整数 RNG `[0,101)` → `chance > roll` → `DamageMeta.isCritical (+0x28)`。
+
+入口是攻击者覆写 `BaseMonoPlayer.OnBeforeAttack @ 0x55A95EC`。`BaseActor.<RunAttackSequence>d__44.MoveNext @ 0x5496AB0` 先构造 `DamageMeta`，将 `isCritical` 初始化为 false，再调用攻击者攻击前钩子。攻击者钩子在公共尾部以 `cset gt` 生成布尔值并写入 DamageMeta。
+
+结论：`VERIFIED / HIGH`。
+
+## 2. Gacha
+
+### Selector
+
+`GachaProduct.RewardGacha @ 0x52F22E4` 使用 `<RewardGacha>b__21_0 @ 0x52F4840` 读取 `Gacha.prob (+0x28)`，并调用通用选择器 `0x50EDB34`。
+
+选择器先获得权重总和，将其乘以常数 `10000`，调用 RNG 助手 `0x513C53C` 取得整数随机游标，再遍历候选项：若游标仍大于当前权重则减去当前权重并继续，否则返回当前索引。
+
+结论：`VERIFIED / HIGH`。
+
+### Pity counter
+
+配置表明确给出三组 `ceilCount`：20、50、400。运行时计数更新助手 `0x51138F0` 已定位：它按抽数参数更新一个持久化 Gacha 记录的计数，并存在不同的分支处理；命中检查助手 `0x510078C` 会读取持久化记录并与传入的 ceil 参数比较。`RewardGacha` 在 `0x52F3D1C` 调用该检查助手，成功分支进入指定保底奖励选择。
+
+但当前静态证据尚不能把 `0x51138F0` 的两个分支安全命名为“普通 increment”和“reset”，也没有看到可独立证明的 `count = 0` 写入。因此本包不把“何时归零、是否跨十连逐抽归零、提前出货是否归零”写成事实。
+
+结论：`PARTIAL / MEDIUM`。已闭合 `count update → ceil compare → guaranteed branch`，未闭合精确 reset 语义。
+
+## 3. Boss Gauge
+
+### 关键纠正
+
+`stageinfo.csv` 中 `bossSpawnRule=DiceGauge, bossSpawnRuleValue=50` 的 50 是每次格子结算加入 Gauge 的配置值，不是“当前 Gauge 与 50 比较”的阈值。
+
+格子执行状态机 `<ExecuteAsync>d__0.MoveNext @ 0x553EEEC` 在 `0x55445E8` 读取配置增量，随后：
+
+```text
+current = GetRuntimeGauge()        // 0x52E4DA8
+next = clamp(current + configValue, 0, 100)
+SetRuntimeGauge(next)              // 0x52E4E10
+```
+
+实时 Gauge 存储在运行时数据对象 `+0x2E0`。setter 写入后还会通知相关事件/UI。`MoveTile` 在 `0x56C038C` 调用 `TrySpawnBossTilesByGauge @ 0x569FEC0`；生成流程完成后的后续状态机在 `0x52E6064–0x52E6068` 对同一 setter 传入 0，形成清零证据。
+
+`NewStagePlayData.highestBossTileGauge (+0x1C)` 是历史最高 Gauge 存档字段，不能替代实时字段。
+
+结论：Gauge 更新式与实时字段为 `VERIFIED / HIGH`；“具体哪一个布尔资格检查代表满 Gauge”仍为 `PARTIAL / MEDIUM`，因为该检查被共享/间接调用封装，未恢复出可靠托管名称。
+
+## 4. 对 GDD 反推的约束
+
+- 暴击率可写为客户端判定：`critical = CRITICAL_RATE > RandomInt(0,101)`。
+- Gacha 可写为权重抽取，但不得擅自把 `prob` 解释成百分比；它是相对权重，内部按 10000 精度离散化。
+- Pity 可写配置阈值与已定位计数助手，不得补写未经证明的 reset 时机。
+- Boss Gauge 应写成 0–100 的进度，配置 50 是单次增量；不要写成“Gauge >= 50 触发 Boss”。
@@ -0,0 +1,54 @@
+# Stage 2.5.3 最终交付审计
+
+审计日期：2026-08-21  
+目标：HEROLL 2.0.1（`com.percent.aos.rollinghero`）  
+审计性质：只补齐报告已引用的 Primary Native 与文件完整性记录；未新增逆向任务，未新增或修改玩法结论。
+
+## 审计结论
+
+**PASS / READY FOR CHATGPT HANDOFF**。
+
+Stage 2.5.3 原有 Critical、Gacha、Boss Gauge 报告和 Evidence Matrix 保持原结论等级。此前报告引用但未随包提供的指定原生函数现已全部加入，并以完整、排他的函数地址范围导出。
+
+## Primary Native 覆盖
+
+### Gacha
+
+| 要求地址 | 随包文件 | 完整范围 | 结果 |
+|---|---|---|---|
+| `0x52F4840` | `05_NATIVE_PRIMARY/GACHA_PRIMARY/RewardGacha_prob_reader__06001C52.txt` | `[0x52F4840, 0x52F4854)` | PASS |
+| `0x50EDB34` | `05_NATIVE_PRIMARY/GACHA_PRIMARY/Address_0x50EDB34_weighted_selector.txt` | `[0x50EDB34, 0x50EDCA4)` | PASS |
+| `0x513C53C` | `05_NATIVE_PRIMARY/GACHA_PRIMARY/Address_0x513C53C_rng_helper.txt` | `[0x513C53C, 0x513C8C4)` | PASS |
+| `0x51138F0` | `05_NATIVE_PRIMARY/GACHA_PRIMARY/Address_0x51138F0_counter_update.txt` | `[0x51138F0, 0x5113C40)` | PASS |
+| `0x510078C` | `05_NATIVE_PRIMARY/GACHA_PRIMARY/Address_0x510078C_ceil_compare.txt` | `[0x510078C, 0x5100928)` | PASS |
+
+### Boss Gauge
+
+| 要求内容 | 随包文件 | 完整范围 | 结果 |
+|---|---|---|---|
+| 包含 `0x55445E8–0x5544614` 的 ExecuteAsync | `05_NATIVE_PRIMARY/BOSS_GAUGE_PRIMARY/ExecuteAsync_d__0.MoveNext__06003026.txt` | `[0x553EEEC, 0x5547874)` | PASS |
+| getter `0x52E4DA8` | `05_NATIVE_PRIMARY/BOSS_GAUGE_PRIMARY/Address_0x52E4DA8_gauge_getter.txt` | `[0x52E4DA8, 0x52E4E10)` | PASS |
+| setter `0x52E4E10` | `05_NATIVE_PRIMARY/BOSS_GAUGE_PRIMARY/Address_0x52E4E10_gauge_setter.txt` | `[0x52E4E10, 0x52E4F94)` | PASS |
+| 包含 `0x52E6064–0x52E6068` 清零调用的完整函数 | `05_NATIVE_PRIMARY/BOSS_GAUGE_PRIMARY/MoveFocusToCompositeRoot.MoveNext_clear_call__06001BD8.txt` | `[0x52E5740, 0x52E78E8)` | PASS |
+
+## Evidence → Finding → Path 复核
+
+- Critical：原有 Primary Native 与 `F-CRIT-253-001/002` 路径未改动。
+- Gacha：新增的五份 Primary Native 为 `F-GACHA-253-001/002/003` 提供随包原始函数体；Finding 的 `VERIFIED/PARTIAL` 等级未改动。
+- Boss Gauge：新增的四份 Primary Native 覆盖 `F-BOSS-253-001/002` 报告引用区间；Finding 的 `VERIFIED/PARTIAL` 等级未改动。
+- `06_EVIDENCE_MATRIX.csv` 仍是结论等级主索引；`05_NATIVE_PRIMARY/FINAL_AUDIT_NATIVE_INDEX.csv` 是本轮原始函数附件索引。
+
+## 范围与语义保护
+
+- 包名已更正为 `com.percent.aos.rollinghero`。
+- 最终原始函数核对确认，先前报告把 ExecuteAsync 指令区间多写了一个十六进制位；已从 `0x554445E8–0x55444614` 校正为原生文件中的 `0x55445E8–0x5544614`。该校正不改变玩法结论。
+- 未进行新的动态测试、静态追踪或玩法推断。
+- 未把 Gacha reset 或 Boss 完整触发谓词从 `PARTIAL` 提升为 `VERIFIED`。
+- 新增文件仅用于补足报告已引用地址的原始指令可审计性。
+
+## 完整性
+
+- `SHA256SUMS.csv` 覆盖包内除其自身外的全部文件。
+- `05_NATIVE_PRIMARY/FINAL_AUDIT_NATIVE_INDEX.csv` 记录本轮九份新增 Primary Native 的地址范围、大小与单文件 SHA-256。
+- 已对原始 case `work/heroll-stage-2-5` 执行 Case Review 的 `--verify-hashes --strict` 检查：`0 errors / 0 warnings / PASS`。
+- 最终打包前执行逐文件 SHA-256 回验和 ZIP 条目检查；结果必须为 PASS 后方可交付。
@@ -0,0 +1,23 @@
+# Case review
+
+- status: PASS
+- case_root: `C:\Users\toshio\Documents\ChatGPT\heroll\work\heroll-stage-2-5`
+- generated_at: 2026-08-31T07:46:23.383470+00:00
+- command: `review_case.py work/heroll-stage-2-5 --verify-hashes --strict --format markdown`
+
+## Summary
+
+| Metric | Value |
+|---|---:|
+| errors | 0 |
+| warnings | 0 |
+| evidence | 20 |
+| workitems | 4 |
+| timeline_events | 5 |
+| findings | 10 |
+| paths | 8 |
+
+## Result
+
+No review issues found. Artifact hashes present in the case package were verified. New drop-rule Evidence records are linked to `WI-004` and the 2026-08-31 timeline event.
+
@@ -0,0 +1,19 @@
+# 99-审计与证据追溯
+
+范围、时间线、Evidence→Finding→Path与各模块Case Review。
+
+## 文件
+
+- [01_CORRECTION_REPORT.md](./01_CORRECTION_REPORT.md) — correction；来源：`HEROLL_STAGE_2_5_3_CORRECTION_EVIDENCE/01_CORRECTION_REPORT.md`
+- [09_CASE_REVIEW.md](./09_CASE_REVIEW.md) — audit；来源：`HEROLL_STAGE_2_5_3_CORRECTION_EVIDENCE/09_CASE_REVIEW.md`
+- [2026-08-31-drop-rules-case-review.md](./2026-08-31-drop-rules-case-review.md) — audit；来源：`work/heroll-stage-2-5/report/2026-08-31-drop-rules-case-review.md`
+- [case-review-combat.md](./case-review-combat.md) — audit；来源：`work/heroll-stage-2-5/report/case-review-combat.md`
+- [case-review-pass.md](./case-review-pass.md) — audit；来源：`analysis/catalog-reverse/case-review-pass.md`
+- [findings.md](./findings.md) — findings；来源：`work/heroll-stage-2-5/findings.md`
+- [path.md](./path.md) — path；来源：`work/heroll-stage-2-5/path.md`
+- [scope.md](./scope.md) — scope；来源：`work/heroll-stage-2-5/scope.md`
+- [stage-floor-case-review.md](./stage-floor-case-review.md) — audit；来源：`work/heroll-stage-2-5/report/stage-floor-case-review.md`
+- [tile-event-case-review.md](./tile-event-case-review.md) — audit；来源：`work/heroll-stage-2-5/report/tile-event-case-review.md`
+- [timeline.md](./timeline.md) — timeline；来源：`work/heroll-stage-2-5/timeline.md`
+
+模块内Markdown与CSV均来自同一v0.2.8规则域；跨模块综合报告会在相关模块中保留副本。
@@ -0,0 +1,22 @@
+# Case review — main-run combat and Double closure
+
+- status: PASS
+- case_root: `work/heroll-stage-2-5`
+- generated_at: 2026-08-28T09:18:19.908482+00:00
+- mode: `--verify-hashes --strict --format markdown`
+
+## Summary
+
+| Metric | Value |
+|---|---:|
+| errors | 0 |
+| warnings | 0 |
+| evidence | 17 |
+| workitems | 3 |
+| timeline_events | 4 |
+| findings | 10 |
+| paths | 8 |
+
+## Result
+
+No review issues found. All seven evidence records added for the combat/Double closure are linked from WI-003 and the 2026-08-28 timeline event.
@@ -0,0 +1,13 @@
+# Case review
+
+- status: PASS
+- date: 2026-08-31
+- strict: true
+- verify_hashes: true
+- errors: 0
+- warnings: 0
+- evidence_records: 24
+- workitems: 5
+
+检查结论：Evidence → Work Item → Timeline → Report 路径完整，无严格审计问题。
+
@@ -0,0 +1,101 @@
+# Findings
+
+## F-STAGE-001
+- title: Default bossSpawnRuleValue is the exact Normal-stage floor count
+- category: reverse_algo
+- status: validated
+- evidence_ids: [E-STAGE-CONFIG-001]
+- location: stageinfo.csv joined to board.csv on EPlayMode=Normal and Stage
+- impact: Stage 0 is exactly ten stat-bearing loops before boss_0; DiceGauge 50 must not be interpreted as a floor count.
+- confidence: high
+- remediation: Drive Default stage length from bossSpawnRuleValue and require a matching board row for every zero-based loop.
+
+## F-REFRESH-001
+- title: Board progression is additive and good-tile injection count is not fixed at two
+- category: reverse_algo
+- status: validated
+- evidence_ids: [E-STAGE-NATIVE-001, E-STAGE-WEB-001]
+- location: InitNewGame/SpawnInitalTiles/AddNextLoopTiles native state machines
+- impact: The earlier MVP rule of two guaranteed good tiles per floor does not reproduce the original board economy.
+- confidence: high
+- remediation: Initialize with AddRandomGoodTiles(8), then call AddRandomGoodTiles(loopIndex+2) and AddRandomEnemyTile(enemyTilesPerLoop,false) at loop transitions.
+
+## F-TILE-001
+- title: Player good tiles use a shuffled OutGameTile deck without replacement per deck cycle
+- category: reverse_algo
+- status: validated
+- evidence_ids: [E-STAGE-CONFIG-001, E-STAGE-NATIVE-001]
+- location: BoardController.GetNextMetadata/GetRandomOutGameTileMetas/AddRandomGoodTiles
+- impact: Direct equal-weight selection from all GoodEvent rows produces the wrong initial board and ignores player loadout.
+- confidence: high
+- remediation: Build the deck from eligible player metas, advance a cached index, and reshuffle only at exhaustion.
+
+## F-GAUGE-001
+- title: DiceGauge 50 is a per-settlement increment into a separate 0..100 runtime gauge
+- category: reverse_algo
+- status: validated
+- evidence_ids: [E-STAGE-NATIVE-001]
+- location: tile processing ExecuteAsync @ 0x553EEEC and MoveTile @ 0x56BF914
+- impact: Treating 50 as a threshold or merging it with BossDiceCounter breaks pressure timing and save restoration.
+- confidence: high
+- remediation: Keep runtimeBossGauge and BossDiceCounter separate; clamp additions and clear the gauge after the spawn sequence.
+
+## F-GAUGE-002
+- title: Original DiceGauge pressure cycle is two-roll buildup plus four-roll countdown and four unique non-blessing conversions
+- category: design
+- status: validated
+- evidence_ids: [E-STAGE-NATIVE-001, E-STAGE-RUNTIME-001]
+- location: DiceGauge movement and boss tile generation flow
+- impact: Applying the cycle to Default stages or firing immediately after two rolls changes the original pacing.
+- confidence: high for observed standard path; partial for insufficient-candidate fallback
+- remediation: Enable only for DiceGauge stages and keep candidate-shortage behavior configurable until matching footage is captured.
+
+## F-REFRESH-002
+- title: The start tile advances floor and hosts a shop every three display floors
+- category: design
+- status: corroborated
+- evidence_ids: [E-STAGE-WEB-001, E-STAGE-NATIVE-001]
+- location: Start tile behavior and BoardController shopPerLoop branch
+- impact: Treating the shop as an ordinary random tile changes access cadence.
+- confidence: medium-high
+- remediation: Attach shop appearance to the start tile at displayFloor mod 3 == 0.
+
+## F-EVENT-001
+- title: The requested six Good Tiles are independent event state machines
+- category: reverse_algo
+- status: validated
+- evidence_ids: [E-TILE-CONFIG-001, E-TILE-NATIVE-001, E-TILE-RUNTIME-001]
+- location: NewTile IDs 137/141/143/151/164/169 and their ExecuteAsync/UI classes
+- impact: Reusing a single generic reward popup loses event-specific input, failure and continuation rules.
+- confidence: high
+- remediation: Implement each event as a separately persisted state machine with a single completion callback.
+
+## F-EVENT-002
+- title: Lucky Scratch is GoodEventSpito 169, not GoodEventLotto 142
+- category: reverse_mapping
+- status: validated
+- evidence_ids: [E-TILE-CONFIG-001, E-TILE-NATIVE-001, E-TILE-RUNTIME-001]
+- location: newtile values 30,10,1,10,50,40 and ScratchPainter/SpitoEventView
+- impact: Mapping it to Lotto imports the wrong five-draw cost and reward rules.
+- confidence: high
+- remediation: Use weighted 30/10/1 point prizes at 10/50/40 and scratch-to-reveal input.
+
+## F-EVENT-003
+- title: Chest generates three gear items and Dice Battle has no supported entry stake
+- category: design
+- status: validated
+- evidence_ids: [E-TILE-RUNTIME-001, E-TILE-NATIVE-001, E-TILE-WEB-001]
+- location: GoodEventChest spawn loop and BlackJackView reward flow
+- impact: The previous one-item chest and three-point stake materially underpay these tiles.
+- confidence: high for Chest; medium-high for no-stake mapping
+- remediation: Generate three normal-loot gear instances; interpret Blackjack config as three starting dice and ten-point base reward.
+
+## F-CORNER-001
+- title: Core Corner set is 126–129 and has passive, timed and batch-mutation semantics
+- category: reverse_mapping
+- status: validated
+- evidence_ids: [E-TILE-CONFIG-001, E-TILE-NATIVE-001, E-TILE-WEB-001]
+- location: ingamereward item IDs 126–129 and Corner event classes
+- impact: Treating every enabled Corner as one of the base four breaks unlocks and board pacing.
+- confidence: high except Housing Support point scale
+- remediation: Keep Piggy Bank, Race, Flower Garden and Housing Support as the core four; gate later Corners independently.
@@ -0,0 +1,40 @@
+# Paths
+
+## P-STAGE-001
+- title: Default stage configuration to final Boss
+- path_type: solve
+- start: stageinfo.csv Normal row
+- goal: final Boss entry
+- steps:
+  1. Read bossSpawnRule and bossSpawnRuleValue — E-STAGE-CONFIG-001, F-STAGE-001.
+  2. For Default, load board.csv rows loop=0..value-1 — E-STAGE-CONFIG-001, F-STAGE-001.
+  3. Resolve each floor with its row's enemy stat template — E-STAGE-CONFIG-001, F-STAGE-001.
+  4. After the final configured loop, enter stage bossID — E-STAGE-CONFIG-001, F-STAGE-001.
+- residual_risks: Default mid-boss user-visible floor number needs one capture to close the zero/one-based presentation boundary.
+
+## P-REFRESH-001
+- title: Start-tile transition to additive board refresh
+- path_type: callflow
+- start: player passes the start tile
+- goal: next-floor board state
+- steps:
+  1. Advance the loop through AddNextLoopTiles — E-STAGE-NATIVE-001, F-REFRESH-001.
+  2. Draw loopIndex+2 player good-tile metas — E-STAGE-NATIVE-001, F-TILE-001.
+  3. Resolve each refNewTileId and attempt installation with good-tile FX — E-STAGE-NATIVE-001, F-TILE-001.
+  4. Add enemyTilesPerLoop enemy tiles without a full board rebuild — E-STAGE-NATIVE-001, F-REFRESH-001.
+  5. At each third display floor, expose the shop on the start tile — E-STAGE-WEB-001, F-REFRESH-002.
+- residual_risks: The original serialized enemyTilesPerLoop value is not present in the recovered tables/assets.
+
+## P-GAUGE-001
+- title: DiceGauge settlement to Boss pressure conversion
+- path_type: callflow
+- start: qualified tile settlement in a DiceGauge stage
+- goal: Boss pressure tiles generated and gauge reset
+- steps:
+  1. Add bossSpawnRuleValue to the distinct runtime gauge and clamp 0..100 — E-STAGE-NATIVE-001, F-GAUGE-001.
+  2. Run mid-boss and boss-spawn checks after movement — E-STAGE-NATIVE-001, F-GAUGE-001.
+  3. With value 50, two standard settlements reach 100 — E-STAGE-NATIVE-001, E-STAGE-RUNTIME-001, F-GAUGE-002.
+  4. Count down the next four rolls — E-STAGE-RUNTIME-001, F-GAUGE-002.
+  5. Convert four unique non-blessing tiles and clear the runtime gauge — E-STAGE-NATIVE-001, E-STAGE-RUNTIME-001, F-GAUGE-002.
+- residual_risks: Candidate shortage, mode-specific protected tiles and exact post-attack restoration are not closed.
+
@@ -0,0 +1,61 @@
+# Case Scope
+
+## meta
+- case_id: heroll-stage-2-5
+- created: 2026-08-19T00:52:29.9191946+08:00
+- operator: local
+- project_root: C:\Users\toshio\Documents\ChatGPT\heroll
+- primary_skill: apk-reverse/SKILL.md
+- primary_id: R1
+- lead_role: lead
+- specialist_roles: []
+- hint: HEROLL 2.0.1 Unity IL2CPP APK targeted reverse engineering formulas runtime rules monetization evidence
+
+## auth
+- status: granted
+- basis: user-owned project and explicitly provided APK
+- evidence_of_auth: User explicitly requested reverse-analysis of HEROLL APK materials in this task
+- MUST NOT proceed if status != granted
+
+## in_scope
+- assets:
+  - C:\Users\toshio\Documents\ChatGPT\heroll\HEROLL_APK_REVERSE_ONLY
+  - C:\Users\toshio\Documents\ChatGPT\heroll\work\heroll-stage-2-5\video-analysis
+- surfaces: []
+- activities: []
+
+## out_of_scope
+- assets: []
+- activities: [dos, phishing_real_users, unrestricted_exfil]
+
+## network_profile
+- mode: offline
+- notes: |
+    Stage 2.5.1 is an offline static/video evidence closure. No live target action is required.
+
+## deliverables
+- report: true
+- field_journal: true
+- diagrams: true
+- timeline: true
+
+## constraints
+- timebox: {}
+- stealth: low
+- data_handling: anonymize
+
+## signoff
+- ready_for_act: true
+- checklist:
+  - [x] auth.status = granted
+  - [x] in_scope.assets non-empty OR offline sample path set
+  - [x] network_profile.mode chosen
+  - [x] out_of_scope reviewed
+  - [x] roles assigned (lead-only offline review; no specialist delegation required)
+
+## ops_refs
+- skills/ops/scope-contract.md
+- skills/ops/evidence-finding-path.md
+- skills/ops/role-map.md
+- skills/ops/timeline-workitem.md
+- skills/ops/IDENTITY.md
@@ -0,0 +1,60 @@
+# Case Review — HEROLL Stage/Floor Refresh
+
+## Verdict
+
+PASS WITH EXPLICIT PARTIALS
+
+The report is ready for internal gameplay-validation use. All central claims have an Evidence → Finding → Path chain. Three edge cases remain explicitly partial and are not represented as original facts.
+
+## Scope readiness
+
+- Authorization: PASS — user supplied and explicitly requested analysis of HEROLL 2.0.1.
+- Target identity: PASS — decrypted `libil2cpp.so` SHA-256 is recorded.
+- Network posture: PASS — local evidence is primary; public pages were used only for observable-behavior corroboration.
+- Cross-project contamination: PASS — no Dice Lords design rule is used.
+
+## Traceability
+
+| Finding | Evidence | Path | Result |
+|---|---|---|---|
+| F-STAGE-001 | E-STAGE-CONFIG-001 | P-STAGE-001 | PASS |
+| F-REFRESH-001 | E-STAGE-NATIVE-001, E-STAGE-WEB-001 | P-REFRESH-001 | PASS |
+| F-TILE-001 | E-STAGE-CONFIG-001, E-STAGE-NATIVE-001 | P-REFRESH-001 | PASS |
+| F-GAUGE-001 | E-STAGE-NATIVE-001 | P-GAUGE-001 | PASS |
+| F-GAUGE-002 | E-STAGE-NATIVE-001, E-STAGE-RUNTIME-001 | P-GAUGE-001 | PASS |
+| F-REFRESH-002 | E-STAGE-WEB-001, E-STAGE-NATIVE-001 | P-REFRESH-001 | PASS |
+
+## Work item coverage
+
+- WI-006 status: completed.
+- Required artifacts: present.
+- Timeline entry: present.
+- Field journal: present and continuous for this work item.
+- Configuration hashes: present.
+- Native target hash: present.
+- Gameplay-validation GDD and affected CSV contracts: corrected to disable DiceGauge in stage 0 and remove fixed-two/six-class guarantees.
+
+## Mechanical validation
+
+- 33 Default stages checked; floor-count mismatches: 0.
+- 19 DiceGauge stages checked; all configuration increments: 50.
+- Stage 0 Normal board rows: 10.
+- Generated tables: 52 stage rows, 10 Stage-0 floor rows, 46 enabled natural-tile rows, 8 default player-tile metas.
+- CSV parse: PASS for all four output tables and the edited GDD contract/UI/QA tables.
+- `git diff --check`: PASS.
+- Required artifact empty-file count: 0.
+
+## Accuracy challenges
+
+1. `loopIndex+2` was challenged against the previous “fixed +2” design. The ARM64 sequence explicitly loads the loop parameter and performs integer addition before the call; previous design is rejected.
+2. `DiceGauge=50` was challenged as a floor count/threshold. Board row counts are 13/15 and native arithmetic adds the value into a 0..100 field; the alternative interpretations are rejected.
+3. Initial draw 8 was challenged as coincidence with eight default metas. The call constant and eight defaultEquip rows are independent evidence; the implementation claim is accepted while placement success remains conditional.
+4. BossDiceCounter was challenged as the Gauge storage. It has independent getter/setter and add/subtract methods; the fields are kept separate.
+
+## Explicit partials
+
+- Exact serialized `enemyTilesPerLoop` value: UNKNOWN.
+- DiceGauge candidate shortage/protection fallback: UNKNOWN beyond the observed blessing exclusion.
+- Post-pressure restoration priority and exact Default mid-boss UI off-by-one boundary: PARTIAL.
+
+No report section substitutes invented constants for these partials.
@@ -0,0 +1,50 @@
+# HEROLL Good Tile / Corner Case Review
+
+- review_date: 2026-09-01
+- scope: WI-007
+- verdict: PASS WITH EXPLICIT PARTIALS
+- target: HEROLL 2.0.1 `libil2cpp.runtime-decrypted.so`
+- target_sha256: `AC357FBA5BF8A68BA02829593020F29DA220EAC8D5ECA91212C1A6744B0100DA`
+
+## Scope readiness
+
+- Six requested Good Tiles are mapped to IDs 137, 141, 143, 151, 164 and 169.
+- The requested four core Corners are mapped to IDs 126–129.
+- Four additional enabled Corner events are separated from the core set to prevent taxonomy drift.
+- The analysis is limited to HEROLL; unrelated project material is not used as evidence.
+
+## Evidence → Finding → Design traceability
+
+| Evidence | Finding | Design output | Result |
+|---|---|---|---|
+| E-TILE-CONFIG-001 | F-EVENT-001, F-EVENT-002, F-CORNER-001 | Three CSV rule tables | PASS |
+| E-TILE-NATIVE-001 | F-EVENT-001, F-EVENT-003, F-CORNER-001 | Per-event state, input lock and completion rules | PASS |
+| E-TILE-RUNTIME-001 | F-EVENT-002, F-EVENT-003 | Chest/Forge/Scratch/Claw corrections | PASS |
+| E-TILE-WEB-001 | F-EVENT-003, F-CORNER-001 | Version-qualified semantic cross-check | PASS |
+
+## Integrity and artifact checks
+
+| Artifact | SHA256 |
+|---|---|
+| `analysis/tile-event-rules/2026-09-01_逆向-HEROLL-GoodTile与Corner规则-report.md` | `93EB13223E303FAD652ED46810A96AC5E4E0B4A0CA3384ED0B14352D2EA64B8B` |
+| `analysis/tile-event-rules/tables/good-tile-rules.csv` | `F5EBC9DF6A1BEEC71A8EB354881DBC2A8FA7DBDC92AC00E4E49B05C9CA0A7F2B` |
+| `analysis/tile-event-rules/tables/corner-rules.csv` | `4679EEBE11D52CDFAE15A830A5F3C221CC011F28E16FBCF4DAAB08731B4B60DE` |
+| `analysis/tile-event-rules/tables/event-reward-tables.csv` | `FBA1344325AF69C45862B8045A3FA6093F5DDC42BFA012CF0ECB38331881998C` |
+| `design/gameplay-validation/specs/events.csv` | `2B4064F29AA7B46EDB3DCC93F0150A6C43EA9A2E2BC14DAEC3B687AD0036B67F` |
+
+- CSV parse check: PASS (`good-tile-rules` 6 rows, `corner-rules` 8 rows, `event-reward-tables` 21 rows, GDD `events` 14 rows).
+- Requested event-ID presence check: PASS.
+- Deprecated Dice Battle stake/dealer-17 rules absent: PASS.
+- `git diff --check`: PASS.
+- Native evidence index: 31 bounded ARM64 method extracts with individual hashes.
+
+## Explicit partials
+
+1. Housing Support: exact conversion from houses actually built to awarded points is not exposed by the recovered tables or localization data. The report does not promote the candidate “one point per house” to an original rule.
+2. Dice Battle: native methods expose UserWin and DealerWin but no separate push handler. Tie-to-dealer is a strong inference, not an exact recovered rule.
+
+These partials do not affect entry, interaction, event completion or board-mutation reconstruction. They remain configuration gates for an exact reproduction build.
+
+## Final review
+
+WI-007 is complete at the available evidence boundary. Findings are supported by local configuration, bounded native disassembly and owner-provided runtime material; public community material is used only as version-qualified corroboration. No unsupported value is presented as source-confirmed.
@@ -0,0 +1,79 @@
+# Timeline (append-only)
+
+## 2026-08-19T00:52:29.9191946+08:00 | lead | init
+- action: case-init
+- command_or_ref: skills/scripts/case-init.ps1
+- result_summary: case directory created; scope ready_for_act=true
+- artifacts: [scope.md, workitems.md]
+- evidence_ids: []
+- next: open PRIMARY SKILL.md and ACT within scope
+
+## 2026-08-19T01:45:00+08:00 | lead | targeted-analysis
+- action: reconstruct IL2CPP mapping, extract native evidence, test runtime, index video, package findings
+- command_or_ref: method mapping scripts; radare2; ADB/logcat; FFmpeg; artifact-tool
+- result_summary: dice and Idle Dungeon formulas closed; commercial config structured; runtime blocker documented; UNKNOWNs preserved
+- artifacts: [libil2cpp.runtime-decrypted.so, method_addresses_raw.csv, native-evidence, video-analysis, report/stage25-findings.md]
+- evidence_ids: [E-IL2CPP-001, E-MAP-001, E-NATIVE-001, E-CONFIG-001, E-VIDEO-001, E-RUNTIME-001]
+- next: strict case review and handoff
+
+## 2026-08-19T12:20:00+08:00 | lead | stage-2.5.1-closure
+- action: recover exact P0/P1 native bodies, protected IngameShop MethodDef addresses, dependency matrix, workbook and upload package
+- command_or_ref: build_stage251_manifest.mjs; extract_exact_stage251_native.ps1; build_stage251_call_edges.mjs; build_stage251_workbook.mjs
+- result_summary: 93 bounded Native bodies included; Main Run partially closed; Gacha pity and Boss Gauge arithmetic remain UNKNOWN; runtime attribution corrected
+- artifacts: [stage251-native-exact-final, evidence/stage251_evidence_dependency_matrix.csv, evidence/stage251_formula_evidence_incremental.xlsx]
+- evidence_ids: [E-NATIVE-251, E-MATRIX-251, E-WORKBOOK-251, E-ENV-251]
+- next: strict case review and independent ChatGPT audit
+
+## 2026-08-28T00:00:00+08:00 | lead | main-run-combat-and-double-closure
+- action: re-audit main-run combat arithmetic and Double combat consumers
+- command_or_ref: radare2 6.2.0 bounded ARM64 disassembly; config joins; video evidence; web cross-check for unresolved localization semantics
+- result_summary: corrected hit-vs-critical RNG attribution; closed linear defense, reciprocal attack-speed, ceil/min-1 lifesteal and counter boundary; established that Double does not multiply movement or base damage and only affects combat through subscribed content
+- artifacts: [analysis/combat-rules/2026-08-28_逆向-HEROLL战斗规则-report.md, analysis/combat-rules/combat-formulas.csv, analysis/combat-rules/native-slices]
+- evidence_ids: [E-COMBAT-001, E-COMBAT-002, E-COMBAT-003, E-DOUBLE-001, E-DOUBLE-002, E-WEB-001, E-WEB-002]
+- next: apply validated overrides to the HEROLL gameplay-validation MVP and use controlled captures only for listed partial branches
+
+## 2026-08-31T18:00:00+08:00 | lead | in-run-gear-generation-closure
+- action: recover gear-level weighted offset, rarity-to-affix mapping, shared affix pool, plusLevel star allocation and status value formula; audit boss mid-battle spawn evidence
+- command_or_ref: radare2 bounded ARM64 disassembly at 0x55BE240/0x55BDCC0/0x55C0840/0x55C0D70; config joins; user runtime observation; web cross-check
+- result_summary: normal-stage GearLevel=Floor+Weighted(0,1,2;90,5,1); six-grade affix/star behavior and nine-affix shared pool closed; original boss_0 threshold remains partial and validation 50 percent rule is explicitly non-original
+- artifacts: [analysis/drop-rules/2026-08-31_逆向-HEROLL装备等级词条星级与Boss掉落-report.md, analysis/drop-rules/gear-level-rules.csv, analysis/drop-rules/gear-rarity-affix-rules.csv, analysis/drop-rules/gear-affix-pools.csv, analysis/drop-rules/gear-value-formulas.csv]
+- evidence_ids: [E-DROP-LEVEL-001, E-DROP-AFFIX-001, E-DROP-BOSS-001]
+- next: strict case review and implementation into the gameplay-validation MVP
+
+## 2026-08-31T22:30:00+08:00 | lead | blessing-equipment-shop-catalog-closure
+- action: join authoritative CSVs with source localization and recover shop refresh, buy-count and surcharge arithmetic from native code
+- command_or_ref: extract_catalogs.py; bounded ARM64 review at 0x54E1FD4/0x54E2250/0x54DE518/0x54DE0A4
+- result_summary: 31 enabled blessings, 40 equipment identities and 96 shop offers extracted; paid reroll sequence 3,5,7... closed; generic repeat-purchase price growth disproved; fixed upgrade price chains enumerated
+- artifacts: [analysis/catalog-reverse/2026-08-31_逆向-HEROLL祝福装备商店完整清单-report.md, analysis/catalog-reverse/tables]
+- evidence_ids: [E-CATALOG-BLESSING-001, E-CATALOG-EQUIP-001, E-CATALOG-SHOP-001, E-SHOP-RUNTIME-001]
+- next: completed; workbook visual/formula validation and strict hash-aware case review passed
+
+## 2026-08-31T23:30:00+08:00 | lead | stage-floor-refresh-closure
+- action: close Normal stage floor counts, additive board mutation, player good-tile deck selection and DiceGauge Boss pressure cycle
+- command_or_ref: radare2 6.2.0 bounded ARM64 disassembly; stageinfo/board/newtile/outgametile joins; owner runtime evidence; public behavior cross-check
+- result_summary: all Default stage values matched board row counts; initial good-tile draw 8 and per-loop loop+2 calls recovered; no-replacement shuffled player deck recovered; 50-per-settlement Gauge and 2+4 pressure cycle separated from BossDiceCounter
+- artifacts: [analysis/stage-floor-rules/2026-08-31_逆向-HEROLL关卡楼层分布与刷新规则-report.md, analysis/stage-floor-rules/tables]
+- evidence_ids: [E-STAGE-CONFIG-001, E-STAGE-NATIVE-001, E-STAGE-RUNTIME-001, E-STAGE-WEB-001]
+- next: strict case review; update gameplay-validation MVP to remove fixed +2-good-tile and stage-0 DiceGauge assumptions
+
+## 2026-09-01T00:10:00+08:00 | lead | stage-floor-strict-review
+- action: execute strict traceability and mechanical validation; apply the recovered rules as an authoritative GDD overlay
+- command_or_ref: Evidence-Finding-Path audit; CSV parse/count checks; Default-stage equality join; git diff --check
+- result_summary: PASS WITH EXPLICIT PARTIALS; 33 Default stages had zero row-count mismatches; stage 0 Gauge and fixed-two/six-class assumptions removed from GDD and affected contracts
+- artifacts: [work/heroll-stage-2-5/report/stage-floor-case-review.md, design/gameplay-validation/Heroll_Gameplay_Validation_GDD.md]
+- evidence_ids: [E-STAGE-CONFIG-001, E-STAGE-NATIVE-001, E-STAGE-RUNTIME-001, E-STAGE-WEB-001]
+- next: update executable MVP behavior in a separate implementation turn if requested
+
+## 2026-09-01T15:10:00+08:00 | lead | good-tile-corner-closure
+- action: recover six requested Good Tile state machines and the four core Corner rules
+- command_or_ref: CSV joins; IL2CPP metadata; radare2 6.2.0 bounded ARM64 extraction; owner screenshots; public semantic cross-check
+- result_summary: Chest/Forge/Dice Battle/Lucky Scratch/Claw/Dicereel and Corner 126–129 documented with entry, input, outcomes, rewards, exits and exception boundaries
+- artifacts: [analysis/tile-event-rules/2026-09-01_逆向-HEROLL-GoodTile与Corner规则-report.md, analysis/tile-event-rules/tables, analysis/tile-event-rules/native-evidence]
+- evidence_ids: [E-TILE-CONFIG-001, E-TILE-NATIVE-001, E-TILE-RUNTIME-001, E-TILE-WEB-001]
+- next: focused capture for Housing Support point payout and Dice Battle tie if exact closure is required
+
+## 2026-09-01 — Good Tile / Corner strict review
+
+- Completed WI-007 for Chest, Forge, Dice Battle, Lucky Scratch, Claw Machine, Dicereel and core Corner IDs 126–129.
+- Parsed all generated CSV deliverables, verified requested IDs, checked deprecated assumptions were removed, and ran `git diff --check` successfully.
+- Recorded artifact hashes and the two explicit residual unknowns in `report/tile-event-case-review.md`; verdict: PASS WITH EXPLICIT PARTIALS.